From 6c50349bd89d686a168ea3b7b75dd13193e83642 Mon Sep 17 00:00:00 2001 From: joshsiv-mulga Date: Thu, 8 Oct 2026 00:42:00 +1000 Subject: [PATCH] docs: record ACM registration --- docs/PACKAGE_BOUNDARY_MIGRATION.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/PACKAGE_BOUNDARY_MIGRATION.md b/docs/PACKAGE_BOUNDARY_MIGRATION.md index 203775419..44bf2b79b 100644 --- a/docs/PACKAGE_BOUNDARY_MIGRATION.md +++ b/docs/PACKAGE_BOUNDARY_MIGRATION.md @@ -286,6 +286,8 @@ while the branch is in flight; they do not describe the umbrella repository's | `6c48ab6b7` | `spinifex/gateway` (`ECR_Request`, `ecrActionFromTarget`, `ecrAuthorizationPrincipal`, the four `ECR*` `GatewayConfig` fields, the `ecr` legacy table/switch entries) | `spinifex/domains/ecr/awsapi` (`NewRegistration`, `OperationInventory`), wired by `spinifex/runtime/roles/awsgw` | ADR-0002 phase 3: ECR's AWS JSON 1.1 control plane registers from its domain. The dispatcher reproduces the removed gateway path step for step (error codes and order, one bounded body read feeding scope and invocation, `Authorize` before every use case, nil capability as ServerInternal, the token principal from the verified `Actor`, the JSON writer). The gateway no longer imports `domains/ecr/awsapi`; the OCI `/v2` route is unchanged. Operation coverage reads the pure `OperationInventory()` that the registration uses verbatim, proved equal by `TestRegistrationInventoryIsTheDeclaredInventory`; `coverage.json` and every coverage page were byte-identical. `TestS4_OnlyAWSGWRoleImportsDispatchAndECRAWSAPI` binds acceptance item 3, with `cmd/aws-model-coverage` as the only named, non-serving tool exception. Five mutations (authorise after use, prefix-strict resolver, inventory drop, body-derived token principal, probe import) were each caught; Phase 0 characterisation kept every assertion except one rebound from the deleted parser to the registration's resolver; full preflight passed. Remaining temporary edge: `Deps.NATS` is a raw `*nats.Conn`. | | `5f66bd2a3` | `spinifex/gateway` (`GenerateEC2ErrorResponse`, `GenerateIAMErrorResponse`, `GenerateS3ErrorResponse`, `requestSignalsJSONProtocol`, `jsonErrorType`, error content types), `spinifex/gateway/eks` (`GenerateEKSErrorResponse`) | `spinifex/ingress/aws/envelope` | ADR-0002 phase 4, error rendering: pure EC2, IAM-style and S3 XML builders, the AWS JSON 1.1 body and error type, the header-only JSON-protocol detector and content types, importing only the standard library. `ErrorHandler`, the cluster-unavailable, throttle and SigV4 writers and the legacy service-to-envelope selection stay in `gateway`. A 140-case golden of status, headers and body across 14 service cases and every error writer was identical before and after; two mutations were caught; the S4 ingress import invariant scans the new package; full preflight passed. | | `b81ae4eb4` | `spinifex/gateway` (service served/action/error-protocol selection, overlap check) | `spinifex/ingress/aws/dispatch` (`Selector`, `Legacy`) | ADR-0002 phase 4 slice 2: one selector decides whether a service is served, its throttle/trace/audit action, its error protocol, its registered entry and the startup overlap; a registered service always wins and a resolver-less registration does not fall back to legacy action resolution. The gateway supplies its legacy tables through the three-method `dispatch.Legacy` interface, so ingress imports nothing from gateway; legacy dispatch, the Bedrock sub-service mapping and invocation building (which read gateway request-context keys) stay in gateway. A 160-case golden capture through the real SigV4, trace and `Request` chain with live test NATS and the ECR registration was identical before and after; mutating `Served`, `ResolveAction` and `Validate` each failed tests. Only startup-visible change: the overlap error now begins `dispatch:` and names the first overlap in sorted order. Full preflight passed. | +| `4b0a4dd6b` | — | — | ACM characterization before registration: full-pipeline 400 MissingAction/InvalidAction envelopes, a 200 `ListCertificates` against a live NATS responder, dispatch and telemetry target-parser agreement, authorization before the NATS call (subject counter stays zero), 413 before dispatch, 503 when NATS is down (ACM's own nil-connection check is unreachable over HTTP), the action reaching throttle, trace and audit, and the nine-action inventory. Mutating the parser, the authorization call and the action table each failed tests. Test-only; full preflight passed. | +| `fdaf589ca` | `spinifex/gateway` (`ACM_Request`, `acmActions`, `acmActionFromTarget`, legacy `acm` entries) | `spinifex/domains/acm/awsapi` (`NewRegistration`, `OperationInventory`) | ACM registers its AWS JSON 1.1 control plane from its domain, wired only by the awsgw role; the dispatcher reproduces the old order (missing/unknown action, `InternalError` without an account, bounded body, resource ARNs, authorization, then nil-NATS and the action). The S4 composition invariant now covers every registered domain `awsapi` with the same named coverage-tool exception. Coverage output was byte-identical and the ACM integration conformance summary was identical at the parent and after. Mutating authorization order, the target parser, the inventory and gateway imports each failed tests. Temporary edge: `Deps.NATS` is a raw `*nats.Conn` because every ACM action function takes one. Full preflight passed. | The EC2 contract row is intentionally different from the directory moves: it creates a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS