feat(arc): Application Recovery Controller (control config, cluster data plane, readiness, zonal shift)

.beads/issues.jsonl

@@ -8,7 +8,7 @@
 {"_type":"issue","id":"gopherstack-gb98x","title":"Flaky: iotdataplane TestGetConnection_ReportsLiveBrokerSession/clean_with_socket","description":"Failed in CI unit-tests(0) on PR #2482 (wire_sdk_roundtrip_test.go:69 Not equal); passes 20x locally under -race. Likely races broker session registration vs GetConnection under load. Make deterministic (wait on session-registered signal, no sleeps) and prove with -count=50 -race.","status":"closed","priority":1,"issue_type":"bug","owner":"blackbird7181@gmail.com","created_at":"2026-10-11T22:56:45Z","created_by":"Witness Patrol","updated_at":"2026-10-12T00:00:28Z","closed_at":"2026-10-12T00:00:28Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"gopherstack-cefu7.10","title":"Per-service feature-depth comparison for existing AWS services","description":"For every service we both cover, diff documented operations/behaviours against the reference set and file per-service gaps. Track privately; repo docs must not mention the comparison.","status":"open","priority":1,"issue_type":"task","owner":"blackbird7181@gmail.com","created_at":"2026-10-11T14:33:30Z","created_by":"Witness Patrol","updated_at":"2026-10-11T14:33:30Z","dependencies":[{"issue_id":"gopherstack-cefu7.10","depends_on_id":"gopherstack-cefu7","type":"parent-child","created_at":"2026-10-11T09:33:30Z","created_by":"Witness Patrol","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"gopherstack-cefu7","title":"Competitive feature parity programme (AWS + other clouds)","description":"Close feature gaps against the reference emulator set (mapping kept privately, see maintainer notes; never name or reference external projects in repo docs, PARITY.md, READMEs, commits or PR text). Covers missing AWS services, per-service feature depth on existing AWS services, multi-language SDK compatibility suites, test-container modules, CLI/UI tooling, and Azure/GCP/OCI emulators.","status":"open","priority":1,"issue_type":"epic","owner":"blackbird7181@gmail.com","created_at":"2026-10-11T14:32:37Z","created_by":"Witness Patrol","updated_at":"2026-10-11T14:32:37Z","dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"gopherstack-7bxwn","title":"Add AWS Application Recovery Controller services","description":"User 2026-10-11: simulate ARC. New services: route53-recovery-control-config (clusters, control panels, routing controls, safety rules), route53-recovery-cluster (Get/UpdateRoutingControlState(s) with safety-rule evaluation, cluster endpoints), route53-recovery-readiness (recovery groups, cells, readiness checks, resource sets), arc-zonal-shift (zonal shifts, autoshift, practice runs). Wire routing-control state into Route53 health checks (RECOVERY_CONTROL type). SDK-driven tests; terraform fixtures where provider supports.","status":"open","priority":1,"issue_type":"feature","owner":"blackbird7181@gmail.com","created_at":"2026-10-11T14:08:51Z","created_by":"Witness Patrol","updated_at":"2026-10-11T14:08:51Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"gopherstack-7bxwn","title":"Add AWS Application Recovery Controller services","description":"User 2026-10-11: simulate ARC. New services: route53-recovery-control-config (clusters, control panels, routing controls, safety rules), route53-recovery-cluster (Get/UpdateRoutingControlState(s) with safety-rule evaluation, cluster endpoints), route53-recovery-readiness (recovery groups, cells, readiness checks, resource sets), arc-zonal-shift (zonal shifts, autoshift, practice runs). Wire routing-control state into Route53 health checks (RECOVERY_CONTROL type). SDK-driven tests; terraform fixtures where provider supports.","status":"closed","priority":1,"issue_type":"feature","owner":"blackbird7181@gmail.com","created_at":"2026-10-11T14:08:51Z","created_by":"Witness Patrol","updated_at":"2026-10-14T00:05:39Z","closed_at":"2026-10-14T00:05:39Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"gopherstack-kvze4","title":"S3/DynamoDB perf round 2 + leak hunt","description":"User 2026-10-11: S3 and DDB are primary use. Profile remaining hotspots (HeadObject ~93 allocs, GetObject 64KiB ~100 allocs, ListObjectsV2 delimiter 100k ~430us, DeleteObjects per-object allocs, DDB SDK-type conversion allocs, TransactWrite/BatchWrite deep copies, filter literal re-parse per item). Leak hunt: goroutine leaks (goleak in tests), unbounded maps/caches, janitor/ticker lifecycles, multipart upload orphans, stream/iterator state, memory growth under soak (pprof heap diff over N ops).","notes":"Approach (user 2026-10-11): build e2e benchmarks through the top-level router (full middleware stack) for common S3/DDB patterns; use their cpu/heap/goroutine profiles to pick optimisations and leaks. Leak tests assert bounded heap/goroutine growth over N iterations.","status":"closed","priority":1,"issue_type":"task","owner":"blackbird7181@gmail.com","created_at":"2026-10-11T14:08:43Z","created_by":"Witness Patrol","updated_at":"2026-10-11T18:20:18Z","closed_at":"2026-10-11T18:20:18Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"gopherstack-tumin","title":"CodeQL alerts on PR #2482: odatatable alloc (373), json_error_message reflected-xss (372), stepfunctions intrinsics alloc overflow (364)","description":"Open CodeQL alerts introduced on chore/parity-sweep-2026-10-07: pkgs/odatatable/store.go:212 go/uncontrolled-allocation-size (top used in make cap); pkgs/service/json_error_message.go:68 go/reflected-xss (mirror writer passthrough Write); services/stepfunctions/asl/intrinsics.go:386 go/allocation-size-overflow. Fix with CodeQL-recognised sanitizers (see memory codeql-and-ci-gotchas).","status":"closed","priority":1,"issue_type":"bug","owner":"blackbird7181@gmail.com","created_at":"2026-10-11T07:37:05Z","created_by":"Witness Patrol","updated_at":"2026-10-12T05:39:51Z","closed_at":"2026-10-12T05:39:51Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"gopherstack-1zitl","title":"cognitoidp exposes temporary passwords as the custom:temporaryPassword user attribute","description":"users.go:452/558/675 store the AdminCreateUser/AdminSetUserPassword temporary password in user.Attributes, so ListUsers/AdminGetUser/GetUser return it. Real Cognito never returns passwords. Store it in a non-attribute field, keep FORCE_CHANGE_PASSWORD auth working, and prove with typed SDK tests that no response carries it.","status":"closed","priority":1,"issue_type":"bug","owner":"blackbird7181@gmail.com","created_at":"2026-10-05T19:56:34Z","created_by":"Witness Patrol","updated_at":"2026-10-05T20:14:39Z","closed_at":"2026-10-05T20:14:39Z","close_reason":"fixed; temp password moved off user attributes","dependency_count":0,"dependent_count":0,"comment_count":0}

README.md

@@ -368,6 +368,8 @@ By default resources settle instantly. Set a dwell to make Creating/Processing/P
 | `--lifecycle-mgn` | `MGN_LIFECYCLE_DELAY` | Application Migration Service replication/job/import per-hop window (built-in `100ms`). |
 | `--lifecycle-forecast` | `FORECAST_LIFECYCLE_DELAY` | Forecast resource CREATE_PENDING/CREATE_IN_PROGRESS window. |
 | `--lifecycle-networkmonitor` | `NETWORKMONITOR_LIFECYCLE_DELAY` | Network Monitor monitor and probe PENDING window. |
+| `--lifecycle-route53-recovery` | `ROUTE53_RECOVERY_LIFECYCLE_DELAY` | Route 53 ARC control plane PENDING and PENDING_DELETION window for clusters, control panels, routing controls and safety rules. |
+| `--lifecycle-arczonalshift` | `ARCZONALSHIFT_PRACTICE_RUN_DURATION` | ARC zonal shift practice run ACTIVE window; 0 keeps the built-in 30m; ignores the global delay. |
 | `--lifecycle-managedblockchain` | `MANAGEDBLOCKCHAIN_LIFECYCLE_DELAY` | Managed Blockchain network/member/node CREATING window. |
 | `--lifecycle-cleanrooms` | `CLEANROOMS_LIFECYCLE_DELAY` | Clean Rooms protected query and job SUBMITTED window. |
 | `--lifecycle-resourcegroups` | `RESOURCEGROUPS_LIFECYCLE_DELAY` | Resource Groups transitional window. |
@@ -631,13 +633,17 @@ Every service links to its own page with a coverage breakdown — audited operat
 | [API Gateway](services/apigateway/README.md) | A | 123 | 2 gaps; 1 structural gap; 2 deferred |
 | [API Gateway Management API](services/apigatewaymanagementapi/README.md) | A | 3 | 2 deferred |
 | [API Gateway v2](services/apigatewayv2/README.md) | A | 77 | 5 gaps; 1 structural gap |
+| [ARC Zonal Shift](services/arczonalshift/README.md) | A | 15 | 1 structural gap |
 | [App Mesh](services/appmesh/README.md) | A | 38 | 1 structural gap |
 | [Cloud Map](services/servicediscovery/README.md) | A | 30 | 4 structural gaps; 1 deferred |
 | [CloudFront](services/cloudfront/README.md) | A | 60 | 2 gaps; 4 structural gaps; 4 deferred |
 | [CloudWatch Network Monitor](services/networkmonitor/README.md) | A | 12 | 1 deferred |
 | [ELB (Classic)](services/elb/README.md) | A | 29 | 1 gap; 1 deferred |
 | [ELBv2](services/elbv2/README.md) | A | 51 | 2 gaps; 2 structural gaps; 2 deferred |
 | [Route 53](services/route53/README.md) | A | 67 | 3 deferred |
+| [Route 53 Recovery Cluster](services/route53recoverycluster/README.md) | A | 4 | clean |
+| [Route 53 Recovery Control Config](services/route53recoverycontrolconfig/README.md) | A | 25 | 1 structural gap |
+| [Route 53 Recovery Readiness](services/route53recoveryreadiness/README.md) | A | 32 | 1 structural gap |
 | [Route 53 Resolver](services/route53resolver/README.md) | A | 72 | 4 gaps; 1 structural gap; 1 deferred |
 | [VPC Lattice](services/vpclattice/README.md) | A | 73 | 1 gap; 3 structural gaps |
 

cli.go

@@ -83,6 +83,7 @@ import (
 	apprunnerbackend "github.com/blackbirdworks/gopherstack/services/apprunner"
 	appstreambackend "github.com/blackbirdworks/gopherstack/services/appstream"
 	appsyncbackend "github.com/blackbirdworks/gopherstack/services/appsync"
+	arczonalshiftbackend "github.com/blackbirdworks/gopherstack/services/arczonalshift"
 	athenabackend "github.com/blackbirdworks/gopherstack/services/athena"
 	autoscalingbackend "github.com/blackbirdworks/gopherstack/services/autoscaling"
 	awsconfigbackend "github.com/blackbirdworks/gopherstack/services/awsconfig"
@@ -205,6 +206,9 @@ import (
 	resourcegroupstaggingapibackend "github.com/blackbirdworks/gopherstack/services/resourcegroupstaggingapi"
 	rolesanywherebackend "github.com/blackbirdworks/gopherstack/services/rolesanywhere"
 	route53backend "github.com/blackbirdworks/gopherstack/services/route53"
+	route53recoveryclusterbackend "github.com/blackbirdworks/gopherstack/services/route53recoverycluster"
+	route53recoverycontrolconfigbackend "github.com/blackbirdworks/gopherstack/services/route53recoverycontrolconfig"
+	route53recoveryreadinessbackend "github.com/blackbirdworks/gopherstack/services/route53recoveryreadiness"
 	route53resolverbackend "github.com/blackbirdworks/gopherstack/services/route53resolver"
 	s3backend "github.com/blackbirdworks/gopherstack/services/s3"
 	s3controlbackend "github.com/blackbirdworks/gopherstack/services/s3control"
@@ -337,6 +341,10 @@ type CLI struct {
 	swfHandler                    service.Registerable
 	firehoseHandler               service.Registerable
 	networkmonitorHandler         service.Registerable
+	arcZonalShiftHandler          service.Registerable
+	route53RecoveryClusterHandler service.Registerable
+	route53RecoveryControlHandler service.Registerable
+	route53RecoveryReadyHandler   service.Registerable
 	schedulerHandler              service.Registerable
 	servicediscoveryHandler       service.Registerable
 	transcribeHandler             service.Registerable
@@ -1314,6 +1322,32 @@ func (c *CLI) GetSWFHandler() service.Registerable { return c.swfHandler }
 //nolint:ireturn // architecturally required to return interface
 func (c *CLI) GetFirehoseHandler() service.Registerable { return c.firehoseHandler }
 
