docs: port ranges, OpenSearch default image, quick-start fixes, MWAA index row, parity TODOs

[sam-fakhreddine]

Summary

Six small, independent documentation fixes, batched into one PR to avoid opening six near-trivial PRs:

• Ports reference: document the MemoryDB, Neptune, and MWAA in-Floci proxy port ranges in docs/configuration/ports.md, which previously only covered ElastiCache and RDS.
• Ports reference wording: drop the "TCP" qualifier from the in-Floci proxy description — the proxy is protocol-agnostic (it also fronts the MWAA HTTP proxy), so calling it a "TCP proxy" was inaccurate.
• OpenSearch default image: FLOCI_SERVICES_OPENSEARCH_DEFAULT_IMAGE is unset by default (images resolve per requested EngineVersion, see OpenSearchDomainManager.java:151 / EmulatorConfig.java:1045, Optional<String> defaultImage()), but README.md and docs/configuration/environment-variables.md both documented a fixed default image string. Corrected both.
• Quick-start guide: fixed the wrong ECR registry port and a reference to an undefined $AWS_ENDPOINT variable (the guide defines $AWS_ENDPOINT_URL earlier but the ECR section used the wrong name).
• Services index: added a missing MWAA row to the per-service operation-count table in docs/services/index.md (MWAA has had a service page and nav entry since it shipped but was never added to this specific table), and dropped a duplicate CloudTrail nav entry from mkdocs.yml.
• Parity tracking: added docs/service-api-parity-todos.md, consolidating scattered service API parity TODOs into one tracked document. This doc links to four investigation/epic files that existed on an unmerged branch but not on any docs branch — restoring them was needed to avoid shipping broken links: three general project docs (docs/services/codebuild-local-agent-investigation-epic.md, docs/services/codepipeline-v2-epic.md, docs/services/network-data-plane-investigation-epic.md) and one issue-tracking doc (issues/0009-epic-account-region-scoping-audit.md, rewritten to drop references to tooling that doesn't exist in this repo and read as a project-facing bug-pattern writeup instead of private notes).

All content was verified as still current against upstream/main before pushing — this is a docs-only branch that had drifted since being cut, so it was rebased onto current upstream/main first, and each fix was re-checked against the current code/docs state rather than assumed still applicable.

Deliberate scope notes

• This branch supersedes an earlier, more stale push of the same PR-slot branch (feature/docs, previously at a base ~128 commits behind current main). That earlier push contained 4 of these 6 commits (same fixes, different SHAs after rebase); the 2 newest commits (MWAA operations-table row + parity-todos consolidation) were not yet present there. No open PR existed against that branch, so it was force-updated in place rather than opened as a second competing PR.
• Docs-only change: no .java files touched, so the wire-fidelity extractor and local code-review steps in the PR-maintenance runbook do not apply.

Type of change

• Documentation

AWS Compatibility

• N/A — no behavioral or API changes.

Checklist

• Rebased onto current upstream/main
• rtk mvn --ultra-compact clean test-compile — BUILD SUCCESS (no non-doc files changed)
• make docs-check — passes clean
• Checked for collisions with other open PRs (fix(dynamodb): hybrid persistence #2677, fix(security): reject unregistered SigV4 access keys and unbound usernames #2680, feat(cloudformation): CodeBuild/CodePipeline CFN provisioning #2685, feat(cloudformation): CDK Provider-framework custom resources and changeset/SSM param fidelity #2688) — no file overlap

[greptile-apps]

Greptile Summary

This documentation-only PR corrects service port and image defaults, repairs quick-start examples, and consolidates service-parity planning material.

• Documents MemoryDB, Neptune, and MWAA proxy ranges.
• Aligns OpenSearch and ECR guidance with current defaults.
• Adds consolidated parity and investigation documents.
• Removes duplicate service-index and navigation entries.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains in the current changes, and all previously reported issues are fixed.

Important Files Changed

Filename	Overview
docs/configuration/ports.md	Adds missing proxy ranges and now lists only the current Lambda Runtime API range.
docs/getting-started/quick-start.md	Corrects the endpoint variable, ECR registry port, and tightly scoped firewall ranges.
docs/service-api-parity-todos.md	Adds a consolidated, linked inventory of service compatibility work.
docs/services/index.md	The attempted MWAA addition was correctly deduplicated, leaving one consistent canonical row.
mkdocs.yml	Removes the duplicate CloudTrail navigation entry without disturbing service navigation.

