release: update go.mod for v0.4.2

build(deps): bump fast-xml-parser (#83 )
feat: migrate to golangci-lint (#82 )
2026-10-24 05:04:03 +00:00 · 2026-03-20 13:09:48 +10:00 · 2026-03-20 12:48:53 +11:00 · 2026-03-20 12:14:42 +11:00 · 2026-03-20 11:12:32 +10:00 · 2026-03-20 09:27:21 +10:00
618 changed files with 7265 additions and 7462 deletions
@@ -1,4 +1,4 @@
-name: Hive E2E Tests
+name: Spinifex E2E Tests

 on:
  push:
@@ -28,7 +28,7 @@ jobs:
      - name: Clean workspace
        run: rm -rf "$GITHUB_WORKSPACE"/*

-      - uses: actions/create-github-app-token@v2
+      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
          app-id: ${{ secrets.APP_ID }}
@@ -42,6 +42,10 @@ jobs:
          sparse-checkout: scripts/tofu-cluster
          path: mulga

+      - name: Clone and build
+        working-directory: mulga/scripts/tofu-cluster
+        run: ./build-artifacts.sh "${GIT_BRANCH}" "${RUNNER_TEMP}/spinifex-artifacts.tar"
+
      - name: Provision VM
        working-directory: mulga/scripts/tofu-cluster
        run: |
@@ -54,7 +58,10 @@ jobs:

      - name: Bootstrap Cluster
        working-directory: mulga/scripts/tofu-cluster
-        run: ./bootstrap.sh env3 >> "$TOFU_LOG" 2>&1
+        run: |
+          SPX_PREBUILT=true \
+          SPX_ARTIFACT_TAR="${RUNNER_TEMP}/spinifex-artifacts.tar" \
+          ./bootstrap.sh env3 >> "$TOFU_LOG" 2>&1

      - name: Run E2E Tests
        working-directory: mulga/scripts/tofu-cluster
@@ -64,7 +71,7 @@ jobs:
          SSH_KEY=$(echo "$INVENTORY" | jq -r '.ssh_key_path')
          SSH_KEY="${SSH_KEY/#\~/$HOME}"
          ssh -o StrictHostKeyChecking=no -i "$SSH_KEY" tf-user@${WAN_IP} \
-            'cd ~/Development/mulga/hive && ./tests/e2e/run-e2e.sh'
+            'cd ~/Development/mulga/spinifex && ./tests/e2e/run-e2e.sh'

      - name: Teardown
        if: always()
@@ -84,7 +91,7 @@ jobs:
      - name: Clean workspace
        run: rm -rf "$GITHUB_WORKSPACE"/*

-      - uses: actions/create-github-app-token@v2
+      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
          app-id: ${{ secrets.APP_ID }}
@@ -96,9 +103,12 @@ jobs:
          repository: mulgadc/mulga
          token: ${{ steps.app-token.outputs.token }}
          sparse-checkout: scripts/tofu-cluster
-
          path: mulga

+      - name: Clone and build
+        working-directory: mulga/scripts/tofu-cluster
+        run: ./build-artifacts.sh "${GIT_BRANCH}" "${RUNNER_TEMP}/spinifex-artifacts.tar"
+
      - name: Provision VM
        working-directory: mulga/scripts/tofu-cluster
        run: |
@@ -111,7 +121,10 @@ jobs:

      - name: Bootstrap Cluster
        working-directory: mulga/scripts/tofu-cluster
-        run: ./bootstrap.sh env4 >> "$TOFU_LOG" 2>&1
+        run: |
+          SPX_PREBUILT=true \
+          SPX_ARTIFACT_TAR="${RUNNER_TEMP}/spinifex-artifacts.tar" \
+          ./bootstrap.sh env4 >> "$TOFU_LOG" 2>&1

      - name: Run E2E Tests
        working-directory: mulga/scripts/tofu-cluster
@@ -121,7 +134,7 @@ jobs:
          SSH_KEY=$(echo "$INVENTORY" | jq -r '.ssh_key_path')
          SSH_KEY="${SSH_KEY/#\~/$HOME}"
          ssh -o StrictHostKeyChecking=no -i "$SSH_KEY" tf-user@${WAN_IP} \
-            'cd ~/Development/mulga/hive && ./tests/e2e/run-pseudo-multinode-e2e.sh'
+            'cd ~/Development/mulga/spinifex && ./tests/e2e/run-pseudo-multinode-e2e.sh'

      - name: Teardown
        if: always()
@@ -141,7 +154,7 @@ jobs:
      - name: Clean workspace
        run: rm -rf "$GITHUB_WORKSPACE"/*

-      - uses: actions/create-github-app-token@v2
+      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
          app-id: ${{ secrets.APP_ID }}
@@ -155,6 +168,10 @@ jobs:
          sparse-checkout: scripts/tofu-cluster
          path: mulga

+      - name: Clone and build
+        working-directory: mulga/scripts/tofu-cluster
+        run: ./build-artifacts.sh "${GIT_BRANCH}" "${RUNNER_TEMP}/spinifex-artifacts.tar"
+
      - name: Provision VMs
        working-directory: mulga/scripts/tofu-cluster
        run: |
@@ -167,7 +184,10 @@ jobs:

      - name: Bootstrap Cluster
        working-directory: mulga/scripts/tofu-cluster
-        run: ./bootstrap.sh env2 >> "$TOFU_LOG" 2>&1
+        run: |
+          SPX_PREBUILT=true \
+          SPX_ARTIFACT_TAR="${RUNNER_TEMP}/spinifex-artifacts.tar" \
+          ./bootstrap.sh env2 >> "$TOFU_LOG" 2>&1

      - name: Run E2E Tests
        working-directory: mulga/scripts/tofu-cluster
@@ -185,7 +205,7 @@ jobs:
          done

          ssh -o StrictHostKeyChecking=no -i "$SSH_KEY" tf-user@${NODE1_IP} \
-            "cd ~/Development/mulga/hive && ./tests/e2e/run-multinode-e2e.sh ${NODE_IPS}"
+            "cd ~/Development/mulga/spinifex && ./tests/e2e/run-multinode-e2e.sh ${NODE_IPS}"

      - name: Teardown
        if: always()
@@ -2,43 +2,203 @@ name: Release

 on:
  push:
-    tags: ['v*']
+    tags: ["v*"]

 permissions:
  contents: write

 jobs:
-  distro:
-    runs-on: ubuntu-latest
+  distro-amd64:
+    runs-on: ubuntu-24.04
    steps:
-      - uses: actions/checkout@v4
+      - name: Checkout Spinifex
+        uses: actions/checkout@v6
        with:
-          path: hive
+          path: spinifex

-      - uses: actions/checkout@v4
+      - name: Checkout Predastore
+        uses: actions/checkout@v6
        with:
          repository: mulgadc/predastore
          path: predastore

-      - uses: actions/checkout@v4
+      - name: Checkout Viperblock
+        uses: actions/checkout@v6
        with:
          repository: mulgadc/viperblock
          path: viperblock

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4

-      - name: Set up QEMU (for arm64 cross-build)
-        uses: docker/setup-qemu-action@v3
+      - name: Build amd64 Tarball
+        env:
+          VERSION: ${{ github.ref_name }}
+        run: cd spinifex && make distro-amd64 VERSION="$VERSION"

-      - name: Build distribution tarballs
-        run: cd hive && make distro VERSION=${{ github.ref_name }}
+      - name: Upload amd64 Artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: distro-amd64
+          path: |
+            spinifex/dist/spinifex-${{ github.ref_name }}-linux-amd64.tar.gz
+            spinifex/dist/spinifex-${{ github.ref_name }}-linux-amd64.tar.gz.sha256
+            spinifex/scripts/setup.sh

-      - name: Create GitHub Release
+  distro-arm64:
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - name: Checkout Spinifex
+        uses: actions/checkout@v6
+        with:
+          path: spinifex
+
+      - name: Checkout Predastore
+        uses: actions/checkout@v6
+        with:
+          repository: mulgadc/predastore
+          path: predastore
+
+      - name: Checkout Viperblock
+        uses: actions/checkout@v6
+        with:
+          repository: mulgadc/viperblock
+          path: viperblock
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build arm64 Tarball
+        env:
+          VERSION: ${{ github.ref_name }}
+        run: cd spinifex && make distro-arm64 VERSION="$VERSION"
+
+      - name: Upload arm64 Artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: distro-arm64
+          path: |
+            spinifex/dist/spinifex-${{ github.ref_name }}-linux-arm64.tar.gz
+            spinifex/dist/spinifex-${{ github.ref_name }}-linux-arm64.tar.gz.sha256
+
+  release:
+    needs: [distro-amd64, distro-arm64]
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Download amd64 Artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: distro-amd64
+          path: artifacts
+
+      - name: Download arm64 Artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: distro-arm64
+          path: artifacts
+
+      - name: Create Draft GitHub Release
        uses: softprops/action-gh-release@v2
        with:
+          draft: true
          files: |
-            hive/dist/*.tar.gz
-            hive/dist/*.sha256
-            hive/scripts/setup.sh
+            artifacts/**/*.tar.gz
+            artifacts/**/*.sha256
+            artifacts/**/setup.sh
          generate_release_notes: true
+
+      - name: Upload Tarball for Verify Job
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-assets
+          path: artifacts/
+
+  verify:
+    needs: release
+    runs-on: [self-hosted, ci-single]
+    timeout-minutes: 25
+    env:
+      TOFU_LOG: /tmp/release-verify-${{ github.run_id }}.log
+      TAG: ${{ github.ref_name }}
+      REPO: ${{ github.repository }}
+    steps:
+      - name: Clean Workspace
+        run: rm -rf "$GITHUB_WORKSPACE"/*
+
+      - uses: actions/create-github-app-token@v3
+        id: app-token
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          repositories: mulga
+
+      - uses: actions/checkout@v6
+        with:
+          repository: mulgadc/mulga
+          token: ${{ steps.app-token.outputs.token }}
+          sparse-checkout: scripts/tofu-cluster
+          path: mulga
+
+      - name: Download Release Assets
+        uses: actions/download-artifact@v4
+        with:
+          name: release-assets
+          path: release-assets
+
+      - name: Provision VM
+        working-directory: mulga/scripts/tofu-cluster
+        run: |
+          tofu init -input=false >> "$TOFU_LOG" 2>&1
+          tofu workspace select -or-create env3 >> "$TOFU_LOG" 2>&1
+          tofu destroy -var-file=envs/env3.tfvars -auto-approve -input=false >> "$TOFU_LOG" 2>&1 || true
+          ./scrub-env.sh env3 >> "$TOFU_LOG" 2>&1 || true
+          tofu apply -var-file=envs/env3.tfvars -auto-approve -input=false >> "$TOFU_LOG" 2>&1
+
+      - name: Bootstrap via Binary Install
+        working-directory: mulga/scripts/tofu-cluster
+        run: |
+          SETUP_SH=$(find "${GITHUB_WORKSPACE}/release-assets" -name "setup.sh" | head -1)
+          TARBALL=$(find "${GITHUB_WORKSPACE}/release-assets" -name "*-linux-amd64.tar.gz" | head -1)
+          ./bootstrap-install.sh env3 "$SETUP_SH" "$TARBALL"
+
+      - name: Run Smoke Test
+        working-directory: mulga/scripts/tofu-cluster
+        run: |
+          INVENTORY=$(tofu output -json inventory)
+          WAN_IP=$(echo "$INVENTORY" | jq -r '.nodes[0].wan_ip')
+          SSH_KEY=$(echo "$INVENTORY" | jq -r '.ssh_key_path')
+          SSH_KEY="${SSH_KEY/#\~/$HOME}"
+          scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR \
+            -i "$SSH_KEY" \
+            smoke-test-install.sh \
+            "tf-user@${WAN_IP}:/tmp/smoke-test.sh"
+          ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR \
+            -i "$SSH_KEY" "tf-user@${WAN_IP}" \
+            'bash /tmp/smoke-test.sh'
+
+      - name: Promote Release
+        if: success()
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release edit "$TAG" --repo "$REPO" --draft=false
+          echo "Release ${TAG} promoted to latest"
+
+      - name: Mark Release Failed
+        if: failure()
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          EXISTING_BODY=$(gh release view "$TAG" --repo "$REPO" --json body -q .body)
+          NOTES_FILE=$(mktemp)
+          printf 'Verification failed — see workflow run for details.\n\n%s' "$EXISTING_BODY" > "$NOTES_FILE"
+          gh release edit "$TAG" --repo "$REPO" --notes-file "$NOTES_FILE"
+          rm -f "$NOTES_FILE"
+
+      - name: Teardown
+        if: always()
+        working-directory: mulga/scripts/tofu-cluster
+        run: |
+          tofu workspace select -or-create env3 >> "$TOFU_LOG" 2>&1
+          tofu destroy -var-file=envs/env3.tfvars -auto-approve -input=false >> "$TOFU_LOG" 2>&1
+          ./scrub-env.sh env3 >> "$TOFU_LOG" 2>&1 || true
@@ -1,4 +1,4 @@
-name: Hive Build and Test
+name: Spinifex Build and Test

 on:
  push:
@@ -10,19 +10,19 @@ on:
      - go.mod
      - go.sum
      - Makefile
-      - .github/workflows/hive.yml
+      - .github/workflows/spinifex.yml
  workflow_dispatch:

 jobs:
  build_and_test:
-    name: Hive Build and Test
+    name: Spinifex Build and Test
    runs-on: ubuntu-24.04

    steps:
-      - name: Checkout Hive
+      - name: Checkout Spinifex
        uses: actions/checkout@v6
        with:
-          path: hive
+          path: spinifex
          fetch-depth: 2

      - name: Checkout Viperblock
@@ -40,30 +40,30 @@ jobs:
      - name: Setup Go
        uses: actions/setup-go@v6
        with:
-          cache-dependency-path: "hive/go.sum"
-          go-version-file: "hive/go.mod"
+          cache-dependency-path: "spinifex/go.sum"
+          go-version-file: "spinifex/go.mod"

      - name: Setup Go Workspace
-        run: go work init ./hive ./viperblock ./predastore
+        run: go work init ./spinifex ./viperblock ./predastore

-      - name: Build Hive
-        run: make -C hive build
+      - name: Build Spinifex
+        run: make -C spinifex build

      - name: Run Tests with Coverage
-        run: make -C hive test-cover
+        run: make -C spinifex test-cover

      - name: Check Diff Coverage
-        run: cd hive && scripts/diff-coverage.sh coverage.out --base HEAD~1
+        run: cd spinifex && scripts/diff-coverage.sh coverage.out --base HEAD~1

  race_detection:
-    name: Hive Race Detection
+    name: Spinifex Race Detection
    runs-on: ubuntu-24.04

    steps:
-      - name: Checkout Hive
+      - name: Checkout Spinifex
        uses: actions/checkout@v6
        with:
-          path: hive
+          path: spinifex

      - name: Checkout Viperblock
        uses: actions/checkout@v6
@@ -80,24 +80,24 @@ jobs:
      - name: Setup Go
        uses: actions/setup-go@v6
        with:
-          cache-dependency-path: "hive/go.sum"
-          go-version-file: "hive/go.mod"
+          cache-dependency-path: "spinifex/go.sum"
+          go-version-file: "spinifex/go.mod"

      - name: Setup Go Workspace
-        run: go work init ./hive ./viperblock ./predastore
+        run: go work init ./spinifex ./viperblock ./predastore

      - name: Run Tests with Race Detector
-        run: make -C hive test-race
+        run: make -C spinifex test-race

  lint_and_security:
-    name: Hive Lint and Security
+    name: Spinifex Lint and Security
    runs-on: ubuntu-24.04

    steps:
-      - name: Checkout Hive
+      - name: Checkout Spinifex
        uses: actions/checkout@v6
        with:
-          path: hive
+          path: spinifex

      - name: Checkout Viperblock
        uses: actions/checkout@v6
@@ -114,20 +114,17 @@ jobs:
      - name: Setup Go
        uses: actions/setup-go@v6
        with:
-          cache-dependency-path: "hive/go.sum"
-          go-version-file: "hive/go.mod"
+          cache-dependency-path: "spinifex/go.sum"
+          go-version-file: "spinifex/go.mod"

      - name: Setup Go Workspace
-        run: go work init ./hive ./viperblock ./predastore
+        run: go work init ./spinifex ./viperblock ./predastore

-      - name: Check Format
-        run: make -C hive check-format
+      - name: Lint
+        uses: golangci/golangci-lint-action@v7
+        with:
+          version: v2.11.3
+          working-directory: spinifex

-      - name: Check Modernize
-        run: make -C hive check-modernize
-
-      - name: Go Vet
-        run: make -C hive vet
-
-      - name: Security Checks
-        run: make -C hive security-check
+      - name: Govulncheck
+        run: make -C spinifex govulncheck
@@ -6,7 +6,7 @@ on:
      - main
      - dev
    paths:
-      - hive/services/hiveui/frontend/**
+      - spinifex/services/spinifexui/frontend/**
      - .github/workflows/ui.yml
  workflow_dispatch:

@@ -16,30 +16,30 @@ jobs:
    runs-on: ubuntu-24.04
    defaults:
      run:
-        working-directory: hive/services/hiveui/frontend
+        working-directory: spinifex/services/spinifexui/frontend

    steps:
      - name: Checkout Code
        uses: actions/checkout@v6
        with:
-          sparse-checkout: hive/services/hiveui/frontend
+          sparse-checkout: spinifex/services/spinifexui/frontend

      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v5
        with:
-          package_json_file: hive/services/hiveui/frontend/package.json
+          package_json_file: spinifex/services/spinifexui/frontend/package.json

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          cache: "pnpm"
-          cache-dependency-path: hive/services/hiveui/frontend/pnpm-lock.yaml
-          node-version-file: hive/services/hiveui/frontend/.nvmrc
+          cache-dependency-path: spinifex/services/spinifexui/frontend/pnpm-lock.yaml
+          node-version-file: spinifex/services/spinifexui/frontend/.nvmrc

      - name: Install Dependencies
        run: pnpm install --frozen-lockfile

-      - name: Run Biome Check
+      - name: Run Check
        run: pnpm check

      - name: Run Tests with Coverage
@@ -35,7 +35,6 @@ Thumbs.db
 docs/INTERNAL.md
 docs/PRIVATE.md
 docs/DEVNOTES.md
-docs/HIVE_DEVELOPMENT_PLAN.md
 docs/PLAN.md
 docs/TODO.md
 docs/development/
@@ -0,0 +1,128 @@
+version: "2"
+
+formatters:
+  enable:
+    - gofmt
+  settings:
+    gofmt:
+      simplify: false # modernize linter covers gofmt -s simplifications (Go 1.23+)
+
+linters:
+  enable:
+    - asasalint # catches pass []any as any in variadic func(...any)
+    - asciicheck # checks that code does not contain non-ASCII identifiers
+    - bidichk # checks for dangerous unicode bidi character sequences
+    - bodyclose # checks whether HTTP response body is closed successfully
+    - canonicalheader # checks whether net/http.Header uses canonical header keys
+    - decorder # checks declaration order of types, consts, vars, and funcs
+    - durationcheck # checks for two durations multiplied together
+    - embeddedstructfieldcheck # checks embedded sync.Mutex/RWMutex in structs
+    - errcheck # checks for unchecked errors in type assertions and I/O
+    - errchkjson # checks types passed to json encoding functions, flags omittable error checks
+    - errname # checks that sentinel errors are prefixed with Err, error types suffixed with Error
+    - exptostd # detects golang.org/x/exp/ functions replaceable by stdlib
+    - fatcontext # detects nested contexts in loops
+    - gocheckcompilerdirectives # validates go compiler directive comments (//go:)
+    - goprintffuncname # checks that printf-like functions are named with f at the end
+    - gosec # inspects source code for security problems
+    - govet # reports suspicious constructs (Printf alignment, shadow, etc.)
+    - ineffassign # detects assignments to existing variables that are not used
+    - makezero # finds slice declarations with non-zero initial length followed by append
+    - mirror # catches wrong mirror patterns in bytes/strings usage
+    - modernize # modernizes code to use newer Go idioms (go fix analyzers)
+    - nakedret # finds naked returns in functions
+    - nilerr # catches code that returns nil even after checking err != nil
+    - nilnesserr # catches returning a different nil error variable after err != nil check
+    - nolintlint # reports ill-formed or insufficient nolint directives
+    - predeclared # catches shadowing of Go builtins (len, cap, error, etc.)
+    - reassign # checks that package variables are not reassigned
+    - recvcheck # checks for receiver type consistency (pointer vs value)
+    - sloglint # enforces consistent log/slog usage (key-value pairs, no globals)
+    - staticcheck # extensive static analysis checks
+    - unconvert # removes unnecessary type conversions
+    - usestdlibvars # detects hardcoded values that should use stdlib constants
+    - usetesting # catches os.TempDir() etc. in tests — should use t.TempDir()
+    - wastedassign # finds assignments to variables that are never subsequently read
+    - whitespace # detects leading and trailing whitespace in functions
+
+  settings:
+    embeddedstructfieldcheck:
+      forbid-mutex: true
+
+    errcheck:
+      check-type-assertions: true
+      exclude-functions:
+        - (*github.com/nats-io/nats.go.Subscription).Unsubscribe # cleanup-only, errors not actionable
+        - (*github.com/kdomanski/iso9660.ImageWriter).Cleanup # deferred cleanup, errors not actionable
+
+    govet:
+      enable-all: true
+      disable:
+        - fieldalignment
+        - shadow # too noisy to retrofit — all 50 findings are err re-declarations
+        - unusedwrite # false positives on struct field assignments before marshal/send
+
+    staticcheck:
+      checks:
+        - all
+        - -ST1000 # package comment
+        - -ST1003 # naming conventions (Id→ID etc.) — too noisy to retrofit
+        - -ST1012 # error var naming — errname covers this + error type suffixes
+        - -ST1013 # HTTP status constants — usestdlibvars is broader
+        - -ST1016 # receiver name consistency (too noisy to retrofit)
+        - -ST1020 # godoc on exported types — not enforcing yet
+        - -ST1021 # godoc on exported type groups — not enforcing yet
+        - -ST1022 # godoc on exported vars/consts — not enforcing yet
+        - -SA1019 # deprecated usage (handle separately)
+        - -SA4006 # value overwritten — ineffassign + wastedassign cover this better
+        - -SA9005 # ineffective break (staticcheck false positives)
+
+    gosec:
+      excludes:
+        - G104 # unchecked errors — errcheck is stricter
+        - G116 # bidi chars — bidichk is more thorough
+        - G117 # use of net/http serve functions (we handle TLS separately)
+        - G703 # path traversal taint analysis — false positives on config file loading
+        - G705 # XSS taint analysis — false positives on internal error responses
+        - G706 # log injection taint analysis — false positives on structured slog usage
+
+    modernize:
+      disable:
+        - newexpr # don't replace aws.String() with new() — AWS SDK idiom
+        - stringsbuilder # don't replace small string concatenations with strings.Builder
+
+    nakedret:
+      max-func-lines: 0
+
+    nolintlint:
+      require-explanation: true
+      require-specific: true
+
+    reassign:
+      patterns:
+        - ".*"
+
+  exclusions:
+    presets:
+      - std-error-handling
+      - common-false-positives
+    rules:
+      - path: '_test\.go'
+        linters:
+          - bodyclose
+          - errcheck
+          - errchkjson
+          - gosec
+
+      # spinifex-specific: gosec exclusions
+      - path: "cmd/"
+        linters:
+          - errcheck # CLI glue code — viper/cobra/pterm errors not actionable
+          - gosec # matches current -exclude-dir=cmd
+
+      - text: "G204"
+        linters: [gosec] # subprocess execution — legitimate in VM orchestration
+      - text: "G304"
+        linters: [gosec] # file path from variable — necessary for config loading
+      - text: "G402"
+        linters: [gosec] # TLS config — we handle TLS ourselves
@@ -1,3 +1,3 @@
-# Hive Installation
+# Spinifex Installation

-For documentation on using and installing Hive see [https://docs.mulgadc.com](https://docs.mulgadc.com/)
+For documentation on using and installing Spinifex see [https://docs.mulgadc.com](https://docs.mulgadc.com/)
@@ -1,201 +1,661 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007

-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.

-   1. Definitions.
+                            Preamble

-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.

-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.

-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.

-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.

-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.

-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.

-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.

-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
+  The precise terms and conditions for copying, distribution and
+modification follow.

-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
+                       TERMS AND CONDITIONS

-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
+  0. Definitions.

-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
+  "This License" refers to version 3 of the GNU Affero General Public License.

-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.

-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.

-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.

-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
+  A "covered work" means either the unmodified Program or a work based
+on the Program.

-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.

-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.

-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.

-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
+  1. Source Code.

-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.

-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.

-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.

-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.

-   END OF TERMS AND CONDITIONS
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.

-   APPENDIX: How to apply the Apache License to your work.
+  The Corresponding Source for a work in source code form is that
+same work.

-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
+  2. Basic Permissions.

-   Copyright [yyyy] [name of copyright owner]
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.

-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.

-       http://www.apache.org/licenses/LICENSE-2.0
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.

-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published
+    by the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.
@@ -1,4 +1,4 @@
-GO_PROJECT_NAME := hive
+GO_PROJECT_NAME := spx
 SHELL := /bin/bash

 # Detect architecture for cross-platform support
@@ -36,12 +36,12 @@ endif
 # Quiet-mode filters (active when QUIET=1, set by preflight via recursive make)
 ifdef QUIET
  _Q     = @
-  _COVQ  = 2>&1 | grep -Ev '^\s*(ok|PASS|\?|=== RUN|--- PASS:)\s' | grep -v 'coverage: 0\.0%' || true
+  _COVQ  = 2>&1 | { grep -Ev '^\s*(ok|PASS|\?|=== RUN|--- PASS:)\s' | grep -v 'coverage: 0\.0%' || true; }; exit $${PIPESTATUS[0]}
  _RACEQ = 2>&1 | { grep -Ev '^\s*(ok|PASS|\?|=== RUN|--- PASS:)\s' || true; }; exit $${PIPESTATUS[0]}
  _SECQ  = >
 else
  _Q     =
-  _COVQ  = || true
+  _COVQ  =
  _RACEQ =
  _SECQ  = 2>&1 | tee
 endif
@@ -49,48 +49,46 @@ endif
 build:
 	$(MAKE) go_build

-# Build hive-ui frontend (requires pnpm)
+# Build spinifex-ui frontend (requires pnpm)
 build-ui:
-	@echo -e "\n....Building hive-ui frontend...."
-	cd hive/services/hiveui/frontend && pnpm build
+	@echo -e "\n....Building spinifex-ui frontend...."
+	cd spinifex/services/spinifexui/frontend && pnpm build

 # GO commands
 VERSION ?= $(shell git describe --tags --always --dirty)
 COMMIT  ?= $(shell git rev-parse --short HEAD)
-LDFLAGS := -s -w -X github.com/mulgadc/hive/cmd/hive/cmd.Version=$(VERSION) -X github.com/mulgadc/hive/cmd/hive/cmd.Commit=$(COMMIT)
+LDFLAGS := -s -w -X github.com/mulgadc/spinifex/cmd/spinifex/cmd.Version=$(VERSION) -X github.com/mulgadc/spinifex/cmd/spinifex/cmd.Commit=$(COMMIT)

 go_build:
 	@echo -e "\n....Building $(GO_PROJECT_NAME)"
-	go build $(GO_BUILD_MOD) -ldflags "$(LDFLAGS)" -o ./bin/$(GO_PROJECT_NAME) cmd/hive/main.go
+	go build $(GO_BUILD_MOD) -ldflags "$(LDFLAGS)" -o ./bin/$(GO_PROJECT_NAME) cmd/spinifex/main.go

 go_run:
 	@echo -e "\n....Running $(GO_PROJECT_NAME)...."
 	$(GOPATH)/bin/$(GO_PROJECT_NAME)

-# Preflight — runs the same checks as GitHub Actions (format + lint + security + tests).
+# Preflight — runs the same checks as GitHub Actions (lint + vuln + tests).
 # Use this before committing to catch CI failures locally.
 preflight:
-	@$(MAKE) --no-print-directory QUIET=1 check-format check-modernize vet security-check test-cover diff-coverage test-race
+	@$(MAKE) --no-print-directory QUIET=1 lint govulncheck test-cover diff-coverage test-race
 	@echo -e "\n ✅ Preflight passed — safe to commit."

 # Run unit tests
 test:
 	@echo -e "\n....Running tests for $(GO_PROJECT_NAME)...."
-	LOG_IGNORE=1 go test -timeout 120s ./hive/...
+	LOG_IGNORE=1 go test -timeout 120s ./spinifex/...

 # Run unit tests with coverage profile
-# Note: go test may exit non-zero due to Go version mismatch in coverage instrumentation
-# for packages without test files. We check actual test results + coverage threshold instead.
 COVERPROFILE ?= coverage.out
 test-cover:
 	@echo -e "\n....Running tests with coverage for $(GO_PROJECT_NAME)...."
-	$(_Q)LOG_IGNORE=1 go test -timeout 120s -coverprofile=$(COVERPROFILE) -covermode=atomic ./hive/... $(_COVQ)
+	$(_Q)LOG_IGNORE=1 go test -timeout 120s -coverprofile=$(COVERPROFILE) -covermode=atomic ./spinifex/... $(_COVQ)
 	@scripts/check-coverage.sh $(COVERPROFILE) $(QUIET)

 # Run unit tests with race detector
 test-race:
 	@echo -e "\n....Running tests with race detector for $(GO_PROJECT_NAME)...."
-	$(_Q)LOG_IGNORE=1 go test -race -timeout 300s ./hive/... $(_RACEQ)
+	$(_Q)LOG_IGNORE=1 go test -race -timeout 300s ./spinifex/... $(_RACEQ)

 # Check that new/changed code meets coverage threshold (runs tests first)
 diff-coverage: test-cover
@@ -107,12 +105,14 @@ run:

 clean:
 	rm -f ./bin/$(GO_PROJECT_NAME)
-	rm -rf hive/services/hiveui/frontend/dist
+	rm -rf spinifex/services/spinifexui/frontend/dist

 install-system:
 	@echo -e "\n....Installing system dependencies for $(ARCH)...."
 	@echo "QEMU packages: $(QEMU_PACKAGES)"
-	apt-get update && sudo apt-get install -y \
+	sudo apt-get update && sudo DEBIAN_FRONTEND=noninteractive apt-get install -y \
+		-o Dpkg::Options::="--force-confdef" \
+		-o Dpkg::Options::="--force-confold" \
 		nbdkit nbdkit-plugin-dev pkg-config $(QEMU_PACKAGES) qemu-utils qemu-kvm \
 		libvirt-daemon-system libvirt-clients libvirt-dev make gcc jq curl \
 		iproute2 netcat-openbsd openssh-client wget git unzip sudo xz-utils file \
@@ -143,92 +143,58 @@ quickinstall: install-system install-go install-aws
 	@echo "   Please ensure /usr/local/go/bin is in your PATH."
 	@echo "   Installed: Go ($(GO_ARCH)), AWS CLI ($(AWS_ARCH)), QEMU ($(QEMU_PACKAGES))"

-# Format all Go files in place
-format:
-	gofmt -w .
+# Lint all Go code via golangci-lint (replaces check-format, vet, gosec, staticcheck)
+lint:
+	@echo "Running golangci-lint..."
+	$(_Q)golangci-lint run ./...
+	@echo "  golangci-lint ok"

-# Check that all Go files are formatted (CI-compatible, fails on diff)
-check-format:
-	@echo "Checking gofmt..."
-	@UNFORMATTED=$$(gofmt -l .); \
-	if [ -n "$$UNFORMATTED" ]; then \
-		echo "Files not formatted:"; \
-		echo "$$UNFORMATTED"; \
-		echo "Run 'make format' to fix."; \
-		exit 1; \
-	fi
-	@echo "  gofmt ok"
+# Auto-fix all linter issues that have fixers
+fix:
+	golangci-lint run --fix ./...

-# Go vet (fails on issues, matches CI)
-vet:
-	@echo "Running go vet..."
-	$(_Q)go vet ./...
-	@echo "  go vet ok"
-
-# Excluded: newexpr (replaces aws.String with new, not idiomatic for AWS SDK)
-# Excluded: stringsbuilder (replaces string += in loops with strings.Builder, not worth the complexity for small loops)
-GOFIX_EXCLUDE := -newexpr=false -stringsbuilder=false
-
-# Apply go fix modernizations
-modernize:
-	@echo "Applying go fix modernizations..."
-	go fix $(GOFIX_EXCLUDE) ./...
-	@echo "  go fix applied"
-
-# Check that code is modernized (CI-compatible, fails on diff)
-check-modernize:
-	@echo "Checking go fix modernizations..."
-	@DIFF=$$(go fix $(GOFIX_EXCLUDE) -diff ./...); \
-	if [ -n "$$DIFF" ]; then \
-		echo "$$DIFF"; \
-		echo "Run 'make modernize' to fix."; \
-		exit 1; \
-	fi
-	@echo "  go fix ok"
-
-# Security checks — each tool fails the build on findings (matches CI).
-# Reports are also saved to tests/ for review.
-security-check:
-	@echo -e "\n....Running security checks for $(GO_PROJECT_NAME)...."
-	$(_Q)set -o pipefail && go tool govulncheck ./... $(_SECQ) tests/govulncheck-report.txt $(if $(QUIET),|| { cat tests/govulncheck-report.txt; exit 1; })
+# Govulncheck — dependency vulnerability scanning (not covered by golangci-lint)
+govulncheck:
+	@echo "Running govulncheck..."
+	$(_Q)go tool govulncheck ./...
 	@echo "  govulncheck ok"
-	$(_Q)set -o pipefail && go tool gosec -quiet -exclude=G204,G304,G402,G117,G703,G705,G706 -exclude-generated -exclude-dir=cmd ./... $(_SECQ) tests/gosec-report.txt $(if $(QUIET),|| { cat tests/gosec-report.txt; exit 1; })
-	@echo "  gosec ok"
-	$(_Q)set -o pipefail && go tool staticcheck -checks="all,-ST1000,-ST1003,-ST1016,-ST1020,-ST1021,-ST1022,-SA1019,-SA9005" ./... $(_SECQ) tests/staticcheck-report.txt $(if $(QUIET),|| { cat tests/staticcheck-report.txt; exit 1; })
-	@echo "  staticcheck ok"

-# Build release tarballs for both architectures via Docker
-distro:
-	@echo "Building hive $(VERSION) distribution tarballs..."
-	@mkdir -p dist/
-	@echo "Building linux/amd64..."
-	docker buildx build \
-		--platform linux/amd64 \
-		--build-arg VERSION=$(VERSION) \
-		-f build/Dockerfile.distro \
-		--output type=local,dest=dist/amd64/ \
-		../
-	tar -czf dist/hive-$(VERSION)-linux-amd64.tar.gz -C dist/amd64 .
-	sha256sum dist/hive-$(VERSION)-linux-amd64.tar.gz > dist/hive-$(VERSION)-linux-amd64.tar.gz.sha256
-	@echo "Building linux/arm64..."
-	docker buildx build \
-		--platform linux/arm64 \
-		--build-arg VERSION=$(VERSION) \
-		-f build/Dockerfile.distro \
-		--output type=local,dest=dist/arm64/ \
-		../
-	tar -czf dist/hive-$(VERSION)-linux-arm64.tar.gz -C dist/arm64 .
-	sha256sum dist/hive-$(VERSION)-linux-arm64.tar.gz > dist/hive-$(VERSION)-linux-arm64.tar.gz.sha256
+# Build release tarballs — use distro-ARCH for single arch, distro for both
+distro: distro-amd64 distro-arm64
 	@echo ""
 	@echo "Distribution tarballs:"
 	@ls -lh dist/*.tar.gz
 	@echo ""
 	@cat dist/*.sha256

+distro-amd64:
+	@echo "Building spinifex $(VERSION) linux/amd64..."
+	@mkdir -p dist/
+	docker buildx build \
+		--platform linux/amd64 \
+		--build-arg VERSION=$(VERSION) \
+		-f build/Dockerfile.distro \
+		--output type=local,dest=dist/amd64/ \
+		../
+	tar -czf dist/spinifex-$(VERSION)-linux-amd64.tar.gz -C dist/amd64 .
+	sha256sum dist/spinifex-$(VERSION)-linux-amd64.tar.gz > dist/spinifex-$(VERSION)-linux-amd64.tar.gz.sha256
+
+distro-arm64:
+	@echo "Building spinifex $(VERSION) linux/arm64..."
+	@mkdir -p dist/
+	docker buildx build \
+		--platform linux/arm64 \
+		--build-arg VERSION=$(VERSION) \
+		-f build/Dockerfile.distro \
+		--output type=local,dest=dist/arm64/ \
+		../
+	tar -czf dist/spinifex-$(VERSION)-linux-arm64.tar.gz -C dist/arm64 .
+	sha256sum dist/spinifex-$(VERSION)-linux-arm64.tar.gz > dist/spinifex-$(VERSION)-linux-arm64.tar.gz.sha256
+
 distro-clean:
 	rm -rf dist/

 .PHONY: build build-ui go_build go_run preflight test test-cover test-race diff-coverage bench run clean \
 	install-system install-go install-aws quickinstall \
-	format check-format modernize check-modernize vet security-check \
-	distro distro-clean
+	lint fix govulncheck \
+	distro distro-amd64 distro-arm64 distro-clean
@@ -1,10 +1,10 @@
-# Hive: An Open Source AWS-Compatible Stack for Bare-Metal, Edge, and On-Prem Deployments
+# Spinifex: An Open Source AWS-Compatible Stack for Bare-Metal, Edge, and On-Prem Deployments

-(Developer Preview) - Hive developed by [Mulga Defense Corporation](https://mulgadc.com/) is an open source infrastructure platform that brings the core services of AWS—like EC2, VPC, EBS, and S3—to environments where running in the cloud isn't an option. Whether you're deploying to edge sites, private data-centers, or need to operate in low-connectivity or highly contested environments, Hive gives you AWS-style workflows on your own hardware.
+(Developer Preview) - Spinifex developed by [Mulga Defense Corporation](https://mulgadc.com/) is an open source infrastructure platform that brings the core services of AWS—like EC2, VPC, EBS, and S3—to environments where running in the cloud isn't an option. Whether you're deploying to edge sites, private data-centers, or need to operate in low-connectivity or highly contested environments, Spinifex gives you AWS-style workflows on your own hardware.

-## What is Hive?
+## What is Spinifex?

-Hive replicates essential AWS primitives—virtual machines, block volumes, and object storage—using lightweight, self-contained components that are easy to deploy and integrate.
+Spinifex replicates essential AWS primitives—virtual machines, block volumes, and object storage—using lightweight, self-contained components that are easy to deploy and integrate.

