diff --git a/docs/PACKAGE_BOUNDARY_MIGRATION.md b/docs/PACKAGE_BOUNDARY_MIGRATION.md
index 4ed402e07..330c6c352 100644
--- a/docs/PACKAGE_BOUNDARY_MIGRATION.md
+++ b/docs/PACKAGE_BOUNDARY_MIGRATION.md
@@ -267,6 +267,7 @@ while the branch is in flight; they do not describe the umbrella repository's
 | `8929ee47b` | `cmd/eks-gateway-fetch` (implementation) | `spinifex/agents/eks/gatewayfetch` | The control-plane VM's add-on and recovery fetch is EKS in-guest behaviour. `cmd/eks-gateway-fetch` keeps its nine flags in their original order with `EKS_*` environment defaults, parsing, the `fipsboot` import, the `eks-gateway-fetch:` log prefix and exit code 1; the agent exposes only `Config` (with `Out` supplied by the binary) and `Run(ctx, Config) error`. The 8 former `fatal` sites had no defers or cleanup and return errors with identical text; a render failure is still not retried. As with publish, `retryDelay` is a test variable and the retry wait honours a cancellation the binary never triggers. The TSV emitters and their tests moved unchanged; new `Run` tests cover the five startup errors, addons and recovery rendering at their gateway paths, an unretried render failure, the attempt budget and cancellation. Old and new binaries gave byte-identical stdout, stderr and exit codes for 11 cases against a local TLS gateway, including both TSV outputs and flags overriding environment. Full preflight apart from the known vulnerability-scan finding passed. |
 | `d064924e6` | `cmd/eks-webhook-cert` (implementation) | `spinifex/agents/eks/webhookcert` | Minting and caching the in-cluster admission webhook's self-signed serving certificate is EKS in-guest behaviour. `cmd/eks-webhook-cert` keeps the `-dir`, `-cn` and `-dns` flags, parsing, the usage text, the `fipsboot` import, the `eks-webhook-cert:` log prefix and exit code 1; the agent exposes only `Config` (with `Out` supplied by the binary) and `Run(ctx, Config) error` and depends only on the standard library. The 3 former `fatal` sites had no defers or cleanup; a key-write failure still leaves `tls.crt` on disk, and a stdout write error is still ignored. Moving out of `cmd/` brought the file under gosec, whose G306 finding on the public certificate's 0644 mode is annotated with its reason. Existing tests moved unchanged; new `Run` tests cover the required-flag and blank-SAN errors, the cache-directory failure and the one-line CA/leaf/key output. Old and new binaries gave identical stdout, stderr, exit codes, file modes and output shape for 7 cases, and a second run reused the cached pair. Full preflight apart from the known vulnerability-scan finding passed. |
 | `fba330b86` | `cmd/eks-konnectivity-cert` (implementation) | `spinifex/agents/eks/konnectivitycert` | Issuing and caching the on-node konnectivity-server certificate from the K3s cluster CA is EKS in-guest behaviour. `cmd/eks-konnectivity-cert` keeps its five flags and defaults (including `-cn konnectivity-server`), parsing, the usage text, the `fipsboot` import, the `eks-konnectivity-cert:` log prefix and exit code 1; the agent exposes only `Config` (with `Out` supplied by the binary) and `Run(ctx, Config) error` and depends only on the standard library. The 3 former `fatal` sites had no defers or cleanup; a key-write failure still leaves `tls.crt` on disk, and a stdout write error is still ignored. The gosec G306 finding on the public certificate's 0644 mode is annotated with its reason. Existing signing, reuse/reissue and SAN-splitting tests moved unchanged; new `Run` tests cover the required-flag and blank-SAN errors, an unreadable CA and the path output with IP and DNS SANs. Old and new binaries gave identical stdout, stderr, exit codes, file modes, CA verification, SANs and subject for 10 cases including SEC1 and PKCS8 CA keys, and the new binary reused the cached certificate and reissued it on a SAN change. Full preflight apart from the known vulnerability-scan finding passed. |
+| `ac069d8f3` | `cmd/eks-token-webhook` (implementation) | `spinifex/agents/eks/tokenwebhook` | The control-plane VM's TokenReview webhook is EKS in-guest behaviour. `cmd/eks-token-webhook` keeps the `-addr` flag and loopback default, the environment-derived configuration (`loadConfig`, `envOr`, all eleven `EKS_*` variables, their default paths and the three required-variable errors, with its test), the slog text handler, both log lines and exit code 1; the agent exposes only `Config` and `Run(ctx, Config) error` and imports neither `flag` nor `os.Getenv`. The binary already returned errors from `run`, so no exit sites changed, and the certificate, kubeconfig, gateway-client and serve order is unchanged. Cancelling `ctx` now closes the server, which the binary never triggers. The relay, handler, certificate, kubeconfig and wire types moved unchanged with their tests; the public certificate's gosec G306 finding is annotated. New `Run` tests cover serving-cert, kubeconfig, gateway-client and listen failures and serving until cancelled. Old and new binaries matched for 12 cases including a live server's `/healthz` and `/authenticate` 405, 400 and 503 responses, file modes, kubeconfig body and log messages. Full preflight apart from the known vulnerability-scan finding passed. |
 
 The EC2 contract row is intentionally different from the directory moves: it creates
 a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS
@@ -345,6 +346,7 @@ These residuals were recorded by individual slices and must be resolved once the
 - `spinifex/migrate`: the KV engine already lives in `foundation/state/migrate`, but the remaining config-file and object-store migration engine is not a move into it. It is an operator upgrade concern used only by `spx admin upgrade`, both packages define `Registry`, `NewRegistry` and `DefaultRegistry` with distinct registry models, and its object migrations would give foundation a dependency on `providers/objectstore`. Its eventual owner is deferred; no subpackage is created to satisfy the directory map.
 - `domains/network`: `reconcile/intent.go` builds desired network state by reading EC2's KV buckets and decoding EC2's private VPC, subnet, ENI, route-table, gateway, EIP, NAT and security-group records, and `reconcile/drift.go` watches those buckets. ADR-0001 names this pair explicitly: EC2 and network communicate through a capability/projection or versioned contract, never by one being the other's KV reader. Step 7 fix: an EC2-owned `domains/ec2/projection` exposing network intent with list and watch (it may stay KV-backed, so no data moves); a narrow intent interface declared by `reconcile`; wiring at the composition root; and the duplicated `PurposeEIP`/`PurposeIGWLRP` constants and mirrored `SGRule`/`SGEvent` folded into the projection or `contracts/ec2/v1`. The drift-watch coverage test and reconcile scenario tests are the evidence the projection must keep. `domains/network` also imports `runtime/compute/vm` and `runtime/host/command` (domain-to-runtime).
 - `domains/ec2/instance`: imports `runtime/compute/vm` and `runtime/compute/gpu` (domain-to-runtime) and `domains/dns` (cross-domain implementation import).
+- `agents/eks/tokenwebhook`: imports `handlers/eks` for `WebhookTokenReviewResult`, an agent depending on a domain implementation. Temporary: the eventual EKS contract or projection for the token-review reply needs its own design, and no contract is invented to complete the move.
 - Merge-time follow-up in the umbrella repository: the `Makefile` `invariants-check` target, the `docs-pr.yml` clause cross-check, `.claude/hooks/architecture-traps.sh` and a `check-invariants.sh` comment hard-code `spinifex/spinifex/network/invariants`. They must change with the pointer bump that brings in this branch, or the docs-pr cross-check silently skips. Live specs and proposals citing `spinifex/network/` will report unresolved citations until updated.
 
 ## Recording rule