+// GetARCZonalShiftHandler returns the ARC zonal shift handler.
+//
+//nolint:ireturn // architecturally required to return interface
+func (c *CLI) GetARCZonalShiftHandler() service.Registerable { return c.arcZonalShiftHandler }
+
+// GetRoute53RecoveryClusterHandler returns the Route 53 Recovery Cluster handler.
+//
+//nolint:ireturn // architecturally required to return interface
+func (c *CLI) GetRoute53RecoveryClusterHandler() service.Registerable {
+	return c.route53RecoveryClusterHandler
+}
+
+// GetRoute53RecoveryControlConfigHandler returns the Route 53 Recovery Control Config handler.
+//
+//nolint:ireturn // architecturally required to return interface
+func (c *CLI) GetRoute53RecoveryControlConfigHandler() service.Registerable {
+	return c.route53RecoveryControlHandler
+}
+
+// GetRoute53RecoveryReadinessHandler returns the Route 53 Recovery Readiness handler.
+//
+//nolint:ireturn // architecturally required to return interface
+func (c *CLI) GetRoute53RecoveryReadinessHandler() service.Registerable {
+	return c.route53RecoveryReadyHandler
+}
+
 // GetNetworkMonitorHandler returns the NetworkMonitor handler.
 //
 //nolint:ireturn // architecturally required to return interface
@@ -2811,6 +2845,10 @@ func storeCLIHandlers(cli *CLI, services []service.Registerable) {
 	cli.swfHandler = byName["SWF"]
 	cli.firehoseHandler = byName["Firehose"]
 	cli.networkmonitorHandler = byName["NetworkMonitor"]
+	cli.arcZonalShiftHandler = byName["ARCZonalShift"]
+	cli.route53RecoveryClusterHandler = byName["Route53RecoveryCluster"]
+	cli.route53RecoveryControlHandler = byName["Route53RecoveryControlConfig"]
+	cli.route53RecoveryReadyHandler = byName["Route53RecoveryReadiness"]
 	cli.schedulerHandler = byName["Scheduler"]
 	cli.route53resolverHandler = byName["Route53Resolver"]
 	cli.rdsHandler = byName["RDS"]
@@ -3626,6 +3664,30 @@ func (a *elbEC2ResolverAdapter) subnet(id string) *ec2backend.Subnet {
 	return nil
 }
 
+func (a *elbEC2ResolverAdapter) subnetIn(region, id string) *ec2backend.Subnet {
+	if subnets := a.regions.handler.BackendFor(region).DescribeSubnets([]string{id}); len(subnets) > 0 {
+		return subnets[0]
+	}
+
+	return nil
+}
+
+func (a *elbEC2ResolverAdapter) SubnetVPCIn(region, id string) string {
+	if sn := a.subnetIn(region, id); sn != nil {
+		return sn.VPCID
+	}
+
+	return ""
+}
+
+func (a *elbEC2ResolverAdapter) SubnetAZIn(region, id string) string {
+	if sn := a.subnetIn(region, id); sn != nil {
+		return sn.AvailabilityZone
+	}
+
+	return ""
+}
+
 func (a *elbEC2ResolverAdapter) SubnetVPC(id string) string {
 	if sn := a.subnet(id); sn != nil {
 		return sn.VPCID
@@ -4393,6 +4455,10 @@ func getMostRecentServiceProviders() []service.Provider {
 		&grafanabackend.Provider{},
 		&outpostsbackend.Provider{},
 		&resiliencehubbackend.Provider{},
+		&route53recoverycontrolconfigbackend.Provider{},
+		&route53recoveryclusterbackend.Provider{},
+		&route53recoveryreadinessbackend.Provider{},
+		&arczonalshiftbackend.Provider{},
 		&directconnectbackend.Provider{},
 		&mgnbackend.Provider{},
 		&networkmanagerbackend.Provider{},