diff --git a/.github/assets/architecture.svg b/.github/assets/architecture.svg
index 2cf76995a..74e56d38b 100644
--- a/.github/assets/architecture.svg
+++ b/.github/assets/architecture.svg
@@ -27,7 +27,7 @@
AWS GATEWAY
-spinifex/services/awsgw · TLS termination · SigV4 verification · IAM policy eval · NATS routing
+spinifex/runtime/roles/awsgw · TLS termination · SigV4 verification · IAM policy eval · NATS routing
TLS 1.3
diff --git a/.github/assets/design-architecture.svg b/.github/assets/design-architecture.svg
index d31972696..3b9c11500 100644
--- a/.github/assets/design-architecture.svg
+++ b/.github/assets/design-architecture.svg
@@ -51,7 +51,7 @@
AWS GATEWAY · port 9999
- spinifex/services/awsgw/awsgw.go
+ spinifex/runtime/roles/awsgw/awsgw.go
diff --git a/cmd/spinifex/cmd/service.go b/cmd/spinifex/cmd/service.go
index e839779e2..c2dcb0824 100644
--- a/cmd/spinifex/cmd/service.go
+++ b/cmd/spinifex/cmd/service.go
@@ -13,6 +13,7 @@ import (
"github.com/mulgadc/spinifex/spinifex/bootstrap/config"
handlers_dns "github.com/mulgadc/spinifex/spinifex/handlers/dns"
"github.com/mulgadc/spinifex/spinifex/network/external"
+ "github.com/mulgadc/spinifex/spinifex/runtime/roles/awsgw"
"github.com/mulgadc/spinifex/spinifex/runtime/roles/nats"
"github.com/mulgadc/spinifex/spinifex/runtime/roles/northstar"
"github.com/mulgadc/spinifex/spinifex/runtime/roles/predastore"
@@ -20,7 +21,6 @@ import (
"github.com/mulgadc/spinifex/spinifex/runtime/roles/qmpcollector"
"github.com/mulgadc/spinifex/spinifex/runtime/roles/spinifexui"
"github.com/mulgadc/spinifex/spinifex/runtime/service"
- "github.com/mulgadc/spinifex/spinifex/services/awsgw"
"github.com/mulgadc/spinifex/spinifex/services/viperblockd"
"github.com/mulgadc/spinifex/spinifex/vpcd"
"github.com/spf13/cobra"
diff --git a/docs/DESIGN.md b/docs/DESIGN.md
index cb8709597..07b3d63a6 100644
--- a/docs/DESIGN.md
+++ b/docs/DESIGN.md
@@ -27,7 +27,7 @@ The AWS SDK formats this as an HTTPS POST with:
### 2. AWS Gateway
-The gateway (`spinifex/services/awsgw/awsgw.go`) is the entry point:
+The gateway (`spinifex/runtime/roles/awsgw/awsgw.go`) is the entry point:
```go
// Connect to NATS (retries while the local broker comes up)
diff --git a/docs/service-interfaces.yaml b/docs/service-interfaces.yaml
index 12a5d174d..bcdab9cd2 100644
--- a/docs/service-interfaces.yaml
+++ b/docs/service-interfaces.yaml
@@ -23,7 +23,7 @@ version: 1
services:
awsgw:
- path: spinifex/services/awsgw
+ path: spinifex/runtime/roles/awsgw
# TLS frontend, SigV4 auth. Pure router: HTTP → NATS request/response.
# No subscribes; only publishes (via NATSRequest).
subscribes: []
diff --git a/spinifex/services/awsgw/awsgw.go b/spinifex/runtime/roles/awsgw/awsgw.go
similarity index 100%
rename from spinifex/services/awsgw/awsgw.go
rename to spinifex/runtime/roles/awsgw/awsgw.go
diff --git a/spinifex/services/awsgw/awsgw_bedrock_test.go b/spinifex/runtime/roles/awsgw/awsgw_bedrock_test.go
similarity index 100%
rename from spinifex/services/awsgw/awsgw_bedrock_test.go
rename to spinifex/runtime/roles/awsgw/awsgw_bedrock_test.go
diff --git a/spinifex/services/awsgw/awsgw_test.go b/spinifex/runtime/roles/awsgw/awsgw_test.go
similarity index 100%
rename from spinifex/services/awsgw/awsgw_test.go
rename to spinifex/runtime/roles/awsgw/awsgw_test.go
diff --git a/spinifex/services/awsgw/eks_token_verify.go b/spinifex/runtime/roles/awsgw/eks_token_verify.go
similarity index 100%
rename from spinifex/services/awsgw/eks_token_verify.go
rename to spinifex/runtime/roles/awsgw/eks_token_verify.go
diff --git a/spinifex/services/awsgw/eks_token_verify_test.go b/spinifex/runtime/roles/awsgw/eks_token_verify_test.go
similarity index 100%
rename from spinifex/services/awsgw/eks_token_verify_test.go
rename to spinifex/runtime/roles/awsgw/eks_token_verify_test.go
diff --git a/spinifex/services/awsgw/imds_absent_test.go b/spinifex/runtime/roles/awsgw/imds_absent_test.go
similarity index 100%
rename from spinifex/services/awsgw/imds_absent_test.go
rename to spinifex/runtime/roles/awsgw/imds_absent_test.go
diff --git a/spinifex/services/awsgw/lifecycle_accounts_test.go b/spinifex/runtime/roles/awsgw/lifecycle_accounts_test.go
similarity index 100%
rename from spinifex/services/awsgw/lifecycle_accounts_test.go
rename to spinifex/runtime/roles/awsgw/lifecycle_accounts_test.go
diff --git a/spinifex/services/awsgw/quota_reconcile_test.go b/spinifex/runtime/roles/awsgw/quota_reconcile_test.go
similarity index 100%
rename from spinifex/services/awsgw/quota_reconcile_test.go
rename to spinifex/runtime/roles/awsgw/quota_reconcile_test.go
diff --git a/spinifex/runtime/service/service.go b/spinifex/runtime/service/service.go
index 6b5082d0c..82fd32eeb 100644
--- a/spinifex/runtime/service/service.go
+++ b/spinifex/runtime/service/service.go
@@ -3,6 +3,7 @@ package service
import (
"fmt"
+ "github.com/mulgadc/spinifex/spinifex/runtime/roles/awsgw"
"github.com/mulgadc/spinifex/spinifex/runtime/roles/nats"
"github.com/mulgadc/spinifex/spinifex/runtime/roles/northstar"
"github.com/mulgadc/spinifex/spinifex/runtime/roles/predastore"
@@ -10,7 +11,6 @@ import (
"github.com/mulgadc/spinifex/spinifex/runtime/roles/qmpcollector"
"github.com/mulgadc/spinifex/spinifex/runtime/roles/spinifex"
"github.com/mulgadc/spinifex/spinifex/runtime/roles/spinifexui"
- "github.com/mulgadc/spinifex/spinifex/services/awsgw"
"github.com/mulgadc/spinifex/spinifex/services/viperblockd"
"github.com/mulgadc/spinifex/spinifex/vpcd"
)
diff --git a/tests/integration/harness.go b/tests/integration/harness.go
index c4963f6a6..e3431400f 100644
--- a/tests/integration/harness.go
+++ b/tests/integration/harness.go
@@ -154,7 +154,7 @@ func startGateway(t *testing.T, collector *conformanceCollector, opts ...Option)
// ECR auth bridge signing key: reuses the IAM master key to encrypt the
// signing key at rest in the same embedded JetStream KV, matching
- // production's awsgw-keys wiring (services/awsgw/awsgw.go).
+ // production's awsgw-keys wiring (runtime/roles/awsgw/awsgw.go).
signingKey, verifyKeys, err := ecrauth.LoadOrCreateSigningKey(t.Context(), js, masterKey)
require.NoError(t, err)