 It’s designed for developers and operators who need:

@@ -13,13 +13,13 @@ It’s designed for developers and operators who need:
 - Drop-in compatibility with tools like the AWS CLI, SDKs, and Terraform
 - A secure cloud environment you control and own the entire hardware, network and software stack

-You can run Hive on a few servers in a rack, a field site, or anywhere centralized cloud services aren’t feasible.
+You can run Spinifex on a few servers in a rack, a field site, or anywhere centralized cloud services aren’t feasible.

 ## Core Components

-### Hive (Compute Service – EC2 Alternative)
+### Spinifex (Compute Service – EC2 Alternative)

-Hive is a minimal VM orchestration layer built on top of QEMU, exposing APIs similar to EC2. It manages lifecycle operations like start, stop, and terminate, using QEMU’s QMP interface. Designed to be straightforward and scriptable, Hive lets you launch VMs using the AWS CLI, SDKs, or Terraform—without needing Kubernetes or heavyweight orchestrators. Keep in mind, you can also setup a Kubernetes environment using Hive with underlying instances.
+Spinifex is a minimal VM orchestration layer built on top of QEMU, exposing APIs similar to EC2. It manages lifecycle operations like start, stop, and terminate, using QEMU’s QMP interface. Designed to be straightforward and scriptable, Spinifex lets you launch VMs using the AWS CLI, SDKs, or Terraform—without needing Kubernetes or heavyweight orchestrators. Keep in mind, you can also setup a Kubernetes environment using Spinifex with underlying instances.

 - EC2-like VM management on bare metal
 - Launches with cloud-init metadata support
@@ -54,21 +54,21 @@ AWS-Compatible Interfaces – Provision infrastructure with awscli, Terraform, o

 ## Installation

-Installation requires an Ubuntu / Debian system. See the detailed documentation at [https://docs.mulgadc.com](https://docs.mulgadc.com/) for maintaining and installing Hive.
+Installation requires an Ubuntu / Debian system. See the detailed documentation at [https://docs.mulgadc.com](https://docs.mulgadc.com/) for maintaining and installing Spinifex.

 ### Single node install

 The installation is straightforward to set up and running on a single node for testing purposes.

 ```bash
-export AWS_PROFILE=hive
+export AWS_PROFILE=spinifex
 export AWS_REGION=ap-southeast-2-sc
 ```

 ```bash
 curl https://install.mulgadc.com/ | bash

-hive admin init --region $AWS_REGION
+spx admin init --region $AWS_REGION

 aws ec2 describe-instance-types
 ```
@@ -79,7 +79,7 @@ For a complete development environment see the [Source Install](https://docs.mul

 ### Component Repositories

-Hive coordinates these independent components:
+Spinifex coordinates these independent components:

 - **[Predastore](https://github.com/mulgadc/predastore)** - S3-compatible object storage
 - **[Viperblock](https://github.com/mulgadc/viperblock)** - EBS-compatible block storage
@@ -90,7 +90,7 @@ Each component can be developed independently. See component-specific documentat

 ### Built by Engineers, For Engineers

-Hive is developed by experienced infrastructure engineers with deep AWS expertise, including former AWS team members who understand the intricacies of building production-grade cloud services. Our team brings decades of combined experience from AWS, enterprise infrastructure, and edge computing environments.
+Spinifex is developed by experienced infrastructure engineers with deep AWS expertise, including former AWS team members who understand the intricacies of building production-grade cloud services. Our team brings decades of combined experience from AWS, enterprise infrastructure, and edge computing environments.

 **Real-World Experience:**

@@ -101,7 +101,7 @@ Hive is developed by experienced infrastructure engineers with deep AWS expertis

 ### AI-Assisted Development

-While Hive is architected and implemented by experienced engineers, we leverage **Claude Code** (Anthropic's AI coding assistant) to accelerate certain development tasks. This approach combines human expertise with AI efficiency:
+While Spinifex is architected and implemented by experienced engineers, we leverage **Claude Code** (Anthropic's AI coding assistant) to accelerate certain development tasks. This approach combines human expertise with AI efficiency:

 **How We Use Claude Code:**

@@ -117,8 +117,8 @@ While Hive is architected and implemented by experienced engineers, we leverage
 - **Performance Optimization**: Real-world performance tuning and benchmarking
 - **Production Operations**: Deployment strategies and operational procedures

-This hybrid approach ensures Hive benefits from both proven engineering expertise and modern development acceleration, while maintaining the quality and reliability standards required for production infrastructure.
+This hybrid approach ensures Spinifex benefits from both proven engineering expertise and modern development acceleration, while maintaining the quality and reliability standards required for production infrastructure.

 ## License

-Hive is open source under the Apache 2.0 License. You're free to use, modify, and deploy it—anywhere you need reliable infrastructure without depending on centralized cloud platforms.
+Spinifex is open source under the Apache 2.0 License. You're free to use, modify, and deploy it—anywhere you need reliable infrastructure without depending on centralized cloud platforms.
@@ -11,38 +11,38 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 WORKDIR /build

 # Copy module files for dependency caching
-COPY hive/go.mod hive/go.sum ./hive/
+COPY spinifex/go.mod spinifex/go.sum ./spinifex/
 COPY predastore/go.mod predastore/go.sum ./predastore/
 COPY viperblock/go.mod viperblock/go.sum ./viperblock/
 COPY viperblock/nbd/go.mod viperblock/nbd/go.sum ./viperblock/nbd/
 COPY viperblock/nbd/libguestfs.org/nbdkit/go.mod ./viperblock/nbd/libguestfs.org/nbdkit/

 # Generate go.work (gitignored, so not in checkout)
-RUN cd hive && go work init . ../predastore ../viperblock ../viperblock/nbd ../viperblock/nbd/libguestfs.org/nbdkit
+RUN cd spinifex && go work init . ../predastore ../viperblock ../viperblock/nbd ../viperblock/nbd/libguestfs.org/nbdkit

 # Download dependencies (cached layer)
-RUN cd hive && go mod download
+RUN cd spinifex && go mod download

 # Copy full source
-COPY hive/ ./hive/
+COPY spinifex/ ./spinifex/
 COPY predastore/ ./predastore/
 COPY viperblock/ ./viperblock/

-# Build hive binary
-RUN COMMIT=$(cd hive && git rev-parse --short HEAD 2>/dev/null || echo "unknown") && \
-    cd hive && go build -ldflags "-s -w \
-    -X github.com/mulgadc/hive/cmd/hive/cmd.Version=${VERSION} \
-    -X github.com/mulgadc/hive/cmd/hive/cmd.Commit=${COMMIT}" \
-    -o /out/hive cmd/hive/main.go
+# Build spinifex binary (spx)
+RUN COMMIT=$(cd spinifex && git rev-parse --short HEAD 2>/dev/null || echo "unknown") && \
+    cd spinifex && go build -ldflags "-s -w \
+    -X github.com/mulgadc/spinifex/cmd/spinifex/cmd.Version=${VERSION} \
+    -X github.com/mulgadc/spinifex/cmd/spinifex/cmd.Commit=${COMMIT}" \
+    -o /out/spx cmd/spinifex/main.go

 # Build nbdkit viperblock plugin (.so)
 RUN cd viperblock && go build -o /out/nbdkit-viperblock-plugin.so -buildmode=c-shared nbd/viperblock.go

 # Copy setup scripts and systemd units
-RUN cp hive/scripts/setup.sh /out/setup.sh 2>/dev/null || true
-RUN cp hive/scripts/setup-ovn.sh /out/setup-ovn.sh
-RUN mkdir -p /out/systemd && cp hive/build/systemd/* /out/systemd/
-RUN cp hive/build/logrotate/hive /out/logrotate-hive
+RUN cp spinifex/scripts/setup.sh /out/setup.sh 2>/dev/null || true
+RUN cp spinifex/scripts/setup-ovn.sh /out/setup-ovn.sh
+RUN mkdir -p /out/systemd && cp spinifex/build/systemd/* /out/systemd/
+RUN cp spinifex/build/logrotate/spinifex /out/logrotate-spinifex

 FROM scratch AS export
 COPY --from=builder /out/ /
@@ -1,4 +1,4 @@
-/var/log/hive/*.log {
+/var/log/spinifex/*.log {
    daily
    rotate 14
    compress
@@ -1,22 +0,0 @@
-[Unit]
-Description=Hive AWS Gateway
-PartOf=hive.target
-After=hive-nats.service hive-daemon.service
-Requires=hive-nats.service
-
-[Service]
-Type=simple
-User=hive
-Group=hive
-ExecStartPre=/bin/sh -c 'for i in $(seq 1 30); do nc -z 127.0.0.1 4222 && exit 0; sleep 1; done; exit 1'
-ExecStart=/usr/local/bin/hive service awsgw start
-Restart=on-failure
-RestartSec=5
-OOMScoreAdjust=-500
-Environment=HIVE_CONFIG_PATH=/etc/hive/hive.toml
-Environment=HIVE_BASE_DIR=/var/lib/hive/
-Environment=HIVE_AWSGW_TLS_CERT=/etc/hive/server.pem
-Environment=HIVE_AWSGW_TLS_KEY=/etc/hive/server.key
-
-[Install]
-WantedBy=hive.target
@@ -1,21 +0,0 @@
-[Unit]
-Description=Hive Daemon (VM Orchestration)
-PartOf=hive.target
-After=hive-nats.service hive-viperblock.service
-Requires=hive-nats.service
-
-[Service]
-Type=simple
-User=hive
-Group=hive
-ExecStartPre=/bin/sh -c 'for i in $(seq 1 30); do nc -z 127.0.0.1 4222 && exit 0; sleep 1; done; exit 1'
-ExecStart=/usr/local/bin/hive service hive start
-Restart=on-failure
-RestartSec=5
-OOMScoreAdjust=-500
-Environment=HIVE_CONFIG_PATH=/etc/hive/hive.toml
-Environment=HIVE_BASE_DIR=/var/lib/hive/hive/
-Environment=HIVE_WAL_DIR=/var/lib/hive/hive/
-
-[Install]
-WantedBy=hive.target
@@ -1,17 +0,0 @@
-[Unit]
-Description=Hive NATS Message Bus
-PartOf=hive.target
-Before=hive-predastore.service hive-daemon.service hive-awsgw.service hive-vpcd.service
-
-[Service]
-Type=simple
-User=hive
-Group=hive
-ExecStart=/usr/local/bin/hive service nats start
-Restart=on-failure
-RestartSec=5
-OOMScoreAdjust=-500
-Environment=HIVE_CONFIG_PATH=/etc/hive/nats/nats.conf
-
-[Install]
-WantedBy=hive.target
@@ -1,22 +0,0 @@
-[Unit]
-Description=Hive Predastore (S3-compatible Object Storage)
-PartOf=hive.target
-After=hive-nats.service
-Requires=hive-nats.service
-
-[Service]
-Type=simple
-User=hive
-Group=hive
-ExecStartPre=/bin/sh -c 'for i in $(seq 1 30); do nc -z 127.0.0.1 4222 && exit 0; sleep 1; done; exit 1'
-ExecStart=/usr/local/bin/hive service predastore start
-Restart=on-failure
-RestartSec=5
-OOMScoreAdjust=-500
-Environment=HIVE_PREDASTORE_CONFIG_PATH=/etc/hive/predastore/predastore.toml
-Environment=HIVE_PREDASTORE_BASE_PATH=/var/lib/hive/predastore/
-Environment=HIVE_PREDASTORE_TLS_CERT=/etc/hive/server.pem
-Environment=HIVE_PREDASTORE_TLS_KEY=/etc/hive/server.key
-
-[Install]
-WantedBy=hive.target
@@ -1,16 +0,0 @@
-[Unit]
-Description=Hive Web UI
-PartOf=hive.target
-After=hive-awsgw.service
-
-[Service]
-Type=simple
-User=hive
-Group=hive
-ExecStart=/usr/local/bin/hive service hive-ui start
-Restart=on-failure
-RestartSec=5
-OOMScoreAdjust=-500
-
-[Install]
-WantedBy=hive.target
@@ -1,21 +0,0 @@
-[Unit]
-Description=Hive Viperblock (Block Storage)
-PartOf=hive.target
-After=hive-nats.service hive-predastore.service
-Requires=hive-nats.service
-
-[Service]
-Type=simple
-User=hive
-Group=hive
-ExecStartPre=/bin/sh -c 'for i in $(seq 1 30); do nc -z 127.0.0.1 4222 && exit 0; sleep 1; done; exit 1'
-ExecStart=/usr/local/bin/hive service viperblock start
-Restart=on-failure
-RestartSec=5
-OOMScoreAdjust=-500
-EnvironmentFile=/etc/hive/systemd.env
-Environment=HIVE_CONFIG_PATH=/etc/hive/hive.toml
-Environment=HIVE_BASE_DIR=/var/lib/hive/viperblock/
-
-[Install]
-WantedBy=hive.target
@@ -1,19 +0,0 @@
-[Unit]
-Description=Hive VPC Daemon (OVN Networking)
-PartOf=hive.target
-After=hive-nats.service hive-daemon.service
-Requires=hive-nats.service
-
-[Service]
-Type=simple
-User=hive
-Group=hive
-ExecStartPre=/bin/sh -c 'for i in $(seq 1 30); do nc -z 127.0.0.1 4222 && exit 0; sleep 1; done; exit 1'
-ExecStart=/usr/local/bin/hive service vpcd start
-Restart=on-failure
-RestartSec=5
-OOMScoreAdjust=-500
-Environment=HIVE_CONFIG_PATH=/etc/hive/hive.toml
-
-[Install]
-WantedBy=hive.target
@@ -1,8 +0,0 @@
-[Unit]
-Description=Hive Infrastructure Platform
-After=network-online.target
-Wants=network-online.target
-Wants=hive-nats.service hive-predastore.service hive-viperblock.service hive-daemon.service hive-awsgw.service hive-vpcd.service hive-ui.service
-
-[Install]
-WantedBy=multi-user.target
@@ -0,0 +1,22 @@
+[Unit]
+Description=Spinifex AWS Gateway
+PartOf=spinifex.target
+After=spinifex-nats.service spinifex-daemon.service
+Requires=spinifex-nats.service
+
+[Service]
+Type=simple
+User=spinifex
+Group=spinifex
+ExecStartPre=/bin/sh -c 'for i in $(seq 1 30); do nc -z 127.0.0.1 4222 && exit 0; sleep 1; done; exit 1'
+ExecStart=/usr/local/bin/spx service awsgw start
+Restart=on-failure
+RestartSec=5
+OOMScoreAdjust=-500
+Environment=SPINIFEX_CONFIG_PATH=/etc/spinifex/spinifex.toml
+Environment=SPINIFEX_BASE_DIR=/var/lib/spinifex/
+Environment=SPINIFEX_AWSGW_TLS_CERT=/etc/spinifex/server.pem
+Environment=SPINIFEX_AWSGW_TLS_KEY=/etc/spinifex/server.key
+
+[Install]
+WantedBy=spinifex.target
@@ -0,0 +1,21 @@
+[Unit]
+Description=Spinifex Daemon (VM Orchestration)
+PartOf=spinifex.target
+After=spinifex-nats.service spinifex-viperblock.service
+Requires=spinifex-nats.service
+
+[Service]
+Type=simple
+User=spinifex
+Group=spinifex
+ExecStartPre=/bin/sh -c 'for i in $(seq 1 30); do nc -z 127.0.0.1 4222 && exit 0; sleep 1; done; exit 1'
+ExecStart=/usr/local/bin/spx service spinifex start
+Restart=on-failure
+RestartSec=5
+OOMScoreAdjust=-500
+Environment=SPINIFEX_CONFIG_PATH=/etc/spinifex/spinifex.toml
+Environment=SPINIFEX_BASE_DIR=/var/lib/spinifex/spinifex/
+Environment=SPINIFEX_WAL_DIR=/var/lib/spinifex/spinifex/
+
+[Install]
+WantedBy=spinifex.target
@@ -0,0 +1,17 @@
+[Unit]
+Description=Spinifex NATS Message Bus
+PartOf=spinifex.target
+Before=spinifex-predastore.service spinifex-daemon.service spinifex-awsgw.service spinifex-vpcd.service
+
+[Service]
+Type=simple
+User=spinifex
+Group=spinifex
+ExecStart=/usr/local/bin/spx service nats start
+Restart=on-failure
+RestartSec=5
+OOMScoreAdjust=-500
+Environment=SPINIFEX_CONFIG_PATH=/etc/spinifex/nats/nats.conf
+
+[Install]
+WantedBy=spinifex.target
@@ -0,0 +1,22 @@
+[Unit]
+Description=Spinifex Predastore (S3-compatible Object Storage)
+PartOf=spinifex.target
+After=spinifex-nats.service
+Requires=spinifex-nats.service
+
+[Service]
+Type=simple
+User=spinifex
+Group=spinifex
+ExecStartPre=/bin/sh -c 'for i in $(seq 1 30); do nc -z 127.0.0.1 4222 && exit 0; sleep 1; done; exit 1'
+ExecStart=/usr/local/bin/spx service predastore start
+Restart=on-failure
+RestartSec=5
+OOMScoreAdjust=-500
+Environment=SPINIFEX_PREDASTORE_CONFIG_PATH=/etc/spinifex/predastore/predastore.toml
+Environment=SPINIFEX_PREDASTORE_BASE_PATH=/var/lib/spinifex/predastore/
+Environment=SPINIFEX_PREDASTORE_TLS_CERT=/etc/spinifex/server.pem
+Environment=SPINIFEX_PREDASTORE_TLS_KEY=/etc/spinifex/server.key
+
+[Install]
+WantedBy=spinifex.target
@@ -0,0 +1,16 @@
+[Unit]
+Description=Spinifex Web UI
+PartOf=spinifex.target
+After=spinifex-awsgw.service
+
+[Service]
+Type=simple
+User=spinifex
+Group=spinifex
+ExecStart=/usr/local/bin/spx service spinifex-ui start
+Restart=on-failure
+RestartSec=5
+OOMScoreAdjust=-500
+
+[Install]
+WantedBy=spinifex.target
@@ -0,0 +1,21 @@
+[Unit]
+Description=Spinifex Viperblock (Block Storage)
+PartOf=spinifex.target
+After=spinifex-nats.service spinifex-predastore.service
+Requires=spinifex-nats.service
+
+[Service]
+Type=simple
+User=spinifex
+Group=spinifex
+ExecStartPre=/bin/sh -c 'for i in $(seq 1 30); do nc -z 127.0.0.1 4222 && exit 0; sleep 1; done; exit 1'
+ExecStart=/usr/local/bin/spx service viperblock start
+Restart=on-failure
+RestartSec=5
+OOMScoreAdjust=-500
+EnvironmentFile=/etc/spinifex/systemd.env
+Environment=SPINIFEX_CONFIG_PATH=/etc/spinifex/spinifex.toml
+Environment=SPINIFEX_BASE_DIR=/var/lib/spinifex/viperblock/
+
+[Install]
+WantedBy=spinifex.target
@@ -0,0 +1,19 @@
+[Unit]
+Description=Spinifex VPC Daemon (OVN Networking)
+PartOf=spinifex.target
+After=spinifex-nats.service spinifex-daemon.service
+Requires=spinifex-nats.service
+
+[Service]
+Type=simple
+User=spinifex
+Group=spinifex
+ExecStartPre=/bin/sh -c 'for i in $(seq 1 30); do nc -z 127.0.0.1 4222 && exit 0; sleep 1; done; exit 1'
+ExecStart=/usr/local/bin/spx service vpcd start
+Restart=on-failure
+RestartSec=5
+OOMScoreAdjust=-500
+Environment=SPINIFEX_CONFIG_PATH=/etc/spinifex/spinifex.toml
+
+[Install]
+WantedBy=spinifex.target
@@ -0,0 +1,8 @@
+[Unit]
+Description=Spinifex Infrastructure Platform
+After=network-online.target
+Wants=network-online.target
+Wants=spinifex-nats.service spinifex-predastore.service spinifex-viperblock.service spinifex-daemon.service spinifex-awsgw.service spinifex-vpcd.service spinifex-ui.service
+
+[Install]
+WantedBy=multi-user.target
@@ -1,44 +0,0 @@
-package cmd
-
-import (
-	"os"
-	"path/filepath"
-)
-
-// DefaultConfigDir returns the default configuration directory.
-// Production: /etc/hive (when running as root or /etc/hive exists)
-// Development: ~/hive/config
-func DefaultConfigDir() string {
-	if isProductionLayout() {
-		return "/etc/hive"
-	}
-	homeDir, _ := os.UserHomeDir()
-	return filepath.Join(homeDir, "hive", "config")
-}
-
-// DefaultDataDir returns the default data directory.
-// Production: /var/lib/hive
-// Development: ~/hive
-func DefaultDataDir() string {
-	if isProductionLayout() {
-		return "/var/lib/hive"
-	}
-	homeDir, _ := os.UserHomeDir()
-	return filepath.Join(homeDir, "hive")
-}
-
-// DefaultConfigFile returns the default path to hive.toml.
-func DefaultConfigFile() string {
-	return filepath.Join(DefaultConfigDir(), "hive.toml")
-}
-
-// isProductionLayout returns true when running in a production install.
-// Detected by: running as root, or /etc/hive directory exists.
-func isProductionLayout() bool {
-	if os.Getuid() == 0 {
-		if info, err := os.Stat("/etc/hive"); err == nil && info.IsDir() {
-			return true
-		}
-	}
-	return false
-}
@@ -34,12 +34,12 @@ import (

 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/iam"
-	"github.com/mulgadc/hive/hive/admin"
-	"github.com/mulgadc/hive/hive/config"
-	"github.com/mulgadc/hive/hive/formation"
-	handlers_ec2_vpc "github.com/mulgadc/hive/hive/handlers/ec2/vpc"
-	handlers_iam "github.com/mulgadc/hive/hive/handlers/iam"
-	"github.com/mulgadc/hive/hive/utils"
+	"github.com/mulgadc/spinifex/spinifex/admin"
+	"github.com/mulgadc/spinifex/spinifex/config"
+	"github.com/mulgadc/spinifex/spinifex/formation"
+	handlers_ec2_vpc "github.com/mulgadc/spinifex/spinifex/handlers/ec2/vpc"
+	handlers_iam "github.com/mulgadc/spinifex/spinifex/handlers/iam"
+	"github.com/mulgadc/spinifex/spinifex/utils"
 	"github.com/mulgadc/viperblock/viperblock"
 	"github.com/mulgadc/viperblock/viperblock/backends/s3"
 	"github.com/mulgadc/viperblock/viperblock/v_utils"
@@ -48,8 +48,8 @@ import (
 	"github.com/spf13/cobra"
 )

-//go:embed templates/hive.toml
-var hiveTomlTemplate string
+//go:embed templates/spinifex.toml
+var spinifexTomlTemplate string

 //go:embed templates/awsgw.toml
 var awsgwTomlTemplate string
@@ -77,8 +77,8 @@ var supportedPlatforms = map[string]bool{

 var adminCmd = &cobra.Command{
 	Use:   "admin",
-	Short: "Administrative commands for Hive platform management",
-	Long:  `Administrative commands for initializing and managing the Hive platform.`,
+	Short: "Administrative commands for Spinifex platform management",
+	Long:  `Administrative commands for initializing and managing the Spinifex platform.`,
 }

 var clusterCmd = &cobra.Command{
@@ -98,17 +98,17 @@ Each phase waits for all nodes to ACK before proceeding to the next.`,

 var adminInitCmd = &cobra.Command{
 	Use:   "init",
-	Short: "Initialize Hive platform configuration",
-	Long: `Initialize Hive platform by creating configuration files, generating SSL certificates,
+	Short: "Initialize Spinifex platform configuration",
+	Long: `Initialize Spinifex platform by creating configuration files, generating SSL certificates,
 and setting up AWS credentials. This creates the necessary directory structure and
-configuration files in ~/hive/config.`,
+configuration files in ~/spinifex/config.`,
 	Run: runAdminInit,
 }

 var adminJoinCmd = &cobra.Command{
 	Use:   "join",
-	Short: "Join an existing Hive cluster",
-	Long: `Join an existing Hive cluster by connecting to a leader node and retrieving
+	Short: "Join an existing Spinifex cluster",
+	Long: `Join an existing Spinifex cluster by connecting to a leader node and retrieving
 the cluster configuration. This command will configure the local node to join
 the cluster and participate in distributed operations.`,
 	Run: runAdminJoin,
@@ -136,14 +136,14 @@ var imagesListCmd = &cobra.Command{

 var accountCmd = &cobra.Command{
 	Use:   "account",
-	Short: "Manage Hive accounts",
-	Long:  `Create and manage Hive accounts. Each account namespaces IAM users, policies, and resources.`,
+	Short: "Manage Spinifex accounts",
+	Long:  `Create and manage Spinifex accounts. Each account namespaces IAM users, policies, and resources.`,
 }

 var accountCreateCmd = &cobra.Command{
 	Use:   "create",
 	Short: "Create a new account with an admin user",
-	Long: `Create a new Hive account. This creates an account with a sequential 12-digit ID,
+	Long: `Create a new Spinifex account. This creates an account with a sequential 12-digit ID,
 an admin user, and an AdministratorAccess policy attached to the admin user.
 Requires the cluster to be running (connects to NATS).`,
 	Run: runAccountCreate,
@@ -152,25 +152,25 @@ Requires the cluster to be running (connects to NATS).`,
 var accountListCmd = &cobra.Command{
 	Use:   "list",
 	Short: "List all accounts",
-	Long:  `List all Hive accounts with their ID, name, status, and creation time.`,
+	Long:  `List all Spinifex accounts with their ID, name, status, and creation time.`,
 	Run:   runAccountList,
 }

 /*
 CLI ideas

-hive admin images list
+spx admin images list

 - fetches from remote endpoint for common/trusted images to bootstrap environment, or baked in from compile.

 // If --name specified, download
-hive admin images import --name debian-12-x86_64
+spx admin images import --name debian-12-x86_64

 // List available images
-hive admin images list
+spx admin images list

 // Manually import a path
-hive admin images import --file /path/to/image --distro debian --version 12 --arch x86_64
+spx admin images import --file /path/to/image --distro debian --version 12 --arch x86_64

 -> x <-
 */
@@ -197,7 +197,7 @@ func init() {
 	accountCreateCmd.MarkFlagRequired("name")

 	rootCmd.PersistentFlags().String("config-dir", DefaultConfigDir(), "Configuration directory")
-	rootCmd.PersistentFlags().String("hive-dir", DefaultDataDir(), "Hive base directory")
+	rootCmd.PersistentFlags().String("spinifex-dir", DefaultDataDir(), "Spinifex base directory")

 	// Flags for admin init
 	adminInitCmd.Flags().Bool("force", false, "Force re-initialization (overwrites existing config)")
@@ -212,7 +212,7 @@ func init() {
 	adminInitCmd.Flags().String("cluster-routes", "", "NATS cluster hosts for routing specify multiple with comma (e.g., 10.11.12.1:4248,10.11.12.2:4248 for multi-node)")
 	adminInitCmd.Flags().String("predastore-nodes", "", "Comma-separated IPs for multi-node Predastore cluster (e.g., 10.11.12.1,10.11.12.2,10.11.12.3). Requires >= 3 nodes.")
 	adminInitCmd.Flags().String("formation-timeout", "10m", "Timeout for cluster formation (e.g., 5m, 30s)")
-	adminInitCmd.Flags().String("cluster-name", "hive", "NATS cluster name")
+	adminInitCmd.Flags().String("cluster-name", "spinifex", "NATS cluster name")
 	adminInitCmd.Flags().StringSlice("services", nil, "Services this node runs (default: all). Valid: nats,predastore,viperblock,daemon,awsgw,ui")

 	// Flags for admin join
@@ -220,7 +220,7 @@ func init() {
 	adminJoinCmd.Flags().String("az", "ap-southeast-2a", "Availability zone for this node")
 	adminJoinCmd.Flags().String("node", "", "Node name (required)")
 	adminJoinCmd.Flags().String("host", "", "Leader node host:port (e.g., node1.local:4432) (required)")
-	adminJoinCmd.Flags().String("data-dir", "", "Data directory for this node (default: ~/hive)")
+	adminJoinCmd.Flags().String("data-dir", "", "Data directory for this node (default: ~/spinifex)")
 	adminJoinCmd.Flags().Int("port", 4432, "Port to bind cluster services on")
 	adminJoinCmd.Flags().String("bind", "0.0.0.0", "IP address to bind services to (e.g., 10.11.12.2 for multi-node on single host)")
 	adminJoinCmd.Flags().String("cluster-bind", "", "IP address to bind NATS cluster services to (e.g., 10.11.12.1 for multi-node)")
@@ -238,11 +238,9 @@ func init() {
 	imagesImportCmd.Flags().String("arch", "", "Specified distro arch (e.g aarch64, arm64, x86_64)")
 	imagesImportCmd.Flags().String("platform", "Linux/UNIX", "Specified platform (e.g Linux/UNIX, Windows)")
 	imagesImportCmd.Flags().Bool("force", false, "Force command execution (overwrites existing files)")
-
 }

 func runimagesImportCmd(cmd *cobra.Command, args []string) {
-
 	var image utils.Images

 	var imageFile string
@@ -259,7 +257,7 @@ func runimagesImportCmd(cmd *cobra.Command, args []string) {
 	}

 	//configDir, _ := cmd.Flags().GetString("config-dir")
-	baseDir, _ := cmd.Flags().GetString("hive-dir")
+	baseDir, _ := cmd.Flags().GetString("spinifex-dir")

 	// Strip trailing slash
 	baseDir = filepath.Clean(baseDir)
@@ -268,7 +266,8 @@ func runimagesImportCmd(cmd *cobra.Command, args []string) {
 	imageDir := fmt.Sprintf("%s/images", baseDir)

 	if !admin.FileExists(imageDir) {
-		fmt.Fprintf(os.Stderr, "Image directory does not exist. Base path specified correctly? %s", imageDir)
+		fmt.Fprintf(os.Stderr, "Error: image directory does not exist: %s\n\n", imageDir)
+		fmt.Fprintf(os.Stderr, "Run 'spx admin init' first to initialize the Spinifex platform.\n")
 		os.Exit(1)
 	}

@@ -276,7 +275,6 @@ func runimagesImportCmd(cmd *cobra.Command, args []string) {
 	imageName, _ := cmd.Flags().GetString("name")

 	if imageName != "" {
-
 		var exists bool
 		// Confirm the image exists
 		image, exists = utils.AvailableImages[imageName]
@@ -285,9 +283,7 @@ func runimagesImportCmd(cmd *cobra.Command, args []string) {
 			fmt.Fprintf(os.Stderr, "Image name not found in available images")
 			os.Exit(1)
 		}
-
 	} else {
-
 		imageFile, _ = cmd.Flags().GetString("file")

 		if imageFile == "" {
@@ -295,10 +291,8 @@ func runimagesImportCmd(cmd *cobra.Command, args []string) {
 			os.Exit(1)
 		}

-		//imageStat, err = os.Stat(imageFile)
-
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "File could not be found %s", err)
+		if _, err := os.Stat(imageFile); err != nil {
+			fmt.Fprintf(os.Stderr, "File could not be found: %s", err)
 			os.Exit(1)
 		}

@@ -306,7 +300,6 @@ func runimagesImportCmd(cmd *cobra.Command, args []string) {
 		image.Version, _ = cmd.Flags().GetString("version")
 		image.Arch, _ = cmd.Flags().GetString("arch")
 		image.Platform, _ = cmd.Flags().GetString("platform")
-
 	}

 	if image.Distro == "" {
@@ -353,14 +346,12 @@ func runimagesImportCmd(cmd *cobra.Command, args []string) {
 		if admin.FileExists(imageFile) && !forceCmd {
 			fmt.Printf("Image file already exists, skipping download, use --force to overwrite: %s\n", imageFile)
 		} else {
-
 			err := utils.DownloadFileWithProgress(image.URL, image.Name, imageFile, 0)

 			if err != nil {
 				fmt.Printf("Download failed: %v\n", err)
 				os.Exit(1)
 			}
-
 		}

 		// Update image file path for later extraction
@@ -368,7 +359,7 @@ func runimagesImportCmd(cmd *cobra.Command, args []string) {
 	}

 	// Next, validate if the image is raw, tar, gz, xv, etc. We need to upload the raw image
-	tmpDir, err := os.MkdirTemp(ostmpDir, "hive-image-tmp-*")
+	tmpDir, err := os.MkdirTemp(ostmpDir, "spinifex-image-tmp-*")

 	if err != nil {
 		fmt.Fprintf(os.Stderr, "Could not create temp dir: %v\n", err)
@@ -400,7 +391,7 @@ func runimagesImportCmd(cmd *cobra.Command, args []string) {
 	volumeId := utils.GenerateResourceID("ami")
 	manifest.AMIMetadata.ImageID = volumeId

-	manifest.AMIMetadata.Description = fmt.Sprintf("%s cloud image prepared for Hive", manifest.AMIMetadata.Name)
+	manifest.AMIMetadata.Description = fmt.Sprintf("%s cloud image prepared for Spinifex", manifest.AMIMetadata.Name)
 	manifest.AMIMetadata.Architecture = image.Arch
 	manifest.AMIMetadata.PlatformDetails = image.Platform
 	manifest.AMIMetadata.CreationDate = time.Now()
@@ -477,12 +468,10 @@ func runimagesImportCmd(cmd *cobra.Command, args []string) {
 	defer os.RemoveAll(tmpDir)

 	fmt.Printf("✅ Image import complete. Image-ID (AMI): %s\n", volumeId)
-
 }

 // List remote images available
 func runimagesListCmd(cmd *cobra.Command, args []string) {
-
 	//fmt.Println(availableImages)

 	tableData := pterm.TableData{
@@ -501,7 +490,6 @@ func runimagesListCmd(cmd *cobra.Command, args []string) {

 	// 3. Iterate in sorted order
 	for _, k := range keys {
-
 		img := utils.AvailableImages[k]

 		//for _, img := range utils.AvailableImages {
@@ -515,14 +503,14 @@ func runimagesListCmd(cmd *cobra.Command, args []string) {

 	pterm.Println("To install a selected image as an AMI use:")

-	pterm.Println("hive admin images import --name <image-name>")
+	pterm.Println("spx admin images import --name <image-name>")
 }

 // TODO: Move all logic to a module, use minimal application logic in viper commands
 func runAdminInit(cmd *cobra.Command, args []string) {
 	force, _ := cmd.Flags().GetBool("force")
 	configDir, _ := cmd.Flags().GetString("config-dir")
-	hiveRoot, _ := cmd.Flags().GetString("hive-dir")
+	spxRoot, _ := cmd.Flags().GetString("spinifex-dir")
 	region, _ := cmd.Flags().GetString("region")
 	az, _ := cmd.Flags().GetString("az")
 	node, _ := cmd.Flags().GetString("node")
@@ -557,23 +545,23 @@ func runAdminInit(cmd *cobra.Command, args []string) {
 		clusterBind = bindIP
 	}

-	fmt.Printf("Initializing Hive with bind IP: %s, port: %d\n", bindIP, port)
+	fmt.Printf("Initializing Spinifex with bind IP: %s, port: %d\n", bindIP, port)

 	// Default config directory
 	if configDir == "" {
 		configDir = DefaultConfigDir()
 	}

-	fmt.Println("🚀 Initializing Hive platform...")
+	fmt.Println("🚀 Initializing Spinifex platform...")
 	fmt.Printf("Configuration directory: %s\n\n", configDir)

 	// Check if already initialized
-	hiveTomlPath := filepath.Join(configDir, "hive.toml")
-	if !force && admin.FileExists(hiveTomlPath) {
-		fmt.Println("⚠️  Hive already initialized!")
-		fmt.Printf("Config file exists: %s\n", hiveTomlPath)
+	spinifexTomlPath := filepath.Join(configDir, "spinifex.toml")
+	if !force && admin.FileExists(spinifexTomlPath) {
+		fmt.Println("⚠️  Spinifex already initialized!")
+		fmt.Printf("Config file exists: %s\n", spinifexTomlPath)
 		fmt.Println("\nTo re-initialize, run with --force flag:")
-		fmt.Println("  hive admin init --force")
+		fmt.Println("  spx admin init --force")
 		os.Exit(0)
 	}

@@ -616,7 +604,7 @@ func runAdminInit(cmd *cobra.Command, args []string) {
 	fmt.Printf("   Access Key:  %s\n", bootstrapResult.AdminAccessKey)
 	fmt.Printf("   Secret Key:  %s\n", bootstrapResult.AdminSecretKey)
 	fmt.Printf("   Account:     %s (%s)\n", admin.DefaultAccountName(), admin.DefaultAccountID())
-	fmt.Printf("   AWS Profile: hive\n")
+	fmt.Printf("   AWS Profile: spinifex\n")

 	// Generate SSL certificates (with bind IP in SANs for multi-node support)
 	certPath := admin.GenerateCertificatesIfNeeded(configDir, force, bindIP)
@@ -629,17 +617,17 @@ func runAdminInit(cmd *cobra.Command, args []string) {
 	}
 	fmt.Println("\n🔒 Generated NATS authentication token")

-	if hiveRoot == "" {
-		hiveRoot = DefaultDataDir()
+	if spxRoot == "" {
+		spxRoot = DefaultDataDir()
 	}
-	hiveRoot = filepath.Clean(hiveRoot)
+	spxRoot = filepath.Clean(spxRoot)

 	// Determine if this is a multi-node formation
 	isMultiNode := nodes >= 2 && bindIP != "0.0.0.0"

 	if isMultiNode {
 		runAdminInitMultiNode(cmd, accessKey, secretKey, accountID, natsToken, clusterName,
-			configDir, hiveRoot, certPath, region, az, node, bindIP, clusterBind,
+			configDir, spxRoot, certPath, region, az, node, bindIP, clusterBind,
 			port, nodes, formationTimeoutStr, services)
 		return
 	}
@@ -653,9 +641,9 @@ func runAdminInit(cmd *cobra.Command, args []string) {
 	awsgwDir := filepath.Join(configDir, "awsgw")
 	predastoreDir := filepath.Join(configDir, "predastore")
 	natsDir := filepath.Join(configDir, "nats")
-	hiveDir := filepath.Join(configDir, "hive")
+	spinifexDir := filepath.Join(configDir, "spinifex")

-	for _, dir := range []string{awsgwDir, predastoreDir, natsDir, hiveDir} {
+	for _, dir := range []string{awsgwDir, predastoreDir, natsDir, spinifexDir} {
 		if err := os.MkdirAll(dir, 0700); err != nil {
 			fmt.Fprintf(os.Stderr, "Error creating directory %s: %v\n", dir, err)
 			os.Exit(1)
@@ -713,7 +701,7 @@ func runAdminInit(cmd *cobra.Command, args []string) {
 		AccountID: accountID,
 		Region:    region,
 		NatsToken: natsToken,
-		DataDir:   hiveRoot,
+		DataDir:   spxRoot,
 		ConfigDir: configDir,

 		Node:          node,
@@ -726,11 +714,14 @@ func runAdminInit(cmd *cobra.Command, args []string) {

 		PredastoreNodeID: predastoreNodeID,
 		Services:         services,
+
+		OVNNBAddr: "tcp:127.0.0.1:6641",
+		OVNSBAddr: "tcp:127.0.0.1:6642",
 	}

 	// Generate config files
 	configs := []admin.ConfigFile{
-		{Name: "hive.toml", Path: hiveTomlPath, Template: hiveTomlTemplate},
+		{Name: "spinifex.toml", Path: spinifexTomlPath, Template: spinifexTomlTemplate},
 		{Name: filepath.Join(awsgwDir, "awsgw.toml"), Path: filepath.Join(awsgwDir, "awsgw.toml"), Template: awsgwTomlTemplate},
 		{Name: filepath.Join(natsDir, "nats.conf"), Path: filepath.Join(natsDir, "nats.conf"), Template: natsConfTemplate},
 	}
@@ -754,7 +745,7 @@ func runAdminInit(cmd *cobra.Command, args []string) {
 		fmt.Println("✅ AWS credentials configured")
 	}

-	admin.CreateServiceDirectories(hiveRoot)
+	admin.CreateServiceDirectories(spxRoot)

 	// In production layout (running as root), fix ownership so the service user
 	// can read config and write data. SUDO_USER identifies the operator account.
@@ -762,23 +753,23 @@ func runAdminInit(cmd *cobra.Command, args []string) {
 		sudoUser := os.Getenv("SUDO_USER")
 		if sudoUser != "" {
 			admin.ChownRecursive(configDir, sudoUser)
-			admin.ChownRecursive(hiveRoot, sudoUser)
+			admin.ChownRecursive(spxRoot, sudoUser)
 		}
 	}

 	// Print success message
-	fmt.Println("\n🎉 Hive initialization complete!")
+	fmt.Println("\n🎉 Spinifex initialization complete!")
 	fmt.Println("\n📋 Next steps:")
 	fmt.Println("   1. Start services:")
 	fmt.Println("      ./scripts/start-dev.sh")
 	fmt.Println()
 	fmt.Println("   2. Test with AWS CLI:")
-	fmt.Println("      export AWS_PROFILE=hive")
+	fmt.Println("      export AWS_PROFILE=spinifex")
 	fmt.Println("      aws ec2 describe-instances")
 	fmt.Println()
 	fmt.Println("🔗 Configuration:")
-	fmt.Printf("   Config file: %s\n", hiveTomlPath)
-	fmt.Printf("   Data directory: %s\n", hiveRoot)
+	fmt.Printf("   Config file: %s\n", spinifexTomlPath)
+	fmt.Printf("   Data directory: %s\n", spxRoot)
 	fmt.Println()
 }

@@ -786,9 +777,8 @@ func runAdminInit(cmd *cobra.Command, args []string) {
 // It starts a formation server, registers this node, waits for all nodes to join,
 // then generates configs with complete cluster topology.
 func runAdminInitMultiNode(cmd *cobra.Command, accessKey, secretKey, accountID, natsToken, clusterName,
-	configDir, hiveRoot, certPath, region, az, node, bindIP, clusterBind string,
+	configDir, spxRoot, certPath, region, az, node, bindIP, clusterBind string,
 	port, expectedNodes int, formationTimeoutStr string, services []string) {
-
 	formationTimeout, err := time.ParseDuration(formationTimeoutStr)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "❌ Error: Invalid --formation-timeout: %v\n", err)
@@ -860,7 +850,7 @@ func runAdminInitMultiNode(cmd *cobra.Command, accessKey, secretKey, accountID,

 	fmt.Printf("\n📡 Formation server started on %s\n", formationAddr)
 	fmt.Printf("   Waiting for %d more node(s) to join...\n", expectedNodes-1)
-	fmt.Printf("   Other nodes should run: hive admin join --host %s --node <name> --bind <ip>\n\n", formationAddr)
+	fmt.Printf("   Other nodes should run: spx admin join --host %s --node <name> --bind <ip>\n\n", formationAddr)

 	// Wait for all nodes to register
 	if err := fs.WaitForCompletion(formationTimeout); err != nil {
@@ -882,9 +872,9 @@ func runAdminInitMultiNode(cmd *cobra.Command, accessKey, secretKey, accountID,
 	awsgwDir := filepath.Join(configDir, "awsgw")
 	predastoreDir := filepath.Join(configDir, "predastore")
 	natsDir := filepath.Join(configDir, "nats")
-	hiveDir := filepath.Join(configDir, "hive")
+	spinifexDir := filepath.Join(configDir, "spinifex")

-	for _, dir := range []string{awsgwDir, predastoreDir, natsDir, hiveDir} {
+	for _, dir := range []string{awsgwDir, predastoreDir, natsDir, spinifexDir} {
 		if err := os.MkdirAll(dir, 0700); err != nil {
 			fmt.Fprintf(os.Stderr, "Error creating directory %s: %v\n", dir, err)
 			os.Exit(1)
@@ -912,7 +902,7 @@ func runAdminInitMultiNode(cmd *cobra.Command, accessKey, secretKey, accountID,
 		fmt.Printf("✅ Created: multi-node predastore.toml (node ID: %d)\n", predastoreNodeID)
 	}

-	hiveTomlPath := filepath.Join(configDir, "hive.toml")
+	spinifexTomlPath := filepath.Join(configDir, "spinifex.toml")

 	configSettings := admin.ConfigSettings{
 		AccessKey: accessKey,
@@ -920,7 +910,7 @@ func runAdminInitMultiNode(cmd *cobra.Command, accessKey, secretKey, accountID,
 		AccountID: accountID,
 		Region:    region,
 		NatsToken: natsToken,
-		DataDir:   hiveRoot,
+		DataDir:   spxRoot,
 		ConfigDir: configDir,

 		Node:          node,
@@ -934,11 +924,15 @@ func runAdminInitMultiNode(cmd *cobra.Command, accessKey, secretKey, accountID,
 		PredastoreNodeID: predastoreNodeID,
 		Services:         services,
 		RemoteNodes:      buildRemoteNodes(allNodes, node),
+
+		// Init node runs ovn-central locally
+		OVNNBAddr: "tcp:127.0.0.1:6641",
+		OVNSBAddr: "tcp:127.0.0.1:6642",
 	}

 	// Generate config files
 	configs := []admin.ConfigFile{
-		{Name: "hive.toml", Path: hiveTomlPath, Template: hiveTomlTemplate},
+		{Name: "spinifex.toml", Path: spinifexTomlPath, Template: spinifexTomlTemplate},
 		{Name: filepath.Join(awsgwDir, "awsgw.toml"), Path: filepath.Join(awsgwDir, "awsgw.toml"), Template: awsgwTomlTemplate},
 		{Name: filepath.Join(natsDir, "nats.conf"), Path: filepath.Join(natsDir, "nats.conf"), Template: natsConfTemplate},
 	}
@@ -962,7 +956,7 @@ func runAdminInitMultiNode(cmd *cobra.Command, accessKey, secretKey, accountID,
 		fmt.Println("✅ AWS credentials configured")
 	}

-	admin.CreateServiceDirectories(hiveRoot)
+	admin.CreateServiceDirectories(spxRoot)

 	// Keep formation server running briefly so joining nodes can fetch complete status
 	fmt.Println("\n⏳ Waiting for joining nodes to fetch cluster data...")
@@ -1007,6 +1001,13 @@ func runAdminJoin(cmd *cobra.Command, args []string) {
 		os.Exit(1)
 	}

+	// Extract leader IP for OVN NB/SB DB address (strip port from host:port)
+	leaderIP, _, err := net.SplitHostPort(leaderHost)
+	if err != nil {
+		// leaderHost might be an IP without port
+		leaderIP = leaderHost
+	}
+
 	// Validate IP address format
 	if net.ParseIP(bindIP) == nil {
 		fmt.Fprintf(os.Stderr, "❌ Error: Invalid IP address for --bind: %s\n", bindIP)
@@ -1029,7 +1030,7 @@ func runAdminJoin(cmd *cobra.Command, args []string) {
 		dataDir = DefaultDataDir()
 	}

-	fmt.Println("🚀 Joining Hive cluster...")
+	fmt.Println("🚀 Joining Spinifex cluster...")
 	fmt.Printf("Node: %s\n", node)
 	fmt.Printf("Leader: %s\n", leaderHost)
 	fmt.Printf("Region: %s\n", region)
@@ -1061,7 +1062,7 @@ func runAdminJoin(cmd *cobra.Command, args []string) {
 	resp, err := client.Post(joinURL, "application/json", bytes.NewBuffer(reqBody))
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "❌ Error connecting to formation server: %v\n", err)
-		fmt.Fprintf(os.Stderr, "Make sure the leader node has run 'hive admin init' and is accessible at %s\n", leaderHost)
+		fmt.Fprintf(os.Stderr, "Make sure the leader node has run 'spx admin init' and is accessible at %s\n", leaderHost)
 		os.Exit(1)
 	}

@@ -1188,9 +1189,9 @@ func runAdminJoin(cmd *cobra.Command, args []string) {
 	awsgwDir := filepath.Join(configDir, "awsgw")
 	predastoreDir := filepath.Join(configDir, "predastore")
 	natsDir := filepath.Join(configDir, "nats")
-	hiveDir := filepath.Join(configDir, "hive")
+	spinifexDir := filepath.Join(configDir, "spinifex")

-	for _, dir := range []string{awsgwDir, predastoreDir, natsDir, hiveDir} {
+	for _, dir := range []string{awsgwDir, predastoreDir, natsDir, spinifexDir} {
 		if err := os.MkdirAll(dir, 0700); err != nil {
 			fmt.Fprintf(os.Stderr, "Error creating directory %s: %v\n", dir, err)
 			os.Exit(1)
@@ -1224,7 +1225,7 @@ func runAdminJoin(cmd *cobra.Command, args []string) {
 		fmt.Printf("✅ Created: multi-node predastore.toml (node ID: %d)\n", predastoreNodeID)
 	}

-	hiveTomlPath := filepath.Join(configDir, "hive.toml")
+	spinifexTomlPath := filepath.Join(configDir, "spinifex.toml")

 	configSettings := admin.ConfigSettings{
 		AccessKey: creds.AccessKey,
@@ -1246,11 +1247,15 @@ func runAdminJoin(cmd *cobra.Command, args []string) {
 		PredastoreNodeID: predastoreNodeID,
 		Services:         services,
 		RemoteNodes:      buildRemoteNodes(statusResp.Nodes, node),
+
+		// Joining nodes connect to the init node's OVN NB/SB DB
+		OVNNBAddr: fmt.Sprintf("tcp:%s:6641", leaderIP),
+		OVNSBAddr: fmt.Sprintf("tcp:%s:6642", leaderIP),
 	}

 	// Generate config files
 	configs := []admin.ConfigFile{
-		{Name: "hive.toml", Path: hiveTomlPath, Template: hiveTomlTemplate},
+		{Name: "spinifex.toml", Path: spinifexTomlPath, Template: spinifexTomlTemplate},
 		{Name: filepath.Join(awsgwDir, "awsgw.toml"), Path: filepath.Join(awsgwDir, "awsgw.toml"), Template: awsgwTomlTemplate},
 		{Name: filepath.Join(natsDir, "nats.conf"), Path: filepath.Join(natsDir, "nats.conf"), Template: natsConfTemplate},
 	}
@@ -1291,7 +1296,7 @@ func runAdminJoin(cmd *cobra.Command, args []string) {
 }

 // buildRemoteNodes converts formation NodeInfo into RemoteNode entries,
-// excluding the local node. This puts all cluster members into hive.toml
+// excluding the local node. This puts all cluster members into spinifex.toml
 // so config is the source of truth for expected cluster membership.
 func buildRemoteNodes(allNodes map[string]formation.NodeInfo, localNode string) []admin.RemoteNode {
 	var remote []admin.RemoteNode
@@ -1409,7 +1414,7 @@ func runAccountCreate(cmd *cobra.Command, args []string) {
 	}

 	// Configure AWS CLI profile automatically
-	profileName := "hive-" + strings.ToLower(strings.ReplaceAll(name, " ", "-"))
+	profileName := "spinifex-" + strings.ToLower(strings.ReplaceAll(name, " ", "-"))
 	homeDir, _ := os.UserHomeDir()

 	endpointHost := "localhost"
@@ -1530,6 +1535,7 @@ func writeBootstrapFilesWithAdmin(configDir string, masterKey []byte, accessKey,
 	}

 	bd := &handlers_iam.BootstrapData{
+		Version:         handlers_iam.BootstrapVersion,
 		AccessKeyID:     accessKey,
 		EncryptedSecret: encryptedSecret,
 		AccountID:       accountID,
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"time"

-	"github.com/mulgadc/hive/hive/daemon"
+	"github.com/mulgadc/spinifex/spinifex/daemon"
 	"github.com/nats-io/nats.go"
 	"github.com/spf13/cobra"
 )
@@ -77,7 +77,7 @@ func runClusterShutdown(cmd *cobra.Command, args []string) {

 	// Execute phases sequentially (except INFRA which is fire-and-forget)
 	for _, phase := range phases {
-		topic := "hive.cluster.shutdown." + phase
+		topic := "spinifex.cluster.shutdown." + phase
 		req := daemon.ShutdownRequest{
 			Phase:   phase,
 			Force:   force,
@@ -106,7 +106,7 @@ func runClusterShutdown(cmd *cobra.Command, args []string) {
 		// For DRAIN phase, subscribe to progress updates
 		var progressSub *nats.Subscription
 		if phase == "drain" {
-			progressSub, err = nc.Subscribe("hive.cluster.shutdown.progress", func(msg *nats.Msg) {
+			progressSub, err = nc.Subscribe("spinifex.cluster.shutdown.progress", func(msg *nats.Msg) {
 				var progress daemon.ShutdownProgress
 				if err := json.Unmarshal(msg.Data, &progress); err != nil {
 					return
@@ -24,9 +24,9 @@ import (
 	"strings"
 	"time"

-	"github.com/mulgadc/hive/hive/config"
-	"github.com/mulgadc/hive/hive/types"
-	"github.com/mulgadc/hive/hive/utils"
+	"github.com/mulgadc/spinifex/spinifex/config"
+	"github.com/mulgadc/spinifex/spinifex/types"
+	"github.com/mulgadc/spinifex/spinifex/utils"
 	"github.com/nats-io/nats.go"
 	"github.com/pterm/pterm"
 	"github.com/spf13/cobra"
@@ -75,7 +75,7 @@ func loadConfigAndConnect() (*config.ClusterConfig, *nats.Conn, error) {
 	}

 	// Backfill BaseDir from config file path when not set in the config.
-	// Config lives at <baseDir>/config/hive.toml, so baseDir is two levels up.
+	// Config lives at <baseDir>/config/spinifex.toml, so baseDir is two levels up.
 	if nodeConfig, ok := cfg.Nodes[cfg.Node]; ok && nodeConfig.BaseDir == "" {
 		nodeConfig.BaseDir = filepath.Dir(filepath.Dir(cfgPath))
 		cfg.Nodes[cfg.Node] = nodeConfig
@@ -154,7 +154,7 @@ func runGetNodes(cmd *cobra.Command, args []string) {
 	defer nc.Close()

 	timeout, _ := cmd.Flags().GetDuration("timeout")
-	responses, err := collectResponses(nc, "hive.node.status", timeout)
+	responses, err := collectResponses(nc, "spinifex.node.status", timeout)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
 		os.Exit(1)
@@ -228,7 +228,7 @@ func runGetVMs(cmd *cobra.Command, args []string) {
 	defer nc.Close()

 	timeout, _ := cmd.Flags().GetDuration("timeout")
-	responses, err := collectResponses(nc, "hive.node.vms", timeout)
+	responses, err := collectResponses(nc, "spinifex.node.vms", timeout)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
 		os.Exit(1)
@@ -236,6 +236,7 @@ func runGetVMs(cmd *cobra.Command, args []string) {

 	type vmRow struct {
 		types.VMInfo
+
 		Node string
 		Host string
 	}
@@ -0,0 +1,44 @@
+package cmd
+
+import (
+	"os"
+	"path/filepath"
+)
+
+// DefaultConfigDir returns the default configuration directory.
+// Production: /etc/spinifex (when running as root or /etc/spinifex exists)
+// Development: ~/spinifex/config
+func DefaultConfigDir() string {
+	if isProductionLayout() {
+		return "/etc/spinifex"
+	}
+	homeDir, _ := os.UserHomeDir()
+	return filepath.Join(homeDir, "spinifex", "config")
+}
+
+// DefaultDataDir returns the default data directory.
+// Production: /var/lib/spinifex
+// Development: ~/spinifex
+func DefaultDataDir() string {
+	if isProductionLayout() {
+		return "/var/lib/spinifex"
+	}
+	homeDir, _ := os.UserHomeDir()
+	return filepath.Join(homeDir, "spinifex")
+}
+
+// DefaultConfigFile returns the default path to spinifex.toml.
+func DefaultConfigFile() string {
+	return filepath.Join(DefaultConfigDir(), "spinifex.toml")
+}
+
+// isProductionLayout returns true when running in a production install.
+// Detected by: running as root, or /etc/spinifex directory exists.
+func isProductionLayout() bool {
+	if os.Getuid() == 0 {
+		if info, err := os.Stat("/etc/spinifex"); err == nil && info.IsDir() {
+			return true
+		}
+	}
+	return false
+}
@@ -7,13 +7,13 @@ import (
 )

 func TestDefaultConfigDir_Dev(t *testing.T) {
-	// Non-root user without /etc/hive should get dev paths
+	// Non-root user without /etc/spinifex should get dev paths
 	if os.Getuid() == 0 {
 		t.Skip("test requires non-root user")
 	}

 	homeDir, _ := os.UserHomeDir()
-	expected := filepath.Join(homeDir, "hive", "config")
+	expected := filepath.Join(homeDir, "spinifex", "config")
 	got := DefaultConfigDir()
 	if got != expected {
 		t.Errorf("DefaultConfigDir() = %q, want %q", got, expected)
@@ -26,7 +26,7 @@ func TestDefaultDataDir_Dev(t *testing.T) {
 	}

 	homeDir, _ := os.UserHomeDir()
-	expected := filepath.Join(homeDir, "hive")
+	expected := filepath.Join(homeDir, "spinifex")
 	got := DefaultDataDir()
 	if got != expected {
 		t.Errorf("DefaultDataDir() = %q, want %q", got, expected)
@@ -40,7 +40,7 @@ func TestDefaultConfigFile(t *testing.T) {

 	got := DefaultConfigFile()
 	homeDir, _ := os.UserHomeDir()
-	expected := filepath.Join(homeDir, "hive", "config", "hive.toml")
+	expected := filepath.Join(homeDir, "spinifex", "config", "spinifex.toml")
 	if got != expected {
 		t.Errorf("DefaultConfigFile() = %q, want %q", got, expected)
 	}
@@ -19,7 +19,7 @@ import (
 	"fmt"
 	"os"

-	"github.com/mulgadc/hive/hive/config"
+	"github.com/mulgadc/spinifex/spinifex/config"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 )
@@ -32,20 +32,17 @@ var (

 // rootCmd represents the base command when called without any subcommands
 var rootCmd = &cobra.Command{
-	Use:   "hive",
-	Short: "Hive - Open source AWS-compatible platform for secure edge deployments",
+	Use:   "spx",
+	Short: "Spinifex - Open source AWS-compatible platform for secure edge deployments",
 	Long: `
-__/\\\________/\\\__/\\\\\\\\\\\__/\\\________/\\\__/\\\\\\\\\\\\\\\_
- _\/\\\_______\/\\\_\/////\\\///__\/\\\_______\/\\\_\/\\\///////////__
-  _\/\\\_______\/\\\_____\/\\\_____\//\\\______/\\\__\/\\\_____________
-   _\/\\\\\\\\\\\\\\\_____\/\\\______\//\\\____/\\\___\/\\\\\\\\\\\_____
-    _\/\\\/////////\\\_____\/\\\_______\//\\\__/\\\____\/\\\///////______
-     _\/\\\_______\/\\\_____\/\\\________\//\\\/\\\_____\/\\\_____________
-      _\/\\\_______\/\\\_____\/\\\_________\//\\\\\______\/\\\_____________
-       _\/\\\_______\/\\\__/\\\\\\\\\\\______\//\\\_______\/\\\\\\\\\\\\\\\_
-        _\///________\///__\///////////________\///________\///////////////__
+   _____ _____ _____ _   _ _____ ______ ________   __
+  / ____|  __ \_   _| \ | |_   _|  ____|  ____\ \ / /
+ | (___ | |__) || | |  \| | | | | |__  | |__   \ V /
+  \___ \|  ___/ | | | . ‘ | | | |  __| |  __|   > <
+  ____) | |    _| |_| |\  |_| |_| |    | |____ / . \
+ |_____/|_|   |_____|_| \_|_____|_|    |______/_/ \_\

-Hive – Open source AWS-compatible platform for secure edge deployments.
+Spinifex – Open source AWS-compatible platform for secure edge deployments.
 Run EC2, VPC, S3, and EBS-like services on bare metal with full control.
 Built for environments where running in the cloud isn’t an option.
 Whether you’re deploying to edge sites, private data-centers, or operating
@@ -67,45 +64,44 @@ func init() {

 	// Global flags
 	rootCmd.PersistentFlags().String("config", "", "config file (required)")
-	viper.BindEnv("config", "HIVE_CONFIG_PATH")
+	viper.BindEnv("config", "SPINIFEX_CONFIG_PATH")
 	viper.BindPFlag("config", rootCmd.PersistentFlags().Lookup("config"))

 	// Authentication (access_key, secret)
 	rootCmd.PersistentFlags().String("access-key", "", "AWS access key (overrides config file and env)")
-	viper.BindEnv("access-key", "HIVE_ACCESS_KEY")
+	viper.BindEnv("access-key", "SPINIFEX_ACCESS_KEY")
 	viper.BindPFlag("access-key", rootCmd.PersistentFlags().Lookup("access-key"))

 	rootCmd.PersistentFlags().String("secret-key", "", "AWS secret key (overrides config file and env)")
-	viper.BindEnv("secret-key", "HIVE_SECRET_KEY")
+	viper.BindEnv("secret-key", "SPINIFEX_SECRET_KEY")
 	viper.BindPFlag("secret-key", rootCmd.PersistentFlags().Lookup("secret-key"))

 	rootCmd.PersistentFlags().String("host", "", "AWS Endpoint (overrides config file and env)")
-	viper.BindEnv("host", "HIVE_HOST")
+	viper.BindEnv("host", "SPINIFEX_HOST")
 	viper.BindPFlag("host", rootCmd.PersistentFlags().Lookup("host"))

 	// Viperblock config
 	rootCmd.PersistentFlags().String("base-dir", "", "Viperblock base directory (overrides config file and env)")
-	viper.BindEnv("base-dir", "HIVE_BASE_DIR")
+	viper.BindEnv("base-dir", "SPINIFEX_BASE_DIR")
 	viper.BindPFlag("base-dir", rootCmd.PersistentFlags().Lookup("base-dir"))

 	// NATS specific flags
 	rootCmd.PersistentFlags().String("nats-host", "", "NATS server host (overrides config file and env)")
-	viper.BindEnv("nats-host", "HIVE_NATS_HOST")
+	viper.BindEnv("nats-host", "SPINIFEX_NATS_HOST")
 	viper.BindPFlag("nats-host", rootCmd.PersistentFlags().Lookup("nats-host"))

 	rootCmd.PersistentFlags().String("nats-token", "", "NATS authentication token (overrides config file and env)")
-	viper.BindEnv("nats-token", "HIVE_NATS_TOKEN")
+	viper.BindEnv("nats-token", "SPINIFEX_NATS_TOKEN")
 	viper.BindPFlag("nats-token", rootCmd.PersistentFlags().Lookup("nats-token"))

 	rootCmd.PersistentFlags().String("nats-subject", "", "NATS subscription subject (overrides config file and env)")
-	viper.BindEnv("nats-subject", "HIVE_NATS_SUBJECT")
+	viper.BindEnv("nats-subject", "SPINIFEX_NATS_SUBJECT")
 	viper.BindPFlag("nats-subject", rootCmd.PersistentFlags().Lookup("nats-subject"))

 	// Bind flags to viper
 	//viper.BindPFlag("nats.host", rootCmd.PersistentFlags().Lookup("nats-host"))
 	//viper.BindPFlag("nats.acl.token", rootCmd.PersistentFlags().Lookup("nats-token"))
 	//viper.BindPFlag("nats.sub.subject", rootCmd.PersistentFlags().Lookup("nats-subject"))
-
 }

 // initConfig reads in config file and ENV variables if set.
@@ -121,6 +117,6 @@ func initConfig() {
 			fmt.Fprintf(os.Stderr, "Error: failed to load config %s: %v\n", cfgFile, err)
 			os.Exit(1)
 		}
-		// No config specified — continue with env/defaults (e.g., hive --help)
+		// No config specified — continue with env/defaults (e.g., spx --help)
 	}
 }
@@ -21,21 +21,21 @@ import (
 	"os"
 	"strings"

-	"github.com/mulgadc/hive/hive/config"
-	"github.com/mulgadc/hive/hive/service"
-	"github.com/mulgadc/hive/hive/services/hiveui"
-	"github.com/mulgadc/hive/hive/services/nats"
-	"github.com/mulgadc/hive/hive/services/predastore"
-	"github.com/mulgadc/hive/hive/services/viperblockd"
-	"github.com/mulgadc/hive/hive/services/vpcd"
 	"github.com/mulgadc/predastore/s3"
+	"github.com/mulgadc/spinifex/spinifex/config"
+	"github.com/mulgadc/spinifex/spinifex/service"
+	"github.com/mulgadc/spinifex/spinifex/services/nats"
+	"github.com/mulgadc/spinifex/spinifex/services/predastore"
+	"github.com/mulgadc/spinifex/spinifex/services/spinifexui"
+	"github.com/mulgadc/spinifex/spinifex/services/viperblockd"
+	"github.com/mulgadc/spinifex/spinifex/services/vpcd"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 )

 var serviceCmd = &cobra.Command{
 	Use:   "service",
-	Short: "Manage Hive services",
+	Short: "Manage Spinifex services",
 }

 var predastoreCmd = &cobra.Command{
@@ -53,9 +53,9 @@ var natsCmd = &cobra.Command{
 	Short: "Manage the nats service",
 }

-var hiveCmd = &cobra.Command{
-	Use:   "hive",
-	Short: "Manage the hive service",
+var spinifexCmd = &cobra.Command{
+	Use:   "spinifex",
+	Short: "Manage the spinifex service",
 }

 var awsgwCmd = &cobra.Command{
@@ -68,10 +68,10 @@ var vpcdCmd = &cobra.Command{
 	Short: "Manage the vpcd (VPC daemon) service",
 }

-var hiveUICmd = &cobra.Command{
-	Use:     "hive-ui",
-	Aliases: []string{"ui", "hiveui"},
-	Short:   "Manage the hive-ui service",
+var spinifexUICmd = &cobra.Command{
+	Use:     "spinifex-ui",
+	Aliases: []string{"ui", "spinifexui"},
+	Short:   "Manage the spinifex-ui service",
 }

 var predastoreStartCmd = &cobra.Command{
@@ -410,12 +410,12 @@ var natsStatusCmd = &cobra.Command{
 	},
 }

-// Repeat for hive
-var hiveStartCmd = &cobra.Command{
+// Repeat for spinifex
+var spinifexStartCmd = &cobra.Command{
 	Use:   "start",
-	Short: "Start the hive service",
+	Short: "Start the spinifex service",
 	Run: func(cmd *cobra.Command, args []string) {
-		fmt.Println("Starting hive service...")
+		fmt.Println("Starting spinifex service...")

 		cfgFile := viper.GetString("config")

@@ -451,53 +451,53 @@ var hiveStartCmd = &cobra.Command{
 		// Apply changes back to cluster config
 		clusterConfig.Nodes[clusterConfig.Node] = nodeConfig

-		svc, err := service.New("hive", clusterConfig)
+		svc, err := service.New("spinifex", clusterConfig)

 		if err != nil {
-			fmt.Println("Error starting hive service:", err)
+			fmt.Println("Error starting spinifex service:", err)
 			return
 		}

 		// Set config path for cluster manager
-		if hiveSvc, ok := svc.(interface{ SetConfigPath(string) }); ok {
-			hiveSvc.SetConfigPath(cfgFile)
+		if spxSvc, ok := svc.(interface{ SetConfigPath(string) }); ok {
+			spxSvc.SetConfigPath(cfgFile)
 		}

 		if _, err = svc.Start(); err != nil {
-			fmt.Println("Error starting hive service:", err)
+			fmt.Println("Error starting spinifex service:", err)
 			os.Exit(1)
 		}
-		fmt.Println("HIVE service started")
+		fmt.Println("Spinifex service started")
 	},
 }

-var hiveStopCmd = &cobra.Command{
+var spinifexStopCmd = &cobra.Command{
 	Use:   "stop",
-	Short: "Stop the hive service",
+	Short: "Stop the spinifex service",
 	Run: func(cmd *cobra.Command, args []string) {
-		fmt.Println("Stopping hive service...")
+		fmt.Println("Stopping spinifex service...")

-		service, err := service.New("hive", &config.ClusterConfig{})
+		service, err := service.New("spinifex", &config.ClusterConfig{})

 		if err != nil {
-			fmt.Println("Error stopping hive service:", err)
+			fmt.Println("Error stopping spinifex service:", err)
 			return
 		}

 		if err = service.Stop(); err != nil {
-			fmt.Println("Error stopping hive service:", err)
+			fmt.Println("Error stopping spinifex service:", err)
 			os.Exit(1)
 		}

-		fmt.Println("Hive service stopped")
+		fmt.Println("Spinifex service stopped")
 	},
 }

-var hiveStatusCmd = &cobra.Command{
+var spinifexStatusCmd = &cobra.Command{
 	Use:   "status",
-	Short: "Get status of the hive service",
+	Short: "Get status of the spinifex service",
 	Run: func(cmd *cobra.Command, args []string) {
-		fmt.Println("Hive service status: ...")
+		fmt.Println("Spinifex service status: ...")
 	},
 }

@@ -601,18 +601,18 @@ var awsgwStatusCmd = &cobra.Command{
 	},
 }

-var hiveUIStartCmd = &cobra.Command{
+var spinifexUIStartCmd = &cobra.Command{
 	Use:   "start",
-	Short: "Start the hive-ui service",
+	Short: "Start the spinifex-ui service",
 	Run: func(cmd *cobra.Command, args []string) {
-		fmt.Println("Starting hive-ui service...")
+		fmt.Println("Starting spinifex-ui service...")

-		port := viper.GetInt("hive-ui-port")
-		host := viper.GetString("hive-ui-host")
-		tlsCert := viper.GetString("hive-ui-tls-cert")
-		tlsKey := viper.GetString("hive-ui-tls-key")
+		port := viper.GetInt("spinifex-ui-port")
+		host := viper.GetString("spinifex-ui-host")
+		tlsCert := viper.GetString("spinifex-ui-tls-cert")
+		tlsKey := viper.GetString("spinifex-ui-tls-key")

-		svc, err := service.New("hive-ui", &hiveui.Config{
+		svc, err := service.New("spinifex-ui", &spinifexui.Config{
 			Port:    port,
 			Host:    host,
 			TLSCert: tlsCert,
@@ -620,57 +620,57 @@ var hiveUIStartCmd = &cobra.Command{
 		})

 		if err != nil {
-			fmt.Println("Error starting hive-ui service:", err)
+			fmt.Println("Error starting spinifex-ui service:", err)
 			return
 		}

 		if _, err = svc.Start(); err != nil {
-			fmt.Println("Error starting hive-ui service:", err)
+			fmt.Println("Error starting spinifex-ui service:", err)
 			os.Exit(1)
 		}
-		fmt.Println("hive-ui service started")
+		fmt.Println("spinifex-ui service started")
 	},
 }

-var hiveUIStopCmd = &cobra.Command{
+var spinifexUIStopCmd = &cobra.Command{
 	Use:   "stop",
-	Short: "Stop the hive-ui service",
+	Short: "Stop the spinifex-ui service",
 	Run: func(cmd *cobra.Command, args []string) {
-		fmt.Println("Stopping hive-ui service...")
+		fmt.Println("Stopping spinifex-ui service...")

-		svc, err := service.New("hive-ui", &hiveui.Config{})
+		svc, err := service.New("spinifex-ui", &spinifexui.Config{})

 		if err != nil {
-			fmt.Println("Error stopping hive-ui service:", err)
+			fmt.Println("Error stopping spinifex-ui service:", err)
 			return
 		}

 		if err = svc.Stop(); err != nil {
-			fmt.Println("Error stopping hive-ui service:", err)
+			fmt.Println("Error stopping spinifex-ui service:", err)
 			os.Exit(1)
 		}
-		fmt.Println("hive-ui service stopped")
+		fmt.Println("spinifex-ui service stopped")
 	},
 }

-var hiveUIStatusCmd = &cobra.Command{
+var spinifexUIStatusCmd = &cobra.Command{
 	Use:   "status",
-	Short: "Get status of the hive-ui service",
+	Short: "Get status of the spinifex-ui service",
 	Run: func(cmd *cobra.Command, args []string) {
-		svc, err := service.New("hive-ui", &hiveui.Config{})
+		svc, err := service.New("spinifex-ui", &spinifexui.Config{})

 		if err != nil {
-			fmt.Println("Error getting hive-ui service status:", err)
+			fmt.Println("Error getting spinifex-ui service status:", err)
 			return
 		}

 		status, err := svc.Status()
 		if err != nil {
-			fmt.Println("Error getting hive-ui service status:", err)
+			fmt.Println("Error getting spinifex-ui service status:", err)
 			return
 		}

-		fmt.Println("hive-ui service status:", status)
+		fmt.Println("spinifex-ui service status:", status)
 	},
 }

@@ -744,8 +744,7 @@ var vpcdStatusCmd = &cobra.Command{
 }

 func init() {
-
-	viper.SetEnvPrefix("HIVE") // Prefix for environment variables
+	viper.SetEnvPrefix("SPINIFEX") // Prefix for environment variables
 	viper.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))

 	viper.AutomaticEnv() // Read environment variables automatically
@@ -756,47 +755,47 @@ func init() {

 	// Predastore Port
 	predastoreCmd.PersistentFlags().Int("port", 8443, "Predastore (S3) port")
-	viper.BindEnv("port", "HIVE_PREDASTORE_PORT")
+	viper.BindEnv("port", "SPINIFEX_PREDASTORE_PORT")
 	viper.BindPFlag("port", predastoreCmd.PersistentFlags().Lookup("port"))

 	// Predastore Host
 	predastoreCmd.PersistentFlags().String("host", "0.0.0.0", "Predastore (S3) host")
-	viper.BindEnv("host", "HIVE_PREDASTORE_HOST")
+	viper.BindEnv("host", "SPINIFEX_PREDASTORE_HOST")
 	viper.BindPFlag("host", predastoreCmd.PersistentFlags().Lookup("host"))

 	// Base path
 	predastoreCmd.PersistentFlags().String("base-path", "", "Predastore (S3) base path")
-	viper.BindEnv("base-path", "HIVE_PREDASTORE_BASE_PATH")
+	viper.BindEnv("base-path", "SPINIFEX_PREDASTORE_BASE_PATH")
 	viper.BindPFlag("base-path", predastoreCmd.PersistentFlags().Lookup("base-path"))

 	// Predastore Config Path
 	predastoreCmd.PersistentFlags().String("config-path", "", "Predastore (S3) config path")
-	viper.BindEnv("config-path", "HIVE_PREDASTORE_CONFIG_PATH")
+	viper.BindEnv("config-path", "SPINIFEX_PREDASTORE_CONFIG_PATH")
 	viper.BindPFlag("config-path", predastoreCmd.PersistentFlags().Lookup("config-path"))

 	// Predastore Debug
 	predastoreCmd.PersistentFlags().Bool("debug", false, "Predastore (S3) debug")
-	viper.BindEnv("debug", "HIVE_PREDASTORE_DEBUG")
+	viper.BindEnv("debug", "SPINIFEX_PREDASTORE_DEBUG")
 	viper.BindPFlag("debug", predastoreCmd.PersistentFlags().Lookup("debug"))

 	// Predastore TLS Cert
 	predastoreCmd.PersistentFlags().String("tls-cert", "", "Predastore (S3) TLS certificate")
-	viper.BindEnv("tls-cert", "HIVE_PREDASTORE_TLS_CERT")
+	viper.BindEnv("tls-cert", "SPINIFEX_PREDASTORE_TLS_CERT")
 	viper.BindPFlag("tls-cert", predastoreCmd.PersistentFlags().Lookup("tls-cert"))

 	// Predastore TLS Key
 	predastoreCmd.PersistentFlags().String("tls-key", "", "Predastore (S3) TLS key")
-	viper.BindEnv("tls-key", "HIVE_PREDASTORE_TLS_KEY")
+	viper.BindEnv("tls-key", "SPINIFEX_PREDASTORE_TLS_KEY")
 	viper.BindPFlag("tls-key", predastoreCmd.PersistentFlags().Lookup("tls-key"))

 	// Predastore Backend
 	predastoreCmd.PersistentFlags().String("backend", "distributed", "Predastore (S3) backend")
-	viper.BindEnv("backend", "HIVE_PREDASTORE_BACKEND")
+	viper.BindEnv("backend", "SPINIFEX_PREDASTORE_BACKEND")
 	viper.BindPFlag("backend", predastoreCmd.PersistentFlags().Lookup("backend"))

 	// Predastore Node ID
 	predastoreCmd.PersistentFlags().Int("node-id", 0, "Predastore (S3) node ID")
-	viper.BindEnv("node-id", "HIVE_PREDASTORE_NODE_ID")
+	viper.BindEnv("node-id", "SPINIFEX_PREDASTORE_NODE_ID")
 	viper.BindPFlag("node-id", predastoreCmd.PersistentFlags().Lookup("node-id"))

 	// Predastore CPU Profiling
@@ -816,19 +815,19 @@ func init() {
 	serviceCmd.AddCommand(viperblockCmd)

 	viperblockCmd.PersistentFlags().String("s3-host", "0.0.0.0:8443", "Predastore (S3) host URI")
-	viper.BindEnv("s3-host", "HIVE_VIPERBLOCK_S3_HOST")
+	viper.BindEnv("s3-host", "SPINIFEX_VIPERBLOCK_S3_HOST")
 	viper.BindPFlag("s3-host", predastoreCmd.PersistentFlags().Lookup("s3-host"))

 	viperblockCmd.PersistentFlags().String("s3-bucket", "predastore", "Predastore (S3) bucket")
-	viper.BindEnv("s3-bucket", "HIVE_VIPERBLOCK_S3_BUCKET")
+	viper.BindEnv("s3-bucket", "SPINIFEX_VIPERBLOCK_S3_BUCKET")
 	viper.BindPFlag("s3-bucket", predastoreCmd.PersistentFlags().Lookup("s3-bucket"))

 	viperblockCmd.PersistentFlags().String("s3-region", "ap-southeast-2", "Predastore (S3) region")
-	viper.BindEnv("s3-region", "HIVE_VIPERBLOCK_S3_REGION")
+	viper.BindEnv("s3-region", "SPINIFEX_VIPERBLOCK_S3_REGION")
 	viper.BindPFlag("s3-region", predastoreCmd.PersistentFlags().Lookup("s3-region"))

