From 2764fcbfa36275e2322abb739b8a4275ed2a610b Mon Sep 17 00:00:00 2001 From: joshsiv-mulga Date: Fri, 2 Oct 2026 14:48:36 +1000 Subject: [PATCH] docs: record account key state move --- docs/PACKAGE_BOUNDARY_MIGRATION.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/PACKAGE_BOUNDARY_MIGRATION.md b/docs/PACKAGE_BOUNDARY_MIGRATION.md index 0e4ea03d5..bb5037768 100644 --- a/docs/PACKAGE_BOUNDARY_MIGRATION.md +++ b/docs/PACKAGE_BOUNDARY_MIGRATION.md @@ -233,6 +233,7 @@ while the branch is in flight; they do not describe the umbrella repository's | `cf531cd73` | `spinifex/utils` (QMP telemetry filename convention) | `contracts/telemetry/v1` | The telemetry QMP prefix and metadata path are part of the existing VM-runtime-to-collector file contract. The contract test, focused VM telemetry tests, collector suite and caller compilations passed; the broader VM suite is sandbox-blocked by unrelated socket setup. | | `83615f1f4` | `spinifex/utils` (AWS XML response helpers) | `spinifex/foundation/aws/xml` | EC2 XML response normalization/enveloping and IAM-style Query envelopes are shared AWS protocol mechanics. Focused XML tests and all direct caller compilations passed; the RDS-agent package was compile-checked without execution because its FIPS bootstrap requires a FIPS-enabled runtime. | | `9896834b2` | `spinifex/utils` (`ExtractTags`, `MapToEC2Tags`) | `spinifex/foundation/aws/tags` | Generic EC2 tag-specification extraction and API-model projection join the AWS tag foundation; KV tag mirroring remains separate state-layer work. Focused tag tests and direct caller compilations passed; the volume package was compile-checked without execution because its test main opens a sandbox-blocked TCP listener. | +| `d8985c287` | `spinifex/utils` (`AccountKey`) | `spinifex/foundation/state/kvutil` | Account-scoped durable-key construction belongs to the state foundation; its `{accountID}.{resourceID}` layout is unchanged. AWS account policy (`GlobalAccountID`, `IsAccountID`) remains separate legacy utility work. Focused key and tag-mirror tests plus every direct resource-caller compilation passed. | The EC2 contract row is intentionally different from the directory moves: it creates a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS