From 8c94a4e6134ddb980d86cd46645b8c186d4e5064 Mon Sep 17 00:00:00 2001 From: joshsiv-mulga Date: Wed, 7 Oct 2026 14:31:27 +1000 Subject: [PATCH] docs: record EC2 VPC networking action adapter moves --- docs/PACKAGE_BOUNDARY_MIGRATION.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/PACKAGE_BOUNDARY_MIGRATION.md b/docs/PACKAGE_BOUNDARY_MIGRATION.md index 879e9f339..003616fb6 100644 --- a/docs/PACKAGE_BOUNDARY_MIGRATION.md +++ b/docs/PACKAGE_BOUNDARY_MIGRATION.md @@ -274,6 +274,7 @@ while the branch is in flight; they do not describe the umbrella repository's | `918150758` | `cmd/installer/{autoinstall,branding,firstboot,install,netprobe,systemd,ui}` | `spinifex/operator/installer/` | Installation, UI and autoinstall logic is operator delivery behaviour; the seven packages were already libraries and keep their names, and `cmd/installer/main.go` stays the thin executable with its TTY detection, messages and exit codes unchanged. The installer's `systemd` package writes the installed system's bridge, firstboot, banner and getty units, which is distinct from `operator/host/systemd`'s Spinifex unit reconciliation, so the two are not merged. `scripts/diff-coverage.sh`'s UI exclusion and a `scripts/setup.sh` comment follow the new path; the Makefile still builds `cmd/installer/main.go`. Moving out of `cmd/` brought the code under gosec and errcheck for the first time. All 47 gosec findings are annotated per line with the artifact and why its mode is required: 0755 directories, executables and mount points, 0644 OS configuration, units, networkd files, fstab, GRUB assets and the public CA certificate, and 0444 machine-id, each stating that it contains no secret material; `spinifex-firstboot.sh` is annotated as never permitted to contain credentials or tokenised callback URLs, and the two G115 conversions are annotated as bounded Linux statfs and sysinfo values. The PSK-bearing WPA configuration was already written 0600 and the root password goes through `chpasswd`. The one errcheck finding, an unchecked `*syscall.Stat_t` assertion in the ownership check, is now a checked assertion returning a `verify` error instead of panicking. Installer tests and full preflight apart from the known vulnerability-scan finding passed. | | `05f390e61` | `cmd/spinifex/cmd` | `spinifex/operator/cli` | The `spx` command tree is operator CLI assembly; package `cmd` becomes `cli` and `cmd/spinifex/main.go` stays the thin entry point calling `cli.Execute()`. The `-X` version and commit ldflags in the Makefile and `build/Dockerfile.distro` follow the new import path, and a build using the Makefile `LDFLAGS` printed the injected version rather than `dev`. Template paths in `scripts/reset-dev-env.sh`, `migrate/VERSIONS.md` and the NATS role test follow the move. The listener-bind invariant globbed the old template path, found nothing and passed without examining any template; it now uses the new path and fails when the glob is empty, confirmed against the old path. Moving out of `cmd/` brought the tree under errcheck and gosec (105 findings uncapped). Config and flag wiring now goes through unexported `mustBindEnv`, `mustBindPFlag` and `mustMarkFlagRequired` helpers that panic with the config key, flag and command at startup instead of silently dropping a binding; all 110 sites are covered by the package's init and existing bind-function tests. Listing tables are written with `Srender` and a checked write because pterm's `Render` discards write errors; output is byte-identical and writing to a full device now exits 1. The formation-server shutdown discards are explicit, the `http.DefaultTransport` assertion is checked, twelve permission findings are annotated per line, and the formation join's `InsecureSkipVerify` is annotated as a known security gap (see dependency-rule debt). Full preflight apart from the known vulnerability-scan finding passed. | | `5032e24a7`, `d500e3802`, `e630703d7`, `eb68ec460`, `ebcafa01f` | `gateway/ec2/{account,capacityreservation,key,launchtemplate,placementgroup}` | `spinifex/domains/ec2/awsapi/` | EC2 action adapters are domain-owned AWS API surface, so they move under the EC2 domain's `awsapi`, one commit per resource. Each package takes its directory name and callers use `ec2api`; moved files change only their package line. `gateway/ec2.go` keeps the dispatch map unchanged as the transitional registration point. Callers are the gateway dispatch and account teardown's EC2 reapers. Adapter, gateway dispatch and account-teardown tests, the integration and E2E builds, and full preflight passed. | +| `c38bf99e4`, `2ee60b20f`, `eaa5c971e`, `f6d8060f2`, `f50687210`, `817e19bf2`, `67992c8f5` | `gateway/ec2/{zone,vpc,eigw,eip,igw,natgw,routetable}` | `spinifex/domains/ec2/awsapi/` | The VPC-networking action adapters follow the same per-resource pattern; `zone` moves first because the instance adapter depends on it. Moved files change only their package line (`vpc_test` for its external tests). Callers are the gateway dispatch, account teardown's EC2 reapers, the quota live counters and the not-yet-moved instance adapter. Adapter, gateway and account-teardown tests, the integration and E2E builds, and full preflight passed. | The EC2 contract row is intentionally different from the directory moves: it creates a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS @@ -361,6 +362,7 @@ These residuals were recorded by individual slices and must be resolved once the - `operator/cli` (dependency): the command tree still imports domain and service implementations directly (`handlers/{iam,eks,quota}`, `gateway`, `gateway/bedrock`, `daemon`, `vpcd`, `admin`, `accountteardown`, `migrate`, `services/viperblockd` and runtime roles). ADR row 231 requires command packages to reach domains through public capabilities; splitting supported use cases into `operator/*` packages is later work. - `gateway/ec2.go` (registration): the EC2 dispatch map stays a `GatewayConfig` method in `gateway` and imports every `domains/ec2/awsapi/*` package. ADR-0001 makes the domain own its action registration; moving the map waits on the generic ingress registration seam and must not be done as a package move. - `accountteardown` (dependency): its EC2 reapers call `domains/ec2/awsapi/*` action adapters directly, as they did under `gateway/ec2`. ADR row 225 replaces this with domain-owned cleanup capabilities before the package moves. +- `handlers/quota` (dependency): the live quota counters call `domains/ec2/awsapi/{vpc,eip}` describe adapters to count VPCs, subnets and addresses, as they did under `gateway/ec2`. ADR row 254 replaces these with reader capabilities once their final locations exist. - Merge-time follow-up in the umbrella repository: the `Makefile` `invariants-check` target, the `docs-pr.yml` clause cross-check, `.claude/hooks/architecture-traps.sh` and a `check-invariants.sh` comment hard-code `spinifex/spinifex/network/invariants`. They must change with the pointer bump that brings in this branch, or the docs-pr cross-check silently skips. Live specs and proposals citing `spinifex/network/` will report unresolved citations until updated. ## Recording rule