From 3e7ac0d24fab4ab04f5d75793e7aba6bb6d5358e Mon Sep 17 00:00:00 2001 From: joshsiv-mulga Date: Wed, 7 Oct 2026 08:15:59 +1000 Subject: [PATCH] docs: record network domain move --- docs/PACKAGE_BOUNDARY_MIGRATION.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/docs/PACKAGE_BOUNDARY_MIGRATION.md b/docs/PACKAGE_BOUNDARY_MIGRATION.md index bc1fa025e..4d5411a01 100644 --- a/docs/PACKAGE_BOUNDARY_MIGRATION.md +++ b/docs/PACKAGE_BOUNDARY_MIGRATION.md @@ -258,6 +258,7 @@ while the branch is in flight; they do not describe the umbrella repository's | `93f101c0f` | `spinifex/handlers/ochrevector` | `spinifex/domains/ochre/vector` | The tenant vector store (pgvector backend, KV index registry, ingest, jobs, backup and appliance orchestration) is Ochre domain state and now sits under the Ochre domain as the ADR-0001 map requires. Package renamed from `handlers_ochrevector` to `vector` with its existing package comment; callers use the `ochrevector` alias because `vector` is a common local identifier in the gateway, daemon and CLI. Error strings keep their `ochrevector:` prefix. The service-interface manifest names the new path. Full preflight apart from the known vulnerability-scan finding, focused Ochre, gateway, daemon, awsgw and CLI tests, tagged integration/E2E compilation and the manifest check passed. | | `2b6131e21` | `spinifex/gateway/bedrock/hfhub` | `spinifex/domains/ochre/hfhub` | The Hugging Face Hub client resolves and streams model weights for Ochre and has no dependency on the rest of `gateway/bedrock`; its only caller is `spx admin ochre` weights pull. Package name unchanged. The rest of `gateway/bedrock` is not moved: it holds Ochre domain state, stores and the inference engine alongside the Bedrock action layer, and `domains/ochre` imports it, so moving it to `domains/ochre/awsapi` would invert the domain-to-adapter direction. It is recorded as dependency-rule debt. Full preflight apart from the known vulnerability-scan finding, focused hfhub and CLI tests, and tagged integration/E2E compilation passed. | | `40964815b` | `spinifex/utils` (`MergeTagsMut`, `ApplyTagRemovals`, `RemoveTagsMut`, `UpdateKVRecordTags`, `MirrorKVRecordTags`) | `spinifex/domains/ec2/tagmirror` | EC2-wide AWS tag mutation over resource KV records is EC2 domain behaviour and imports only foundation packages. The EC2 tags resource package was not used because it imports the instance, key and VPC resources that call these helpers, which would create a resource-to-resource cycle. Twelve EC2 resource packages now call `tagmirror`; a stale `utils.ParseNBDURI` comment in the VM device code now names `nbd.ParseNBDURI`. Full preflight apart from the known vulnerability-scan finding, focused EC2, utils and VM tests, and tagged integration/E2E compilation passed. | +| `7003168bc` | `spinifex/network/*` (all 15 packages) | `spinifex/domains/network/*` | Network control, policy, topology, OVN, external and host realisation are network-domain ownership. The packages move as one enclosing move because the L0–L5 invariants classify layers by trimming a single `networkRoot` prefix; a partial move would silently drop moved packages out of S1. Package names, layer assignments, reconciliation authority and the vpcd boundary are unchanged. Invariant scan roots, the RG-10 sudo allow-list path, `.github/CODEOWNERS` and the IMDS netns unit test's repo-root walk follow the new path. Injected `host`→`topology` and L3 `CreateLogicalSwitch` violations failed S1 and S5 at the new paths, confirming the invariants still scan the moved packages; `domains/network/systemvpc` now also falls inside the host-containment and NAT-mode scans and passes them. Full preflight apart from the known vulnerability-scan finding, focused network, invariant, host-command and vpcd suites, `setup-ovn_test.sh`, `manifest-check` and tagged integration/E2E compilation passed. | The EC2 contract row is intentionally different from the directory moves: it creates a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS @@ -326,7 +327,7 @@ These residuals were recorded by individual slices and must be resolved once the - Guest metadata: the cross-domain and runtime imports above. - `admin` → `operator/admin` is blocked until its shared pieces have owners: `DefaultAccountID`/`DefaultAccountName` (IAM/account bootstrap), `GenerateAWSAccessKey`/`GenerateAWSSecretKey` (IAM credentials), `PromoteSystemImage` (EC2 image domain), and `GenerateCACert`/`GenerateSignedCert` (Spinifex certificate issuance, used by the NATS role and RDS). -- `domains/dns`: imports `runtime/compute/vm` (domain-to-runtime), `network/reconcile` for the reconcile lock and `bootstrap/config` for node configuration. +- `domains/dns`: imports `runtime/compute/vm` (domain-to-runtime), `domains/network/reconcile` for the reconcile lock and `bootstrap/config` for node configuration. - ACM: the IAM AES-GCM helper import and gateway-owned action dispatch (ACM relocation residuals). - `runtime/roles/awsgw`: the quota reconcile loop belongs to `domains/admission/quota`, and the EKS token-verify responder belongs with STS or EKS identity. - `utils`: `vpcd_event.go` (vpcd request/ack protocol and NAT helpers) awaits a network contract, `ec2_subject.go` awaits an EC2 contract, and `encryption.go` (the Viperblock master-key loader) awaits a Viperblock adapter owner, since `providers/ebs` is provider-neutral. @@ -334,6 +335,8 @@ These residuals were recorded by individual slices and must be resolved once the - `domains/ec2/systeminstance`: managed-service parent metadata is only the `ManagedBy` tag value. - `gateway/bedrock`: holds the Ochre domain core (model catalogue, provisioned throughput, guardrail, access, credential, usage, price, logging and weights stores), the inference engine (provider, vLLM, Anthropic, embeddings, reranker, admission) and the Bedrock action layer in one package with internal cycles. `domains/ochre` imports it, which is the ADR step 7 Ochre gateway import. Splitting it needs a plan: domain core and stores to `domains/ochre/`, inference to an Ochre-owned package, and only the action layer to `domains/ochre/awsapi`. The top-level `gateway/bedrock*.go` HTTP handlers additionally wait for the ingress registration seam. - `spinifex/migrate`: the KV engine already lives in `foundation/state/migrate`, but the remaining config-file and object-store migration engine is not a move into it. It is an operator upgrade concern used only by `spx admin upgrade`, both packages define `Registry`, `NewRegistry` and `DefaultRegistry` with distinct registry models, and its object migrations would give foundation a dependency on `providers/objectstore`. Its eventual owner is deferred; no subpackage is created to satisfy the directory map. +- `domains/network`: imports the EC2 `vpc`, `igw`, `routetable`, `natgw` and `eip` implementations, which breaks rule 3 once both sit under `domains/`, and imports `runtime/compute/vm` and `runtime/host/command` (domain-to-runtime). Direction is unchanged by the move; resolving it needs EC2-owned projections or contracts. +- Merge-time follow-up in the umbrella repository: the `Makefile` `invariants-check` target, the `docs-pr.yml` clause cross-check, `.claude/hooks/architecture-traps.sh` and a `check-invariants.sh` comment hard-code `spinifex/spinifex/network/invariants`. They must change with the pointer bump that brings in this branch, or the docs-pr cross-check silently skips. Live specs and proposals citing `spinifex/network/` will report unresolved citations until updated. ## Recording rule