From 12e4005eefb67bd61209085ba0e9b4ade4e0879e Mon Sep 17 00:00:00 2001 From: joshsiv-mulga Date: Thu, 1 Oct 2026 15:39:25 +1000 Subject: [PATCH] docs: record ecr authorization token extraction --- docs/PACKAGE_BOUNDARY_MIGRATION.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/PACKAGE_BOUNDARY_MIGRATION.md b/docs/PACKAGE_BOUNDARY_MIGRATION.md index d6598306a..1585d8caf 100644 --- a/docs/PACKAGE_BOUNDARY_MIGRATION.md +++ b/docs/PACKAGE_BOUNDARY_MIGRATION.md @@ -204,6 +204,7 @@ while the branch is in flight; they do not describe the umbrella repository's | `c558872e8` | Gateway `CreateRepository` action semantics | `spinifex/domains/ecr/awsapi.CreateRepository` | Request decoding, input defaults and validation, duplicate detection, account-scoped metadata persistence and AWS response projection are ECR AWS-action ownership. Gateway retains authenticated HTTP adaptation and response writing. Focused domain, gateway lifecycle and tagged integration validation passed. | | `a6b209b7b` | Gateway `DeleteRepository` action semantics | `spinifex/domains/ecr/awsapi.DeleteRepository` | Request validation, account scope, non-empty protection, forced deletion, metadata cascade and AWS response projection are ECR AWS-action ownership. Blob reclamation remains the separately documented GC concern. Focused domain, gateway lifecycle and tagged integration validation passed. | | `7a5159366` | Gateway `PutImageTagMutability` action | `spinifex/domains/ecr/awsapi.PutImageTagMutability` | This endpoint-free action is registered directly in the ECR action table rather than retained as a gateway wrapper. Request validation, account-scoped metadata update and AWS response construction are domain-adapter ownership; generic gateway auth and policy gating remain before dispatch. Focused domain, gateway and tagged integration validation passed. | +| `a2f6005d2` | Gateway `GetAuthorizationToken` action response | `spinifex/domains/ecr/awsapi.GetAuthorizationToken` | Gateway retains canonical IAM/STS principal construction from authenticated context. The ECR adapter consumes a narrow token-issuer capability and owns mint-result handling, Docker `AWS:` encoding and AWS response projection. Focused domain, real issuer/verifier gateway round-trip and tagged integration validation passed. | The EC2 contract row is intentionally different from the directory moves: it creates a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS