From cfc59f5004f142fb145c0061607016ca519f7060 Mon Sep 17 00:00:00 2001 From: joshsiv-mulga Date: Fri, 2 Oct 2026 09:55:28 +1000 Subject: [PATCH] docs: record acm domain relocation --- docs/PACKAGE_BOUNDARY_MIGRATION.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/docs/PACKAGE_BOUNDARY_MIGRATION.md b/docs/PACKAGE_BOUNDARY_MIGRATION.md index 4d207af6f..1c0d56f7f 100644 --- a/docs/PACKAGE_BOUNDARY_MIGRATION.md +++ b/docs/PACKAGE_BOUNDARY_MIGRATION.md @@ -218,6 +218,7 @@ while the branch is in flight; they do not describe the umbrella repository's | `40e7b14ad` | Gateway lifecycle-preview wrappers | `spinifex/domains/ecr/awsapi.LifecyclePreviewActionService` | StartLifecyclePolicyPreview and GetLifecyclePolicyPreview now dispatch through one composed policy-store-plus-image-catalog capability after generic authorization. Production reuses the registry's NATS metadata client; focused tests compose an in-memory metadata store. The obsolete wrappers are removed, and a missing composition fails closed rather than falling through to the raw action table. Focused domain, gateway, AWS-gateway and tagged integration validation passed. | | `54f96ad78` | Gateway CreateRepository, DescribeRepositories and DeleteRepository wrappers | `spinifex/domains/ecr/awsapi.RepositoryActionService` | Repository actions now dispatch through one composed metadata-store-plus-endpoint-profile capability after generic authorization. The individual action adapters depend on a narrow repository metadata contract rather than constructing NATS clients themselves. The three obsolete wrappers are removed, and a missing composition fails closed. Focused domain, gateway, AWS-gateway and tagged integration validation passed. | | `5ebbdcb53` | Gateway GetAuthorizationToken wrapper and endpoint adapter | `spinifex/domains/ecr/awsapi.AuthorizationTokenActionService` | GetAuthorizationToken now dispatches through a composed issuer-plus-endpoint capability after gateway constructs the canonical IAM/STS principal. The token subject remains gateway identity work; ECR retains credential response projection. The obsolete wrapper and endpoint adapter are removed, a missing action service fails closed, and an unavailable issuer retains the declared NotImplemented response. Focused domain, gateway, AWS-gateway and tagged integration validation passed. | +| `2b945ad88` | `spinifex/handlers/acm`, `spinifex/gateway/acm` | `spinifex/domains/acm`, `spinifex/domains/acm/awsapi` | ACM certificate state, issuance and renewal are ACM-domain ownership; its AWS JSON/NATS request adapters live beside them. All nine adapters, including the previously inlined RequestCertificate path, now use `domains/acm/awsapi`; generic gateway retains only routing, request context, policy gating and response writing. Focused domain, adapter and gateway request tests plus direct-caller and tagged integration compilation passed. | The EC2 contract row is intentionally different from the directory moves: it creates a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS @@ -257,6 +258,21 @@ capabilities. The remaining ECR-named gateway code is generic `/v2/*` route assembly, SigV4/registry authentication and policy enforcement; it remains in gateway rather than inverting those dependencies into the ECR domain. +### ACM relocation residuals + +The ACM move leaves two pre-existing dependency seams visible rather than +changing their behaviour in a structural slice: + +- `domains/acm.Store` still imports IAM's AES-GCM helper functions. It does + not read IAM records, but the crypto mechanism must move behind a shared + crypto boundary before the final domain-dependency lint can prohibit that + implementation import. +- `GatewayConfig` still owns the ACM action-name dispatch map. ACM owns the + action adapters and resource-scope derivation, while generic gateway owns + route handling, request context, policy gating and response writing. Moving + service registration itself needs the later ingress registration contract; + it is not hidden by a compatibility shim in this move. + ## Recording rule For every later slice, add the old and new path, source commit, focused