-	viperblockCmd.PersistentFlags().String("plugin-path", "/opt/hive/lib/nbdkit-viperblock-plugin.so", "Pathname to the nbdkit viperblockplugin")
-	viper.BindEnv("plugin-path", "HIVE_VIPERBLOCK_PLUGIN_PATH")
+	viperblockCmd.PersistentFlags().String("plugin-path", "/opt/spinifex/lib/nbdkit-viperblock-plugin.so", "Pathname to the nbdkit viperblockplugin")
+	viper.BindEnv("plugin-path", "SPINIFEX_VIPERBLOCK_PLUGIN_PATH")
 	viper.BindPFlag("plugin-path", predastoreCmd.PersistentFlags().Lookup("plugin-path"))

 	viperblockCmd.AddCommand(viperblockStartCmd)
@@ -844,83 +843,83 @@ func init() {

 	// Add NATS flags
 	natsCmd.PersistentFlags().Int("port", 4222, "NATS server port")
-	viper.BindEnv("port", "HIVE_NATS_PORT")
+	viper.BindEnv("port", "SPINIFEX_NATS_PORT")
 	viper.BindPFlag("port", natsCmd.PersistentFlags().Lookup("port"))

 	natsCmd.PersistentFlags().String("host", "0.0.0.0", "NATS server host")
-	viper.BindEnv("host", "HIVE_NATS_HOST")
+	viper.BindEnv("host", "SPINIFEX_NATS_HOST")
 	viper.BindPFlag("host", natsCmd.PersistentFlags().Lookup("host"))

 	natsCmd.PersistentFlags().Bool("debug", false, "Enable debug logging")
-	viper.BindEnv("debug", "HIVE_NATS_DEBUG")
+	viper.BindEnv("debug", "SPINIFEX_NATS_DEBUG")
 	viper.BindPFlag("debug", natsCmd.PersistentFlags().Lookup("debug"))

 	natsCmd.PersistentFlags().String("data-dir", "", "NATS data directory")
-	viper.BindEnv("data-dir", "HIVE_NATS_DATA_DIR")
+	viper.BindEnv("data-dir", "SPINIFEX_NATS_DATA_DIR")
 	viper.BindPFlag("data-dir", natsCmd.PersistentFlags().Lookup("data-dir"))

 	natsCmd.PersistentFlags().Bool("jetstream", false, "Enable JetStream")
-	viper.BindEnv("jetstream", "HIVE_NATS_JETSTREAM")
+	viper.BindEnv("jetstream", "SPINIFEX_NATS_JETSTREAM")
 	viper.BindPFlag("jetstream", natsCmd.PersistentFlags().Lookup("jetstream"))

-	// Hive
-	serviceCmd.AddCommand(hiveCmd)
+	// Spinifex
+	serviceCmd.AddCommand(spinifexCmd)

-	hiveCmd.AddCommand(hiveStartCmd)
-	hiveCmd.AddCommand(hiveStopCmd)
-	hiveCmd.AddCommand(hiveStatusCmd)
+	spinifexCmd.AddCommand(spinifexStartCmd)
+	spinifexCmd.AddCommand(spinifexStopCmd)
+	spinifexCmd.AddCommand(spinifexStatusCmd)

-	hiveCmd.PersistentFlags().String("wal-dir", "", "Write-ahead log (WAL) directory. Place on high-speed NVMe disk, or tmpfs for development.")
-	viper.BindEnv("wal-dir", "HIVE_WAL_DIR")
-	viper.BindPFlag("wal-dir", hiveCmd.PersistentFlags().Lookup("wal-dir"))
+	spinifexCmd.PersistentFlags().String("wal-dir", "", "Write-ahead log (WAL) directory. Place on high-speed NVMe disk, or tmpfs for development.")
+	viper.BindEnv("wal-dir", "SPINIFEX_WAL_DIR")
+	viper.BindPFlag("wal-dir", spinifexCmd.PersistentFlags().Lookup("wal-dir"))

 	// AWS GW
 	serviceCmd.AddCommand(awsgwCmd)

 	awsgwCmd.PersistentFlags().String("host", "0.0.0.0:9999", "AWS Gateway server host")
-	viper.BindEnv("host", "HIVE_AWSGW_HOST")
+	viper.BindEnv("host", "SPINIFEX_AWSGW_HOST")
 	viper.BindPFlag("host", awsgwCmd.PersistentFlags().Lookup("host"))

 	// AWS GW TLS Cert
 	awsgwCmd.PersistentFlags().String("tls-cert", "", "AWS Gateway TLS certificate")
-	viper.BindEnv("tls-cert", "HIVE_AWSGW_TLS_CERT")
+	viper.BindEnv("tls-cert", "SPINIFEX_AWSGW_TLS_CERT")
 	viper.BindPFlag("tls-cert", awsgwCmd.PersistentFlags().Lookup("tls-cert"))

 	// AWS GW TLS Key
 	awsgwCmd.PersistentFlags().String("tls-key", "", "AWS Gateway TLS key")
-	viper.BindEnv("tls-key", "HIVE_AWSGW_TLS_KEY")
+	viper.BindEnv("tls-key", "SPINIFEX_AWSGW_TLS_KEY")
 	viper.BindPFlag("tls-key", awsgwCmd.PersistentFlags().Lookup("tls-key"))

 	awsgwCmd.PersistentFlags().Bool("debug", false, "AWS Gateway Debug")
-	viper.BindEnv("debug", "HIVE_AWSGW_DEBUG")
+	viper.BindEnv("debug", "SPINIFEX_AWSGW_DEBUG")
 	viper.BindPFlag("debug", awsgwCmd.PersistentFlags().Lookup("debug"))

 	awsgwCmd.AddCommand(awsgwStartCmd)
 	awsgwCmd.AddCommand(awsgwStopCmd)
 	awsgwCmd.AddCommand(awsgwStatusCmd)

-	// hive-ui
-	serviceCmd.AddCommand(hiveUICmd)
+	// spinifex-ui
+	serviceCmd.AddCommand(spinifexUICmd)

-	hiveUICmd.PersistentFlags().Int("port", 3000, "hive-ui server port")
-	viper.BindEnv("hive-ui-port", "HIVE_UI_PORT")
-	viper.BindPFlag("hive-ui-port", hiveUICmd.PersistentFlags().Lookup("port"))
+	spinifexUICmd.PersistentFlags().Int("port", 3000, "spinifex-ui server port")
+	viper.BindEnv("spinifex-ui-port", "SPINIFEX_UI_PORT")
+	viper.BindPFlag("spinifex-ui-port", spinifexUICmd.PersistentFlags().Lookup("port"))

-	hiveUICmd.PersistentFlags().String("host", "0.0.0.0", "hive-ui server host")
-	viper.BindEnv("hive-ui-host", "HIVE_UI_HOST")
-	viper.BindPFlag("hive-ui-host", hiveUICmd.PersistentFlags().Lookup("host"))
+	spinifexUICmd.PersistentFlags().String("host", "0.0.0.0", "spinifex-ui server host")
+	viper.BindEnv("spinifex-ui-host", "SPINIFEX_UI_HOST")
+	viper.BindPFlag("spinifex-ui-host", spinifexUICmd.PersistentFlags().Lookup("host"))

-	hiveUICmd.PersistentFlags().String("tls-cert", "", "TLS certificate path")
-	viper.BindEnv("hive-ui-tls-cert", "HIVE_UI_TLS_CERT")
-	viper.BindPFlag("hive-ui-tls-cert", hiveUICmd.PersistentFlags().Lookup("tls-cert"))
+	spinifexUICmd.PersistentFlags().String("tls-cert", "", "TLS certificate path")
+	viper.BindEnv("spinifex-ui-tls-cert", "SPINIFEX_UI_TLS_CERT")
+	viper.BindPFlag("spinifex-ui-tls-cert", spinifexUICmd.PersistentFlags().Lookup("tls-cert"))

-	hiveUICmd.PersistentFlags().String("tls-key", "", "TLS key path")
-	viper.BindEnv("hive-ui-tls-key", "HIVE_UI_TLS_KEY")
-	viper.BindPFlag("hive-ui-tls-key", hiveUICmd.PersistentFlags().Lookup("tls-key"))
+	spinifexUICmd.PersistentFlags().String("tls-key", "", "TLS key path")
+	viper.BindEnv("spinifex-ui-tls-key", "SPINIFEX_UI_TLS_KEY")
+	viper.BindPFlag("spinifex-ui-tls-key", spinifexUICmd.PersistentFlags().Lookup("tls-key"))

-	hiveUICmd.AddCommand(hiveUIStartCmd)
-	hiveUICmd.AddCommand(hiveUIStopCmd)
-	hiveUICmd.AddCommand(hiveUIStatusCmd)
+	spinifexUICmd.AddCommand(spinifexUIStartCmd)
+	spinifexUICmd.AddCommand(spinifexUIStopCmd)
+	spinifexUICmd.AddCommand(spinifexUIStatusCmd)

 	// vpcd
 	serviceCmd.AddCommand(vpcdCmd)
@@ -928,5 +927,4 @@ func init() {
 	vpcdCmd.AddCommand(vpcdStartCmd)
 	vpcdCmd.AddCommand(vpcdStopCmd)
 	vpcdCmd.AddCommand(vpcdStatusCmd)
-
 }
@@ -1,5 +1,5 @@
 # NATS Server Configuration
-# Generated by Hive admin init
+# Generated by Spinifex admin init

 # Server configuration
 {{- if .BindIP }}
@@ -22,7 +22,7 @@ cluster {
 }
 {{- end }}

-server_name: hive-nats-{{.Node}}
+server_name: spinifex-nats-{{.Node}}

 # Authorization
 authorization {
@@ -52,4 +52,4 @@ policy = [
 nats_url = "nats://{{.BindIP}}:4222"
 nats_token = "{{.NatsToken}}"
 master_key_path = "{{.ConfigDir}}/master.key"
-access_keys_bucket = "hive-iam-access-keys"
+access_keys_bucket = "spinifex-iam-access-keys"
@@ -86,4 +86,4 @@ policy = [
 nats_url = "nats://{{if eq .BindIP "0.0.0.0"}}localhost{{else}}{{.BindIP}}{{end}}:4222"
 nats_token = "{{.NatsToken}}"
 master_key_path = "{{.ConfigDir}}/master.key"
-access_keys_bucket = "hive-iam-access-keys"
+access_keys_bucket = "spinifex-iam-access-keys"
@@ -39,8 +39,8 @@ token = "{{.NatsToken}}"
 shardwal = false

 [nodes.{{.Node}}.vpcd]
-ovn_nb_addr = "tcp:127.0.0.1:6641"
-ovn_sb_addr = "tcp:127.0.0.1:6642"
+ovn_nb_addr = "{{.OVNNBAddr}}"
+ovn_sb_addr = "{{.OVNSBAddr}}"

 [nodes.{{.Node}}.predastore]
 host = "{{.BindIP}}:8443"
@@ -22,7 +22,7 @@ import (
 	"sort"
 	"time"

-	"github.com/mulgadc/hive/hive/types"
+	"github.com/mulgadc/spinifex/spinifex/types"
 	"github.com/pterm/pterm"
 	"github.com/spf13/cobra"
 )
@@ -56,7 +56,7 @@ func runTopNodes(cmd *cobra.Command, args []string) {
 	defer nc.Close()

 	timeout, _ := cmd.Flags().GetDuration("timeout")
-	responses, err := collectResponses(nc, "hive.node.status", timeout)
+	responses, err := collectResponses(nc, "spinifex.node.status", timeout)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
 		os.Exit(1)
@@ -8,7 +8,7 @@ import (
 )

 // Version variables set via ldflags at build time.
-// Example: go build -ldflags "-X github.com/mulgadc/hive/cmd/hive/cmd.Version=v1.0.0"
+// Example: go build -ldflags "-X github.com/mulgadc/spinifex/cmd/spinifex/cmd.Version=v1.0.0"
 var (
 	Version = "dev"
 	Commit  = "unknown"
@@ -16,9 +16,9 @@ var (

 var versionCmd = &cobra.Command{
 	Use:   "version",
-	Short: "Print the Hive version",
+	Short: "Print the Spinifex version",
 	Run: func(cmd *cobra.Command, args []string) {
-		fmt.Printf("hive %s (%s) %s/%s\n", Version, Commit, runtime.GOOS, runtime.GOARCH)
+		fmt.Printf("spinifex %s (%s) %s/%s\n", Version, Commit, runtime.GOOS, runtime.GOARCH)
 	},
 }

@@ -15,7 +15,7 @@ limitations under the License.
 */
 package main

-import "github.com/mulgadc/hive/cmd/hive/cmd"
+import "github.com/mulgadc/spinifex/cmd/spinifex/cmd"

 func main() {
 	cmd.Execute()
@@ -1,71 +1,71 @@
-# Hive Systemd Service
+# Spinifex Systemd Service

-This directory contains the systemd service configuration for running Hive services on Ubuntu and Debian systems.
+This directory contains the systemd service configuration for running Spinifex services on Ubuntu and Debian systems.

 ## Files

- `hive.service` - The systemd service file that manages all Hive services
- `install-hive-service.sh` - Installation script to set up the service
+- `spinifex.service` - The systemd service file that manages all Spinifex services
+- `install-spinifex-service.sh` - Installation script to set up the service
 - `README.md` - This documentation file

 ## Installation

 ### Prerequisites

-1. Ensure Hive is installed in `/opt/hive/`
-2. Ensure the `hive` binary is available at `/opt/hive/bin/hive`
+1. Ensure Spinifex is installed in `/opt/spinifex/`
+2. Ensure the `spx` binary is available at `/opt/spinifex/bin/spx`
 3. Run the installation script as root

 ### Setup Configuration

 ```
-/opt/hive/bin/hive admin init
+/opt/spinifex/bin/spx admin init
 ```

-This will init the Hive environment and create the default configuration files in the home directory, e.g `~/hive/`.
+This will init the Spinifex environment and create the default configuration files in the home directory, e.g `~/spinifex/`.

 ```
-/home/username/hive:
+/home/username/spinifex:
 amis  config  images  logs  nats  predastore  state  viperblock  volumes

-/home/username/hive/amis:
+/home/username/spinifex/amis:

-/home/username/hive/config:
-awsgw  hive.toml  nats  predastore  server.key  server.pem
+/home/username/spinifex/config:
+awsgw  spinifex.toml  nats  predastore  server.key  server.pem

-/home/username/hive/config/awsgw:
+/home/username/spinifex/config/awsgw:
 awsgw.toml

-/home/username/hive/config/nats:
+/home/username/spinifex/config/nats:
 nats.conf

-/home/username/hive/config/predastore:
+/home/username/spinifex/config/predastore:
 predastore.toml

-/home/username/hive/images:
+/home/username/spinifex/images:

-/home/username/hive/logs:
-awsgw.log  awsgw.pid  hive.log  hive.pid  nats.log  nats.pid  predastore.log  predastore.pid  viperblock.log  viperblock.pid
+/home/username/spinifex/logs:
+awsgw.log  awsgw.pid  spinifex.log  spinifex.pid  nats.log  nats.pid  predastore.log  predastore.pid  viperblock.log  viperblock.pid

-/home/username/hive/nats:
+/home/username/spinifex/nats:

-/home/username/hive/predastore:
+/home/username/spinifex/predastore:
 data

-/home/username/hive/predastore/data:
+/home/username/spinifex/predastore/data:
 predastore

-/home/ben/hive/state:
+/home/ben/spinifex/state:

-/home/ben/hive/viperblock:
+/home/ben/spinifex/viperblock:

-/home/ben/hive/volumes:
+/home/ben/spinifex/volumes:
 ```

 ### Quick Installation

 ```bash
-sudo ./config/install-hive-service.sh
+sudo ./config/install-spinifex-service.sh
 ```

 ### Manual Installation
@@ -74,7 +74,7 @@ If you prefer to install manually:

 1. Copy the service file:
   ```bash
-   sudo cp config/hive.service /etc/systemd/system/
+   sudo cp config/spinifex.service /etc/systemd/system/
   ```

 2. Reload systemd:
@@ -84,44 +84,44 @@ If you prefer to install manually:

 3. Enable the service:
   ```bash
-   sudo systemctl enable hive.service
+   sudo systemctl enable spinifex.service
   ```

 ## Service Management

 ### Start the service
 ```bash
-sudo systemctl start hive
+sudo systemctl start spinifex
 ```

 ### Stop the service
 ```bash
-sudo systemctl stop hive
+sudo systemctl stop spinifex
 ```

 ### Check service status
 ```bash
-sudo systemctl status hive
+sudo systemctl status spinifex
 ```

 ### Restart the service
 ```bash
-sudo systemctl restart hive
+sudo systemctl restart spinifex
 ```

 ### View service logs
 ```bash
-sudo journalctl -u hive -f
+sudo journalctl -u spinifex -f
 ```

 ### Disable auto-start
 ```bash
-sudo systemctl disable hive
+sudo systemctl disable spinifex
 ```

 ## Service Details

-The `hive.service` file:
+The `spinifex.service` file:

 - Starts services in the correct order: NATS → Predastore → Viperblock
 - Includes proper delays between service starts to ensure dependencies are ready
@@ -143,41 +143,41 @@ The service starts the following components in order:

 ### Check if the service is running
 ```bash
-sudo systemctl is-active hive
+sudo systemctl is-active spinifex
 ```

 ### View recent logs
 ```bash
-sudo journalctl -u hive --since "1 hour ago"
+sudo journalctl -u spinifex --since "1 hour ago"
 ```

 ### Check service configuration
 ```bash
-sudo systemctl cat hive
+sudo systemctl cat spinifex
 ```

 ### Verify binary exists
 ```bash
-ls -la /opt/hive/bin/hive
+ls -la /opt/spinifex/bin/spx
 ```

 ### Test service commands manually
 ```bash
-/opt/hive/bin/hive service nats start
-/opt/hive/bin/hive service predastore start
-/opt/hive/bin/hive service viperblock start
+/opt/spinifex/bin/spx service nats start
+/opt/spinifex/bin/spx service predastore start
+/opt/spinifex/bin/spx service viperblock start
 ```

 ## Customization

 If you need to modify the service configuration:

-1. Edit the service file: `sudo nano /etc/systemd/system/hive.service`
+1. Edit the service file: `sudo nano /etc/systemd/system/spinifex.service`
 2. Reload systemd: `sudo systemctl daemon-reload`
-3. Restart the service: `sudo systemctl restart hive`
+3. Restart the service: `sudo systemctl restart spinifex`

 ## Security Notes

 - The service runs as root, which is necessary for system-level services
 - Security hardening is enabled with `ProtectSystem=strict` and `NoNewPrivileges=true`
- Only specific paths are writable: `/opt/hive`, `/var/log`, `/var/run` 
+- Only specific paths are writable: `/opt/spinifex`, `/var/log`, `/var/run` 
@@ -1,49 +0,0 @@
-[Unit]
-Description=Hive Services
-Documentation=https://github.com/mulgadc/hive
-After=network.target
-Wants=network.target
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-User=root
-Group=root
-WorkingDirectory=/opt/hive
-Environment=PATH=/opt/hive/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-
-# Start NATS service
-ExecStart=/opt/hive/bin/hive service nats start
-ExecStartPost=/bin/sleep 3
-
-# Start Predastore service
-ExecStart=/opt/hive/bin/hive service predastore start
-ExecStartPost=/bin/sleep 2
-
-# Start Viperblock service
-ExecStart=/opt/hive/bin/hive service viperblock start
-
-# Stop services in reverse order
-ExecStop=/opt/hive/bin/hive service viperblock stop
-ExecStopPost=/bin/sleep 2
-ExecStop=/opt/hive/bin/hive service predastore stop
-ExecStopPost=/bin/sleep 2
-ExecStop=/opt/hive/bin/hive service nats stop
-
-# Restart policy
-Restart=on-failure
-RestartSec=10
-
-# Security settings
-NoNewPrivileges=true
-ProtectSystem=strict
-ProtectHome=true
-ReadWritePaths=/opt/hive /var/log /var/run
-
-# Logging
-StandardOutput=journal
-StandardError=journal
-SyslogIdentifier=hive
-
-[Install]
-WantedBy=multi-user.target 
@@ -1,7 +1,7 @@
 #!/bin/bash

-# Hive Service Installation Script
-# This script installs the hive systemd service on Ubuntu/Debian systems
+# Spinifex Service Installation Script
+# This script installs the spinifex systemd service on Ubuntu/Debian systems

 set -e

@@ -38,7 +38,7 @@ fi

 # Get the directory where this script is located
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-SERVICE_FILE="$SCRIPT_DIR/hive.service"
+SERVICE_FILE="$SCRIPT_DIR/spinifex.service"

 # Check if service file exists
 if [[ ! -f "$SERVICE_FILE" ]]; then
@@ -46,7 +46,7 @@ if [[ ! -f "$SERVICE_FILE" ]]; then
    exit 1
 fi

-print_status "Installing Hive systemd service..."
+print_status "Installing Spinifex systemd service..."

 # Copy service file to systemd directory
 cp "$SERVICE_FILE" /etc/systemd/system/
@@ -55,20 +55,20 @@ cp "$SERVICE_FILE" /etc/systemd/system/
 systemctl daemon-reload

 # Enable the service to start on boot
-systemctl enable hive.service
+systemctl enable spinifex.service

 print_status "Service installed successfully!"
 print_status "You can now use the following commands:"
-echo "  systemctl start hive    # Start the service"
-echo "  systemctl stop hive     # Stop the service"
-echo "  systemctl status hive   # Check service status"
-echo "  systemctl restart hive  # Restart the service"
-echo "  journalctl -u hive -f   # View service logs"
+echo "  systemctl start spinifex    # Start the service"
+echo "  systemctl stop spinifex     # Stop the service"
+echo "  systemctl status spinifex   # Check service status"
+echo "  systemctl restart spinifex  # Restart the service"
+echo "  journalctl -u spinifex -f   # View service logs"

-# Check if hive binary exists
-if [[ ! -f "/opt/hive/bin/hive" ]]; then
-    print_warning "Hive binary not found at /opt/hive/bin/hive"
-    print_warning "Please ensure hive is installed in /opt/hive before starting the service"
+# Check if spinifex binary exists
+if [[ ! -f "/opt/spinifex/bin/spinifex" ]]; then
+    print_warning "Spinifex binary not found at /opt/spinifex/bin/spinifex"
+    print_warning "Please ensure spinifex is installed in /opt/spinifex before starting the service"
 fi

 print_status "Installation complete!" 
@@ -0,0 +1,49 @@
+[Unit]
+Description=Spinifex Services
+Documentation=https://github.com/mulgadc/spinifex
+After=network.target
+Wants=network.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+User=root
+Group=root
+WorkingDirectory=/opt/spinifex
+Environment=PATH=/opt/spinifex/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+# Start NATS service
+ExecStart=/opt/spinifex/bin/spinifex service nats start
+ExecStartPost=/bin/sleep 3
+
+# Start Predastore service
+ExecStart=/opt/spinifex/bin/spinifex service predastore start
+ExecStartPost=/bin/sleep 2
+
+# Start Viperblock service
+ExecStart=/opt/spinifex/bin/spinifex service viperblock start
+
+# Stop services in reverse order
+ExecStop=/opt/spinifex/bin/spinifex service viperblock stop
+ExecStopPost=/bin/sleep 2
+ExecStop=/opt/spinifex/bin/spinifex service predastore stop
+ExecStopPost=/bin/sleep 2
+ExecStop=/opt/spinifex/bin/spinifex service nats stop
+
+# Restart policy
+Restart=on-failure
+RestartSec=10
+
+# Security settings
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/opt/spinifex /var/log /var/run
+
+# Logging
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=spinifex
+
+[Install]
+WantedBy=multi-user.target 
@@ -1,36 +1,36 @@
 # Command Implementation Matrix

-## Hive Admin CLI
+## Spinifex Admin CLI

 Platform management commands not exposed via the AWS gateway API. These are CLI-only commands.

 ### Service Management

-Service lifecycle commands for starting, stopping, and checking status of all Hive cluster services. Each service subcommand supports `start`, `stop`, and `status` operations.
+Service lifecycle commands for starting, stopping, and checking status of all Spinifex cluster services. Each service subcommand supports `start`, `stop`, and `status` operations.

 | Command | Flags | Prerequisites | Basic Logic | Status |
 |---------|-------|---------------|-------------|--------|
-| `hive service predastore start` | `--port` (default: 8443), `--host` (default: 0.0.0.0), `--base-path`, `--config-path`, `--debug`, `--tls-cert`, `--tls-key`, `--backend` (distributed/filesystem, default: distributed), `--node-id` (default: 0), `--pprof`, `--pprof-output` | TLS cert/key, base-path, config-path required | Creates predastore service instance with S3-compatible storage backend → starts service | **DONE** |
-| `hive service predastore stop` | — | Predastore must be running | Stops the predastore service | **DONE** |
-| `hive service predastore status` | — | None | Reports predastore service status | **DONE** |
-| `hive service viperblock start` | `--s3-host` (default: 0.0.0.0:8443), `--s3-bucket` (default: predastore), `--s3-region` (default: ap-southeast-2), `--plugin-path` (default: /opt/hive/lib/nbdkit-viperblock-plugin.so) | `--config` required, plugin-path must exist on disk | Loads cluster config → connects to NATS and Predastore → starts viperblock block storage service with NBD plugin | **DONE** |
-| `hive service viperblock stop` | — | Viperblock must be running | Stops the viperblock service | **DONE** |
-| `hive service viperblock status` | — | None | Reports viperblock service status | **DONE** |
-| `hive service nats start` | `--port` (default: 4222), `--host` (default: 0.0.0.0), `--debug`, `--data-dir`, `--jetstream` | None | Starts embedded NATS server with optional JetStream | **DONE** |
-| `hive service nats stop` | — | NATS must be running | Stops the NATS service | **DONE** |
-| `hive service nats status` | — | None | Reports NATS service status | **DONE** |
-| `hive service hive start` | `--wal-dir` | `--config` required | Loads cluster config → starts hive daemon (VM orchestration, NATS subscriptions, health endpoint) | **DONE** |
-| `hive service hive stop` | — | Hive daemon must be running | Stops the hive daemon service | **DONE** |
-| `hive service hive status` | — | None | Reports hive daemon service status | **DONE** |
-| `hive service awsgw start` | `--host` (default: 0.0.0.0:9999), `--tls-cert`, `--tls-key`, `--debug` | `--config` required | Loads cluster config → starts AWS-compatible gateway with SigV4 auth, IAM policy enforcement, TLS | **DONE** |
-| `hive service awsgw stop` | — | AWS gateway must be running | Stops the AWS gateway service | **DONE** |
-| `hive service awsgw status` | — | None | Reports AWS gateway service status | **DONE** |
-| `hive service hive-ui start` | `--port` (default: 3000), `--host` (default: 0.0.0.0), `--tls-cert`, `--tls-key` | None | Starts embedded web UI server serving the React frontend. Aliases: `ui`, `hiveui` | **DONE** |
-| `hive service hive-ui stop` | — | hive-ui must be running | Stops the hive-ui service | **DONE** |
-| `hive service hive-ui status` | — | None | Reports hive-ui service status | **DONE** |
-| `hive service vpcd start` | — | `--config` required, OVN/OVS installed | Loads cluster config → starts VPC daemon (subscribes to `vpc.*` NATS events, translates to OVN logical switches/ports/routers) | **DONE** |
-| `hive service vpcd stop` | — | vpcd must be running | Stops the vpcd service | **DONE** |
-| `hive service vpcd status` | — | None | Reports vpcd service status | **DONE** |
+| `spx service predastore start` | `--port` (default: 8443), `--host` (default: 0.0.0.0), `--base-path`, `--config-path`, `--debug`, `--tls-cert`, `--tls-key`, `--backend` (distributed/filesystem, default: distributed), `--node-id` (default: 0), `--pprof`, `--pprof-output` | TLS cert/key, base-path, config-path required | Creates predastore service instance with S3-compatible storage backend → starts service | **DONE** |
+| `spx service predastore stop` | — | Predastore must be running | Stops the predastore service | **DONE** |
+| `spx service predastore status` | — | None | Reports predastore service status | **DONE** |
+| `spx service viperblock start` | `--s3-host` (default: 0.0.0.0:8443), `--s3-bucket` (default: predastore), `--s3-region` (default: ap-southeast-2), `--plugin-path` (default: /opt/spinifex/lib/nbdkit-viperblock-plugin.so) | `--config` required, plugin-path must exist on disk | Loads cluster config → connects to NATS and Predastore → starts viperblock block storage service with NBD plugin | **DONE** |
+| `spx service viperblock stop` | — | Viperblock must be running | Stops the viperblock service | **DONE** |
+| `spx service viperblock status` | — | None | Reports viperblock service status | **DONE** |
+| `spx service nats start` | `--port` (default: 4222), `--host` (default: 0.0.0.0), `--debug`, `--data-dir`, `--jetstream` | None | Starts embedded NATS server with optional JetStream | **DONE** |
+| `spx service nats stop` | — | NATS must be running | Stops the NATS service | **DONE** |
+| `spx service nats status` | — | None | Reports NATS service status | **DONE** |
+| `spx service spinifex start` | `--wal-dir` | `--config` required | Loads cluster config → starts spinifex daemon (VM orchestration, NATS subscriptions, health endpoint) | **DONE** |
+| `spx service spinifex stop` | — | Spinifex daemon must be running | Stops the spinifex daemon service | **DONE** |
+| `spx service spinifex status` | — | None | Reports spinifex daemon service status | **DONE** |
+| `spx service awsgw start` | `--host` (default: 0.0.0.0:9999), `--tls-cert`, `--tls-key`, `--debug` | `--config` required | Loads cluster config → starts AWS-compatible gateway with SigV4 auth, IAM policy enforcement, TLS | **DONE** |
+| `spx service awsgw stop` | — | AWS gateway must be running | Stops the AWS gateway service | **DONE** |
+| `spx service awsgw status` | — | None | Reports AWS gateway service status | **DONE** |
+| `spx service spinifex-ui start` | `--port` (default: 3000), `--host` (default: 0.0.0.0), `--tls-cert`, `--tls-key` | None | Starts embedded web UI server serving the React frontend. Aliases: `ui`, `spinifexui` | **DONE** |
+| `spx service spinifex-ui stop` | — | spinifex-ui must be running | Stops the spinifex-ui service | **DONE** |
+| `spx service spinifex-ui status` | — | None | Reports spinifex-ui service status | **DONE** |
+| `spx service vpcd start` | — | `--config` required, OVN/OVS installed | Loads cluster config → starts VPC daemon (subscribes to `vpc.*` NATS events, translates to OVN logical switches/ports/routers) | **DONE** |
+| `spx service vpcd stop` | — | vpcd must be running | Stops the vpcd service | **DONE** |
+| `spx service vpcd status` | — | None | Reports vpcd service status | **DONE** |

 ### Cluster Inspection

@@ -38,41 +38,41 @@ Operational commands for inspecting cluster state. These fan out NATS requests t

 | Command | Flags | Prerequisites | Basic Logic | Output Columns | Status |
 |---------|-------|---------------|-------------|----------------|--------|
-| `hive get nodes` | `--timeout` (default: 3s) | Cluster must be running (NATS) | Loads config → publishes to `hive.node.status` fan-out topic → collects responses within timeout → merges config-known nodes with NATS responders → nodes that don't respond shown as `NotReady` | NAME, STATUS, IP, REGION, AZ, UPTIME, VMs, SERVICES | **DONE** |
-| `hive get vms` | `--timeout` (default: 3s) | Cluster must be running (NATS) | Publishes to `hive.node.vms` fan-out topic → collects VM info from all nodes → sorts by node then instance ID → prints table. Alias: `hive get instances` | INSTANCE, STATUS, TYPE, VCPU, MEM, NODE, IP, AGE | **DONE** |
+| `spx get nodes` | `--timeout` (default: 3s) | Cluster must be running (NATS) | Loads config → publishes to `spinifex.node.status` fan-out topic → collects responses within timeout → merges config-known nodes with NATS responders → nodes that don't respond shown as `NotReady` | NAME, STATUS, IP, REGION, AZ, UPTIME, VMs, SERVICES | **DONE** |
+| `spx get vms` | `--timeout` (default: 3s) | Cluster must be running (NATS) | Publishes to `spinifex.node.vms` fan-out topic → collects VM info from all nodes → sorts by node then instance ID → prints table. Alias: `spx get instances` | INSTANCE, STATUS, TYPE, VCPU, MEM, NODE, IP, AGE | **DONE** |

 ### Resource Monitoring

 | Command | Flags | Prerequisites | Basic Logic | Output | Status |
 |---------|-------|---------------|-------------|--------|--------|
-| `hive top nodes` | `--timeout` (default: 3s) | Cluster must be running (NATS) | Publishes to `hive.node.status` fan-out topic → collects CPU/memory usage per node → aggregates instance type capacity across all nodes → prints two tables: per-node resource usage and cluster-wide instance type availability | Table 1: NAME, CPU (used/total), MEM (used/total), VMs. Table 2: INSTANCE TYPE, AVAILABLE, VCPU, MEMORY | **DONE** |
+| `spx top nodes` | `--timeout` (default: 3s) | Cluster must be running (NATS) | Publishes to `spinifex.node.status` fan-out topic → collects CPU/memory usage per node → aggregates instance type capacity across all nodes → prints two tables: per-node resource usage and cluster-wide instance type availability | Table 1: NAME, CPU (used/total), MEM (used/total), VMs. Table 2: INSTANCE TYPE, AVAILABLE, VCPU, MEMORY | **DONE** |

 ### Cluster Initialization

 | Command | Flags | Prerequisites | Basic Logic | Test Cases | Status |
 |---------|-------|---------------|-------------|------------|--------|
-| `hive admin init` | `--nodes`, `--node`, `--bind`, `--port`, `--region`, `--az`, `--cluster-name`, `--cluster-bind`, `--cluster-routes`, `--predastore-nodes`, `--services`, `--formation-timeout`, `--force` | None (first-time setup) | Generates root IAM credentials (AKIA-prefixed access key + secret) → creates master.key (AES-256, 32 bytes, 0600) → writes bootstrap.json (consumed on first start) → generates CA + server TLS certificates → creates NATS config with auth token → writes hive.toml, awsgw.toml, predastore.toml → configures AWS CLI `hive` profile → creates directory structure under `~/hive/` | 1. Init creates all config files<br>2. Root credentials printed once<br>3. master.key is 32 bytes, mode 0600<br>4. bootstrap.json consumed on first start<br>5. `--force` re-initializes existing config<br>6. AWS CLI profile `hive` auto-configured | **DONE** |
-| `hive admin join` | `--host` (required), `--node` (required), `--bind`, `--port`, `--region`, `--az`, `--cluster-bind`, `--cluster-routes`, `--data-dir`, `--services` | Leader node must be running | Connects to leader node → retrieves cluster configuration → configures local node to join cluster and participate in distributed operations | 1. Join existing cluster<br>2. Missing host (error)<br>3. Missing node name (error) | **DONE** |
+| `spx admin init` | `--nodes`, `--node`, `--bind`, `--port`, `--region`, `--az`, `--cluster-name`, `--cluster-bind`, `--cluster-routes`, `--predastore-nodes`, `--services`, `--formation-timeout`, `--force` | None (first-time setup) | Generates root IAM credentials (AKIA-prefixed access key + secret) → creates master.key (AES-256, 32 bytes, 0600) → writes bootstrap.json (consumed on first start) → generates CA + server TLS certificates → creates NATS config with auth token → writes spinifex.toml, awsgw.toml, predastore.toml → configures AWS CLI `spx` profile → creates directory structure under `~/spinifex/` | 1. Init creates all config files<br>2. Root credentials printed once<br>3. master.key is 32 bytes, mode 0600<br>4. bootstrap.json consumed on first start<br>5. `--force` re-initializes existing config<br>6. AWS CLI profile `spx` auto-configured | **DONE** |
+| `spx admin join` | `--host` (required), `--node` (required), `--bind`, `--port`, `--region`, `--az`, `--cluster-bind`, `--cluster-routes`, `--data-dir`, `--services` | Leader node must be running | Connects to leader node → retrieves cluster configuration → configures local node to join cluster and participate in distributed operations | 1. Join existing cluster<br>2. Missing host (error)<br>3. Missing node name (error) | **DONE** |

 ### Cluster Operations

 | Command | Flags | Prerequisites | Basic Logic | Test Cases | Status |
 |---------|-------|---------------|-------------|------------|--------|
-| `hive admin cluster shutdown` | — | Cluster must be running | Gracefully shuts down the entire cluster | 1. Shutdown running cluster<br>2. All nodes stop cleanly | **DONE** |
+| `spx admin cluster shutdown` | — | Cluster must be running | Gracefully shuts down the entire cluster | 1. Shutdown running cluster<br>2. All nodes stop cleanly | **DONE** |

 ### Account Management

 | Command | Flags | Prerequisites | Basic Logic | Test Cases | Status |
 |---------|-------|---------------|-------------|------------|--------|
-| `hive admin account create` | `--name` | Cluster must be running (NATS), master key must exist | Connects to NATS → CAS loop on `hive-account-counter:next_id` for sequential 12-digit ID → creates Account record in `hive-accounts` KV → creates `admin` user in new account → creates access key for admin → creates AdministratorAccess policy (Action:*, Resource:*) → attaches policy → prints credentials | 1. Create first account (ID 000000000001)<br>2. Sequential IDs (000000000002, etc.)<br>3. Admin user has full access<br>4. Credentials printed once | **DONE** |
-| `hive admin account list` | — | Cluster must be running (NATS), master key must exist | Connects to NATS → IAMService.ListAccounts() → prints table with Account ID, Name, Status, Created | 1. List all accounts<br>2. Empty list (only global account) | **DONE** |
+| `spx admin account create` | `--name` | Cluster must be running (NATS), master key must exist | Connects to NATS → CAS loop on `spinifex-account-counter:next_id` for sequential 12-digit ID → creates Account record in `spinifex-accounts` KV → creates `admin` user in new account → creates access key for admin → creates AdministratorAccess policy (Action:*, Resource:*) → attaches policy → prints credentials | 1. Create first account (ID 000000000001)<br>2. Sequential IDs (000000000002, etc.)<br>3. Admin user has full access<br>4. Credentials printed once | **DONE** |
+| `spx admin account list` | — | Cluster must be running (NATS), master key must exist | Connects to NATS → IAMService.ListAccounts() → prints table with Account ID, Name, Status, Created | 1. List all accounts<br>2. Empty list (only global account) | **DONE** |

 ### Image Management

 | Command | Flags | Prerequisites | Basic Logic | Test Cases | Status |
 |---------|-------|---------------|-------------|------------|--------|
-| `hive admin images import` | `--name` | Cluster must be running, image file must exist locally | Imports a local disk image (QCOW2) as an AMI → uploads to Predastore S3 → registers as available AMI | 1. Import valid QCOW2 image<br>2. Image appears in `describe-images` | **DONE** |
-| `hive admin images list` | — | None | Lists available OS images that can be imported or downloaded | 1. List available images | **DONE** |
+| `spx admin images import` | `--name` | Cluster must be running, image file must exist locally | Imports a local disk image (QCOW2) as an AMI → uploads to Predastore S3 → registers as available AMI | 1. Import valid QCOW2 image<br>2. Image appears in `describe-images` | **DONE** |
+| `spx admin images list` | — | None | Lists available OS images that can be imported or downloaded | 1. List available images | **DONE** |

 ## AWS Commands

@@ -87,7 +87,7 @@ Operational commands for inspecting cluster state. These fan out NATS requests t
 | `terminate-instances` | `--instance-ids`, `DeleteOnTermination` (per-volume flag, default true) | `--dry-run` | `run-instances` (instance must exist) | Gateway sends NATS to target node → daemon kills QEMU process → cleans up NBD mounts → deletes volumes with `DeleteOnTermination=true` via `volumeService.DeleteVolume()` (S3 cleanup of vol/, vol-efi/, vol-cloudinit/) → internal volumes (EFI, cloud-init) always cleaned up via `ebs.delete` NATS → volumes with `DeleteOnTermination=false` left in available state → state→terminated | 1. Terminate running instance<br>2. Terminate stopped instance<br>3. Terminate with DeleteOnTermination=true deletes volumes<br>4. Terminate with DeleteOnTermination=false preserves volumes<br>5. Terminate already-terminated (idempotent)<br>6. Internal volumes (EFI, cloud-init) always cleaned up<br>7. Invalid instance ID | **DONE** |
 | `reboot-instances` | — | `--instance-ids`, `--dry-run` | `run-instances` (instance must be running) | Gateway sends NATS to target node → daemon issues QMP `system_reset` → instance reboots without stopping | 1. Reboot running instance<br>2. Reboot stopped instance (error)<br>3. Verify instance stays in running state after reboot | **NOT STARTED** (parser test exists) |
 | `describe-instance-types` | `--filters` (capacity filter only) | `--instance-types`, `--max-results`, `--next-token`, `--dry-run`, all other filters | None | Gateway fans out NATS `ec2.DescribeInstanceTypes` to all nodes → each daemon reports supported types (t3.micro/small/medium/large) with vCPU/memory specs → gateway deduplicates and returns | 1. List all instance types<br>2. Filter by specific type<br>3. Filter with `capacity=true` shows available slots<br>4. Verify vCPU/memory specs match hardware | **DONE** |
-| `modify-instance-attribute` | `--instance-id`, `--instance-type`, `--user-data` | `--disable-api-termination`, `--ebs-optimized`, `--source-dest-check`, `--instance-initiated-shutdown-behavior`, `--block-device-mappings`, `--groups`, `--ena-support`, `--sriov-net-support` | Instance must be stopped (in NATS KV) | Gateway validates input (exactly one attribute per call, instance ID format) → NATS `ec2.ModifyInstanceAttribute` with `hive-workers` queue group → daemon loads stopped instance from JetStream KV → applies attribute change → writes back to KV → returns `{}` on success. **InstanceType**: updates vm.InstanceType, Config, and Instance fields; clears StateReason (enables recovery from instance-type-missing bug). **UserData**: stores decoded content in vm.UserData and re-encodes to base64 for RunInstancesInput (cloud-init on next start). No instance type pre-validation (matches AWS — invalid types accepted, fail at StartInstances time). | 1. Change instance type while stopped<br>2. Change user data while stopped<br>3. Modify running instance (error: NotFound — running instances not in KV)<br>4. Instance not found (error: InvalidInstanceID.NotFound)<br>5. Instance not stopped (error: IncorrectInstanceState)<br>6. Invalid instance type accepted (fails on start with InsufficientInstanceCapacity)<br>7. StateReason cleared on type change (recovery from capacity-unavailable)<br>8. Missing/malformed instance ID (error: InvalidInstanceID.Malformed)<br>9. No attribute set (error: InvalidParameterValue)<br>10. Multiple attributes in one call (error: InvalidParameterValue) | **DONE** |
+| `modify-instance-attribute` | `--instance-id`, `--instance-type`, `--user-data` | `--disable-api-termination`, `--ebs-optimized`, `--source-dest-check`, `--instance-initiated-shutdown-behavior`, `--block-device-mappings`, `--groups`, `--ena-support`, `--sriov-net-support` | Instance must be stopped (in NATS KV) | Gateway validates input (exactly one attribute per call, instance ID format) → NATS `ec2.ModifyInstanceAttribute` with `spinifex-workers` queue group → daemon loads stopped instance from JetStream KV → applies attribute change → writes back to KV → returns `{}` on success. **InstanceType**: updates vm.InstanceType, Config, and Instance fields; clears StateReason (enables recovery from instance-type-missing bug). **UserData**: stores decoded content in vm.UserData and re-encodes to base64 for RunInstancesInput (cloud-init on next start). No instance type pre-validation (matches AWS — invalid types accepted, fail at StartInstances time). | 1. Change instance type while stopped<br>2. Change user data while stopped<br>3. Modify running instance (error: NotFound — running instances not in KV)<br>4. Instance not found (error: InvalidInstanceID.NotFound)<br>5. Instance not stopped (error: IncorrectInstanceState)<br>6. Invalid instance type accepted (fails on start with InsufficientInstanceCapacity)<br>7. StateReason cleared on type change (recovery from capacity-unavailable)<br>8. Missing/malformed instance ID (error: InvalidInstanceID.Malformed)<br>9. No attribute set (error: InvalidParameterValue)<br>10. Multiple attributes in one call (error: InvalidParameterValue) | **DONE** |
 | `get-console-output` | `--instance-id` | `--latest` (always returns latest), `--dry-run` | Instance must be running on a node | Gateway sends NATS `ec2.{instanceId}.GetConsoleOutput` (per-instance topic, routed to owning node) → daemon reads console log file from disk → returns last 64KB base64-encoded with timestamp. Always available regardless of serial console access setting (matches AWS behavior). | 1. Get output from running instance<br>2. Empty log file returns empty output<br>3. Instance not found (error: InvalidInstanceID.NotFound) | **DONE** |
 | `monitor-instances` | — | `--instance-ids` | Instance must exist | Enable basic monitoring (CPU, disk, network) → store metrics in NATS KV → return monitoring state | 1. Enable monitoring<br>2. Verify monitoring state in describe-instances | **NOT STARTED** |
 | `unmonitor-instances` | — | `--instance-ids` | Instance must exist | Disable detailed monitoring → revert to basic monitoring → return monitoring state | 1. Disable monitoring<br>2. Verify monitoring state reverts in describe-instances | **NOT STARTED** |
@@ -121,7 +121,7 @@ Operational commands for inspecting cluster state. These fan out NATS requests t
 |---------|-------------------|---------------|---------------|-------------|------------|--------|
 | `describe-volumes` | `--volume-ids` (fast-path lookup), `DeleteOnTermination` (from persisted VolumeMetadata) | `--filters`, `--max-results`, `--next-token`, `--dry-run` | None | NATS `ec2.DescribeVolumes` → daemon queries viperblock for volume metadata → returns volume list with state, size, attachments, type, DeleteOnTermination flag | 1. List all volumes<br>2. Filter by volume ID<br>3. Filter by attachment state<br>4. Non-existent volume returns empty<br>5. DeleteOnTermination reflects persisted value | **DONE** |
 | `modify-volume` | `--volume-id`, `--size`, `--volume-type`, `--iops` | `--throughput`, `--dry-run`, `--multi-attach-enabled` | Volume must exist | NATS `ec2.ModifyVolume` → daemon sends resize request to viperblock → NBD does not support live resize, instance must be stopped → returns modification state | 1. Increase volume size<br>2. Modify volume type<br>3. Decrease size (error - not supported)<br>4. Modify attached volume (requires stop/start) | **DONE** |
-| `create-volume` | `--size`, `--availability-zone`, `--volume-type` (gp3 only), `--snapshot-id` (creates volume from snapshot) | `--iops` (hardcoded 3000), `--encrypted` (hardcoded false), `--throughput`, `--tag-specifications` | Valid AZ configured via `hive init` | Gateway validates input → NATS `ec2.CreateVolume` → daemon generates vol-ID via viperblock → creates volume (empty or from snapshot) of specified size → persists config.json to Predastore S3 → returns vol-ID with state=available | 1. Create 80GB gp3 volume<br>2. Boundary sizes (1 GiB min, 16384 GiB max)<br>3. Invalid AZ (error)<br>4. Verify volume in describe-volumes<br>5. Unsupported volume type (error - only gp3)<br>6. Size out of range (error)<br>7. Create from snapshot | **DONE** |
+| `create-volume` | `--size`, `--availability-zone`, `--volume-type` (gp3 only), `--snapshot-id` (creates volume from snapshot) | `--iops` (hardcoded 3000), `--encrypted` (hardcoded false), `--throughput`, `--tag-specifications` | Valid AZ configured via `spinifex init` | Gateway validates input → NATS `ec2.CreateVolume` → daemon generates vol-ID via viperblock → creates volume (empty or from snapshot) of specified size → persists config.json to Predastore S3 → returns vol-ID with state=available | 1. Create 80GB gp3 volume<br>2. Boundary sizes (1 GiB min, 16384 GiB max)<br>3. Invalid AZ (error)<br>4. Verify volume in describe-volumes<br>5. Unsupported volume type (error - only gp3)<br>6. Size out of range (error)<br>7. Create from snapshot | **DONE** |
 | `delete-volume` | `--volume-id` | `--dry-run` | Volume must exist and be detached (state=available) | Gateway validates vol- prefix → NATS `ec2.DeleteVolume` → daemon confirms state=available and no AttachedInstance → NATS `ebs.delete` to viperblockd (stops nbdkit/WAL) → deletes S3 objects under vol-id/, vol-id-efi/, vol-id-cloudinit/ → returns success | 1. Delete detached volume<br>2. Delete attached volume (error: VolumeInUse)<br>3. Delete non-existent volume (error: InvalidVolume.NotFound)<br>4. Verify volume gone from describe-volumes<br>5. Malformed volume ID (error: InvalidVolumeID.Malformed)<br>6. Double delete (idempotent NotFound) | **DONE** |
 | `attach-volume` | `--volume-id`, `--instance-id`, `--device` (optional, auto-assigns `/dev/sd[f-p]`) | `--dry-run` | Volume must exist (available), instance must exist (running) | Gateway sends to `ec2.cmd.{instanceId}` → daemon validates volume (Predastore) → `ebs.mount` via NATS (viperblock starts NBD server) → QMP `blockdev-add` (nbd-{volId}) → QMP `device_add` (virtio-blk-pci, vdisk-{volId}) → three-phase rollback on failure → update EBSRequests + BlockDeviceMappings → persist to JetStream + Predastore → respond with VolumeAttachment | 1. Attach volume to running instance<br>2. Auto-assign device name<br>3. Attach already-attached volume (VolumeInUse)<br>4. Attach to non-existent instance (InvalidInstanceID.NotFound)<br>5. Attach to stopped instance (IncorrectInstanceState)<br>6. Volume not found (InvalidVolume.NotFound)<br>7. All device slots full (AttachmentLimitExceeded)<br>8. Volume persists across stop/start | **DONE** |
 | `detach-volume` | `--volume-id`, `--instance-id` (optional, resolved via DescribeVolumes), `--device` (optional cross-check), `--force` | `--dry-run` | Volume must be attached, instance must be running | Gateway resolves InstanceId if omitted (via DescribeVolumes) → sends to `ec2.cmd.{instanceId}` → daemon validates (running, attached, not boot/EFI/CloudInit, device match) → three-phase hot-unplug: QMP `device_del` (force continues on failure) → QMP `blockdev-del` (abort if fails, preserves state to prevent double-attach) → `ebs.unmount` via NATS (best-effort) → remove from EBSRequests + BlockDeviceMappings → update volume metadata to available → persist state → respond with VolumeAttachment (state=detaching) | 1. Detach with explicit InstanceId<br>2. Detach without InstanceId (gateway resolution)<br>3. Detach with correct --device cross-check<br>4. Missing VolumeId (InvalidParameterValue)<br>5. Volume not attached (IncorrectState)<br>6. Nonexistent volume (InvalidVolume.NotFound)<br>7. Nonexistent instance (InvalidInstanceID.NotFound)<br>8. Instance not running (IncorrectInstanceState)<br>9. Device mismatch (InvalidParameterValue)<br>10. Boot volume protection (OperationNotPermitted)<br>11. Force flag (continues past device_del failure)<br>12. Volume reusability (re-attach after detach) | **DONE** |
@@ -150,8 +150,8 @@ Operational commands for inspecting cluster state. These fan out NATS requests t

 | Command | Implemented Flags | Missing Flags | Prerequisites | Basic Logic | Test Cases | Status |
 |---------|-------------------|---------------|---------------|-------------|------------|--------|
-| `describe-regions` | *(returns configured region, endpoint, opt-in status from config — input params ignored)* | `--region-names`, `--filters`, `--all-regions`, `--dry-run` | None | Return configured region from hive init config with Endpoint and OptInStatus → local-only response, no NATS | 1. List all regions<br>2. Filter by region name<br>3. Verify endpoint URL returned<br>4. Verify OptInStatus returned | **DONE** |
-| `describe-availability-zones` | *(returns configured AZ, region, zone ID, state, opt-in status from config — input params ignored)* | `--zone-names`, `--filters`, `--all-availability-zones` | None | Return configured AZ from hive init config with zone ID, state, group name, network border group → local-only response, no NATS | 1. List all AZs<br>2. Filter by zone name<br>3. Verify zone state is available<br>4. Verify region name matches config | **DONE** |
+| `describe-regions` | *(returns configured region, endpoint, opt-in status from config — input params ignored)* | `--region-names`, `--filters`, `--all-regions`, `--dry-run` | None | Return configured region from spinifex init config with Endpoint and OptInStatus → local-only response, no NATS | 1. List all regions<br>2. Filter by region name<br>3. Verify endpoint URL returned<br>4. Verify OptInStatus returned | **DONE** |
+| `describe-availability-zones` | *(returns configured AZ, region, zone ID, state, opt-in status from config — input params ignored)* | `--zone-names`, `--filters`, `--all-availability-zones` | None | Return configured AZ from spinifex init config with zone ID, state, group name, network border group → local-only response, no NATS | 1. List all AZs<br>2. Filter by zone name<br>3. Verify zone state is available<br>4. Verify region name matches config | **DONE** |

 ### EC2 - Account Attributes

@@ -165,12 +165,12 @@ Persistence layer works (NATS JetStream KV), but stored values are not yet enfor

 | Command | Implemented Flags | Missing Flags | Prerequisites | Basic Logic | Test Cases | Status |
 |---------|-------------------|---------------|---------------|-------------|------------|--------|
-| `enable-ebs-encryption-by-default` | *(no flags needed)* | `--dry-run` | None | Gateway validates input → NATS `ec2.EnableEbsEncryptionByDefault` with `hive-workers` queue group → daemon stores `EbsEncryptionByDefault=true` in JetStream KV (`hive-ec2-account-settings` bucket) → return `EbsEncryptionByDefault=true`. Enforcement deferred: stored value not yet checked by CreateVolume/CreateSnapshot. | 1. Enable encryption<br>2. Verify via get | **STARTED** (enforcement pending) |
-| `disable-ebs-encryption-by-default` | *(no flags needed)* | `--dry-run` | None | Gateway validates input → NATS `ec2.DisableEbsEncryptionByDefault` with `hive-workers` queue group → daemon stores `EbsEncryptionByDefault=false` in JetStream KV → return `EbsEncryptionByDefault=false`. | 1. Disable encryption<br>2. Verify via get | **STARTED** (enforcement pending) |
-| `get-ebs-encryption-by-default` | *(no flags needed)* | `--dry-run` | None | Gateway validates input → NATS `ec2.GetEbsEncryptionByDefault` with `hive-workers` queue group → daemon reads `EbsEncryptionByDefault` from JetStream KV → return current state. | 1. Get default state<br>2. Verify matches last enable/disable | **STARTED** (enforcement pending) |
-| `enable-serial-console-access` | *(no flags needed)* | `--dry-run` | None | Gateway validates input → NATS `ec2.EnableSerialConsoleAccess` with `hive-workers` queue group → daemon stores `SerialConsoleAccessEnabled=true` in JetStream KV (`hive-ec2-account-settings` bucket) → return enabled=true. Stored for future interactive serial console support (not currently enforced by any operation). | 1. Enable access<br>2. Verify via get | **STARTED** (enforcement pending) |
-| `disable-serial-console-access` | *(no flags needed)* | `--dry-run` | None | Gateway validates input → NATS `ec2.DisableSerialConsoleAccess` with `hive-workers` queue group → daemon stores `SerialConsoleAccessEnabled=false` in JetStream KV → return enabled=false. Stored for future interactive serial console support (not currently enforced by any operation). | 1. Disable access<br>2. Verify via get | **STARTED** (enforcement pending) |
-| `get-serial-console-access-status` | *(no flags needed)* | `--dry-run` | None | Gateway validates input → NATS `ec2.GetSerialConsoleAccessStatus` with `hive-workers` queue group → daemon reads `SerialConsoleAccessEnabled` from JetStream KV → return current state. | 1. Get current status<br>2. Verify matches last enable/disable | **DONE** |
+| `enable-ebs-encryption-by-default` | *(no flags needed)* | `--dry-run` | None | Gateway validates input → NATS `ec2.EnableEbsEncryptionByDefault` with `spinifex-workers` queue group → daemon stores `EbsEncryptionByDefault=true` in JetStream KV (`spinifex-ec2-account-settings` bucket) → return `EbsEncryptionByDefault=true`. Enforcement deferred: stored value not yet checked by CreateVolume/CreateSnapshot. | 1. Enable encryption<br>2. Verify via get | **STARTED** (enforcement pending) |
+| `disable-ebs-encryption-by-default` | *(no flags needed)* | `--dry-run` | None | Gateway validates input → NATS `ec2.DisableEbsEncryptionByDefault` with `spinifex-workers` queue group → daemon stores `EbsEncryptionByDefault=false` in JetStream KV → return `EbsEncryptionByDefault=false`. | 1. Disable encryption<br>2. Verify via get | **STARTED** (enforcement pending) |
+| `get-ebs-encryption-by-default` | *(no flags needed)* | `--dry-run` | None | Gateway validates input → NATS `ec2.GetEbsEncryptionByDefault` with `spinifex-workers` queue group → daemon reads `EbsEncryptionByDefault` from JetStream KV → return current state. | 1. Get default state<br>2. Verify matches last enable/disable | **STARTED** (enforcement pending) |
+| `enable-serial-console-access` | *(no flags needed)* | `--dry-run` | None | Gateway validates input → NATS `ec2.EnableSerialConsoleAccess` with `spinifex-workers` queue group → daemon stores `SerialConsoleAccessEnabled=true` in JetStream KV (`spinifex-ec2-account-settings` bucket) → return enabled=true. Stored for future interactive serial console support (not currently enforced by any operation). | 1. Enable access<br>2. Verify via get | **STARTED** (enforcement pending) |
+| `disable-serial-console-access` | *(no flags needed)* | `--dry-run` | None | Gateway validates input → NATS `ec2.DisableSerialConsoleAccess` with `spinifex-workers` queue group → daemon stores `SerialConsoleAccessEnabled=false` in JetStream KV → return enabled=false. Stored for future interactive serial console support (not currently enforced by any operation). | 1. Disable access<br>2. Verify via get | **STARTED** (enforcement pending) |
+| `get-serial-console-access-status` | *(no flags needed)* | `--dry-run` | None | Gateway validates input → NATS `ec2.GetSerialConsoleAccessStatus` with `spinifex-workers` queue group → daemon reads `SerialConsoleAccessEnabled` from JetStream KV → return current state. | 1. Get current status<br>2. Verify matches last enable/disable | **DONE** |
 | `enable-snapshot-block-public-access` | — | `--state` | None | Store snapshot block public access state in JetStream KV | 1. Enable with block-all-sharing<br>2. Enable with block-new-sharing | **NOT STARTED** (enforcement pending) |
 | `disable-snapshot-block-public-access` | — | `--dry-run` | None | Clear snapshot block public access state in JetStream KV | 1. Disable access | **NOT STARTED** (enforcement pending) |
 | `get-snapshot-block-public-access-state` | — | `--dry-run` | None | Read snapshot block public access state from JetStream KV | 1. Get current state | **NOT STARTED** (enforcement pending) |
@@ -182,13 +182,13 @@ Persistence layer works (NATS JetStream KV), but stored values are not yet enfor

 ### EC2 - Egress-Only Internet Gateway

-Gateway routing and KV CRUD are wired up but no OVN/OVS integration exists. EIGWs are stored in `hive-eigw` KV bucket but have no effect on network topology (no vpcd events published, unlike IGW which publishes `vpc.igw-attach`/`vpc.igw-detach`).
+Gateway routing and KV CRUD are wired up but no OVN/OVS integration exists. EIGWs are stored in `spinifex-eigw` KV bucket but have no effect on network topology (no vpcd events published, unlike IGW which publishes `vpc.igw-attach`/`vpc.igw-detach`).

 | Command | Implemented Flags | Missing Flags | Prerequisites | Basic Logic | Test Cases | Status |
 |---------|-------------------|---------------|---------------|-------------|------------|--------|
-| `create-egress-only-internet-gateway` | `--vpc-id`, `--tag-specifications` | `--client-token`, `--dry-run` | VPC must exist | Gateway validates VpcId → NATS `ec2.CreateEgressOnlyInternetGateway` → daemon generates eigw-ID → creates EgressOnlyIGWRecord in `hive-eigw` KV bucket with state=attached (always attached at creation, unlike IGW) → returns EgressOnlyInternetGateway with attachment | 1. Create with valid VpcId<br>2. Missing VpcId (error: MissingParameter)<br>3. Create with inline tags<br>4. Verify ID format eigw-{16hex} | **STARTED** (KV only, no OVN) |
-| `delete-egress-only-internet-gateway` | `--egress-only-internet-gateway-id` | `--dry-run` | EIGW must exist | NATS `ec2.DeleteEgressOnlyInternetGateway` → daemon verifies EIGW exists in KV → deletes from `hive-eigw` KV → returns ReturnCode=true. No detach required (unlike IGW). | 1. Delete existing EIGW<br>2. Delete non-existent EIGW (error)<br>3. Missing ID (error: MissingParameter) | **STARTED** (KV only, no OVN) |
-| `describe-egress-only-internet-gateways` | `--egress-only-internet-gateway-ids` | `--filters`, `--max-results`, `--next-token`, `--dry-run` | None | NATS `ec2.DescribeEgressOnlyInternetGateways` → daemon lists all keys from `hive-eigw` KV bucket → filters by ID if specified → always includes Attachments array → returns list | 1. Describe all EIGWs<br>2. Filter by specific ID<br>3. Non-existent ID returns empty list | **STARTED** (KV only, no OVN) |
+| `create-egress-only-internet-gateway` | `--vpc-id`, `--tag-specifications` | `--client-token`, `--dry-run` | VPC must exist | Gateway validates VpcId → NATS `ec2.CreateEgressOnlyInternetGateway` → daemon generates eigw-ID → creates EgressOnlyIGWRecord in `spinifex-eigw` KV bucket with state=attached (always attached at creation, unlike IGW) → returns EgressOnlyInternetGateway with attachment | 1. Create with valid VpcId<br>2. Missing VpcId (error: MissingParameter)<br>3. Create with inline tags<br>4. Verify ID format eigw-{16hex} | **STARTED** (KV only, no OVN) |
+| `delete-egress-only-internet-gateway` | `--egress-only-internet-gateway-id` | `--dry-run` | EIGW must exist | NATS `ec2.DeleteEgressOnlyInternetGateway` → daemon verifies EIGW exists in KV → deletes from `spinifex-eigw` KV → returns ReturnCode=true. No detach required (unlike IGW). | 1. Delete existing EIGW<br>2. Delete non-existent EIGW (error)<br>3. Missing ID (error: MissingParameter) | **STARTED** (KV only, no OVN) |
+| `describe-egress-only-internet-gateways` | `--egress-only-internet-gateway-ids` | `--filters`, `--max-results`, `--next-token`, `--dry-run` | None | NATS `ec2.DescribeEgressOnlyInternetGateways` → daemon lists all keys from `spinifex-eigw` KV bucket → filters by ID if specified → always includes Attachments array → returns list | 1. Describe all EIGWs<br>2. Filter by specific ID<br>3. Non-existent ID returns empty list | **STARTED** (KV only, no OVN) |

 ### EC2 - Placement Groups

@@ -254,19 +254,19 @@ Gateway routing and KV CRUD are wired up but no OVN/OVS integration exists. EIGW

 ### EC2 - VPC Networking (Core)

-Requires OVN/OVS (`apt install openvswitch-switch ovn-host`). VPC/Subnet/ENI CRUD stores metadata in NATS KV and publishes events to vpcd (the network topology daemon) which translates to OVN logical switches, ports, and routers. Single AZ for Hive v1. IPAM uses CAS-based allocation from NATS KV (`hive-vpc-ipam` bucket).
+Requires OVN/OVS (`apt install openvswitch-switch ovn-host`). VPC/Subnet/ENI CRUD stores metadata in NATS KV and publishes events to vpcd (the network topology daemon) which translates to OVN logical switches, ports, and routers. Single AZ for Spinifex v1. IPAM uses CAS-based allocation from NATS KV (`spinifex-vpc-ipam` bucket).

 | Command | Implemented Flags | Missing Flags | Prerequisites | Basic Logic | Test Cases | Status |
 |---------|-------------------|---------------|---------------|-------------|------------|--------|
-| `create-vpc` | `--cidr-block`, `--tag-specifications` | `--instance-tenancy`, `--dry-run` | None | Gateway validates CidrBlock (required, valid CIDR, /16–/28 prefix) → NATS `ec2.CreateVpc` → daemon allocates unique VNI from `hive-vpc-vni-counter` KV → generates vpc-ID → stores VPCRecord in `hive-vpc-vpcs` KV → publishes `vpc.create` event to vpcd (creates OVN logical switch) → returns VPC with state=available | 1. Create VPC with /16 CIDR<br>2. Invalid CIDR format (error: InvalidVpcRange)<br>3. CIDR prefix outside /16–/28 (error)<br>4. Verify in describe-vpcs<br>5. Tags applied at creation | **DONE** |
-| `delete-vpc` | `--vpc-id` | `--dry-run` | VPC must be empty (no subnets) | Gateway validates VpcId → NATS `ec2.DeleteVpc` → daemon checks for dependent subnets in `hive-vpc-subnets` KV → returns DependencyViolation if subnets exist → deletes from `hive-vpc-vpcs` KV → publishes `vpc.delete` event to vpcd (removes OVN resources) | 1. Delete empty VPC<br>2. Delete VPC with subnets (DependencyViolation)<br>3. Delete non-existent VPC (error) | **DONE** |
-| `describe-vpcs` | `--vpc-ids` | `--filters`, `--max-results`, `--dry-run` | None | NATS `ec2.DescribeVpcs` → daemon lists all keys from `hive-vpc-vpcs` KV → filters by VPC IDs if specified → returns error for non-existent requested IDs → returns VPC list with CIDR, state, CIDR associations | 1. List all VPCs<br>2. Filter by VPC ID<br>3. Non-existent VPC ID returns error | **DONE** |
+| `create-vpc` | `--cidr-block`, `--tag-specifications` | `--instance-tenancy`, `--dry-run` | None | Gateway validates CidrBlock (required, valid CIDR, /16–/28 prefix) → NATS `ec2.CreateVpc` → daemon allocates unique VNI from `spinifex-vpc-vni-counter` KV → generates vpc-ID → stores VPCRecord in `spinifex-vpc-vpcs` KV → publishes `vpc.create` event to vpcd (creates OVN logical switch) → returns VPC with state=available | 1. Create VPC with /16 CIDR<br>2. Invalid CIDR format (error: InvalidVpcRange)<br>3. CIDR prefix outside /16–/28 (error)<br>4. Verify in describe-vpcs<br>5. Tags applied at creation | **DONE** |
+| `delete-vpc` | `--vpc-id` | `--dry-run` | VPC must be empty (no subnets) | Gateway validates VpcId → NATS `ec2.DeleteVpc` → daemon checks for dependent subnets in `spinifex-vpc-subnets` KV → returns DependencyViolation if subnets exist → deletes from `spinifex-vpc-vpcs` KV → publishes `vpc.delete` event to vpcd (removes OVN resources) | 1. Delete empty VPC<br>2. Delete VPC with subnets (DependencyViolation)<br>3. Delete non-existent VPC (error) | **DONE** |
+| `describe-vpcs` | `--vpc-ids` | `--filters`, `--max-results`, `--dry-run` | None | NATS `ec2.DescribeVpcs` → daemon lists all keys from `spinifex-vpc-vpcs` KV → filters by VPC IDs if specified → returns error for non-existent requested IDs → returns VPC list with CIDR, state, CIDR associations | 1. List all VPCs<br>2. Filter by VPC ID<br>3. Non-existent VPC ID returns error | **DONE** |
 | `modify-vpc-attribute` | — | `--vpc-id`, `--enable-dns-support`, `--enable-dns-hostnames` | VPC must exist | NATS `ec2.ModifyVpcAttribute` → daemon updates VPC attribute in KV → return success | 1. Enable DNS support<br>2. Enable DNS hostnames<br>3. Missing VPC ID (error) | **NOT STARTED** |
 | `associate-vpc-cidr-block` | — | `--vpc-id`, `--cidr-block` | VPC must exist | NATS `ec2.AssociateVpcCidrBlock` → daemon adds secondary CIDR to VPC metadata → return association | 1. Add secondary CIDR<br>2. Overlapping CIDR (error)<br>3. Max CIDR blocks exceeded (error) | **NOT STARTED** |
 | `disassociate-vpc-cidr-block` | — | `--association-id` | Association must exist | NATS `ec2.DisassociateVpcCidrBlock` → daemon removes secondary CIDR from VPC → return success | 1. Remove secondary CIDR<br>2. Remove primary CIDR (error) | **NOT STARTED** |
-| `create-subnet` | `--vpc-id`, `--cidr-block`, `--availability-zone`, `--tag-specifications` | `--dry-run` | VPC must exist | Gateway validates VpcId + CidrBlock (required, valid CIDR, /16–/28 prefix) → NATS `ec2.CreateSubnet` → daemon verifies parent VPC exists → validates subnet CIDR is within VPC CIDR range → checks for overlapping subnets in same VPC → calculates available IPs (total hosts - 5 AWS-reserved: .0/.1/.2/.3/.255) → generates subnet-ID → stores SubnetRecord in `hive-vpc-subnets` KV → publishes `vpc.create-subnet` event to vpcd → defaults AZ from config if omitted | 1. Create subnet within VPC CIDR<br>2. Subnet CIDR outside VPC range (error: InvalidSubnetRange)<br>3. Overlapping subnet CIDRs (error: InvalidSubnetConflict)<br>4. CIDR prefix outside /16–/28 (error)<br>5. Missing VPC or CIDR (error: MissingParameter) | **DONE** |
-| `delete-subnet` | `--subnet-id` | `--dry-run` | Subnet must exist | NATS `ec2.DeleteSubnet` → daemon verifies subnet exists → deletes from `hive-vpc-subnets` KV → publishes `vpc.delete-subnet` event to vpcd | 1. Delete existing subnet<br>2. Delete non-existent subnet (error) | **DONE** |
-| `describe-subnets` | `--subnet-ids`, `--filters` (vpc-id) | `--max-results`, `--dry-run` | None | NATS `ec2.DescribeSubnets` → daemon lists all keys from `hive-vpc-subnets` KV → applies vpc-id filter if present → filters by subnet IDs if specified → recalculates available IPs from CIDR → returns error for non-existent requested IDs | 1. List all subnets<br>2. Filter by VPC ID<br>3. Filter by subnet ID<br>4. Non-existent subnet returns error | **DONE** |
+| `create-subnet` | `--vpc-id`, `--cidr-block`, `--availability-zone`, `--tag-specifications` | `--dry-run` | VPC must exist | Gateway validates VpcId + CidrBlock (required, valid CIDR, /16–/28 prefix) → NATS `ec2.CreateSubnet` → daemon verifies parent VPC exists → validates subnet CIDR is within VPC CIDR range → checks for overlapping subnets in same VPC → calculates available IPs (total hosts - 5 AWS-reserved: .0/.1/.2/.3/.255) → generates subnet-ID → stores SubnetRecord in `spinifex-vpc-subnets` KV → publishes `vpc.create-subnet` event to vpcd → defaults AZ from config if omitted | 1. Create subnet within VPC CIDR<br>2. Subnet CIDR outside VPC range (error: InvalidSubnetRange)<br>3. Overlapping subnet CIDRs (error: InvalidSubnetConflict)<br>4. CIDR prefix outside /16–/28 (error)<br>5. Missing VPC or CIDR (error: MissingParameter) | **DONE** |
+| `delete-subnet` | `--subnet-id` | `--dry-run` | Subnet must exist | NATS `ec2.DeleteSubnet` → daemon verifies subnet exists → deletes from `spinifex-vpc-subnets` KV → publishes `vpc.delete-subnet` event to vpcd | 1. Delete existing subnet<br>2. Delete non-existent subnet (error) | **DONE** |
+| `describe-subnets` | `--subnet-ids`, `--filters` (vpc-id) | `--max-results`, `--dry-run` | None | NATS `ec2.DescribeSubnets` → daemon lists all keys from `spinifex-vpc-subnets` KV → applies vpc-id filter if present → filters by subnet IDs if specified → recalculates available IPs from CIDR → returns error for non-existent requested IDs | 1. List all subnets<br>2. Filter by VPC ID<br>3. Filter by subnet ID<br>4. Non-existent subnet returns error | **DONE** |
 | `modify-subnet-attribute` | — | `--subnet-id`, `--map-public-ip-on-launch`, `--assign-ipv6-address-on-creation` | Subnet must exist | NATS `ec2.ModifySubnetAttribute` → daemon updates subnet attribute in KV → return success | 1. Enable auto-assign public IP<br>2. Missing subnet ID (error) | **NOT STARTED** |
 | `associate-subnet-cidr-block` | — | `--subnet-id`, `--ipv6-cidr-block` | Subnet must exist | NATS `ec2.AssociateSubnetCidrBlock` → daemon adds IPv6 CIDR to subnet → return association | 1. Add IPv6 CIDR<br>2. Missing subnet ID (error) | **NOT STARTED** |
 | `disassociate-subnet-cidr-block` | — | `--association-id` | Association must exist | NATS `ec2.DisassociateSubnetCidrBlock` → daemon removes IPv6 CIDR from subnet → return success | 1. Remove IPv6 CIDR<br>2. Invalid association (error) | **NOT STARTED** |
@@ -277,11 +277,11 @@ Requires OVN/OVS (`apt install openvswitch-switch ovn-host`). VPC/Subnet/ENI CRU
 | `authorize-security-group-egress` | — | `--group-id`, `--protocol`, `--port`, `--cidr` | SG must exist | Add outbound rule → create OVS OpenFlow rule → persist to metadata | 1. Allow HTTPS outbound<br>2. Restrict to specific CIDR | **NOT STARTED** |
 | `revoke-security-group-ingress` | — | `--group-id`, `--protocol`, `--port`, `--cidr` | SG must exist, rule must exist | Remove inbound rule → delete OVS OpenFlow rule → update metadata | 1. Revoke existing rule<br>2. Revoke non-existent rule (error) | **NOT STARTED** |
 | `revoke-security-group-egress` | — | `--group-id`, `--protocol`, `--port`, `--cidr` | SG must exist, rule must exist | Remove outbound rule → delete OVS OpenFlow rule → update metadata | 1. Revoke existing rule<br>2. Revoke non-existent rule (error) | **NOT STARTED** |
-| `create-internet-gateway` | `--tag-specifications` | `--dry-run` | None | NATS `ec2.CreateInternetGateway` → daemon generates igw-ID → creates IGWRecord in `hive-igw` KV bucket with state=available (not attached) → returns InternetGateway with empty Attachments | 1. Create IGW<br>2. Verify in describe-internet-gateways<br>3. Tags applied at creation | **DONE** |
+| `create-internet-gateway` | `--tag-specifications` | `--dry-run` | None | NATS `ec2.CreateInternetGateway` → daemon generates igw-ID → creates IGWRecord in `spinifex-igw` KV bucket with state=available (not attached) → returns InternetGateway with empty Attachments | 1. Create IGW<br>2. Verify in describe-internet-gateways<br>3. Tags applied at creation | **DONE** |
 | `attach-internet-gateway` | `--internet-gateway-id`, `--vpc-id` | `--dry-run` | IGW and VPC must exist | NATS `ec2.AttachInternetGateway` → daemon validates IGW exists and is not already attached (ResourceAlreadyAssociated) → sets VpcId on record → state=attached → publishes `vpc.igw-attach` event to vpcd (creates OVN external switch, gateway port, SNAT rules) | 1. Attach IGW to VPC<br>2. Attach already-attached IGW (ResourceAlreadyAssociated)<br>3. Non-existent IGW (error)<br>4. Missing params (MissingParameter) | **DONE** |
 | `detach-internet-gateway` | `--internet-gateway-id`, `--vpc-id` | `--dry-run` | IGW must be attached to specified VPC | NATS `ec2.DetachInternetGateway` → daemon validates IGW exists and is attached to specified VPC (GatewayNotAttached if wrong VPC) → clears VpcId → state=available → publishes `vpc.igw-detach` event to vpcd (removes OVN resources) | 1. Detach attached IGW<br>2. Detach from wrong VPC (GatewayNotAttached)<br>3. Detach unattached IGW (error) | **DONE** |
-| `delete-internet-gateway` | `--internet-gateway-id` | `--dry-run` | IGW must be detached | NATS `ec2.DeleteInternetGateway` → daemon validates IGW exists and VpcId is empty (DependencyViolation if attached) → deletes from `hive-igw` KV | 1. Delete detached IGW<br>2. Delete attached IGW (DependencyViolation)<br>3. Delete non-existent (error) | **DONE** |
-| `describe-internet-gateways` | `--internet-gateway-ids` | `--filters`, `--max-results`, `--dry-run` | None | NATS `ec2.DescribeInternetGateways` → daemon lists all keys from `hive-igw` KV → filters by IGW IDs if specified → returns list with Attachments array (if attached) | 1. List all IGWs<br>2. Filter by IGW ID<br>3. Verify attachment info | **DONE** |
+| `delete-internet-gateway` | `--internet-gateway-id` | `--dry-run` | IGW must be detached | NATS `ec2.DeleteInternetGateway` → daemon validates IGW exists and VpcId is empty (DependencyViolation if attached) → deletes from `spinifex-igw` KV | 1. Delete detached IGW<br>2. Delete attached IGW (DependencyViolation)<br>3. Delete non-existent (error) | **DONE** |
+| `describe-internet-gateways` | `--internet-gateway-ids` | `--filters`, `--max-results`, `--dry-run` | None | NATS `ec2.DescribeInternetGateways` → daemon lists all keys from `spinifex-igw` KV → filters by IGW IDs if specified → returns list with Attachments array (if attached) | 1. List all IGWs<br>2. Filter by IGW ID<br>3. Verify attachment info | **DONE** |

 ### EC2 - Route Tables

@@ -365,13 +365,13 @@ Requires OVN/OVS (`apt install openvswitch-switch ovn-host`). VPC/Subnet/ENI CRU

 ### EC2 - Network Interfaces

-ENIs are managed via `hive-vpc-enis` KV bucket with CAS-based IPAM allocation from `hive-vpc-ipam`. ENIs are auto-created by `run-instances --subnet-id` and auto-deleted on termination. MAC addresses are deterministically generated from the ENI ID. Attach/detach are internal operations used by instance lifecycle — no standalone attach/detach API yet.
+ENIs are managed via `spinifex-vpc-enis` KV bucket with CAS-based IPAM allocation from `spinifex-vpc-ipam`. ENIs are auto-created by `run-instances --subnet-id` and auto-deleted on termination. MAC addresses are deterministically generated from the ENI ID. Attach/detach are internal operations used by instance lifecycle — no standalone attach/detach API yet.

 | Command | Implemented Flags | Missing Flags | Prerequisites | Basic Logic | Test Cases | Status |
 |---------|-------------------|---------------|---------------|-------------|------------|--------|
-| `create-network-interface` | `--subnet-id`, `--private-ip-address`, `--description`, `--tag-specifications` | `--groups`, `--dry-run` | Subnet must exist | Gateway validates SubnetId (required) → NATS `ec2.CreateNetworkInterface` → daemon verifies subnet exists in `hive-vpc-subnets` KV → if no PrivateIpAddress, allocates from IPAM pool (CAS-based, up to 5 retries) → generates eni-ID → generates deterministic MAC from ENI ID → stores ENIRecord in `hive-vpc-enis` KV → publishes `vpc.create-port` event to vpcd (creates OVN logical port) → returns NetworkInterface with status=available | 1. Create in subnet (auto-allocate IP)<br>2. Create with specific private IP<br>3. Missing subnet ID (MissingParameter)<br>4. Non-existent subnet (error)<br>5. Tags applied at creation | **DONE** |
-| `delete-network-interface` | `--network-interface-id` | `--dry-run` | Must not be attached (status != in-use) | NATS `ec2.DeleteNetworkInterface` → daemon verifies ENI exists and status is not "in-use" (InvalidNetworkInterfaceInUse) → releases IP back to IPAM pool → deletes from `hive-vpc-enis` KV → publishes `vpc.delete-port` event to vpcd | 1. Delete detached ENI<br>2. Delete attached ENI (InvalidNetworkInterfaceInUse)<br>3. Delete non-existent (error) | **DONE** |
-| `describe-network-interfaces` | `--network-interface-ids`, `--filters` (subnet-id, vpc-id, attachment.instance-id) | `--max-results`, `--dry-run` | None | NATS `ec2.DescribeNetworkInterfaces` → daemon lists all keys from `hive-vpc-enis` KV → applies filters (subnet-id, vpc-id, attachment.instance-id) → filters by ENI IDs if specified → returns error for non-existent requested IDs | 1. List all ENIs<br>2. Filter by subnet-id<br>3. Filter by vpc-id<br>4. Filter by attachment.instance-id<br>5. Non-existent ENI returns error | **DONE** |
+| `create-network-interface` | `--subnet-id`, `--private-ip-address`, `--description`, `--tag-specifications` | `--groups`, `--dry-run` | Subnet must exist | Gateway validates SubnetId (required) → NATS `ec2.CreateNetworkInterface` → daemon verifies subnet exists in `spinifex-vpc-subnets` KV → if no PrivateIpAddress, allocates from IPAM pool (CAS-based, up to 5 retries) → generates eni-ID → generates deterministic MAC from ENI ID → stores ENIRecord in `spinifex-vpc-enis` KV → publishes `vpc.create-port` event to vpcd (creates OVN logical port) → returns NetworkInterface with status=available | 1. Create in subnet (auto-allocate IP)<br>2. Create with specific private IP<br>3. Missing subnet ID (MissingParameter)<br>4. Non-existent subnet (error)<br>5. Tags applied at creation | **DONE** |
+| `delete-network-interface` | `--network-interface-id` | `--dry-run` | Must not be attached (status != in-use) | NATS `ec2.DeleteNetworkInterface` → daemon verifies ENI exists and status is not "in-use" (InvalidNetworkInterfaceInUse) → releases IP back to IPAM pool → deletes from `spinifex-vpc-enis` KV → publishes `vpc.delete-port` event to vpcd | 1. Delete detached ENI<br>2. Delete attached ENI (InvalidNetworkInterfaceInUse)<br>3. Delete non-existent (error) | **DONE** |
+| `describe-network-interfaces` | `--network-interface-ids`, `--filters` (subnet-id, vpc-id, attachment.instance-id) | `--max-results`, `--dry-run` | None | NATS `ec2.DescribeNetworkInterfaces` → daemon lists all keys from `spinifex-vpc-enis` KV → applies filters (subnet-id, vpc-id, attachment.instance-id) → filters by ENI IDs if specified → returns error for non-existent requested IDs | 1. List all ENIs<br>2. Filter by subnet-id<br>3. Filter by vpc-id<br>4. Filter by attachment.instance-id<br>5. Non-existent ENI returns error | **DONE** |
 | `attach-network-interface` | — | `--network-interface-id`, `--instance-id`, `--device-index` | ENI and instance must exist | Internal operation used by `run-instances --subnet-id`. Marks ENI as "in-use", sets instance attachment, generates attachment ID. No standalone API endpoint yet. | 1. Attach ENI to instance<br>2. Already attached (error)<br>3. Missing device index (error) | **NOT STARTED** (internal only) |
 | `detach-network-interface` | — | `--attachment-id`, `--force` | ENI must be attached | Internal operation used by terminate-instances. Marks ENI as "available", clears attachment info. No standalone API endpoint yet. | 1. Detach ENI<br>2. Force detach<br>3. Not attached (error) | **NOT STARTED** (internal only) |
 | `modify-network-interface-attribute` | — | `--network-interface-id`, `--description`, `--source-dest-check`, `--groups` | ENI must exist | NATS `ec2.ModifyNetworkInterfaceAttribute` → daemon updates ENI attributes in KV → return success | 1. Modify description<br>2. Toggle source/dest check<br>3. Update security groups | **NOT STARTED** |
@@ -409,7 +409,7 @@ ENIs are managed via `hive-vpc-enis` KV bucket with CAS-based IPAM allocation fr

 ### S3 (via Predastore)

-Currently S3 operations are handled directly by Predastore. Consider moving control/data plane to Hive format for AWS gateway integration.
+Currently S3 operations are handled directly by Predastore. Consider moving control/data plane to Spinifex format for AWS gateway integration.

 | Command | Implemented Flags | Missing Flags | Prerequisites | Basic Logic | Test Cases | Status |
 |---------|-------------------|---------------|---------------|-------------|------------|--------|
@@ -1,6 +1,6 @@
-# Hive Architecture
+# Spinifex Architecture

-Hive is an AWS-compatible infrastructure platform for bare-metal, edge, and on-premise deployments. It provides EC2-compatible VM orchestration backed by QEMU/KVM, with storage provided by companion projects Viperblock (EBS) and Predastore (S3).
+Spinifex is an AWS-compatible infrastructure platform for bare-metal, edge, and on-premise deployments. It provides EC2-compatible VM orchestration backed by QEMU/KVM, with storage provided by companion projects Viperblock (EBS) and Predastore (S3).

 ## High-Level Architecture

@@ -19,7 +19,7 @@ Hive is an AWS-compatible infrastructure platform for bare-metal, edge, and on-p
 │   • EC2 Query Protocol parsing         • Routes to service handlers         │
 │   • XML response generation            • NATS client connection             │
 │                                                                             │
-│   File: hive/services/awsgw/awsgw.go                                        │
+│   File: spinifex/services/awsgw/awsgw.go                                        │
 └─────────────────────────────────────────────────────────────────────────────┘
                                      │
                                      │ JSON over NATS
@@ -28,7 +28,7 @@ Hive is an AWS-compatible infrastructure platform for bare-metal, edge, and on-p
 │                            NATS Message Broker                              │
 │                                                                             │
 │   Topics:                              Queue Groups:                        │
-│   • ec2.RunInstances                   • hive-workers (load balanced)       │
+│   • ec2.RunInstances                   • spinifex-workers (load balanced)       │
 │   • ec2.DescribeInstances              • No queue (fan-out to all nodes)    │
 │   • ec2.cmd.{instanceID}              (per-instance start/stop/terminate)   │
 │   • ebs.mount / ebs.unmount                                                 │
@@ -37,7 +37,7 @@ Hive is an AWS-compatible infrastructure platform for bare-metal, edge, and on-p
                    ┌─────────────────┼─────────────────┐
                    ▼                 ▼                 ▼
 ┌──────────────────────┐ ┌──────────────────────┐ ┌──────────────────────┐
-│   Hive Daemon        │ │   Hive Daemon        │ │   Hive Daemon        │
+│   Spinifex Daemon        │ │   Spinifex Daemon        │ │   Spinifex Daemon        │
 │   (Node 1)           │ │   (Node 2)           │ │   (Node N)           │
 │                      │ │                      │ │                      │
 │ • NATS subscriber    │ │ • NATS subscriber    │ │ • NATS subscriber    │
@@ -58,7 +58,7 @@ Hive is an AWS-compatible infrastructure platform for bare-metal, edge, and on-p

 ### 1. AWS SDK Request

-Users interact with Hive using standard AWS SDKs or the AWS CLI by pointing to a custom endpoint:
+Users interact with Spinifex using standard AWS SDKs or the AWS CLI by pointing to a custom endpoint:

 ```bash
 aws --endpoint-url https://localhost:9999 --no-verify-ssl ec2 run-instances \
@@ -73,7 +73,7 @@ The AWS SDK formats this as an HTTP POST with:

 ### 2. AWS Gateway

-The gateway (`hive/services/awsgw/awsgw.go:57-107`) is the entry point:
+The gateway (`spinifex/services/awsgw/awsgw.go:57-107`) is the entry point:

 ```go
 // awsgw.go:74 - Connect to NATS
@@ -89,7 +89,7 @@ gw := gateway.GatewayConfig{
 log.Fatal(app.ListenTLS(nodeConfig.AWSGW.Host, nodeConfig.AWSGW.TLSCert, nodeConfig.AWSGW.TLSKey))
 ```

-Request routing (`hive/gateway/gateway.go:125-156`):
+Request routing (`spinifex/gateway/gateway.go:125-156`):

 1. **Authentication**: SigV4 middleware validates AWS credentials (`gateway.go:104`)
 2. **Service Detection**: Extracts service name (ec2, iam, account) from Authorization header (`gateway.go:158-186`)
@@ -109,7 +109,7 @@ case "iam":

 ### 3. EC2 Handler

-The EC2 handler (`hive/gateway/ec2.go`) parses the Action parameter and delegates to specific handlers:
+The EC2 handler (`spinifex/gateway/ec2.go`) parses the Action parameter and delegates to specific handlers:

 ```go
 // ec2.go - Action routing
@@ -124,7 +124,7 @@ case "DescribeInstances":

 ### 4. NATS Messaging

-The gateway communicates with daemons via NATS request/response (`hive/handlers/ec2/instance/service_nats.go:24-57`):
+The gateway communicates with daemons via NATS request/response (`spinifex/handlers/ec2/instance/service_nats.go:24-57`):

 ```go
 // service_nats.go:24-57
@@ -145,13 +145,13 @@ func (s *NATSInstanceService) RunInstances(input *ec2.RunInstancesInput) (*ec2.R

 ### 5. Daemon Processing

-Daemons (`hive/daemon/daemon.go`) subscribe to NATS topics and handle requests:
+Daemons (`spinifex/daemon/daemon.go`) subscribe to NATS topics and handle requests:

 ```go
 // daemon.go:319 - Subscribe with queue group for load balancing
 d.natsSubscriptions["ec2.RunInstances"], err = d.natsConn.QueueSubscribe(
    "ec2.RunInstances",
-    "hive-workers",      // Queue group - only one daemon handles each request
+    "spinifex-workers",      // Queue group - only one daemon handles each request
    d.handleEC2RunInstances,
 )

@@ -162,7 +162,7 @@ d.natsSubscriptions["ec2.DescribeInstances"], err = d.natsConn.Subscribe(
 )
 ```

-**Queue Groups**: Topics subscribed with a queue group (`hive-workers`) are load-balanced - only one daemon handles each request. Topics without a queue group fan out to all daemons.
+**Queue Groups**: Topics subscribed with a queue group (`spinifex-workers`) are load-balanced - only one daemon handles each request. Topics without a queue group fan out to all daemons.

 ### 6. VM Launch

@@ -225,19 +225,19 @@ type ResourceManager struct {

 | Topic | Queue Group | Purpose |
 |-------|-------------|---------|
-| `ec2.RunInstances` | `hive-workers` | Launch new instances |
+| `ec2.RunInstances` | `spinifex-workers` | Launch new instances |
 | `ec2.DescribeInstances` | None (fan-out) | Query all nodes for instances |
 | `ec2.cmd.{instanceID}` | None (owner only) | Per-instance commands (start/stop/terminate, attach/detach volume) |
-| `ec2.CreateKeyPair` | `hive-workers` | Generate SSH keypair |
-| `ec2.DescribeKeyPairs` | `hive-workers` | List SSH keypairs |
-| `ec2.DescribeImages` | `hive-workers` | List AMIs |
+| `ec2.CreateKeyPair` | `spinifex-workers` | Generate SSH keypair |
+| `ec2.DescribeKeyPairs` | `spinifex-workers` | List SSH keypairs |
+| `ec2.DescribeImages` | `spinifex-workers` | List AMIs |
 | `ebs.mount` | - | Mount volume via Viperblock |
 | `ebs.unmount` | - | Unmount volume |
-| `hive.admin.{node}.health` | None | Node health checks |
+| `spinifex.admin.{node}.health` | None | Node health checks |

 ### Multi-Node Aggregation

-For operations that need data from all nodes (like `DescribeInstances`), the gateway uses inbox-based fan-out (`hive/gateway/ec2/instance/DescribeInstances.go`):
+For operations that need data from all nodes (like `DescribeInstances`), the gateway uses inbox-based fan-out (`spinifex/gateway/ec2/instance/DescribeInstances.go`):

 ```go
 // DescribeInstances.go:16-111
@@ -288,13 +288,13 @@ Object storage used for:

 ## Configuration

-Cluster configuration (`hive/config/config.go`):
+Cluster configuration (`spinifex/config/config.go`):

 ```go
 type ClusterConfig struct {
    Epoch   uint64            // Incremented on config changes
    Node    string            // This node's identifier
-    Version string            // Hive version
+    Version string            // Spinifex version
    Nodes   map[string]Config // Configuration for all nodes
 }

@@ -312,8 +312,8 @@ type Config struct {
 ## File Structure

 ```
-hive/
-├── hive/
+spinifex/
+├── spinifex/
 │   ├── services/
 │   │   └── awsgw/
 │   │       └── awsgw.go        # AWS Gateway service entry point
@@ -340,7 +340,7 @@ hive/
 │   └── qmp/
 │       └── qmp.go              # QEMU Machine Protocol client
 └── cmd/
-    └── hive/
+    └── spinifex/
        └── main.go             # CLI entry point
 ```

@@ -351,8 +351,8 @@ hive/
 1. Start NATS broker
 2. Start Predastore (S3)
 3. Start Viperblock (EBS)
-4. Start Hive Gateway (`hive awsgw`)
-5. Start Hive Daemon(s) (`hive daemon`)
+4. Start Spinifex Gateway (`spx awsgw`)
+5. Start Spinifex Daemon(s) (`spx daemon`)

 ### Testing with AWS CLI

@@ -1,4 +1,4 @@
-# Hive Installation
+# Spinifex Installation

 Notes for development environment installation.

@@ -15,20 +15,20 @@ For the development preview, please use one of the supported versions above.

 ## Download

-Create the base directory for the Hive development environment.
+Create the base directory for the Spinifex development environment.

 ```bash
 mkdir -p ~/Development/mulga/
 cd ~/Development/mulga/
-git clone https://github.com/mulgadc/hive.git
+git clone https://github.com/mulgadc/spinifex.git
 ```

 ### Quick Install

-To bootstrap all dependencies of Hive in one step (QEMU, Go, AWS CLI, OVN/OVS):
+To bootstrap all dependencies of Spinifex in one step (QEMU, Go, AWS CLI, OVN/OVS):

 ```bash
-sudo make -C hive quickinstall
+sudo make -C spinifex quickinstall
 ```

 Ensure Go is available in your `PATH` if not previously installed:
@@ -56,7 +56,7 @@ Confirm Go is correctly installed, and set in your $PATH.
 go version
 ```

-Hive provides AWS API/SDK layer functionality, which requires the AWS CLI tool to be installed to interface with the system.
+Spinifex provides AWS API/SDK layer functionality, which requires the AWS CLI tool to be installed to interface with the system.

 ```bash
 curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
@@ -77,16 +77,16 @@ aws --version
 Setup the dev environment and package dependencies on [viperblock](https://github.com/mulgadc/viperblock/) and [predastore](https://github.com/mulgadc/predastore/).

 ```bash
-cd hive
+cd spinifex
 ./scripts/clone-deps.sh    # Clone viperblock + predastore repositories
 ./scripts/dev-setup.sh     # Setup complete development environment
 ```

-Once complete, confirm `./bin/hive` exists and is executable.
+Once complete, confirm `./bin/spx` exists and is executable.

 # Single Node Installation

-For rapid development and testing, `hive` can be installed locally as a single node instance. Follow the instructions below for a complete working environment. For multi node installation, skip to [Multi-Node Installation](#multi-node-installation)
+For rapid development and testing, `spx` can be installed locally as a single node instance. Follow the instructions below for a complete working environment. For multi node installation, skip to [Multi-Node Installation](#multi-node-installation)

 ## Setup OVN

@@ -96,31 +96,31 @@ OVN provides the virtual networking layer for VPC instances. This step configure
 ./scripts/setup-ovn.sh --management
 ```

-This creates the `br-int` integration bridge, starts `ovn-controller`, starts the OVN central databases (NB DB + SB DB), configures Geneve tunnel endpoints, enables IP forwarding, and creates a sudoers rule so the Hive daemon can manage tap devices and OVS ports without running as root. Hive will not start without this step.
+This creates the `br-int` integration bridge, starts `ovn-controller`, starts the OVN central databases (NB DB + SB DB), configures Geneve tunnel endpoints, enables IP forwarding, and creates a sudoers rule so the Spinifex daemon can manage tap devices and OVS ports without running as root. Spinifex will not start without this step.

 ## Init

-When running Hive for the first time, run the init function to create the default directories for data, config files and layout required.
+When running Spinifex for the first time, run the init function to create the default directories for data, config files and layout required.

 Example single node installation to get started, this will create a new region `ap-southeast-2` and availability zone `ap-southeast-2a` on your local instance:

 ```bash
-./bin/hive admin init --region ap-southeast-2 --az ap-southeast-2a --node node1 --nodes 1
+./bin/spx admin init --region ap-southeast-2 --az ap-southeast-2a --node node1 --nodes 1
 ```

 ## Trust CA Certificate (Required)

-Hive generates a local Certificate Authority (CA) during initialization. For AWS CLI and other tools to trust Hive services over HTTPS, you must add the CA certificate to your system's trust store.
+Spinifex generates a local Certificate Authority (CA) during initialization. For AWS CLI and other tools to trust Spinifex services over HTTPS, you must add the CA certificate to your system's trust store.

 ```bash
-sudo cp ~/hive/config/ca.pem /usr/local/share/ca-certificates/hive-ca.crt
+sudo cp ~/spinifex/config/ca.pem /usr/local/share/ca-certificates/spinifex-ca.crt
 sudo update-ca-certificates
 ```

 Verify the certificate was added:

 ```bash
-ls -la /usr/local/share/ca-certificates/hive-ca.crt
+ls -la /usr/local/share/ca-certificates/spinifex-ca.crt
 ```

 ## Launch Services
@@ -134,7 +134,7 @@ Start the core services for development.
 Set the AWS profile to use the default admin account created during init:

 ```bash
-export AWS_PROFILE=hive
+export AWS_PROFILE=spinifex
 ```

 All subsequent `aws` CLI commands will use this account.
@@ -148,7 +148,7 @@ For first install, create or import an existing key pair which can be used to la
 Import an existing key pair, replace `~/.ssh/id_rsa.pub` with your specified key.

 ```bash
-aws ec2 import-key-pair --key-name "hive-key" --public-key-material fileb://~/.ssh/id_rsa.pub
+aws ec2 import-key-pair --key-name "spinifex-key" --public-key-material fileb://~/.ssh/id_rsa.pub
 ```

 If no key exists, generate one using `ssh-keygen` and repeat the command above.
@@ -163,20 +163,20 @@ Alternatively, create a new key pair using the AWS CLI tool and store the JSON o

 ```bash
 aws ec2 create-key-pair \
-  --key-name hive-key \
-| jq -r '.KeyMaterial | rtrimstr("\n")' > ~/.ssh/hive-key
+  --key-name spinifex-key \
+| jq -r '.KeyMaterial | rtrimstr("\n")' > ~/.ssh/spinifex-key
 ```

 Update permissions for the key for SSH to accept reading the file.

 ```bash
-chmod 600 ~/.ssh/hive-key
+chmod 600 ~/.ssh/spinifex-key
 ```

 Next, generate a public key from the specified private key pair.

 ```bash
-ssh-keygen -y -f ~/.ssh/hive-key > ~/.ssh/hive-key.pub
+ssh-keygen -y -f ~/.ssh/spinifex-key > ~/.ssh/spinifex-key.pub
 ```

 ### Verify New Key
@@ -193,7 +193,7 @@ aws ec2 describe-key-pairs
      "KeyType": "ed25519",
      "Tags": [],
      "CreateTime": "2025-10-28T13:39:23.458000+00:00",
-      "KeyName": "hive-key",
+      "KeyName": "spinifex-key",
      "KeyFingerprint": "SHA256:/g/A5OkeZeSydz9WUErXYVdCt00b0VbfN6RLn2YVFAY"
    }
  ]
@@ -202,16 +202,16 @@ aws ec2 describe-key-pairs

 ## Create AMI Template

-The Hive CLI tool offers 2 ways of importing an image. You can use automatic image importing, and select from our range of images. Alternatively, provide your own image source file (e.g image.tar.gz, image.gz, image.tar.xz) and the tool will automatically extract and upload the raw OS image as an AMI (after validating the image contains UEFI/BIOS boot capability).
+The Spinifex CLI tool offers 2 ways of importing an image. You can use automatic image importing, and select from our range of images. Alternatively, provide your own image source file (e.g image.tar.gz, image.gz, image.tar.xz) and the tool will automatically extract and upload the raw OS image as an AMI (after validating the image contains UEFI/BIOS boot capability).

-**Note:** When downloading OS images, use platforms that support the `cloud-init` feature to automatically bootstrap when using the Hive EC2 functionality to access SSH and networking services.
+**Note:** When downloading OS images, use platforms that support the `cloud-init` feature to automatically bootstrap when using the Spinifex EC2 functionality to access SSH and networking services.

 ### Automatic Image Import

-Discover available images to automatically download and install. This will pull the images from the distro official mirror and simplify the process to bootstrap a Hive installation with AMIs for common operating systems.
+Discover available images to automatically download and install. This will pull the images from the distro official mirror and simplify the process to bootstrap a Spinifex installation with AMIs for common operating systems.

 ```bash
-./bin/hive admin images list
+./bin/spx admin images list
 ```

 ```bash
@@ -225,7 +225,7 @@ ubuntu-24.04-x86_64  | ubuntu | 24.04   | x86_64 | bios
 Next, choose the image you would like to import as an AMI. Choose the appropriate `x86_64` or `arm64` architecture depending on your platform.

 ```bash
-./bin/hive admin images import --name debian-12-arm64
+./bin/spx admin images import --name debian-12-arm64
 ```

 ### Manual Image Import
@@ -241,7 +241,7 @@ wget https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericclou
 Import as an AMI to the backend store:

 ```bash
-./bin/hive admin images import --file ~/debian-12-genericcloud-arm64.tar.xz --arch arm64 --distro debian --version 12
+./bin/spx admin images import --file ~/debian-12-genericcloud-arm64.tar.xz --arch arm64 --distro debian --version 12
 ```

 ### Verify Image Import
@@ -249,18 +249,18 @@ Import as an AMI to the backend store:
 Export the AMI.

 ```bash
-export HIVE_AMI="ami-XXX"
+export SPINIFEX_AMI="ami-XXX"
 ```

 Next, verify available disk images to confirm the import was successful.

 ```bash
-aws ec2 describe-images --image-ids $HIVE_AMI
+aws ec2 describe-images --image-ids $SPINIFEX_AMI
 ```

 ## Create VPC and Subnet

-Every EC2 instance runs inside a VPC (Virtual Private Cloud) with an isolated virtual network. Hive creates a default VPC automatically during initialization, but you can also create your own.
+Every EC2 instance runs inside a VPC (Virtual Private Cloud) with an isolated virtual network. Spinifex creates a default VPC automatically during initialization, but you can also create your own.

 ### Create a VPC

@@ -282,7 +282,7 @@ aws ec2 create-vpc --cidr-block 10.200.0.0/16
 Export the VPC ID:

 ```bash
-export HIVE_VPC="vpc-XXX"
+export SPINIFEX_VPC="vpc-XXX"
 ```

 ### Create a Subnet
@@ -290,7 +290,7 @@ export HIVE_VPC="vpc-XXX"
 Create a subnet within the VPC. All instances launched into this subnet will receive a private IP address from its CIDR range via DHCP.

 ```bash
-aws ec2 create-subnet --vpc-id $HIVE_VPC --cidr-block 10.200.1.0/24
+aws ec2 create-subnet --vpc-id $SPINIFEX_VPC --cidr-block 10.200.1.0/24
 ```

 ```json
@@ -308,7 +308,7 @@ aws ec2 create-subnet --vpc-id $HIVE_VPC --cidr-block 10.200.1.0/24
 Export the Subnet ID — this is required when launching instances:

 ```bash
-export HIVE_SUBNET="subnet-XXX"
+export SPINIFEX_SUBNET="subnet-XXX"
 ```

 ### Verify VPC Networking
@@ -320,15 +320,15 @@ aws ec2 describe-vpcs
 aws ec2 describe-subnets
 ```

-Behind the scenes, Hive's `vpcd` service translates these into OVN topology: the VPC becomes a logical router, the subnet becomes a logical switch with DHCP options, and each instance launched into the subnet gets an OVN port with automatic IP assignment.
+Behind the scenes, Spinifex's `vpcd` service translates these into OVN topology: the VPC becomes a logical router, the subnet becomes a logical switch with DHCP options, and each instance launched into the subnet gets an OVN port with automatic IP assignment.

 ## Run Instance

-Once Hive is successfully installed and bootstrapped with a system AMI, SSH keys, and a VPC subnet, proceed to run an instance.
+Once Spinifex is successfully installed and bootstrapped with a system AMI, SSH keys, and a VPC subnet, proceed to run an instance.

 ### Query Instance Types

-Depending on the host platform Hive is installed, different compute instances will be available.
+Depending on the host platform Spinifex is installed, different compute instances will be available.

 Query available instance types and choose an instance type available on your host:

@@ -369,19 +369,19 @@ aws ec2 describe-instance-types
 Export the instance-type:

 ```sh
-export HIVE_INSTANCE="t3.small"
+export SPINIFEX_INSTANCE="t3.small"
 ```

 ### Run Instance

-Next, launch a new instance. The `--subnet-id` places the instance into your VPC subnet, where it will receive a private IP address via DHCP. The `hive-key` is the SSH key specified in the previous stage.
+Next, launch a new instance. The `--subnet-id` places the instance into your VPC subnet, where it will receive a private IP address via DHCP. The `spinifex-key` is the SSH key specified in the previous stage.

 ```bash
 aws ec2 run-instances \
-  --image-id $HIVE_AMI \
-  --instance-type $HIVE_INSTANCE \
-  --key-name hive-key \
-  --subnet-id $HIVE_SUBNET \
+  --image-id $SPINIFEX_AMI \
+  --instance-type $SPINIFEX_INSTANCE \
+  --key-name spinifex-key \
+  --subnet-id $SPINIFEX_SUBNET \
  --count 1
 ```

@@ -402,7 +402,7 @@ A sample response is below from the `RunInstance` request. Note the `InstanceId`
      "PrivateIpAddress": "10.200.1.5",
      "SubnetId": "subnet-6e7f829e3a4b1c5d0",
      "VpcId": "vpc-1035bd70d9bc10b06",
-      "KeyName": "hive-key",
+      "KeyName": "spinifex-key",
      "InstanceType": "t3.micro",
      "LaunchTime": "2025-11-12T13:07:47.548000+00:00",
      "NetworkInterfaces": [
@@ -457,7 +457,7 @@ Confirm the `State.Name` attribute is set as `running` and the instance has a `P
          "PrivateIpAddress": "10.200.1.5",
          "SubnetId": "subnet-6e7f829e3a4b1c5d0",
          "VpcId": "vpc-1035bd70d9bc10b06",
-          "KeyName": "hive-key",
+          "KeyName": "spinifex-key",
          "InstanceType": "t3.micro",
          "LaunchTime": "2025-11-12T13:07:47.548000+00:00"
        }
@@ -469,7 +469,7 @@ Confirm the `State.Name` attribute is set as `running` and the instance has a `P

 ## SSH Connection (development)

-For a Hive development environment (toggled off for production), a local SSH port forwarding will be active to connect directly to the instance, regardless of the VPC and network settings.
+For a Spinifex development environment (toggled off for production), a local SSH port forwarding will be active to connect directly to the instance, regardless of the VPC and network settings.

 Determine the SSH port allocated.

@@ -484,12 +484,12 @@ qemu-system-x86_64 -daemonize -pidfile /run/user/1000/i-36765eb0c6609e4d.pid -qm
 Note the `hostfwd=tcp:127.0.0.1:33683-:22`, in this case the local port `33683` will connect to the new instance.

 ```bash
-ssh -i ~/.ssh/hive-key ec2-user@127.0.0.1 -p 33683
+ssh -i ~/.ssh/spinifex-key ec2-user@127.0.0.1 -p 33683

 ...

-Linux hive-vm-36765eb0 6.1.0-40-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.153-1 (2025-09-20) x86_64
-ec2-user@hive-vm-36765eb0:~$
+Linux spinifex-vm-36765eb0 6.1.0-40-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.153-1 (2025-09-20) x86_64
+ec2-user@spinifex-vm-36765eb0:~$
 ```

 Congratulations! Your first AMI image is imported, a new EC2 instance launched, and successfully connected via SSH for the configured SSH key, using the OS `cloud-init` procedure.
@@ -542,7 +542,7 @@ aws ec2 describe-instances --instance-ids $INSTANCE_ID
            "Code": 80,
            "Name": "stopped"
          },
-          "KeyName": "hive-key",
+          "KeyName": "spinifex-key",
          "InstanceType": "t3.micro",
          "LaunchTime": "2025-11-12T13:07:47.548000+00:00"
        }
@@ -598,7 +598,7 @@ aws ec2 describe-instances  --instance-ids "i-36765eb0c6609e4d2"
            "Code": 16,
            "Name": "running"
          },
-          "KeyName": "hive-key",
+          "KeyName": "spinifex-key",
          "InstanceType": "t3.micro",
          "LaunchTime": "2025-11-12T13:07:47.548000+00:00"
        }
@@ -644,29 +644,29 @@ On success no data will be returned, since the instance is no longer available.

 ## Additional Accounts (Optional)

-The default `hive` account is created automatically during init. To create additional isolated accounts with their own resources (instances, volumes, VPCs, key pairs):
+The default `spx` account is created automatically during init. To create additional isolated accounts with their own resources (instances, volumes, VPCs, key pairs):

 ```bash
-./bin/hive admin account create --name myteam
+./bin/spx admin account create --name myteam
 ```

-This provisions an IAM account with an admin user, generates access keys, and configures a local AWS CLI profile named `hive-myteam`. Resources created under one account are isolated from other accounts.
+This provisions an IAM account with an admin user, generates access keys, and configures a local AWS CLI profile named `spinifex-myteam`. Resources created under one account are isolated from other accounts.

 ```bash
-export AWS_PROFILE=hive-myteam
+export AWS_PROFILE=spinifex-myteam
 ```

 ## UI Management Panel

-The Hive Platform also offers a web interface for managing hive services. Simply have the hive server running and go to [https://localhost:3000](https://localhost:3000) in your browser to continue.
+The Spinifex Platform also offers a web interface for managing spx services. Simply have the spinifex server running and go to [https://localhost:3000](https://localhost:3000) in your browser to continue.

-**Note:** If you are not viewing the website on the same machine that is running the hive server, you will need to go to [https://localhost:9999](https://localhost:9999) and [https://localhost:8443](https://localhost:8443) and accept the certificates. If you have added the CA to your local machine this is not needed.
+**Note:** If you are not viewing the website on the same machine that is running the spinifex server, you will need to go to [https://localhost:9999](https://localhost:9999) and [https://localhost:8443](https://localhost:8443) and accept the certificates. If you have added the CA to your local machine this is not needed.

 # Multi-Node Installation

-Hive is designed for distributed, multi-server deployments. A Hive cluster operates as a fully distributed infrastructure region — similar to an AWS Region — where multiple nodes work together to provide high availability, data durability, and fault tolerance across the platform.
+Spinifex is designed for distributed, multi-server deployments. A Spinifex cluster operates as a fully distributed infrastructure region — similar to an AWS Region — where multiple nodes work together to provide high availability, data durability, and fault tolerance across the platform.

-When deploying a multi-node cluster, you define a **region** (e.g., `ap-southeast-2`, `us-east-1`) and **availability zones** to organize your infrastructure. Services are distributed across nodes: NATS provides a clustered message bus for request routing and JetStream replication, Predastore uses Raft consensus with Reed-Solomon erasure coding (RS 2+1) for durable S3-compatible object storage, and the Hive daemon on each node can independently serve AWS API requests. The result is a platform where compute, storage, and API services are replicated — an AMI stored on one node is available from any node, an EC2 instance launched via any gateway is visible cluster-wide, and the loss of a single node does not compromise data or availability.
+When deploying a multi-node cluster, you define a **region** (e.g., `ap-southeast-2`, `us-east-1`) and **availability zones** to organize your infrastructure. Services are distributed across nodes: NATS provides a clustered message bus for request routing and JetStream replication, Predastore uses Raft consensus with Reed-Solomon erasure coding (RS 2+1) for durable S3-compatible object storage, and the Spinifex daemon on each node can independently serve AWS API requests. The result is a platform where compute, storage, and API services are replicated — an AMI stored on one node is available from any node, an EC2 instance launched via any gateway is visible cluster-wide, and the loss of a single node does not compromise data or availability.

 Cluster formation is automatic. When initializing with `--nodes 3`, the init node starts a formation server and waits for other nodes to join. Once all nodes have registered, each node receives the full cluster topology — credentials, CA certificates, NATS routes, Predastore peer lists — and generates its own configuration files. No manual configuration synchronization is required.

@@ -677,9 +677,9 @@ Cluster formation is automatic. When initializing with `--nodes 3`, the init nod
 | **Servers** | 1 machine, loopback IPs | 3+ physical/virtual servers |
 | **Use case** | Development & testing | Production & staging |
 | **Network** | `127.0.0.1/2/3` (no setup) | Real LAN IPs |
-| **Data dirs** | `~/node1/`, `~/node2/`, `~/node3/` | `~/hive/` on each server |
+| **Data dirs** | `~/node1/`, `~/node2/`, `~/node3/` | `~/spinifex/` on each server |

-Both options use `HIVE_NODE1`, `HIVE_NODE2`, and `HIVE_NODE3` environment variables. Set them in the option you choose, then all subsequent sections (verification, usage, shutdown) reference them.
+Both options use `SPINIFEX_NODE1`, `SPINIFEX_NODE2`, and `SPINIFEX_NODE3` environment variables. Set them in the option you choose, then all subsequent sections (verification, usage, shutdown) reference them.

 ### Option A: Simulated Multi-Node (Single Server)

@@ -690,9 +690,9 @@ For development and testing, a 3-node cluster can be simulated on a single machi
 ```bash
 make build

-export HIVE_NODE1=127.0.0.1
-export HIVE_NODE2=127.0.0.2
-export HIVE_NODE3=127.0.0.3
+export SPINIFEX_NODE1=127.0.0.1
+export SPINIFEX_NODE2=127.0.0.2
+export SPINIFEX_NODE3=127.0.0.3
 ```

 #### 2. Setup OVN
@@ -712,28 +712,28 @@ The formation process requires running init and join commands concurrently. The
 **Terminal 1 — Initialize the leader node:**

 ```bash
-./bin/hive admin init \
+./bin/spx admin init \
  --node node1 \
  --nodes 3 \
-  --bind $HIVE_NODE1 \
-  --cluster-bind $HIVE_NODE1 \
+  --bind $SPINIFEX_NODE1 \
+  --cluster-bind $SPINIFEX_NODE1 \
  --port 4432 \
-  --hive-dir ~/node1/ \
+  --spinifex-dir ~/node1/ \
  --config-dir ~/node1/config/ \
  --region ap-southeast-2 \
  --az ap-southeast-2a
 ```

-This starts a formation server on `$HIVE_NODE1:4432` and waits for 2 more nodes to join.
+This starts a formation server on `$SPINIFEX_NODE1:4432` and waits for 2 more nodes to join.

 **Terminal 2 — Join node 2 (while init is running):**

 ```bash
-./bin/hive admin join \
+./bin/spx admin join \
  --node node2 \
-  --bind $HIVE_NODE2 \
-  --cluster-bind $HIVE_NODE2 \
-  --host $HIVE_NODE1:4432 \
+  --bind $SPINIFEX_NODE2 \
+  --cluster-bind $SPINIFEX_NODE2 \
+  --host $SPINIFEX_NODE1:4432 \
  --data-dir ~/node2/ \
  --config-dir ~/node2/config/ \
  --region ap-southeast-2 \
@@ -743,11 +743,11 @@ This starts a formation server on `$HIVE_NODE1:4432` and waits for 2 more nodes
 **Terminal 3 — Join node 3 (while init is running):**

 ```bash
-./bin/hive admin join \
+./bin/spx admin join \
  --node node3 \
-  --bind $HIVE_NODE3 \
-  --cluster-bind $HIVE_NODE3 \
-  --host $HIVE_NODE1:4432 \
+  --bind $SPINIFEX_NODE3 \
+  --cluster-bind $SPINIFEX_NODE3 \
+  --host $SPINIFEX_NODE1:4432 \
  --data-dir ~/node3/ \
  --config-dir ~/node3/config/ \
  --region ap-southeast-2 \
@@ -774,14 +774,14 @@ For production or production-like deployments across multiple physical servers o

 On **each server**:

-1. Install Hive dependencies (see [Dependencies](#dependencies) above)
+1. Install Spinifex dependencies (see [Dependencies](#dependencies) above)
 2. Clone the repository and build:

 ```bash
 mkdir -p ~/Development/mulga/
 cd ~/Development/mulga/
-git clone https://github.com/mulgadc/hive.git
-cd hive
+git clone https://github.com/mulgadc/spinifex.git
+cd spinifex
 ./scripts/clone-deps.sh
 make build
 ```
@@ -802,9 +802,9 @@ With a **single NIC**, use the one real IP (e.g. `192.168.1.10`) for everything.
 Export the IPs for your three servers (replace with your actual IPs) on each server:

 ```bash
-export HIVE_NODE1=192.168.1.10
-export HIVE_NODE2=192.168.1.11
-export HIVE_NODE3=192.168.1.12
+export SPINIFEX_NODE1=192.168.1.10
+export SPINIFEX_NODE2=192.168.1.11
+export SPINIFEX_NODE3=192.168.1.12
 ```

 #### 2. Setup OVN
@@ -816,8 +816,8 @@ OVN must be configured on every server before forming the cluster. Server 1 runs
 **Server 1 — OVN central + compute (run first):**

 ```bash
-cd ~/Development/mulga/hive
-./scripts/setup-ovn.sh --management --encap-ip=$HIVE_NODE1
+cd ~/Development/mulga/spinifex
+./scripts/setup-ovn.sh --management --encap-ip=$SPINIFEX_NODE1
 ```

 Verify OVN central is ready before proceeding to other servers:
@@ -829,15 +829,15 @@ sudo ovn-sbctl show
 **Server 2 — Compute node (after server 1 is ready):**

 ```bash
-cd ~/Development/mulga/hive
-./scripts/setup-ovn.sh --ovn-remote=tcp:$HIVE_NODE1:6642 --encap-ip=$HIVE_NODE2
+cd ~/Development/mulga/spinifex
+./scripts/setup-ovn.sh --ovn-remote=tcp:$SPINIFEX_NODE1:6642 --encap-ip=$SPINIFEX_NODE2
 ```

 **Server 3 — Compute node (after server 1 is ready):**

 ```bash
-cd ~/Development/mulga/hive
-./scripts/setup-ovn.sh --ovn-remote=tcp:$HIVE_NODE1:6642 --encap-ip=$HIVE_NODE3
+cd ~/Development/mulga/spinifex
+./scripts/setup-ovn.sh --ovn-remote=tcp:$SPINIFEX_NODE1:6642 --encap-ip=$SPINIFEX_NODE3
 ```

 Verify OVN is running on all servers:
@@ -861,16 +861,16 @@ If your servers have a dedicated data/overlay NIC separate from the management N
 **Server 1 — Initialize the cluster:**

 ```bash
-cd ~/Development/mulga/hive
+cd ~/Development/mulga/spinifex

-./bin/hive admin init \
+./bin/spx admin init \
  --node node1 \
  --nodes 3 \
-  --bind $HIVE_NODE1 \
-  --cluster-bind $HIVE_NODE1 \
+  --bind $SPINIFEX_NODE1 \
+  --cluster-bind $SPINIFEX_NODE1 \
  --port 4432 \
-  --hive-dir ~/hive/ \
-  --config-dir ~/hive/config/ \
+  --spinifex-dir ~/spinifex/ \
+  --config-dir ~/spinifex/config/ \
  --region us-east-1 \
  --az us-east-1a
 ```
@@ -878,15 +878,15 @@ cd ~/Development/mulga/hive
 **Server 2 — Join the cluster (while init is running):**

 ```bash
-cd ~/Development/mulga/hive
+cd ~/Development/mulga/spinifex

-./bin/hive admin join \
+./bin/spx admin join \
  --node node2 \
-  --bind $HIVE_NODE2 \
-  --cluster-bind $HIVE_NODE2 \
-  --host $HIVE_NODE1:4432 \
-  --data-dir ~/hive/ \
-  --config-dir ~/hive/config/ \
+  --bind $SPINIFEX_NODE2 \
+  --cluster-bind $SPINIFEX_NODE2 \
+  --host $SPINIFEX_NODE1:4432 \
+  --data-dir ~/spinifex/ \
+  --config-dir ~/spinifex/config/ \
  --region us-east-1 \
  --az us-east-1a
 ```
@@ -894,15 +894,15 @@ cd ~/Development/mulga/hive
 **Server 3 — Join the cluster (while init is running):**

 ```bash
-cd ~/Development/mulga/hive
+cd ~/Development/mulga/spinifex

-./bin/hive admin join \
+./bin/spx admin join \
  --node node3 \
-  --bind $HIVE_NODE3 \
-  --cluster-bind $HIVE_NODE3 \
-  --host $HIVE_NODE1:4432 \
-  --data-dir ~/hive/ \
-  --config-dir ~/hive/config/ \
+  --bind $SPINIFEX_NODE3 \
+  --cluster-bind $SPINIFEX_NODE3 \
+  --host $SPINIFEX_NODE1:4432 \
+  --data-dir ~/spinifex/ \
+  --config-dir ~/spinifex/config/ \
  --region us-east-1 \
  --az us-east-1a
 ```
@@ -922,41 +922,41 @@ After formation completes, start services on **all servers**:
 From any node, view cluster status and resource capacity:

 ```bash
-./bin/hive get nodes
+./bin/spx get nodes
 # NAME    STATUS    IP              REGION    AZ    UPTIME   VMs   SERVICES
-# node1   Ready     $HIVE_NODE1     ...       ...   2m       0     nats,predastore,viperblock,daemon,...
-# node2   Ready     $HIVE_NODE2     ...       ...   2m       0     nats,predastore,viperblock,daemon
-# node3   Ready     $HIVE_NODE3     ...       ...   2m       0     nats,predastore,viperblock,daemon
+# node1   Ready     $SPINIFEX_NODE1     ...       ...   2m       0     nats,predastore,viperblock,daemon,...
+# node2   Ready     $SPINIFEX_NODE2     ...       ...   2m       0     nats,predastore,viperblock,daemon
+# node3   Ready     $SPINIFEX_NODE3     ...       ...   2m       0     nats,predastore,viperblock,daemon

-./bin/hive top nodes
+./bin/spx top nodes
 # NAME    CPU (used/total)   MEM (used/total)   VMs
 # node1   0/16               0.0Gi/30.6Gi       0
 # node2   0/16               0.0Gi/30.6Gi       0
 # node3   0/16               0.0Gi/30.6Gi       0
 ```

-All nodes should show `Ready` status. Use `./bin/hive get vms` to see running instances across the cluster.
+All nodes should show `Ready` status. Use `./bin/spx get vms` to see running instances across the cluster.

 Check individual daemon health endpoints:

 ```bash
-curl -s http://$HIVE_NODE1:4432/health
-curl -s http://$HIVE_NODE2:4432/health
-curl -s http://$HIVE_NODE3:4432/health
+curl -s http://$SPINIFEX_NODE1:4432/health
+curl -s http://$SPINIFEX_NODE2:4432/health
+curl -s http://$SPINIFEX_NODE3:4432/health
 ```

 Check NATS cluster routing (from any node):

 ```bash
 grep -i "route\|cluster" ~/node1/logs/nats.log   # simulated
-grep -i "route\|cluster" ~/hive/logs/nats.log     # real multi-server
+grep -i "route\|cluster" ~/spinifex/logs/nats.log     # real multi-server
 ```

 Check Predastore Raft consensus:

 ```bash
 grep -i "leader\|election" ~/node1/logs/predastore.log   # simulated
-grep -i "leader\|election" ~/hive/logs/predastore.log     # real multi-server
+grep -i "leader\|election" ~/spinifex/logs/predastore.log     # real multi-server
 ```

 ## Trust CA Certificate
@@ -964,21 +964,21 @@ grep -i "leader\|election" ~/hive/logs/predastore.log     # real multi-server
 The CA certificate is generated by the init node and distributed to all joining nodes during formation. On **each node** (or the single machine for simulated mode), trust the CA:

 ```bash
-sudo cp ~/hive/config/ca.pem /usr/local/share/ca-certificates/hive-ca.crt
+sudo cp ~/spinifex/config/ca.pem /usr/local/share/ca-certificates/spinifex-ca.crt
 sudo update-ca-certificates
 ```

 For simulated mode, the config directory is under each node's data directory — copy from any node since the CA is the same:

 ```bash
-sudo cp ~/node1/config/ca.pem /usr/local/share/ca-certificates/hive-ca.crt
+sudo cp ~/node1/config/ca.pem /usr/local/share/ca-certificates/spinifex-ca.crt
 sudo update-ca-certificates
 ```

 Set the AWS profile to use the default admin account created during init:

 ```bash
-export AWS_PROFILE=hive
+export AWS_PROFILE=spinifex
 ```

 ## Using the Cluster
@@ -986,8 +986,8 @@ export AWS_PROFILE=hive
 Connect to any node's AWS Gateway — all nodes serve the same cluster state:

 ```bash
-AWS_ENDPOINT_URL=https://$HIVE_NODE1:9999 aws ec2 describe-instances
-AWS_ENDPOINT_URL=https://$HIVE_NODE2:9999 aws ec2 describe-instances
+AWS_ENDPOINT_URL=https://$SPINIFEX_NODE1:9999 aws ec2 describe-instances
+AWS_ENDPOINT_URL=https://$SPINIFEX_NODE2:9999 aws ec2 describe-instances
 ```

 ### Create SSH Key
@@ -995,24 +995,24 @@ AWS_ENDPOINT_URL=https://$HIVE_NODE2:9999 aws ec2 describe-instances
 Create or import an SSH key pair from **any node** — the key is stored in Predastore and available cluster-wide:

 ```bash
-aws ec2 import-key-pair --key-name "hive-key" --public-key-material fileb://~/.ssh/id_rsa.pub
+aws ec2 import-key-pair --key-name "spinifex-key" --public-key-material fileb://~/.ssh/id_rsa.pub
 ```

 Or generate a new key pair:

 ```bash
 aws ec2 create-key-pair \
-  --key-name hive-key \
-| jq -r '.KeyMaterial | rtrimstr("\n")' > ~/.ssh/hive-key
-chmod 600 ~/.ssh/hive-key
+  --key-name spinifex-key \
+| jq -r '.KeyMaterial | rtrimstr("\n")' > ~/.ssh/spinifex-key
+chmod 600 ~/.ssh/spinifex-key
 ```

 **Important:** If you want to ssh into instances, you will need to copy the private key to every node in the cluster. Instance SSH port forwarding is only accessible from the node running the VM, so you need the key available on all nodes:

 ```bash
 # From the node where the key was created, copy to other nodes:
-scp ~/.ssh/hive-key tf-user@$HIVE_NODE2:~/.ssh/hive-key
-scp ~/.ssh/hive-key tf-user@$HIVE_NODE3:~/.ssh/hive-key
+scp ~/.ssh/spinifex-key tf-user@$SPINIFEX_NODE2:~/.ssh/spinifex-key
+scp ~/.ssh/spinifex-key tf-user@$SPINIFEX_NODE3:~/.ssh/spinifex-key
 ```

 ### Create AMI Template
@@ -1020,15 +1020,15 @@ scp ~/.ssh/hive-key tf-user@$HIVE_NODE3:~/.ssh/hive-key
 Import an OS image from **any node**. The AMI is stored in Predastore and available cluster-wide:

 ```bash
-./bin/hive admin images list
-./bin/hive admin images import --name debian-12-x86_64
+./bin/spx admin images list
+./bin/spx admin images import --name debian-12-x86_64
 ```

 Verify and export the AMI ID:

 ```bash
 aws ec2 describe-images
-export HIVE_AMI="ami-XXX"
+export SPINIFEX_AMI="ami-XXX"
 ```

 See the [single-node AMI section](#create-ami-template) for more options (manual import, custom images).
@@ -1039,10 +1039,10 @@ Create a VPC and subnet for your cluster. This only needs to be done once — th

 ```bash
 aws ec2 create-vpc --cidr-block 10.200.0.0/16
-export HIVE_VPC="vpc-XXX"
+export SPINIFEX_VPC="vpc-XXX"

-aws ec2 create-subnet --vpc-id $HIVE_VPC --cidr-block 10.200.1.0/24
-export HIVE_SUBNET="subnet-XXX"
+aws ec2 create-subnet --vpc-id $SPINIFEX_VPC --cidr-block 10.200.1.0/24
+export SPINIFEX_SUBNET="subnet-XXX"
 ```

 Verify the OVN topology was created (from server 1):
@@ -1054,14 +1054,14 @@ sudo ovn-nbctl ls-list    # One logical switch per subnet

 ### Launching Instances Across Nodes

-Use `--count` to launch multiple instances in a single request. Hive distributes them across nodes in the cluster based on available capacity — instances land on different physical hosts but share the same VPC subnet, and can route traffic to each other over OVN's Geneve overlay:
+Use `--count` to launch multiple instances in a single request. Spinifex distributes them across nodes in the cluster based on available capacity — instances land on different physical hosts but share the same VPC subnet, and can route traffic to each other over OVN's Geneve overlay:

 ```bash
 aws ec2 run-instances \
-  --image-id $HIVE_AMI \
-  --instance-type $HIVE_INSTANCE \
-  --key-name hive-key \
-  --subnet-id $HIVE_SUBNET \
+  --image-id $SPINIFEX_AMI \
+  --instance-type $SPINIFEX_INSTANCE \
+  --key-name spinifex-key \
+  --subnet-id $SPINIFEX_SUBNET \
  --count 3
 ```

@@ -1076,7 +1076,7 @@ aws ec2 describe-instances
 Check which node each instance landed on:

 ```bash
-./bin/hive get vms
+./bin/spx get vms
 ```

 ### Verifying Cross-Host Connectivity
@@ -1090,7 +1090,7 @@ ps auxw | grep hostfwd
 ```

 ```bash
-ssh -i ~/.ssh/hive-key ec2-user@<node-ip> -p <port>
+ssh -i ~/.ssh/spinifex-key ec2-user@<node-ip> -p <port>
 ```

 From inside the VM, ping an instance running on a **different physical node**:
@@ -1101,7 +1101,7 @@ ping 10.200.1.6

 If the ping succeeds across hosts, the OVN Geneve overlay is working correctly — traffic is being encapsulated and routed between physical servers transparently.

-Check logs on each node for debugging. Log locations depend on your deployment mode — `~/node{1,2,3}/logs/` for simulated, `~/hive/logs/` for real multi-server.
+Check logs on each node for debugging. Log locations depend on your deployment mode — `~/node{1,2,3}/logs/` for simulated, `~/spinifex/logs/` for real multi-server.

 ## Advanced Configuration

@@ -1154,14 +1154,14 @@ Example with management NIC `192.168.1.0/24` and overlay NIC `10.0.0.0/24`. The
 Server 1:

 ```bash
-./bin/hive admin init \
+./bin/spx admin init \
  --node node1 \
  --nodes 3 \
  --bind 192.168.1.10 \
  --cluster-bind 192.168.1.10 \
  --port 4432 \
-  --hive-dir ~/hive/ \
-  --config-dir ~/hive/config/ \
+  --spinifex-dir ~/spinifex/ \
+  --config-dir ~/spinifex/config/ \
  --region us-east-1 \
  --az us-east-1a
 ```
@@ -1169,13 +1169,13 @@ Server 1:
 Server 2 (while init is running):

 ```bash
-./bin/hive admin join \
+./bin/spx admin join \
  --node node2 \
  --bind 192.168.1.11 \
  --cluster-bind 192.168.1.11 \
  --host 192.168.1.10:4432 \
-  --data-dir ~/hive/ \
-  --config-dir ~/hive/config/ \
+  --data-dir ~/spinifex/ \
+  --config-dir ~/spinifex/config/ \
  --region us-east-1 \
  --az us-east-1a
 ```
@@ -1183,13 +1183,13 @@ Server 2 (while init is running):
 Server 3 (while init is running):

 ```bash
-./bin/hive admin join \
+./bin/spx admin join \
  --node node3 \
  --bind 192.168.1.12 \
  --cluster-bind 192.168.1.12 \
  --host 192.168.1.10:4432 \
-  --data-dir ~/hive/ \
-  --config-dir ~/hive/config/ \
+  --data-dir ~/spinifex/ \
+  --config-dir ~/spinifex/config/ \
  --region us-east-1 \
  --az us-east-1a
 ```
@@ -1204,7 +1204,7 @@ sudo ip addr add 10.11.12.2/24 dev eth0
 sudo ip addr add 10.11.12.3/24 dev eth0
 ```

-Replace `eth0` with your network interface name (e.g., `enp0s3`, `ens33`). Then export these as your `HIVE_NODE` variables instead of the loopback addresses.
+Replace `eth0` with your network interface name (e.g., `enp0s3`, `ens33`). Then export these as your `SPINIFEX_NODE` variables instead of the loopback addresses.

 To remove the aliases:

@@ -1221,7 +1221,7 @@ When running in the multi-server cluster mode a graceful shutdown is required to
 On any node, issue the following command to shutdown nodes cluster wide:

 ```sh
-./bin/hive admin cluster shutdown
+./bin/spx admin cluster shutdown
 ```

 Example output:
@@ -1231,9 +1231,9 @@ Phases: gate -> drain -> storage -> persist -> infra
 Timeout per phase: 2m0s

 [GATE] Sending to 3 node(s)...
-  [GATE] node1: stopped awsgw, hive-ui
-  [GATE] node3: stopped awsgw, hive-ui
-  [GATE] node2: stopped awsgw, hive-ui
+  [GATE] node1: stopped awsgw, spinifex-ui
+  [GATE] node3: stopped awsgw, spinifex-ui
+  [GATE] node2: stopped awsgw, spinifex-ui
 [GATE] Complete (3/3 nodes, 2.005s)

 [DRAIN] Sending to 3 node(s)...
@@ -1,3 +1,3 @@
-# Hive Documentation
+# Spinifex Documentation

-This directory contains the Hive documentation. This is available in individual markdown files, and a generated website to aid navigation and browing documentation at: [https://docs.mulgadc.com](https://docs.mulgadc.com/)
+This directory contains the Spinifex documentation. This is available in individual markdown files, and a generated website to aid navigation and browing documentation at: [https://docs.mulgadc.com](https://docs.mulgadc.com/)
@@ -7,8 +7,8 @@ tags:
  - iam
  - admin
 resources:
-  - title: "Hive Repository"
-    url: "https://github.com/mulgadc/hive"
+  - title: "Spinifex Repository"
+    url: "https://github.com/mulgadc/spinifex"
 ---

 # Creating Accounts
@@ -25,15 +25,15 @@ resources:

 ## Overview

-Hive supports multi-tenant account isolation. Each account gets its own IAM credentials, AWS CLI profile, and isolated resource namespace.
+Spinifex supports multi-tenant account isolation. Each account gets its own IAM credentials, AWS CLI profile, and isolated resource namespace.

 ## Instructions

 ## Create Account

 ```bash
-./bin/hive admin account create --name myteam
-export AWS_PROFILE=hive-myteam
+./bin/spx admin account create --name myteam
+export AWS_PROFILE=spinifex-myteam
 ```

 ## Verify
@@ -57,5 +57,5 @@ Ensure the `AWS_PROFILE` environment variable matches the profile name:

 ```bash
 echo $AWS_PROFILE
-export AWS_PROFILE=hive-myteam
+export AWS_PROFILE=spinifex-myteam
 ```
@@ -8,8 +8,8 @@ tags:
  - ec2
  - ssh
 resources:
-  - title: "Hive Repository"
-    url: "https://github.com/mulgadc/hive"
+  - title: "Spinifex Repository"
+    url: "https://github.com/mulgadc/spinifex"
  - title: "Debian Cloud Images"
    url: "https://cloud.debian.org/images/cloud/bookworm/latest/"
 ---
@@ -28,9 +28,10 @@ resources:

 ## Overview

-This guide walks through the complete workflow for creating a production-ready Hive environment.
+This guide walks through the complete workflow for creating a production-ready Spinifex environment.

 **Steps:**
+
 1. Create a user account
 2. Import or create SSH keys
 3. Create a VPC and subnet
@@ -44,35 +45,35 @@ This guide walks through the complete workflow for creating a production-ready H
 ## 1. Import SSH Key

 ```bash
-aws ec2 import-key-pair --key-name "hive-key" --public-key-material fileb://~/.ssh/id_rsa.pub
+aws ec2 import-key-pair --key-name "spinifex-key" --public-key-material fileb://~/.ssh/id_rsa.pub
 ```

 ## 2. Create VPC

 ```bash
 aws ec2 create-vpc --cidr-block 10.200.0.0/16
-export HIVE_VPC="vpc-XXX"
+export SPINIFEX_VPC="vpc-XXX"

-aws ec2 create-subnet --vpc-id $HIVE_VPC --cidr-block 10.200.1.0/24
-export HIVE_SUBNET="subnet-XXX"
+aws ec2 create-subnet --vpc-id $SPINIFEX_VPC --cidr-block 10.200.1.0/24
+export SPINIFEX_SUBNET="subnet-XXX"
 ```

 ## 3. Import AMI

 ```bash
-./bin/hive admin images list
-./bin/hive admin images import --name debian-12-x86_64
-export HIVE_AMI="ami-XXX"
+./bin/spx admin images list
+./bin/spx admin images import --name debian-12-x86_64
+export SPINIFEX_AMI="ami-XXX"
 ```

 ## 4. Launch Instance

 ```bash
 aws ec2 run-instances \
-  --image-id $HIVE_AMI \
+  --image-id $SPINIFEX_AMI \
  --instance-type t3.small \
-  --key-name hive-key \
-  --subnet-id $HIVE_SUBNET \
+  --key-name spinifex-key \
+  --subnet-id $SPINIFEX_SUBNET \
  --count 1
 ```

@@ -82,24 +83,24 @@ aws ec2 run-instances \
 ps auxw | grep $INSTANCE_ID
 # Look for: hostfwd=tcp:127.0.0.1:<port>-:22

-ssh -i ~/.ssh/hive-key ec2-user@127.0.0.1 -p <port>
+ssh -i ~/.ssh/spinifex-key ec2-user@127.0.0.1 -p <port>
 ```

 ## Troubleshooting

 ## Instance stuck in pending

-Check the Hive daemon and QEMU logs for boot errors:
+Check the Spinifex daemon and QEMU logs for boot errors:

 ```bash
-ls ~/hive/logs/
-cat ~/hive/logs/daemon.log
+ls ~/spinifex/logs/
+cat ~/spinifex/logs/spinifex.log
 ```

 Verify the AMI exists and architecture matches your host:

 ```bash
-aws ec2 describe-images --image-ids $HIVE_AMI
+aws ec2 describe-images --image-ids $SPINIFEX_AMI
 ```

 ## SSH connection refused
@@ -115,5 +116,5 @@ ps auxw | grep hostfwd
 Ensure you're using the correct key and port:

 ```bash
-ssh -i ~/.ssh/hive-key ec2-user@127.0.0.1 -p <port>
+ssh -i ~/.ssh/spinifex-key ec2-user@127.0.0.1 -p <port>
 ```
@@ -1,19 +1,19 @@
 ---
 title: "Hybrid Sync"
-description: "Synchronize data between Hive and AWS when network connectivity is available."
+description: "Synchronize data between Spinifex and AWS when network connectivity is available."
 category: "Migration"
 tags:
  - hybrid
  - sync
  - s3
 resources:
-  - title: "Hive Repository"
-    url: "https://github.com/mulgadc/hive"
+  - title: "Spinifex Repository"
+    url: "https://github.com/mulgadc/spinifex"
 ---

 # Hybrid Sync

-> Synchronize data between Hive and AWS when network connectivity is available.
+> Synchronize data between Spinifex and AWS when network connectivity is available.

 ## Table of Contents

@@ -25,7 +25,7 @@ resources:

 ## Overview

-Hive's hybrid mode enables bidirectional data synchronization between local infrastructure and AWS cloud services. Ideal for intermittent connectivity environments.
+Spinifex's hybrid mode enables bidirectional data synchronization between local infrastructure and AWS cloud services. Ideal for intermittent connectivity environments.

 ## Instructions

@@ -33,20 +33,20 @@ Hive's hybrid mode enables bidirectional data synchronization between local infr

 ```bash
 aws s3 sync s3://local-bucket/ s3://cloud-bucket/ \
-  --source-region hive --region us-east-1
+  --source-region spinifex --region us-east-1
 ```

 ## Pull Cloud to Local

 ```bash
 aws s3 sync s3://cloud-bucket/ s3://local-bucket/ \
-  --source-region us-east-1 --region hive
+  --source-region us-east-1 --region spinifex
 ```

 ## EBS Volume Backup

 ```bash
-rsync -avz /data/ user@cloud-server:/backup/hive-data/
+rsync -avz /data/ user@cloud-server:/backup/spinifex-data/
 ```

 ## Troubleshooting
@@ -57,7 +57,7 @@ S3 sync is idempotent — re-run the same command to resume where it left off:

 ```bash
 aws s3 sync s3://local-bucket/ s3://cloud-bucket/ \
-  --source-region hive --region us-east-1
+  --source-region spinifex --region us-east-1
 ```

 Only changed or missing files will be transferred on subsequent runs.
@@ -67,7 +67,7 @@ Only changed or missing files will be transferred on subsequent runs.
 Verify your AWS credentials are configured for both the source and destination:

 ```bash
-aws sts get-caller-identity --profile hive
+aws sts get-caller-identity --profile spinifex
 aws sts get-caller-identity --profile default
 ```

@@ -1,6 +1,6 @@
 ---
 title: "Air-Gapped Installation"
-description: "Deploy Hive in environments without internet connectivity. Covers offline package caching, USB deployment, and package verification."
+description: "Deploy Spinifex in environments without internet connectivity. Covers offline package caching, USB deployment, and package verification."
 category: "Getting Started"
 tags:
  - install
@@ -8,15 +8,15 @@ tags:
  - offline
 badge: advanced
 resources:
-  - title: "Hive Repository"
-    url: "https://github.com/mulgadc/hive"
+  - title: "Spinifex Repository"
+    url: "https://github.com/mulgadc/spinifex"
  - title: "apt-cacher-ng"
    url: "https://wiki.debian.org/AptCacherNg"
 ---

 # Air-Gapped Installation

-> Deploy Hive in environments without internet connectivity.
+> Deploy Spinifex in environments without internet connectivity.

 ## Table of Contents

@@ -28,7 +28,7 @@ resources:

 ## Overview

-In air-gapped or disconnected environments, Hive can be deployed without internet access. This guide covers preparing offline packages on a connected machine, creating USB deployment media, and installing on the target server with package verification.
+In air-gapped or disconnected environments, Spinifex can be deployed without internet access. This guide covers preparing offline packages on a connected machine, creating USB deployment media, and installing on the target server with package verification.

 **Deployment methods:**
 - **apt-cacher-ng** — Local APT cache for Debian/Ubuntu packages
@@ -47,7 +47,7 @@ sudo apt install apt-cacher-ng
 sudo systemctl enable --now apt-cacher-ng
 ```

-Pre-download all Hive dependencies:
+Pre-download all Spinifex dependencies:

 ```bash
 sudo apt install --download-only nbdkit nbdkit-plugin-dev pkg-config \
@@ -59,10 +59,10 @@ sudo apt install --download-only nbdkit nbdkit-plugin-dev pkg-config \
 ## Step 2. Create USB deployment media

 ```bash
-mkdir -p /media/hive-deploy/{apt-packages,go-cache,hive-source}
-cp /var/cache/apt/archives/*.deb /media/hive-deploy/apt-packages/
-cp -r ~/go/pkg/mod/cache/ /media/hive-deploy/go-cache/
-cp -r ~/Development/mulga/hive /media/hive-deploy/hive-source/
+mkdir -p /media/spinifex-deploy/{apt-packages,go-cache,spinifex-source}
+cp /var/cache/apt/archives/*.deb /media/spinifex-deploy/apt-packages/
+cp -r ~/go/pkg/mod/cache/ /media/spinifex-deploy/go-cache/
+cp -r ~/Development/mulga/spinifex /media/spinifex-deploy/spinifex-source/
 ```

 ## Step 3. Verify package integrity
@@ -70,9 +70,9 @@ cp -r ~/Development/mulga/hive /media/hive-deploy/hive-source/
 Sign and verify packages before transferring to the target:

 ```bash
-gpg --import /media/hive-deploy/mulga-signing-key.asc
-gpg --verify hive-v1.0.tar.gz.sig hive-v1.0.tar.gz
-sha256sum -c /media/hive-deploy/checksums.sha256
+gpg --import /media/spinifex-deploy/mulga-signing-key.asc
+gpg --verify spinifex-v1.0.tar.gz.sig spinifex-v1.0.tar.gz
+sha256sum -c /media/spinifex-deploy/checksums.sha256
 ```

 ## Step 4. Install on the target server
@@ -82,8 +82,8 @@ Mount the USB and install:
 ```bash
 sudo mount /dev/sdb1 /mnt/usb
 sudo dpkg -i /mnt/usb/apt-packages/*.deb
-cp -r /mnt/usb/hive-source ~/Development/mulga/hive
-cd ~/Development/mulga/hive && make build
+cp -r /mnt/usb/spinifex-source ~/Development/mulga/spinifex
+cd ~/Development/mulga/spinifex && make build
 ```

 Then follow the [Source Install](/docs/source-install) guide from Step 3 (Setup OVN) onwards.
@@ -106,14 +106,14 @@ The `-f` flag tells apt to fix broken dependencies using what's available locall
 The signing key may not match or the download was corrupted. Re-import the key and verify:

 ```bash
-gpg --import /media/hive-deploy/mulga-signing-key.asc
-gpg --verify hive-v1.0.tar.gz.sig hive-v1.0.tar.gz
+gpg --import /media/spinifex-deploy/mulga-signing-key.asc
+gpg --verify spinifex-v1.0.tar.gz.sig spinifex-v1.0.tar.gz
 ```

 If verification still fails, re-download the package on the connected machine and compare checksums:

 ```bash
-sha256sum hive-v1.0.tar.gz
+sha256sum spinifex-v1.0.tar.gz
 ```

 ## Go module cache errors
@@ -121,7 +121,7 @@ sha256sum hive-v1.0.tar.gz
 The Go module cache may have been incompletely copied. On the connected machine, re-export the full cache:

 ```bash
-cp -r ~/go/pkg/mod/cache/ /media/hive-deploy/go-cache/
+cp -r ~/go/pkg/mod/cache/ /media/spinifex-deploy/go-cache/
 ```

 On the target, restore it:
@@ -1,6 +1,6 @@
 ---
 title: "Multi-Node Installation"
-description: "Deploy Hive across multiple servers to create an availability zone with high availability, data durability, and fault tolerance."
+description: "Deploy Spinifex across multiple servers to create an availability zone with high availability, data durability, and fault tolerance."
 category: "Getting Started"
 tags:
  - install
@@ -8,8 +8,8 @@ tags:
  - cluster
 badge: availability-zone
 resources:
-  - title: "Hive Repository"
-    url: "https://github.com/mulgadc/hive"
+  - title: "Spinifex Repository"
+    url: "https://github.com/mulgadc/spinifex"
  - title: "Predastore (S3)"
    url: "https://github.com/mulgadc/predastore"
  - title: "Viperblock (EBS)"
@@ -18,7 +18,7 @@ resources:

 # Multi-Node Installation

-> Deploy Hive across multiple servers to create an availability zone.
+> Deploy Spinifex across multiple servers to create an availability zone.

 ## Table of Contents

@@ -30,29 +30,31 @@ resources:

 ## Overview

-A Hive cluster operates as a fully distributed infrastructure region — similar to an AWS Region — where multiple nodes provide high availability, data durability, and fault tolerance.
+A Spinifex cluster operates as a fully distributed infrastructure region — similar to an AWS Region — where multiple nodes provide high availability, data durability, and fault tolerance.

 **Services distributed across nodes:**
+
 - **NATS** — Clustered message bus for request routing and JetStream replication
 - **Predastore** — Raft consensus with Reed-Solomon erasure coding (RS 2+1)
 - **Viperblock** — Block storage co-located with compute nodes
- **Hive Daemon** — Independent AWS API request serving per node
+- **Spinifex Daemon** — Independent AWS API request serving per node

 Cluster formation is automatic. When initializing with `--nodes 3`, the init node starts a formation server and waits for peers to join. Once all nodes register, each receives the full cluster topology — credentials, CA certificates, NATS routes, Predastore peer lists — no manual configuration synchronization required.

 **Network requirements:**
+
 - Minimum 1 NIC per server
 - 2 NICs recommended for production (management + overlay)
 - UDP port 6081 open between hosts (Geneve tunnels)

 ## Instructions

-## Step 1. Install Hive on each server
+## Step 1. Install Spinifex on each server

 Run the binary installer on **every server** in the cluster:

 ```bash
-curl https://install.mulgadc.com/ | bash
+curl https://install.mulgadc.com | bash
 ```

 ## Step 2. Set node IP variables
@@ -60,9 +62,9 @@ curl https://install.mulgadc.com/ | bash
 On **each server**, export the IPs for all nodes (replace with your actual IPs):

 ```bash
-export HIVE_NODE1=192.168.1.10
-export HIVE_NODE2=192.168.1.11
-export HIVE_NODE3=192.168.1.12
+export SPINIFEX_NODE1=192.168.1.10
+export SPINIFEX_NODE2=192.168.1.11
+export SPINIFEX_NODE3=192.168.1.12
 ```

 To find your server's IP:
@@ -71,6 +73,13 @@ To find your server's IP:
 ip addr show | grep "inet "
 ```

+Next, define the AWS region and AZ you are deploying locally.
+
+```bash
+export AWS_REGION=us-east-1
+export AWS_AZ=us-east-1a
+```
+
 ## Step 3. Setup OVN networking

 OVN must be configured on every server before forming the cluster. Server 1 runs OVN central (NB and SB databases) and must be set up first.
@@ -78,7 +87,7 @@ OVN must be configured on every server before forming the cluster. Server 1 runs
 **Server 1 — OVN central + compute (run first):**

 ```bash
-hive setup-ovn --management --encap-ip=$HIVE_NODE1
+sudo /usr/local/share/spinifex/setup-ovn.sh --management --encap-ip=$SPINIFEX_NODE1
 ```

 Verify OVN central is ready before proceeding:
@@ -90,13 +99,13 @@ sudo ovn-sbctl show
 **Server 2 — Compute node (after server 1 is ready):**

 ```bash
-hive setup-ovn --ovn-remote=tcp:$HIVE_NODE1:6642 --encap-ip=$HIVE_NODE2
+sudo /usr/local/share/spinifex/setup-ovn.sh --ovn-remote=tcp:$SPINIFEX_NODE1:6642 --encap-ip=$SPINIFEX_NODE2
 ```

 **Server 3 — Compute node (after server 1 is ready):**

 ```bash
-hive setup-ovn --ovn-remote=tcp:$HIVE_NODE1:6642 --encap-ip=$HIVE_NODE3
+sudo /usr/local/share/spinifex/setup-ovn.sh --ovn-remote=tcp:$SPINIFEX_NODE1:6642 --encap-ip=$SPINIFEX_NODE3
 ```

 Verify all chassis have registered (from server 1):
@@ -114,44 +123,38 @@ The formation process requires running init and join commands concurrently. The
 **Server 1 — Initialize the cluster:**

 ```bash
-hive admin init \
+sudo spx admin init \
  --node node1 \
  --nodes 3 \
-  --bind $HIVE_NODE1 \
-  --cluster-bind $HIVE_NODE1 \
+  --bind $SPINIFEX_NODE1 \
+  --cluster-bind $SPINIFEX_NODE1 \
  --port 4432 \
-  --hive-dir ~/hive/ \
-  --config-dir ~/hive/config/ \
-  --region us-east-1 \
-  --az us-east-1a
+  --region $AWS_REGION \
+  --az $AWS_AZ
 ```

 **Server 2 — Join the cluster (while init is running):**

 ```bash
-hive admin join \
+spx admin join \
  --node node2 \
-  --bind $HIVE_NODE2 \
-  --cluster-bind $HIVE_NODE2 \
-  --host $HIVE_NODE1:4432 \
-  --data-dir ~/hive/ \
-  --config-dir ~/hive/config/ \
-  --region us-east-1 \
-  --az us-east-1a
+  --bind $SPINIFEX_NODE2 \
+  --cluster-bind $SPINIFEX_NODE2 \
+  --host $SPINIFEX_NODE1:4432 \
+  --region $AWS_REGION \
+  --az $AWS_AZ
 ```

 **Server 3 — Join the cluster (while init is running):**

 ```bash
-hive admin join \
+spx admin join \
  --node node3 \
-  --bind $HIVE_NODE3 \
-  --cluster-bind $HIVE_NODE3 \
-  --host $HIVE_NODE1:4432 \
-  --data-dir ~/hive/ \
-  --config-dir ~/hive/config/ \
-  --region us-east-1 \
-  --az us-east-1a
+  --bind $SPINIFEX_NODE3 \
+  --cluster-bind $SPINIFEX_NODE3 \
+  --host $SPINIFEX_NODE1:4432 \
+  --region $AWS_REGION \
+  --az $AWS_AZ
 ```

 All three processes will exit with a cluster summary once formation is complete.
@@ -161,13 +164,13 @@ All three processes will exit with a cluster summary once formation is complete.
 Start services on **all servers**:

 ```bash
-hive start
+sudo systemctl start spinifex.target
 ```

 From any node, verify the cluster:

 ```bash
-hive get nodes
+spx get nodes
 ```

 ```
@@ -182,9 +185,9 @@ node3   Ready     192.168.1.12    us-east-1   us-east-1a   2m       0
 On **each server**, trust the CA generated during init:

 ```bash
-sudo cp ~/hive/config/ca.pem /usr/local/share/ca-certificates/hive-ca.crt
+sudo cp ~/spinifex/config/ca.pem /usr/local/share/ca-certificates/spinifex-ca.crt
 sudo update-ca-certificates
-export AWS_PROFILE=hive
+export AWS_PROFILE=spinifex
 ```

 ## Step 7. Launch instances across the cluster
@@ -193,17 +196,17 @@ Connect to any node's AWS Gateway — all nodes serve the same cluster state:

 ```bash
 aws ec2 run-instances \
-  --image-id $HIVE_AMI \
+  --image-id $SPINIFEX_AMI \
  --instance-type t3.small \
-  --key-name hive-key \
-  --subnet-id $HIVE_SUBNET \
+  --key-name spinifex-key \
+  --subnet-id $SPINIFEX_SUBNET \
  --count 3
 ```

-Hive distributes instances across nodes based on available capacity. Check which node each instance landed on:
+Spinifex distributes instances across nodes based on available capacity. Check which node each instance landed on:

 ```bash
-hive get vms
+spx get vms
 ```

 ## Shutdown
@@ -211,7 +214,7 @@ hive get vms
 A graceful shutdown coordinates all nodes — drains VMs, flushes storage, and stops services:

 ```bash
-hive admin cluster shutdown
+spx admin cluster shutdown
 ```

 ## Troubleshooting
@@ -223,7 +226,7 @@ The init command must still be running when you execute join on other servers. I
 Check that all servers can reach the init node on the formation port:

 ```bash
-curl -s http://$HIVE_NODE1:4432/health
+curl -s http://$SPINIFEX_NODE1:4432/health
 ```

 ## OVN chassis not registering
@@ -263,13 +266,13 @@ If tunnels are missing, verify `--encap-ip` was set correctly during OVN setup.
 Check if the daemon is running and listening on the correct IP:

 ```bash
-curl -s http://$HIVE_NODE1:4432/health
+curl -s http://$SPINIFEX_NODE1:4432/health
 ```

 Review the daemon logs for errors:

 ```bash
-cat ~/hive/logs/daemon.log
+cat ~/spinifex/logs/spinifex.log
 ```

 Verify `--bind` was set to the correct IP during cluster formation.
@@ -279,7 +282,7 @@ Verify `--bind` was set to the correct IP during cluster formation.
 Check NATS logs for connection errors between nodes:

 ```bash
-grep -i "route\|cluster" ~/hive/logs/nats.log
+grep -i "route\|cluster" ~/spinifex/logs/nats.log
 ```

 Ensure `--cluster-bind` IPs are reachable between all servers.
@@ -1,6 +1,6 @@
 ---
-title: "Installing Hive"
-description: "Install Hive on a single server using the binary installer. Get a working region with EC2, VPC, EBS, and S3 in minutes."
+title: "Installing Spinifex"
+description: "Install Spinifex on a single server using the binary installer. Get a working region with EC2, VPC, EBS, and S3 in minutes."
 category: "Getting Started"
 tags:
  - install
@@ -8,17 +8,17 @@ tags:
  - quickstart
 badge: quickstart
 resources:
-  - title: "Hive Repository"
-    url: "https://github.com/mulgadc/hive"
+  - title: "Spinifex Repository"
+    url: "https://github.com/mulgadc/spinifex"
  - title: "Predastore (S3)"
    url: "https://github.com/mulgadc/predastore"
  - title: "Viperblock (EBS)"
    url: "https://github.com/mulgadc/viperblock"
 ---

-# Installing Hive
+# Installing Spinifex

-> Install Hive on a single server using the binary installer.
+> Install Spinifex on a single server using the binary installer.