_{Reviews (4): Last reviewed commit: "docs(issues-0009): rewrite as project-fa..." | Re-trigger Greptile}

[Copilot]

Pull request overview

This PR batches several documentation corrections across Floci’s user/docs site: port-range references, environment variable defaults, quick-start commands, MkDocs navigation, and a new parity TODO inventory.

Changes:

• Updates port-range documentation (adds MemoryDB/Neptune/MWAA proxies; adjusts proxy wording) and quick-start examples (ECR endpoint var + registry port).
• Corrects OpenSearch default-image documentation to reflect that FLOCI_SERVICES_OPENSEARCH_DEFAULT_IMAGE is unset by default and resolved per EngineVersion.
• Adds MWAA to the services index table, removes a duplicate CloudTrail nav entry, and introduces a consolidated parity TODO document.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
README.md	Updates documented default for FLOCI_SERVICES_OPENSEARCH_DEFAULT_IMAGE to “unset” behavior.
mkdocs.yml	Removes a duplicate CloudTrail navigation entry.
docs/services/index.md	Adds MWAA to the services operation-count table.
docs/service-api-parity-todos.md	New consolidated parity/TODO inventory document.
docs/getting-started/quick-start.md	Fixes ECR quick-start commands and adds tighter UFW examples.
docs/configuration/ports.md	Expands the port-range reference to cover more proxy services and adjusts proxy wording.
docs/configuration/environment-variables.md	Corrects OpenSearch default-image documentation to match “unset” behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[pgermosen]

The six described fixes check out — I spot-checked the OpenSearch default-image claim directly against EmulatorConfig.java (the field really is an unannotated Optional, no fixed default, confirming the doc correction) and confirmed the port-range and duplicate-MWAA-row bot findings are resolved.

Before going further though, the PR summary describes six small fixes, but the diff also includes four larger files — three multi-hundred-line investigation/architecture documents and one issue-tracking doc — that aren't mentioned anywhere in the description. I see from the thread that these were restored from another branch specifically to fix broken links a new file introduced, so I understand how they got here. Three of the four (the CodeBuild local-agent, CodePipeline V2, and network-data-plane investigation docs) read as legitimate, general project documentation — decision frameworks written for the project rather than for one person — so I don't have a content objection to them, just a visibility one: a reviewer relying on the summary alone would have no idea they're part of this PR at all.

The fourth one, the account+region-scoping audit issue doc, is a different case worth a closer look. It references a workflow script, a specific automation tool, and a particular subagent/model orchestration setup, none of which exist anywhere in this repository, and its own decision log reads in the voice of one person's private working notes rather than something another contributor could pick up and act on. The underlying technical concern it describes, ambient account or region resolution being used in place of an already-known explicit value, sounds like a genuinely worthwhile thing to track for this project. But as written, nobody besides the author can act on the file, since the tooling it references doesn't exist here. Would you be open to either rewriting that one as a project-facing issue describing just the bug pattern and the affected files, or letting me know if there's a reason it should stay as-is?

[sam-fakhreddine]

Thanks for the close look, and for spot-checking the OpenSearch claim against EmulatorConfig.java directly.

On visibility: you're right that the summary didn't mention the four restored files. Updated the PR description to call out that docs/service-api-parity-todos.md links to them and why they needed restoring (broken-link avoidance, not scope creep) — no content changes to the three general architecture docs (CodeBuild local-agent, CodePipeline V2, network-data-plane epics), they read fine as-is.

On the fourth file, issues/0009-epic-account-region-scoping-audit.md: agreed completely, it referenced a workflow script, a subagent/model orchestration setup, and a scripts/static-checks/ shell script that don't exist in this repo, and the decision log was written for one person rather than the project. Rewrote it in 483747e65 to keep the useful part — the bug pattern (ambient account/region resolution used in place of an already-resolved explicit value), the three confirmed fixes cited by commit SHA instead of nonexistent issue paths, the candidate file/service-domain scope, and the AWS global-services exclusion list — and dropped everything that assumed tooling or context outside this repo. The detection method is now a plain shell one-liner (search plus an async-boundary cross-reference) any contributor can run directly.

Pushed as 483747e65 on top of b3b32b3d6. make docs-check still passes clean.