docs: record AWS ingress helper moves and tooling conformance

docs/PACKAGE_BOUNDARY_MIGRATION.md

@@ -277,6 +277,9 @@ while the branch is in flight; they do not describe the umbrella repository's
 | `c38bf99e4`, `2ee60b20f`, `eaa5c971e`, `f6d8060f2`, `f50687210`, `817e19bf2`, `67992c8f5` | `gateway/ec2/{zone,vpc,eigw,eip,igw,natgw,routetable}` | `spinifex/domains/ec2/awsapi/<same>` | The VPC-networking action adapters follow the same per-resource pattern; `zone` moves first because the instance adapter depends on it. Moved files change only their package line (`vpc_test` for its external tests). Callers are the gateway dispatch, account teardown's EC2 reapers, the quota live counters and the not-yet-moved instance adapter. Adapter, gateway and account-teardown tests, the integration and E2E builds, and full preflight passed. |
 | `4b315469f`, `8b106e796`, `7ee808d2d`, `0485c77e6` | `gateway/ec2/{image,snapshot,volume,tags}` | `spinifex/domains/ec2/awsapi/<same>` | Image, snapshot, volume and tag action adapters follow the same per-resource pattern; moved files change only their package line. Callers are the gateway dispatch, account teardown's EC2 reapers and the quota storage counter. The volume adapter still imports the instance adapter, which moves next. Adapter, gateway, account-teardown and quota tests, the integration and E2E builds, and full preflight passed. |
 | `b9a5eaf19`, `d4c68007e`, `534c5b49d`, `931af0ea5` | `gateway/ec2` (root), `gateway/ec2/{idem,instance,spotinstance}` | `spinifex/domains/ec2/awsapi`, `spinifex/domains/ec2/awsapi/<same>` | The root package holds EC2 resource-ARN resolution for authorization and becomes package `awsapi` (imported as `ec2awsapi`); the completeness test's failure messages now name its new path. The idempotency, instance and spot-instance adapters follow the per-resource pattern, instance and spot instance last because they carry cross-domain and runtime dependencies (see dependency-rule debt). Moved files change only their package line; `docs/DESIGN.md` examples use the new alias. `gateway/ec2` no longer exists and `gateway/ec2.go` remains the transitional dispatch point. E2E suite selection is unchanged: neither the old nor the new path is in the manifest. EC2 domain, gateway, account-teardown, quota, daemon and awsgw tests, the integration and E2E builds, and full preflight passed. |
+| `cd9266176` | `gateway/restrouter.go` | `spinifex/ingress/aws/rest` | The REST-JSON router maps method and path to an AWS action and percent-decodes path parameters because ARNs appear in paths, so it is AWS protocol mechanics rather than protocol-neutral HTTP and sits beside `ingress/aws/query`. The exported surface is `Route[H]`, `NewRouter` and `(*Router).Lookup`; pattern parsing stays package-private and tested in place. The Bedrock and EKS route tables and their duplicate-route and completeness assertions stay in `gateway`, which computes the two former helper values inline rather than widening the API. Ingress and gateway tests, the integration and E2E builds, and full preflight passed. |
+| `ba2d59b29` | `gateway/ratelimit.go` | `spinifex/ingress/aws/ratelimit` | Per-IP lockout after repeated failed SigV4 authentication returns AWS `RequestLimitExceeded`, so it is AWS ingress protection. Moved code changes only its package line and the four exports the gateway needs: `MaxFailures`, `Fingerprint`, `TokenDigest` and `Anonymous`; limiter behaviour is unchanged. `gateway` imports it as `authlimit` because it already imports Bluebottle's `ratelimit` throttler. The 14 implementation tests move with the package; the end-to-end gateway tests stay. The session-principal verdict and success-reset tests now read the record table through the lockout boundary instead of the limiter's private fields, and three mutations (success not clearing, double counting, legacy verdict recording) each fail them. Ingress and gateway tests, the integration and E2E builds, and full preflight passed. |
+| — | `cmd/dhcptest`, `cmd/spx-loadgen` | unchanged | Both already conform to ADR-0001's tooling row: the load engine is `internal/testkit/loadgen` and the DHCP probe's shared pieces come from the network domain's `dhcp` package. What remains in each `main` is its own flag parsing and one-off orchestration that nothing else imports, so extracting it would create a package solely to satisfy the directory map. No source change. |
 
 The EC2 contract row is intentionally different from the directory moves: it creates
 a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS
@@ -363,6 +366,7 @@ These residuals were recorded by individual slices and must be resolved once the
 - `operator/cli` (known security risk): `spx admin join` contacts the formation server with `InsecureSkipVerify`, sends the join token as a bearer credential and receives the cluster CA certificate and key, master key, Viperblock key and shared credentials, so an on-path attacker during formation can capture the token and the cluster root secrets or substitute a CA. This predates the move; lint surfaced it when the tree left `cmd/`. It is accepted for now and carries a line-level gosec annotation stating it is not a false positive. Removal condition: authenticate formation TLS with a pinned key or certificate delivered with the join material, or an out-of-band CA, with tests proving a mismatched server certificate fails before credentials are sent.
 - `operator/cli` (dependency): the command tree still imports domain and service implementations directly (`handlers/{iam,eks,quota}`, `gateway`, `gateway/bedrock`, `daemon`, `vpcd`, `admin`, `accountteardown`, `migrate`, `services/viperblockd` and runtime roles). ADR row 231 requires command packages to reach domains through public capabilities; splitting supported use cases into `operator/*` packages is later work.
 - `gateway/ec2.go` (registration): the EC2 dispatch map stays a `GatewayConfig` method in `gateway` and imports every `domains/ec2/awsapi/*` package. ADR-0001 makes the domain own its action registration; moving the map waits on the generic ingress registration seam and must not be done as a package move.
+- `gateway/requestaudit.go`: the outermost request-audit middleware records AWS fields and is updated from four places in the gateway's authentication flow through the gateway's own context key. Moving it would export about seven names used only by that flow, so it stays in `gateway` until the generic ingress registration seam defines how ingress middleware receives authentication results.
 - `accountteardown` (dependency): its EC2 reapers call `domains/ec2/awsapi/*` action adapters directly, as they did under `gateway/ec2`. ADR row 225 replaces this with domain-owned cleanup capabilities before the package moves.
 - `handlers/quota` (dependency): the live quota counters call `domains/ec2/awsapi/{vpc,eip,volume}` describe adapters to count VPCs, subnets, addresses and volumes, as they did under `gateway/ec2`. ADR row 254 replaces these with reader capabilities once their final locations exist.
 - `domains/ec2/awsapi/instance` (dependency): imports `handlers/iam` (`IAMService` in `DescribeInstances.go`, `RunInstances.go` and `IamInstanceProfileAssociation.go`; `InstanceProfile` in the latter two), `runtime/compute/cache` (`NodeState`, `NodeUnknown`, `NodeLive`) and `runtime/compute/vm` (`VM`), both in `status_synthesis.go`. The IAM edge needs an IAM capability; the runtime edges are domain-to-runtime and need the instance record and node liveness exposed through an EC2-owned projection.