From 81c3f1402b4b2a598ff7520eb4291ec968dcfcbb Mon Sep 17 00:00:00 2001 From: joshsiv-mulga Date: Tue, 6 Oct 2026 14:26:38 +1000 Subject: [PATCH] docs: record base zone bootstrap move --- docs/PACKAGE_BOUNDARY_MIGRATION.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/PACKAGE_BOUNDARY_MIGRATION.md b/docs/PACKAGE_BOUNDARY_MIGRATION.md index af652ec01..01742dad1 100644 --- a/docs/PACKAGE_BOUNDARY_MIGRATION.md +++ b/docs/PACKAGE_BOUNDARY_MIGRATION.md @@ -249,6 +249,7 @@ while the branch is in flight; they do not describe the umbrella repository's | `4d86296eb` | `spinifex/handlers/systemvpc` | `spinifex/domains/network/systemvpc` | Managed system-VPC realisation is network ownership; ELBv2, EKS, RDS and Bedrock consume its builder. The package was renamed from `handlers_systemvpc` to its directory and callers dropped the alias; it depends only on foundation packages. Full preflight (excluding the pre-existing containerd advisory), focused system-VPC, daemon and managed-service suites and tagged integration/E2E compilation passed. | | `09de514ef` | `spinifex/handlers/imds` | `spinifex/domains/ec2/guestmetadata` | Guest metadata is a compute-domain interface served to guests on each node. The package was renamed from `handlers_imds` to its directory and its vpcd and E2E callers dropped the alias; five path comments were updated. The move exposes dependency-rule breaks it does not repair: imports of the DNS, EC2 instance, EC2 key, IAM and STS implementations, and the first domain-to-runtime edge (`runtime/compute/vm`); see Guest metadata relocation residuals. Full preflight (excluding the pre-existing containerd advisory), focused guest-metadata, vpcd and DNS suites and tagged integration/E2E compilation passed. | | `99278d5ff` | `spinifex/handlers/dns` | `spinifex/domains/dns` | DNS control semantics (zone records, resolver and name policy) are DNS-domain ownership, distinct from OVN and host-network realisation. The package name was already `dns`, so callers dropped the `handlers_dns` alias; the multinode E2E test that also imports `miekg/dns` uses `dnsdomain`. Six path comments were updated. The move exposes imports of `runtime/compute/vm`, `network/reconcile` and `bootstrap/config`, recorded in the dependency-rule debt. The `integration,segscanoracle` build fails identically on `origin/dev` (`predastoreS3Client` is in package `integration` but called from `integration_test`) and was not touched. Full preflight (excluding the pre-existing containerd advisory), focused DNS, ACM, guest-metadata, daemon, northstar, admin and CLI suites, `manifest-check` and tagged integration, E2E and E2E bench compilation passed. | +| `06b1eefd9` | `spinifex/runtime/roles/northstar` (`BootstrapBaseZone`) | `spinifex/domains/dns` | Seeding the base zone and its NS topology is DNS control-plane work, so it joins the DNS domain and the northstar role is left with process startup and reload only. Its tests moved with it and reuse the DNS package's identical `fakeS3` helper. The daemon flakes seen during verification (`TestRestoreInstances_ClusterRecordWinsForSharedInstance` under load; `TestKVIPSecBarrier_*` and `TestDrainVolumeRecordsItsPointAfterTheWork` under `-count=3`) reproduce identically on `origin/dev`. Full preflight (excluding the pre-existing containerd advisory), focused DNS, northstar and CLI suites and tagged integration/E2E compilation passed. | The EC2 contract row is intentionally different from the directory moves: it creates a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS @@ -318,7 +319,6 @@ These residuals were recorded by individual slices and must be resolved once the - Guest metadata: the cross-domain and runtime imports above. - `domains/dns`: imports `runtime/compute/vm` (domain-to-runtime), `network/reconcile` for the reconcile lock and `bootstrap/config` for node configuration. - ACM: the IAM AES-GCM helper import and gateway-owned action dispatch (ACM relocation residuals). -- `runtime/roles/northstar`: `BootstrapBaseZone` is DNS control-plane work that belongs to `domains/dns`. - `runtime/roles/awsgw`: the quota reconcile loop belongs to `domains/admission/quota`, and the EKS token-verify responder belongs with STS or EKS identity. - `utils`: `vpcd_event.go` (vpcd request/ack protocol and NAT helpers) awaits a network contract, `ec2_subject.go` awaits an EC2 contract, and `encryption.go` and `tagmirror.go` await the EC2/EBS slices. - `runtime/compute/cache.New`: two construction-time panics carry a lint exemption pending a constructor that returns an error.