From 09de514ef1b93ebd65fe223b6686d2453e5945f4 Mon Sep 17 00:00:00 2001
From: joshsiv-mulga <mrk@mulgadc.com>
Date: Tue, 6 Oct 2026 12:41:12 +1000
Subject: [PATCH] refactor: move instance metadata service to EC2 domain

---
 .../imds => domains/ec2/guestmetadata}/action.go |  2 +-
 .../ec2/guestmetadata}/action_test.go            |  2 +-
 .../imds => domains/ec2/guestmetadata}/cacert.go |  2 +-
 .../ec2/guestmetadata}/cacert_test.go            |  2 +-
 .../ec2/guestmetadata}/constants.go              |  2 +-
 .../ec2/guestmetadata}/credentials.go            |  2 +-
 .../ec2/guestmetadata}/credentials_test.go       |  2 +-
 .../guestmetadata}/cross_account_owner_test.go   |  2 +-
 .../ec2/guestmetadata}/dns_forwarder.go          |  2 +-
 .../ec2/guestmetadata}/dns_forwarder_test.go     |  2 +-
 .../imds => domains/ec2/guestmetadata}/imdsv1.go |  2 +-
 .../ec2/guestmetadata}/imdsv1_test.go            |  2 +-
 .../ec2/guestmetadata}/instance_lookup.go        |  2 +-
 .../guestmetadata}/instance_lookup_retry_test.go |  2 +-
 .../ec2/guestmetadata}/instance_lookup_test.go   |  2 +-
 .../ec2/guestmetadata}/metadata.go               |  2 +-
 .../ec2/guestmetadata}/metadata_test.go          |  2 +-
 .../ec2/guestmetadata}/nats_clients.go           |  2 +-
 .../ec2/guestmetadata}/nats_clients_test.go      |  2 +-
 .../ec2/guestmetadata}/resolver.go               |  2 +-
 .../ec2/guestmetadata}/resolver_test.go          |  2 +-
 .../ec2/guestmetadata}/role_visibility.go        |  2 +-
 .../ec2/guestmetadata}/role_visibility_test.go   |  2 +-
 .../ec2/guestmetadata}/service.go                |  4 ++--
 .../ec2/guestmetadata}/tap_responder.go          |  2 +-
 .../ec2/guestmetadata}/tap_responder_test.go     |  2 +-
 .../imds => domains/ec2/guestmetadata}/token.go  |  2 +-
 .../ec2/guestmetadata}/token_test.go             |  2 +-
 .../ec2/guestmetadata}/trace_test.go             |  2 +-
 spinifex/handlers/dns/quotas.go                  |  2 +-
 spinifex/vpcd/imds_instance_state.go             |  4 ++--
 spinifex/vpcd/vpcd.go                            | 16 ++++++++--------
 spinifex/vpcd/vpcd_test.go                       |  6 +++---
 tests/e2e/harness/dns.go                         |  6 +++---
 tests/e2e/single/sgreachability_test.go          |  4 ++--
 35 files changed, 49 insertions(+), 49 deletions(-)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/action.go (99%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/action_test.go (99%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/cacert.go (99%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/cacert_test.go (99%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/constants.go (98%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/credentials.go (99%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/credentials_test.go (99%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/cross_account_owner_test.go (99%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/dns_forwarder.go (99%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/dns_forwarder_test.go (99%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/imdsv1.go (99%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/imdsv1_test.go (99%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/instance_lookup.go (99%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/instance_lookup_retry_test.go (98%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/instance_lookup_test.go (99%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/metadata.go (99%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/metadata_test.go (99%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/nats_clients.go (99%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/nats_clients_test.go (99%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/resolver.go (99%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/resolver_test.go (99%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/role_visibility.go (99%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/role_visibility_test.go (99%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/service.go (98%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/tap_responder.go (99%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/tap_responder_test.go (99%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/token.go (98%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/token_test.go (99%)
 rename spinifex/{handlers/imds => domains/ec2/guestmetadata}/trace_test.go (99%)

diff --git a/spinifex/handlers/imds/action.go b/spinifex/domains/ec2/guestmetadata/action.go
similarity index 99%
rename from spinifex/handlers/imds/action.go
rename to spinifex/domains/ec2/guestmetadata/action.go
index 960ac1e9d..b4cfbcd15 100644
--- a/spinifex/handlers/imds/action.go
+++ b/spinifex/domains/ec2/guestmetadata/action.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"net/http"
diff --git a/spinifex/handlers/imds/action_test.go b/spinifex/domains/ec2/guestmetadata/action_test.go
similarity index 99%
rename from spinifex/handlers/imds/action_test.go
rename to spinifex/domains/ec2/guestmetadata/action_test.go
index ce42bd2db..0e9755407 100644
--- a/spinifex/handlers/imds/action_test.go
+++ b/spinifex/domains/ec2/guestmetadata/action_test.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"net/http"
diff --git a/spinifex/handlers/imds/cacert.go b/spinifex/domains/ec2/guestmetadata/cacert.go
similarity index 99%
rename from spinifex/handlers/imds/cacert.go
rename to spinifex/domains/ec2/guestmetadata/cacert.go
index f1b716d48..e6872e202 100644
--- a/spinifex/handlers/imds/cacert.go
+++ b/spinifex/domains/ec2/guestmetadata/cacert.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"errors"
diff --git a/spinifex/handlers/imds/cacert_test.go b/spinifex/domains/ec2/guestmetadata/cacert_test.go
similarity index 99%
rename from spinifex/handlers/imds/cacert_test.go
rename to spinifex/domains/ec2/guestmetadata/cacert_test.go
index da60c50b2..dea67d87f 100644
--- a/spinifex/handlers/imds/cacert_test.go
+++ b/spinifex/domains/ec2/guestmetadata/cacert_test.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"net/http"
diff --git a/spinifex/handlers/imds/constants.go b/spinifex/domains/ec2/guestmetadata/constants.go
similarity index 98%
rename from spinifex/handlers/imds/constants.go
rename to spinifex/domains/ec2/guestmetadata/constants.go
index 2ca10aaf8..6d50f2e0f 100644
--- a/spinifex/handlers/imds/constants.go
+++ b/spinifex/domains/ec2/guestmetadata/constants.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 // MetaDataServerIP is the standard EC2 link-local metadata address.
 const MetaDataServerIP = "169.254.169.254"
diff --git a/spinifex/handlers/imds/credentials.go b/spinifex/domains/ec2/guestmetadata/credentials.go
similarity index 99%
rename from spinifex/handlers/imds/credentials.go
rename to spinifex/domains/ec2/guestmetadata/credentials.go
index 615e0164d..7df609897 100644
--- a/spinifex/handlers/imds/credentials.go
+++ b/spinifex/domains/ec2/guestmetadata/credentials.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"context"
diff --git a/spinifex/handlers/imds/credentials_test.go b/spinifex/domains/ec2/guestmetadata/credentials_test.go
similarity index 99%
rename from spinifex/handlers/imds/credentials_test.go
rename to spinifex/domains/ec2/guestmetadata/credentials_test.go
index b44eaae03..73952abad 100644
--- a/spinifex/handlers/imds/credentials_test.go
+++ b/spinifex/domains/ec2/guestmetadata/credentials_test.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"context"
diff --git a/spinifex/handlers/imds/cross_account_owner_test.go b/spinifex/domains/ec2/guestmetadata/cross_account_owner_test.go
similarity index 99%
rename from spinifex/handlers/imds/cross_account_owner_test.go
rename to spinifex/domains/ec2/guestmetadata/cross_account_owner_test.go
index 9769e6e6a..bf9d30d91 100644
--- a/spinifex/handlers/imds/cross_account_owner_test.go
+++ b/spinifex/domains/ec2/guestmetadata/cross_account_owner_test.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"context"
diff --git a/spinifex/handlers/imds/dns_forwarder.go b/spinifex/domains/ec2/guestmetadata/dns_forwarder.go
similarity index 99%
rename from spinifex/handlers/imds/dns_forwarder.go
rename to spinifex/domains/ec2/guestmetadata/dns_forwarder.go
index 722deace6..c922bc369 100644
--- a/spinifex/handlers/imds/dns_forwarder.go
+++ b/spinifex/domains/ec2/guestmetadata/dns_forwarder.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"context"
diff --git a/spinifex/handlers/imds/dns_forwarder_test.go b/spinifex/domains/ec2/guestmetadata/dns_forwarder_test.go
similarity index 99%
rename from spinifex/handlers/imds/dns_forwarder_test.go
rename to spinifex/domains/ec2/guestmetadata/dns_forwarder_test.go
index e9b4710c6..c605ce5fe 100644
--- a/spinifex/handlers/imds/dns_forwarder_test.go
+++ b/spinifex/domains/ec2/guestmetadata/dns_forwarder_test.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"context"
diff --git a/spinifex/handlers/imds/imdsv1.go b/spinifex/domains/ec2/guestmetadata/imdsv1.go
similarity index 99%
rename from spinifex/handlers/imds/imdsv1.go
rename to spinifex/domains/ec2/guestmetadata/imdsv1.go
index 5f11e5091..c14376429 100644
--- a/spinifex/handlers/imds/imdsv1.go
+++ b/spinifex/domains/ec2/guestmetadata/imdsv1.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"context"
diff --git a/spinifex/handlers/imds/imdsv1_test.go b/spinifex/domains/ec2/guestmetadata/imdsv1_test.go
similarity index 99%
rename from spinifex/handlers/imds/imdsv1_test.go
rename to spinifex/domains/ec2/guestmetadata/imdsv1_test.go
index 8e3c2f59e..0ffdc7aa3 100644
--- a/spinifex/handlers/imds/imdsv1_test.go
+++ b/spinifex/domains/ec2/guestmetadata/imdsv1_test.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"context"
diff --git a/spinifex/handlers/imds/instance_lookup.go b/spinifex/domains/ec2/guestmetadata/instance_lookup.go
similarity index 99%
rename from spinifex/handlers/imds/instance_lookup.go
rename to spinifex/domains/ec2/guestmetadata/instance_lookup.go
index a2b2e3675..77b318d10 100644
--- a/spinifex/handlers/imds/instance_lookup.go
+++ b/spinifex/domains/ec2/guestmetadata/instance_lookup.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"context"
diff --git a/spinifex/handlers/imds/instance_lookup_retry_test.go b/spinifex/domains/ec2/guestmetadata/instance_lookup_retry_test.go
similarity index 98%
rename from spinifex/handlers/imds/instance_lookup_retry_test.go
rename to spinifex/domains/ec2/guestmetadata/instance_lookup_retry_test.go
index 63b4d7b59..f55635e7d 100644
--- a/spinifex/handlers/imds/instance_lookup_retry_test.go
+++ b/spinifex/domains/ec2/guestmetadata/instance_lookup_retry_test.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"context"
diff --git a/spinifex/handlers/imds/instance_lookup_test.go b/spinifex/domains/ec2/guestmetadata/instance_lookup_test.go
similarity index 99%
rename from spinifex/handlers/imds/instance_lookup_test.go
rename to spinifex/domains/ec2/guestmetadata/instance_lookup_test.go
index 50214c1b7..598b00147 100644
--- a/spinifex/handlers/imds/instance_lookup_test.go
+++ b/spinifex/domains/ec2/guestmetadata/instance_lookup_test.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"context"
diff --git a/spinifex/handlers/imds/metadata.go b/spinifex/domains/ec2/guestmetadata/metadata.go
similarity index 99%
rename from spinifex/handlers/imds/metadata.go
rename to spinifex/domains/ec2/guestmetadata/metadata.go
index a61d51205..d1175e645 100644
--- a/spinifex/handlers/imds/metadata.go
+++ b/spinifex/domains/ec2/guestmetadata/metadata.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"context"
diff --git a/spinifex/handlers/imds/metadata_test.go b/spinifex/domains/ec2/guestmetadata/metadata_test.go
similarity index 99%
rename from spinifex/handlers/imds/metadata_test.go
rename to spinifex/domains/ec2/guestmetadata/metadata_test.go
index 6ec77513b..3c0133900 100644
--- a/spinifex/handlers/imds/metadata_test.go
+++ b/spinifex/domains/ec2/guestmetadata/metadata_test.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"context"
diff --git a/spinifex/handlers/imds/nats_clients.go b/spinifex/domains/ec2/guestmetadata/nats_clients.go
similarity index 99%
rename from spinifex/handlers/imds/nats_clients.go
rename to spinifex/domains/ec2/guestmetadata/nats_clients.go
index 246cd7051..565e823d2 100644
--- a/spinifex/handlers/imds/nats_clients.go
+++ b/spinifex/domains/ec2/guestmetadata/nats_clients.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"context"
diff --git a/spinifex/handlers/imds/nats_clients_test.go b/spinifex/domains/ec2/guestmetadata/nats_clients_test.go
similarity index 99%
rename from spinifex/handlers/imds/nats_clients_test.go
rename to spinifex/domains/ec2/guestmetadata/nats_clients_test.go
index 95e073418..d43903fed 100644
--- a/spinifex/handlers/imds/nats_clients_test.go
+++ b/spinifex/domains/ec2/guestmetadata/nats_clients_test.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"context"
diff --git a/spinifex/handlers/imds/resolver.go b/spinifex/domains/ec2/guestmetadata/resolver.go
similarity index 99%
rename from spinifex/handlers/imds/resolver.go
rename to spinifex/domains/ec2/guestmetadata/resolver.go
index 6e983d2c6..7046cc33e 100644
--- a/spinifex/handlers/imds/resolver.go
+++ b/spinifex/domains/ec2/guestmetadata/resolver.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"context"
diff --git a/spinifex/handlers/imds/resolver_test.go b/spinifex/domains/ec2/guestmetadata/resolver_test.go
similarity index 99%
rename from spinifex/handlers/imds/resolver_test.go
rename to spinifex/domains/ec2/guestmetadata/resolver_test.go
index 66e68aa6a..30631eb4c 100644
--- a/spinifex/handlers/imds/resolver_test.go
+++ b/spinifex/domains/ec2/guestmetadata/resolver_test.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"context"
diff --git a/spinifex/handlers/imds/role_visibility.go b/spinifex/domains/ec2/guestmetadata/role_visibility.go
similarity index 99%
rename from spinifex/handlers/imds/role_visibility.go
rename to spinifex/domains/ec2/guestmetadata/role_visibility.go
index 3069303f6..97238c7d4 100644
--- a/spinifex/handlers/imds/role_visibility.go
+++ b/spinifex/domains/ec2/guestmetadata/role_visibility.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"context"
diff --git a/spinifex/handlers/imds/role_visibility_test.go b/spinifex/domains/ec2/guestmetadata/role_visibility_test.go
similarity index 99%
rename from spinifex/handlers/imds/role_visibility_test.go
rename to spinifex/domains/ec2/guestmetadata/role_visibility_test.go
index 38e2bace5..bf5f9f16c 100644
--- a/spinifex/handlers/imds/role_visibility_test.go
+++ b/spinifex/domains/ec2/guestmetadata/role_visibility_test.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"bytes"
diff --git a/spinifex/handlers/imds/service.go b/spinifex/domains/ec2/guestmetadata/service.go
similarity index 98%
rename from spinifex/handlers/imds/service.go
rename to spinifex/domains/ec2/guestmetadata/service.go
index d580ed8bb..40d34ed7e 100644
--- a/spinifex/handlers/imds/service.go
+++ b/spinifex/domains/ec2/guestmetadata/service.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"context"
@@ -26,7 +26,7 @@ const tokenSweepInterval = time.Minute
 const tapReconcileInterval = 15 * time.Second
 
 // listTapsFunc enumerates the local primary-ENI IMDS taps as eniID → endpoint,
-// injected (like the veth hooks) to keep handlers/imds free of a network/host
+// injected (like the veth hooks) to keep domains/ec2/guestmetadata free of a network/host
 // import cycle. Backed by host.ListIMDSTaps in vpcd.
 type listTapsFunc func(ctx context.Context) (map[string]string, error)
 
diff --git a/spinifex/handlers/imds/tap_responder.go b/spinifex/domains/ec2/guestmetadata/tap_responder.go
similarity index 99%
rename from spinifex/handlers/imds/tap_responder.go
rename to spinifex/domains/ec2/guestmetadata/tap_responder.go
index 388bc0177..f6bce7acb 100644
--- a/spinifex/handlers/imds/tap_responder.go
+++ b/spinifex/domains/ec2/guestmetadata/tap_responder.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"context"
diff --git a/spinifex/handlers/imds/tap_responder_test.go b/spinifex/domains/ec2/guestmetadata/tap_responder_test.go
similarity index 99%
rename from spinifex/handlers/imds/tap_responder_test.go
rename to spinifex/domains/ec2/guestmetadata/tap_responder_test.go
index f5fb1173d..ffd8d038d 100644
--- a/spinifex/handlers/imds/tap_responder_test.go
+++ b/spinifex/domains/ec2/guestmetadata/tap_responder_test.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"context"
diff --git a/spinifex/handlers/imds/token.go b/spinifex/domains/ec2/guestmetadata/token.go
similarity index 98%
rename from spinifex/handlers/imds/token.go
rename to spinifex/domains/ec2/guestmetadata/token.go
index ce3916d37..8d28e2df1 100644
--- a/spinifex/handlers/imds/token.go
+++ b/spinifex/domains/ec2/guestmetadata/token.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"crypto/rand"
diff --git a/spinifex/handlers/imds/token_test.go b/spinifex/domains/ec2/guestmetadata/token_test.go
similarity index 99%
rename from spinifex/handlers/imds/token_test.go
rename to spinifex/domains/ec2/guestmetadata/token_test.go
index 7dde4b500..00ed3abd3 100644
--- a/spinifex/handlers/imds/token_test.go
+++ b/spinifex/domains/ec2/guestmetadata/token_test.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"testing"
diff --git a/spinifex/handlers/imds/trace_test.go b/spinifex/domains/ec2/guestmetadata/trace_test.go
similarity index 99%
rename from spinifex/handlers/imds/trace_test.go
rename to spinifex/domains/ec2/guestmetadata/trace_test.go
index 8e892c74d..965f44847 100644
--- a/spinifex/handlers/imds/trace_test.go
+++ b/spinifex/domains/ec2/guestmetadata/trace_test.go
@@ -1,4 +1,4 @@
-package handlers_imds
+package guestmetadata
 
 import (
 	"net/http"
diff --git a/spinifex/handlers/dns/quotas.go b/spinifex/handlers/dns/quotas.go
index bdd9f5d12..89ca28e66 100644
--- a/spinifex/handlers/dns/quotas.go
+++ b/spinifex/handlers/dns/quotas.go
@@ -30,7 +30,7 @@ const (
 	// DefaultResolverQPSPerIP is AWS's 10,000 UDP queries/sec per resolver-endpoint
 	// IP. The per-tap 169.254.169.253 shim is our resolver-endpoint analog, so
 	// this is the AWS-parity ceiling above which the forwarder sheds a flood
-	// (handlers/imds dnsQueryRatePerTap mirrors it).
+	// (domains/ec2/guestmetadata dnsQueryRatePerTap mirrors it).
 	DefaultResolverQPSPerIP = 10_000
 
 	// MaxRecordsPerChangeRequest is the hard cap on ResourceRecord elements in one
diff --git a/spinifex/vpcd/imds_instance_state.go b/spinifex/vpcd/imds_instance_state.go
index 10b506098..499c418ce 100644
--- a/spinifex/vpcd/imds_instance_state.go
+++ b/spinifex/vpcd/imds_instance_state.go
@@ -15,7 +15,7 @@ import (
 
 // localVMStateReader adapts this node's on-disk instance state to IMDS's
 // local-first lookup. vpcd is the composition root for both the network and
-// compute planes IMDS straddles, so this adapter — not handlers/imds — is
+// compute planes IMDS straddles, so this adapter — not domains/ec2/guestmetadata — is
 // what knows the state lives in a daemon-owned file.
 type localVMStateReader struct {
 	dataDir string
@@ -74,7 +74,7 @@ func (r *localVMStateReader) LocalVM(instanceID string) (*vm.VM, error) {
 	return r.cached.VMS[instanceID], nil
 }
 
-// recordLoader mirrors handlers/imds's own narrow instance-record accessor
+// recordLoader mirrors domains/ec2/guestmetadata's own narrow instance-record accessor
 // interface, so a construction failure below returns a true nil interface
 // rather than a *daemon.JetStreamManager typed nil boxed into one.
 type recordLoader interface {
diff --git a/spinifex/vpcd/vpcd.go b/spinifex/vpcd/vpcd.go
index 56f19e034..20412e2c4 100644
--- a/spinifex/vpcd/vpcd.go
+++ b/spinifex/vpcd/vpcd.go
@@ -19,9 +19,9 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/mulgadc/spinifex/spinifex/domains/ec2/guestmetadata"
 	"github.com/mulgadc/spinifex/spinifex/foundation/telemetry"
 	handlers_ec2_igw "github.com/mulgadc/spinifex/spinifex/handlers/ec2/igw"
-	handlers_imds "github.com/mulgadc/spinifex/spinifex/handlers/imds"
 	"github.com/mulgadc/spinifex/spinifex/network/external"
 	"github.com/mulgadc/spinifex/spinifex/network/external/dhcp"
 	"github.com/mulgadc/spinifex/spinifex/network/external/ocinet"
@@ -579,18 +579,18 @@ func launchService(cfg *Config) error {
 		return live, nil
 	}
 	// vpcd is the composition root for both planes IMDS straddles: it wires the
-	// on-disk VM state reader and the shared record space, so handlers/imds
+	// on-disk VM state reader and the shared record space, so domains/ec2/guestmetadata
 	// itself never needs to import the compute plane beyond vm.VM.
 	records, err := newInstanceRecordLoader(ctx, nc)
 	if err != nil {
 		return fmt.Errorf("open instance record space: %w", err)
 	}
-	imdsSvc, err := handlers_imds.NewIMDSServiceImpl(
+	imdsSvc, err := guestmetadata.NewIMDSServiceImpl(
 		ctx,
 		nc,
-		handlers_imds.NewNATSSTSAssumer(nc),
-		handlers_imds.NewNATSProfileLookup(nc),
-		handlers_imds.NewNATSPublicKeyLookup(nc),
+		guestmetadata.NewNATSSTSAssumer(nc),
+		guestmetadata.NewNATSProfileLookup(nc),
+		guestmetadata.NewNATSPublicKeyLookup(nc),
 		newLocalVMStateReader(cfg.DataDir),
 		records,
 		listTaps,
@@ -599,7 +599,7 @@ func launchService(cfg *Config) error {
 		cfg.ServicesDomain,
 		cfg.CACert,
 		cfg.ResolverNameservers,
-		handlers_imds.NewHostBindAddrs(cfg.IMDSHostMetaIP, cfg.IMDSHostDNSIP),
+		guestmetadata.NewHostBindAddrs(cfg.IMDSHostMetaIP, cfg.IMDSHostDNSIP),
 	)
 	if err != nil {
 		return fmt.Errorf("construct IMDS service: %w", err)
@@ -824,7 +824,7 @@ func launchService(cfg *Config) error {
 // absent northstar it falls back to the upstream pool DNS.
 func resolverDNSServer(cfg *Config) string {
 	if len(cfg.ResolverNameservers) > 0 {
-		return handlers_imds.VPCDNSServerIP
+		return guestmetadata.VPCDNSServerIP
 	}
 	return pickDNSServer(cfg.ExternalPools)
 }
diff --git a/spinifex/vpcd/vpcd_test.go b/spinifex/vpcd/vpcd_test.go
index 672d343ca..a5b9fab21 100644
--- a/spinifex/vpcd/vpcd_test.go
+++ b/spinifex/vpcd/vpcd_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	handlers_imds "github.com/mulgadc/spinifex/spinifex/handlers/imds"
+	"github.com/mulgadc/spinifex/spinifex/domains/ec2/guestmetadata"
 	"github.com/mulgadc/spinifex/spinifex/network/external"
 )
 
@@ -486,8 +486,8 @@ func TestResolverDNSServer(t *testing.T) {
 		ResolverNameservers: []string{"192.168.1.31", "192.168.1.32"},
 		ExternalPools:       []external.ExternalPoolConfig{{DNSServers: []string{"8.8.8.8"}}},
 	}
-	if got := resolverDNSServer(cfg); got != handlers_imds.VPCDNSServerIP {
-		t.Errorf("resolverDNSServer = %q, want %q", got, handlers_imds.VPCDNSServerIP)
+	if got := resolverDNSServer(cfg); got != guestmetadata.VPCDNSServerIP {
+		t.Errorf("resolverDNSServer = %q, want %q", got, guestmetadata.VPCDNSServerIP)
 	}
 
 	// Without resolvers, fall back to the upstream pool DNS.
diff --git a/tests/e2e/harness/dns.go b/tests/e2e/harness/dns.go
index 5c57a177b..e462cd267 100644
--- a/tests/e2e/harness/dns.go
+++ b/tests/e2e/harness/dns.go
@@ -16,7 +16,7 @@ import (
 	"github.com/mulgadc/spinifex/spinifex/bootstrap/config"
 
 	handlers_dns "github.com/mulgadc/spinifex/spinifex/handlers/dns"
-	handlers_imds "github.com/mulgadc/spinifex/spinifex/handlers/imds"
+	"github.com/mulgadc/spinifex/spinifex/domains/ec2/guestmetadata"
 )
 
 const (
@@ -211,9 +211,9 @@ func AssertGuestResolver(t *testing.T, target SSHTarget) {
 		if err != nil {
 			return err
 		}
-		if !slices.Contains(resolvers, handlers_imds.VPCDNSServerIP) {
+		if !slices.Contains(resolvers, guestmetadata.VPCDNSServerIP) {
 			return fmt.Errorf("guest forwards DNS to %v, want the VPC resolver %s",
-				resolvers, handlers_imds.VPCDNSServerIP)
+				resolvers, guestmetadata.VPCDNSServerIP)
 		}
 		return nil
 	}, 30*time.Second, 3*time.Second)
diff --git a/tests/e2e/single/sgreachability_test.go b/tests/e2e/single/sgreachability_test.go
index 7cfa0bdf0..7939312bf 100644
--- a/tests/e2e/single/sgreachability_test.go
+++ b/tests/e2e/single/sgreachability_test.go
@@ -11,7 +11,7 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	handlers_dns "github.com/mulgadc/spinifex/spinifex/handlers/dns"
-	handlers_imds "github.com/mulgadc/spinifex/spinifex/handlers/imds"
+	"github.com/mulgadc/spinifex/spinifex/domains/ec2/guestmetadata"
 	"github.com/mulgadc/spinifex/tests/e2e/harness"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -128,7 +128,7 @@ func runSGReachabilityPolicy(t *testing.T, fix *Fixture) {
 		region := aws.StringValue(fix.AWS.EC2Conf.Config.Region)
 		require.NotEmpty(t, region, "AWS region is required to build the internal EC2 name")
 
-		harness.Step(t, "assert guest uses the VPC resolver %s", handlers_imds.VPCDNSServerIP)
+		harness.Step(t, "assert guest uses the VPC resolver %s", guestmetadata.VPCDNSServerIP)
 		harness.AssertGuestResolver(t, tgt)
 
 		// Ping the instance's own private IP — local datapath sanity, no DNS