 ## Table of Contents

@@ -30,16 +30,18 @@ resources:

 ## Overview

-Hive is an open-source infrastructure platform that brings core AWS services — EC2, VPC, EBS, and S3 — to bare-metal, edge, and on-prem environments.
+Spinifex is an open-source infrastructure platform that brings core AWS services — EC2, VPC, EBS, and S3 — to bare-metal, edge, and on-prem environments.

-This guide installs Hive on a single server using the binary installer. For multi-server clusters, see [Multi-Node Installation](/docs/installing-hive-multi-node). To build from source, see [Source Install](/docs/source-install).
+This guide installs Spinifex on a single server using the binary installer. For multi-server clusters, see [Multi-Node Installation](/docs/installing-spinifex-multi-node). To build from source, see [Source Install](/docs/source-install).

 **Supported Operating Systems:**
+
 - Ubuntu 22.04 / 24.04 / 25.10
 - Debian 12.13

 **What gets installed:**
- Hive daemon and CLI
+
+- Spinifex daemon and CLI
 - QEMU/KVM for virtual machine management
 - OVN/Open vSwitch for VPC networking
 - Predastore (S3-compatible object storage)
@@ -48,41 +50,41 @@ This guide installs Hive on a single server using the binary installer. For mult

 ## Instructions

-## Step 1. Install Hive
+## Step 1. Install Spinifex

 ```bash
-curl https://install.mulgadc.com/ | bash
+curl https://install.mulgadc.com | bash
 ```

-The installer downloads the Hive binary and bootstraps all dependencies (QEMU, OVN/OVS, AWS CLI).
+The installer downloads the Spinifex binary and bootstraps all dependencies (QEMU, OVN/OVS, AWS CLI).

 ## Step 2. Initialize a region

-Create your first region and availability zone:
+Create your first region and availability zone, replace `ap-southeast-2` with your desired region:

 ```bash
-hive admin init --region ap-southeast-2 --az ap-southeast-2a --node node1 --nodes 1
+spx admin init --region ap-southeast-2 --az ap-southeast-2a --node node1 --nodes 1
 ```

 ## Step 3. Trust the CA certificate

-Hive generates a local CA during initialization. Add it to your system trust store:
+Spinifex generates a local CA during initialization. Add it to your system trust store:

 ```bash
-sudo cp ~/hive/config/ca.pem /usr/local/share/ca-certificates/hive-ca.crt
+sudo cp ~/spinifex/config/ca.pem /usr/local/share/ca-certificates/spinifex-ca.crt
 sudo update-ca-certificates
 ```

 ## Step 4. Start services

 ```bash
-hive start
+sudo systemctl start spinifex.target
 ```

 Set the AWS profile to use the default admin account:

 ```bash
-export AWS_PROFILE=hive
+export AWS_PROFILE=spinifex
 ```

 ## Step 5. Import an AMI
@@ -90,26 +92,26 @@ export AWS_PROFILE=hive
 List available images and import one matching your architecture:

 ```bash
-hive admin images list
-hive admin images import --name debian-12-arm64
+spx admin images list
+spx admin images import --name debian-12-arm64
 ```

 ## Step 6. Create a VPC and launch an instance

 ```bash
 aws ec2 create-vpc --cidr-block 10.200.0.0/16
-export HIVE_VPC="vpc-XXX"
+export SPINIFEX_VPC="vpc-XXX"

-aws ec2 create-subnet --vpc-id $HIVE_VPC --cidr-block 10.200.1.0/24
-export HIVE_SUBNET="subnet-XXX"
+aws ec2 create-subnet --vpc-id $SPINIFEX_VPC --cidr-block 10.200.1.0/24
+export SPINIFEX_SUBNET="subnet-XXX"

-aws ec2 import-key-pair --key-name "hive-key" --public-key-material fileb://~/.ssh/id_rsa.pub
+aws ec2 import-key-pair --key-name "spinifex-key" --public-key-material fileb://~/.ssh/id_rsa.pub

 aws ec2 run-instances \
-  --image-id $HIVE_AMI \
+  --image-id $SPINIFEX_AMI \
  --instance-type t3.small \
-  --key-name hive-key \
-  --subnet-id $HIVE_SUBNET \
+  --key-name spinifex-key \
+  --subnet-id $SPINIFEX_SUBNET \
  --count 1
 ```

@@ -121,17 +123,17 @@ Find the forwarded SSH port and connect:
 ps auxw | grep hostfwd
 # Look for: hostfwd=tcp:127.0.0.1:<port>-:22

-ssh -i ~/.ssh/hive-key ec2-user@127.0.0.1 -p <port>
+ssh -i ~/.ssh/spinifex-key ec2-user@127.0.0.1 -p <port>
 ```

 ## Troubleshooting

-## hive command not found
+## spx command not found

 The binary is not in your PATH. Run the installer again or add the install directory to your PATH:

 ```bash
-export PATH=$PATH:~/hive/bin/
+export PATH=$PATH:~/spinifex/bin/
 ```

 Add this to your `~/.bashrc` or `~/.zshrc` for persistence.
@@ -153,26 +155,26 @@ journalctl -u ovn-controller --no-pager -n 20

 ## CA certificate not trusted

-AWS CLI will reject HTTPS connections if the Hive CA is not trusted. Re-add the certificate:
+AWS CLI will reject HTTPS connections if the Spinifex CA is not trusted. Re-add the certificate:

 ```bash
-sudo cp ~/hive/config/ca.pem /usr/local/share/ca-certificates/hive-ca.crt
+sudo cp ~/spinifex/config/ca.pem /usr/local/share/ca-certificates/spinifex-ca.crt
 sudo update-ca-certificates
 ```

 Verify it was added:

 ```bash
-ls -la /usr/local/share/ca-certificates/hive-ca.crt
+ls -la /usr/local/share/ca-certificates/spinifex-ca.crt
 ```

 ## Instance stuck in pending

-Check the Hive daemon logs for errors:
+Check the Spinifex daemon logs for errors:

 ```bash
-ls ~/hive/logs/
-cat ~/hive/logs/daemon.log
+ls ~/spinifex/logs/
+cat ~/spinifex/logs/spinifex.log
 ```

 Verify the AMI was imported successfully:
@@ -1,21 +1,21 @@
 ---
 title: "Launching Instances"
-description: "Launch, manage, and connect to EC2-compatible virtual machines on Hive."
+description: "Launch, manage, and connect to EC2-compatible virtual machines on Spinifex."
 category: "Environments"
 tags:
  - ec2
  - instances
  - vm
 resources:
-  - title: "Hive Repository"
-    url: "https://github.com/mulgadc/hive"
+  - title: "Spinifex Repository"
+    url: "https://github.com/mulgadc/spinifex"
  - title: "AWS EC2 CLI"
    url: "https://docs.aws.amazon.com/cli/latest/reference/ec2/"
 ---

 # Launching Instances

-> Launch, manage, and connect to EC2-compatible virtual machines on Hive.
+> Launch, manage, and connect to EC2-compatible virtual machines on Spinifex.

 ## Table of Contents

@@ -27,9 +27,10 @@ resources:

 ## Overview

-Hive provides EC2-compatible VM management built on QEMU/KVM. Instances support cloud-init, SSH key injection, VPC networking, and standard AWS lifecycle operations.
+Spinifex provides EC2-compatible VM management built on QEMU/KVM. Instances support cloud-init, SSH key injection, VPC networking, and standard AWS lifecycle operations.

 **Supported operations:**
+
 - `run-instances` — Launch new VMs
 - `describe-instances` — Query state
 - `stop-instances` / `start-instances` — Lifecycle
@@ -41,10 +42,10 @@ Hive provides EC2-compatible VM management built on QEMU/KVM. Instances support

 ```bash
 aws ec2 run-instances \
-  --image-id $HIVE_AMI \
+  --image-id $SPINIFEX_AMI \
  --instance-type t3.small \
-  --key-name hive-key \
-  --subnet-id $HIVE_SUBNET \
+  --key-name spinifex-key \
+  --subnet-id $SPINIFEX_SUBNET \
  --count 1

 export INSTANCE_ID="i-XXX"
@@ -63,7 +64,7 @@ aws ec2 terminate-instances --instance-ids $INSTANCE_ID

 ```bash
 ps auxw | grep $INSTANCE_ID
-ssh -i ~/.ssh/hive-key ec2-user@127.0.0.1 -p <port>
+ssh -i ~/.ssh/spinifex-key ec2-user@127.0.0.1 -p <port>
 ```

 ## Troubleshooting
@@ -73,15 +74,15 @@ ssh -i ~/.ssh/hive-key ec2-user@127.0.0.1 -p <port>
 Check QEMU logs for the instance and verify the AMI architecture matches your host:

 ```bash
-cat ~/hive/logs/daemon.log
-aws ec2 describe-images --image-ids $HIVE_AMI
+cat ~/spinifex/logs/spinifex.log
+aws ec2 describe-images --image-ids $SPINIFEX_AMI
 ```

 If the AMI is for a different architecture (e.g. arm64 on an x86_64 host), import the correct image:

 ```bash
-./bin/hive admin images list
-./bin/hive admin images import --name debian-12-x86_64
+./bin/spx admin images list
+./bin/spx admin images import --name debian-12-x86_64
 ```

 ## Cannot SSH into instance
@@ -1,6 +1,6 @@
 ---
 title: "Moving an AWS Workload to Mulga"
-description: "Migrate existing AWS workloads to Hive using compatible APIs, SDKs, and Terraform."
+description: "Migrate existing AWS workloads to Spinifex using compatible APIs, SDKs, and Terraform."
 category: "Migration"
 tags:
  - migration
@@ -8,8 +8,8 @@ tags:
  - terraform
 badge: new
 resources:
-  - title: "Hive Repository"
-    url: "https://github.com/mulgadc/hive"
+  - title: "Spinifex Repository"
+    url: "https://github.com/mulgadc/spinifex"
  - title: "AWS CLI Reference"
    url: "https://docs.aws.amazon.com/cli/latest/reference/"
  - title: "Terraform AWS Provider"
@@ -18,7 +18,7 @@ resources:

 # Moving an AWS Workload to Mulga

-> Migrate existing AWS workloads to Hive using compatible APIs, SDKs, and Terraform.
+> Migrate existing AWS workloads to Spinifex using compatible APIs, SDKs, and Terraform.

 ## Table of Contents

@@ -30,7 +30,7 @@ resources:

 ## Overview

-Hive provides drop-in compatibility with AWS APIs, making it possible to migrate existing workloads with minimal changes.
+Spinifex provides drop-in compatibility with AWS APIs, making it possible to migrate existing workloads with minimal changes.

 **Supported Services:** VPC, EC2, EBS, S3, IAM

@@ -41,7 +41,7 @@ Hive provides drop-in compatibility with AWS APIs, making it possible to migrate
 ## Configure AWS CLI

 ```bash
-export AWS_PROFILE=hive
+export AWS_PROFILE=spinifex
 aws ec2 describe-instances
 aws s3 ls
 ```
@@ -51,8 +51,8 @@ aws s3 ls
 ```hcl
 provider "aws" {
  region     = "ap-southeast-2"
-  access_key = "your-hive-access-key"
-  secret_key = "your-hive-secret-key"
+  access_key = "your-spinifex-access-key"
+  secret_key = "your-spinifex-secret-key"

  endpoints {
    ec2 = "https://localhost:9999"
@@ -68,7 +68,7 @@ provider "aws" {
 ## Hybrid S3 Sync

 ```bash
-aws s3 sync s3://local-bucket/ s3://cloud-bucket/ --source-region hive --region us-east-1
+aws s3 sync s3://local-bucket/ s3://cloud-bucket/ --source-region spinifex --region us-east-1
 ```

 ## Troubleshooting
@@ -87,7 +87,7 @@ Without these, Terraform will try to validate credentials and metadata against r

 ## S3 signature errors

-Hive uses AWS Signature V4. Ensure your AWS CLI is version 2.0 or higher:
+Spinifex uses AWS Signature V4. Ensure your AWS CLI is version 2.0 or higher:

 ```bash
 aws --version
@@ -1,6 +1,6 @@
 ---
 title: "Source Install"
-description: "Build Hive from source for development, custom builds, or contributing. Includes dependency setup, compilation, and OVN configuration."
+description: "Build Spinifex from source for development, custom builds, or contributing. Includes dependency setup, compilation, and OVN configuration."
 category: "Getting Started"
 tags:
  - install
@@ -8,8 +8,8 @@ tags:
  - development
 badge: source
 resources:
-  - title: "Hive Repository"
-    url: "https://github.com/mulgadc/hive"
+  - title: "Spinifex Repository"
+    url: "https://github.com/mulgadc/spinifex"
  - title: "Predastore (S3)"
    url: "https://github.com/mulgadc/predastore"
  - title: "Viperblock (EBS)"
@@ -22,7 +22,7 @@ resources:

 # Source Install

-> Build Hive from source for development, custom builds, or contributing.
+> Build Spinifex from source for development, custom builds, or contributing.

 ## Table of Contents

@@ -34,7 +34,7 @@ resources:

 ## Overview

-This guide covers building Hive from source code. Use this if you want to contribute to Hive, build custom versions, or inspect the codebase. For production deployments, the [binary installer](/docs/installing-hive) is recommended.
+This guide covers building Spinifex from source code. Use this if you want to contribute to Spinifex, build custom versions, or inspect the codebase. For production deployments, the [binary installer](/docs/installing-spinifex) is recommended.

 **Supported Operating Systems:**
 - Ubuntu 22.04 / 24.04 / 25.10
@@ -56,7 +56,7 @@ This guide covers building Hive from source code. Use this if you want to contri
 Bootstrap all dependencies in one step:

 ```bash
-sudo make -C hive quickinstall
+sudo make -C spinifex quickinstall
 ```

 Ensure Go is in your PATH:
@@ -94,13 +94,13 @@ aws --version
 ```bash
 mkdir -p ~/Development/mulga/
 cd ~/Development/mulga/
-git clone https://github.com/mulgadc/hive.git
-cd hive
+git clone https://github.com/mulgadc/spinifex.git
+cd spinifex
 ./scripts/clone-deps.sh    # Clone viperblock + predastore
 ./scripts/dev-setup.sh     # Setup complete dev environment
 ```

-Confirm `./bin/hive` exists and is executable.
+Confirm `./bin/spx` exists and is executable.

 ## Step 3. Setup OVN

@@ -117,13 +117,13 @@ This creates the `br-int` integration bridge, starts `ovn-controller`, configure
 Create a region and availability zone:

 ```bash
-./bin/hive admin init --region ap-southeast-2 --az ap-southeast-2a --node node1 --nodes 1
+./bin/spx admin init --region ap-southeast-2 --az ap-southeast-2a --node node1 --nodes 1
 ```

 ## Step 5. Trust the CA certificate

 ```bash
-sudo cp ~/hive/config/ca.pem /usr/local/share/ca-certificates/hive-ca.crt
+sudo cp ~/spinifex/config/ca.pem /usr/local/share/ca-certificates/spinifex-ca.crt
 sudo update-ca-certificates
 ```

@@ -131,7 +131,7 @@ sudo update-ca-certificates

 ```bash
 ./scripts/start-dev.sh
-export AWS_PROFILE=hive
+export AWS_PROFILE=spinifex
 ```

 ## Troubleshooting
@@ -150,7 +150,7 @@ Add this to your `~/.bashrc` or `~/.zshrc` for persistence. Verify with:
 go version
 ```

-## ./bin/hive missing after build
+## ./bin/spx missing after build

 The build did not complete successfully. Re-run the setup:

@@ -177,10 +177,10 @@ sudo ovn-sbctl show

 ## CA certificate not trusted

-AWS CLI will reject HTTPS connections to Hive services. Re-add the certificate:
+AWS CLI will reject HTTPS connections to Spinifex services. Re-add the certificate:

 ```bash
-sudo cp ~/hive/config/ca.pem /usr/local/share/ca-certificates/hive-ca.crt
+sudo cp ~/spinifex/config/ca.pem /usr/local/share/ca-certificates/spinifex-ca.crt
 sudo update-ca-certificates
 ```

@@ -1,6 +1,6 @@
 ---
-title: "Hive Admin CLI"
-description: "Complete reference for the Hive administration CLI. Manage accounts, nodes, VMs, and services."
+title: "Spinifex Admin CLI"
+description: "Complete reference for the Spinifex administration CLI. Manage accounts, nodes, VMs, and services."
 category: "Administration"
 tags:
  - cli
@@ -8,13 +8,13 @@ tags:
  - reference
 badge: cli
 resources:
-  - title: "Hive Repository"
-    url: "https://github.com/mulgadc/hive"
+  - title: "Spinifex Repository"
+    url: "https://github.com/mulgadc/spinifex"
 ---

-# Hive Admin CLI
+# Spinifex Admin CLI

-> Complete reference for the Hive administration CLI.
+> Complete reference for the Spinifex administration CLI.

 ## Table of Contents

@@ -26,25 +26,25 @@ resources:

 ## Overview

-The `hive` binary is the central administration tool for managing your Hive infrastructure. It provides commands for cluster initialization, account management, node operations, VM lifecycle, and service control.
+The `spx` binary is the central administration tool for managing your Spinifex infrastructure. It provides commands for cluster initialization, account management, node operations, VM lifecycle, and service control.

-**Binary location:** `~/Development/mulga/hive/bin/hive`
+**Binary location:** `~/Development/mulga/spinifex/bin/spx`

-All services in the Hive platform are managed through this single binary.
+All services in the Spinifex platform are managed through this single binary.

 ## Instructions

 ## Account Management

 ```bash
-./bin/hive admin account create --name myteam
-export AWS_PROFILE=hive-myteam
+./bin/spx admin account create --name myteam
+export AWS_PROFILE=spinifex-myteam
 ```

 ## Node Management

 ```bash
-./bin/hive get nodes
+./bin/spx get nodes
 ```

 ```
@@ -57,30 +57,30 @@ node3   Ready     127.0.0.3       ap-southeast-2   ap-southeast-2a  2m       0
 ## Monitor Resources

 ```bash
-./bin/hive top nodes
+./bin/spx top nodes
 ```

 ## Image Management

 ```bash
-./bin/hive admin images list
-./bin/hive admin images import --name debian-12-arm64
+./bin/spx admin images list
+./bin/spx admin images import --name debian-12-arm64
 ```

 ## Cluster Shutdown

 ```bash
-./bin/hive admin cluster shutdown
+./bin/spx admin cluster shutdown
 ```

 ## Troubleshooting

-## Permission denied running hive
+## Permission denied running spinifex

 The binary may not be executable. Fix permissions:

 ```bash
-chmod +x ./bin/hive
+chmod +x ./bin/spx
 ```

 If you get permission errors during operations, ensure you're running with appropriate privileges. Some OVN and networking commands require `sudo`.
@@ -90,8 +90,8 @@ If you get permission errors during operations, ensure you're running with appro
 Check the daemon logs for specific errors:

 ```bash
-ls ~/hive/logs/
-cat ~/hive/logs/daemon.log
+ls ~/spinifex/logs/
+cat ~/spinifex/logs/spinifex.log
 ```

 Common causes include port conflicts, missing OVN configuration, or untrusted CA certificates.
@@ -7,8 +7,8 @@ tags:
  - networking
  - ovn
 resources:
-  - title: "Hive Repository"
-    url: "https://github.com/mulgadc/hive"
+  - title: "Spinifex Repository"
+    url: "https://github.com/mulgadc/spinifex"
  - title: "OVN Architecture"
    url: "https://www.ovn.org/en/"
 ---
@@ -27,7 +27,7 @@ resources:

 ## Overview

-Every EC2 instance runs inside a VPC with an isolated virtual network. Hive uses OVN (Open Virtual Network) to provide the networking layer.
+Every EC2 instance runs inside a VPC with an isolated virtual network. Spinifex uses OVN (Open Virtual Network) to provide the networking layer.

 **How it works:**
 - VPC becomes an OVN logical router
@@ -41,14 +41,14 @@ Every EC2 instance runs inside a VPC with an isolated virtual network. Hive uses

 ```bash
 aws ec2 create-vpc --cidr-block 10.200.0.0/16
-export HIVE_VPC="vpc-XXX"
+export SPINIFEX_VPC="vpc-XXX"
 ```

 ## Create Subnet

 ```bash
-aws ec2 create-subnet --vpc-id $HIVE_VPC --cidr-block 10.200.1.0/24
-export HIVE_SUBNET="subnet-XXX"
+aws ec2 create-subnet --vpc-id $SPINIFEX_VPC --cidr-block 10.200.1.0/24
+export SPINIFEX_SUBNET="subnet-XXX"
 ```

 ## Verify
@@ -73,7 +73,7 @@ sudo systemctl is-active ovn-controller
 Check the vpcd logs for errors:

 ```bash
-cat ~/hive/logs/vpcd.log
+cat ~/spinifex/logs/vpcd.log
 ```

 ## Instances cannot reach each other
@@ -1,4 +1,4 @@
-module github.com/mulgadc/hive
+module github.com/mulgadc/spinifex

 go 1.26.1

@@ -8,8 +8,8 @@ require (
 	github.com/google/uuid v1.6.0
 	github.com/kdomanski/iso9660 v0.4.0
 	github.com/klauspost/cpuid/v2 v2.3.0
-	github.com/mulgadc/predastore v1.0.3
-	github.com/mulgadc/viperblock v1.0.17
+	github.com/mulgadc/predastore v1.1.1
+	github.com/mulgadc/viperblock v1.1.1
 	github.com/nats-io/nats-server/v2 v2.12.4
 	github.com/nats-io/nats.go v1.49.0
 	github.com/ovn-kubernetes/libovsdb v0.8.1
@@ -18,8 +18,6 @@ require (
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/viper v1.21.0
 	github.com/stretchr/testify v1.11.1
-	go.uber.org/automaxprocs v1.6.0
-	golang.org/x/net v0.51.0
 	gopkg.in/ini.v1 v1.67.1
 )

@@ -27,21 +25,14 @@ require (
 	atomicgo.dev/cursor v0.2.0 // indirect
 	atomicgo.dev/keyboard v0.2.9 // indirect
 	atomicgo.dev/schedule v0.1.0 // indirect
-	cloud.google.com/go v0.123.0 // indirect
-	cloud.google.com/go/auth v0.18.2 // indirect
-	cloud.google.com/go/compute/metadata v0.9.0 // indirect
-	github.com/BurntSushi/toml v1.6.0 // indirect
-	github.com/anthropics/anthropic-sdk-go v1.26.0 // indirect
 	github.com/antithesishq/antithesis-sdk-go v0.6.0 // indirect
 	github.com/armon/go-metrics v0.4.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/boltdb/bolt v1.3.1 // indirect
 	github.com/buraksezer/consistent v0.10.0 // indirect
-	github.com/ccojocar/zxcvbn-go v1.0.4 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cenkalti/hub v1.0.2 // indirect
 	github.com/cenkalti/rpc2 v1.0.5 // indirect
-	github.com/cespare/xxhash v1.1.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
 	github.com/containerd/console v1.0.5 // indirect
@@ -50,7 +41,6 @@ require (
 	github.com/dgraph-io/ristretto/v2 v2.4.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/fatih/color v1.18.0 // indirect
-	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.13 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
@@ -60,13 +50,8 @@ require (
 	github.com/go-playground/validator/v10 v10.30.1 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/google/flatbuffers v25.12.19+incompatible // indirect
-	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/go-tpm v0.9.8 // indirect
-	github.com/google/s2a-go v0.1.9 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.13 // indirect
-	github.com/googleapis/gax-go/v2 v2.17.0 // indirect
 	github.com/gookit/color v1.6.0 // indirect
-	github.com/gorilla/websocket v1.5.3 // indirect
 	github.com/hashicorp/go-hclog v1.6.3 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
 	github.com/hashicorp/go-metrics v0.5.4 // indirect
@@ -90,7 +75,6 @@ require (
 	github.com/nats-io/jwt/v2 v2.8.0 // indirect
 	github.com/nats-io/nkeys v0.4.15 // indirect
 	github.com/nats-io/nuid v1.0.1 // indirect
-	github.com/openai/openai-go/v3 v3.24.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_golang v1.23.2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
@@ -98,27 +82,22 @@ require (
 	github.com/prometheus/procfs v0.20.1 // indirect
 	github.com/quic-go/quic-go v0.59.0 // indirect
 	github.com/sagikazarmark/locafero v0.12.0 // indirect
-	github.com/securego/gosec/v2 v2.24.7 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/tidwall/gjson v1.18.0 // indirect
-	github.com/tidwall/match v1.2.0 // indirect
-	github.com/tidwall/pretty v1.2.1 // indirect
-	github.com/tidwall/sjson v1.2.5 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	go.etcd.io/bbolt v1.4.3 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.66.0 // indirect
 	go.opentelemetry.io/otel v1.41.0 // indirect
 	go.opentelemetry.io/otel/metric v1.41.0 // indirect
 	go.opentelemetry.io/otel/trace v1.41.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/crypto v0.48.0 // indirect
-	golang.org/x/exp/typeparams v0.0.0-20260218203240-3dfff04db8fa // indirect
+	golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa // indirect
 	golang.org/x/mod v0.33.0 // indirect
+	golang.org/x/net v0.51.0 // indirect
 	golang.org/x/sync v0.19.0 // indirect
 	golang.org/x/sys v0.41.0 // indirect
 	golang.org/x/telemetry v0.0.0-20260304144227-18da59047661 // indirect
@@ -127,16 +106,8 @@ require (
 	golang.org/x/time v0.14.0 // indirect
 	golang.org/x/tools v0.42.0 // indirect
 	golang.org/x/vuln v1.1.4 // indirect
-	google.golang.org/genai v1.49.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect
-	google.golang.org/grpc v1.79.1 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	honnef.co/go/tools v0.7.0 // indirect
 )

-tool (
-	github.com/securego/gosec/v2/cmd/gosec
-	golang.org/x/vuln/cmd/govulncheck
-	honnef.co/go/tools/cmd/staticcheck
-)
+tool golang.org/x/vuln/cmd/govulncheck
@@ -7,14 +7,6 @@ atomicgo.dev/keyboard v0.2.9/go.mod h1:BC4w9g00XkxH/f1HXhW2sXmJFOCWbKn9xrOunSFtE
 atomicgo.dev/schedule v0.1.0 h1:nTthAbhZS5YZmgYbb2+DH8uQIZcTlIrd4eYr3UQxEjs=
 atomicgo.dev/schedule v0.1.0/go.mod h1:xeUa3oAkiuHYh8bKiQBRojqAMq3PXXbJujjb0hw8pEU=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=
-cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU=
-cloud.google.com/go/auth v0.18.2 h1:+Nbt5Ev0xEqxlNjd6c+yYUeosQ5TtEUaNcN/3FozlaM=
-cloud.google.com/go/auth v0.18.2/go.mod h1:xD+oY7gcahcu7G2SG2DsBerfFxgPAJz17zz2joOFF3M=
-cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
-cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
-github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
-github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
 github.com/MarvinJWendt/testza v0.1.0/go.mod h1:7AxNvlfeHP7Z/hDQ5JtE3OKYT3XFUeLCDE2DQninSqs=
 github.com/MarvinJWendt/testza v0.2.1/go.mod h1:God7bhG8n6uQxwdScay+gjm9/LnO4D3kkcZX4hv9Rp8=
@@ -25,17 +17,11 @@ github.com/MarvinJWendt/testza v0.3.0/go.mod h1:eFcL4I0idjtIx8P9C6KkAuLgATNKpX4/
 github.com/MarvinJWendt/testza v0.4.2/go.mod h1:mSdhXiKH8sg/gQehJ63bINcCKp7RtYewEjXsvsVUPbE=
 github.com/MarvinJWendt/testza v0.5.2 h1:53KDo64C1z/h/d/stCYCPY69bt/OSwjq5KpFNwi+zB4=
 github.com/MarvinJWendt/testza v0.5.2/go.mod h1:xu53QFE5sCdjtMCKk8YMQ2MnymimEctc4n3EjyIYvEY=
-github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
-github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
-github.com/OneOfOne/xxhash v1.2.2 h1:KMrpdQIwFcEqXDklaen+P1axHaj9BSKzvpUUfnHldSE=
-github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
-github.com/anthropics/anthropic-sdk-go v1.26.0 h1:oUTzFaUpAevfuELAP1sjL6CQJ9HHAfT7CoSYSac11PY=
-github.com/anthropics/anthropic-sdk-go v1.26.0/go.mod h1:qUKmaW+uuPB64iy1l+4kOSvaLqPXnHTTBKH6RVZ7q5Q=
 github.com/antithesishq/antithesis-sdk-go v0.6.0 h1:v/YViLhFYkZOEEof4AXjD5AgGnGM84YHF4RqEwp6I2g=
 github.com/antithesishq/antithesis-sdk-go v0.6.0/go.mod h1:IUpT2DPAKh6i/YhSbt6Gl3v2yvUZjmKncl7U91fup7E=
 github.com/armon/go-metrics v0.4.1 h1:hR91U9KYmb6bLBYLQjyM+3j+rcd/UhE+G78SFnF8gJA=
@@ -89,16 +75,12 @@ github.com/boltdb/bolt v1.3.1 h1:JQmyP4ZBrce+ZQu0dY660FMfatumYDLun9hBCUVIkF4=
 github.com/boltdb/bolt v1.3.1/go.mod h1:clJnj/oiGkjum5o1McbSZDSLxVThjynRyGBgiAx27Ps=
 github.com/buraksezer/consistent v0.10.0 h1:hqBgz1PvNLC5rkWcEBVAL9dFMBWz6I0VgUCW25rrZlU=
 github.com/buraksezer/consistent v0.10.0/go.mod h1:6BrVajWq7wbKZlTOUPs/XVfR8c0maujuPowduSpZqmw=
-github.com/ccojocar/zxcvbn-go v1.0.4 h1:FWnCIRMXPj43ukfX000kvBZvV6raSxakYr1nzyNrUcc=
-github.com/ccojocar/zxcvbn-go v1.0.4/go.mod h1:3GxGX+rHmueTUMvm5ium7irpyjmm7ikxYFOSJB21Das=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/cenkalti/hub v1.0.2 h1:Nqv9TNaA9boeO2wQFW8o87BY3zKthtnzXmWGmJqhAV8=
 github.com/cenkalti/hub v1.0.2/go.mod h1:8LAFAZcCasb83vfxatMUnZHRoQcffho2ELpHb+kaTJU=
 github.com/cenkalti/rpc2 v1.0.5 h1:T6l4SS3ja3eaJfRyZrn7Oco/PSx/pr3YK5cjCgLVLTk=
 github.com/cenkalti/rpc2 v1.0.5/go.mod h1:2yfU5b86vOr16+iY1jN3MvT6Kxc9Nf8j5iZWwUf7iaw=
-github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
-github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
@@ -119,15 +101,11 @@ github.com/dgraph-io/ristretto/v2 v2.4.0 h1:I/w09yLjhdcVD2QV192UJcq8dPBaAJb9pOuM
 github.com/dgraph-io/ristretto/v2 v2.4.0/go.mod h1:0KsrXtXvnv0EqnzyowllbVJB8yBonswa2lTCK2gGo9E=
 github.com/dgryski/go-farm v0.0.0-20240924180020-3414d57e47da h1:aIftn67I1fkbMa512G+w+Pxci9hJPB8oMnkcP3iZF38=
 github.com/dgryski/go-farm v0.0.0-20240924180020-3414d57e47da/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
-github.com/dnaeon/go-vcr v1.2.0 h1:zHCHvJYTMh1N7xnV7zf1m1GPBF9Ad0Jk/whtQ1663qI=
-github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
 github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
 github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
-github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
-github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
@@ -156,8 +134,6 @@ github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91
 github.com/go-playground/validator/v10 v10.30.1 h1:f3zDSN/zOma+w6+1Wswgd9fLkdwy06ntQJp0BBvFG0w=
 github.com/go-playground/validator/v10 v10.30.1/go.mod h1:oSuBIQzuJxL//3MelwSLD5hc2Tu889bF0Idm9Dg26cM=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
-github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
-github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
 github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
@@ -171,8 +147,6 @@ github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:W
 github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
-github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/flatbuffers v25.12.19+incompatible h1:haMV2JRRJCe1998HeW/p0X9UaMTK6SDo0ffLn2+DbLs=
 github.com/google/flatbuffers v25.12.19+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
 github.com/google/go-cmdtest v0.4.1-0.20220921163831-55ab3332a786 h1:rcv+Ippz6RAtvaGgKxc+8FQIpxHgsF+HBzPyYL2cyVU=
@@ -187,26 +161,16 @@ github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
 github.com/google/go-tpm v0.9.8/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 h1:z2ogiKUYzX5Is6zr/vP9vJGqPwcdqsWjOt+V8J7+bTc=
-github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
 github.com/google/renameio v0.1.0 h1:GOZbcHa3HfsPKPlmyPyN2KEohoMXOhdMbHrvbpl2QaA=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
-github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
-github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.3.13 h1:hSPAhW3NX+7HNlTsmrvU0jL75cIzxFktheceg95Nq14=
-github.com/googleapis/enterprise-certificate-proxy v0.3.13/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg=
-github.com/googleapis/gax-go/v2 v2.17.0 h1:RksgfBpxqff0EZkDWYuz9q/uWsTVz+kf43LsZ1J6SMc=
-github.com/googleapis/gax-go/v2 v2.17.0/go.mod h1:mzaqghpQp4JDh3HvADwrat+6M3MOIDp5YKHhb9PAgDY=
 github.com/gookit/assert v0.1.1 h1:lh3GcawXe/p+cU7ESTZ5Ui3Sm/x8JWpIis4/1aF0mY0=
 github.com/gookit/assert v0.1.1/go.mod h1:jS5bmIVQZTIwk42uXl4lyj4iaaxx32tqH16CFj0VX2E=
 github.com/gookit/color v1.4.2/go.mod h1:fqRyamkC1W8uxl+lxCQxOT09l/vYfZ+QeiX3rKQHCoQ=
 github.com/gookit/color v1.5.0/go.mod h1:43aQb+Zerm/BWh2GnrgOQm7ffz7tvQXEKV6BFMl7wAo=
 github.com/gookit/color v1.6.0 h1:JjJXBTk1ETNyqyilJhkTXJYYigHG24TM9Xa2M1xAhRA=
 github.com/gookit/color v1.6.0/go.mod h1:9ACFc7/1IpHGBW8RwuDm/0YEnhg3dwwXpoMsmtyHfjs=
-github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
-github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
 github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
@@ -291,10 +255,10 @@ github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJ
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
-github.com/mulgadc/predastore v1.0.3 h1:qkuOEUH9B98QzVByn5osKeXm7SSPgk+ardQ3MibPSok=
-github.com/mulgadc/predastore v1.0.3/go.mod h1:x3Z6Ts/PONpmVx/R6t/hkHDJ3+0xRieYS3BuuVaNgyA=
-github.com/mulgadc/viperblock v1.0.17 h1:bGRVlXgcqnmH+Xxon03W/ZsbXqu/EE5+/VG3J4E3EBU=
-github.com/mulgadc/viperblock v1.0.17/go.mod h1:w9V0DjUH5hMXbXsiLbDr9lpqzXBGhEiYB1BeV6TYBkw=
+github.com/mulgadc/predastore v1.1.1 h1:rqpvA/qmewzJBHT2r2N9gNuUaLUKJrONFAyVu2zsRbY=
+github.com/mulgadc/predastore v1.1.1/go.mod h1:WFls3cw+0g0wYBDyKNjEvTihJxuMjIWe2lVNWcYtY7A=
+github.com/mulgadc/viperblock v1.1.1 h1:Z+G6JtR03lhWUGp39iC6pMOjBzYQfLEjyk8c3jcqVCQ=
+github.com/mulgadc/viperblock v1.1.1/go.mod h1:wlLRcHc/28+deiWWXLw+mXEDcmTv9WK2V3SVKkpoyp0=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
@@ -309,12 +273,6 @@ github.com/nats-io/nkeys v0.4.15 h1:JACV5jRVO9V856KOapQ7x+EY8Jo3qw1vJt/9Jpwzkk4=
 github.com/nats-io/nkeys v0.4.15/go.mod h1:CpMchTXC9fxA5zrMo4KpySxNjiDVvr8ANOSZdiNfUrs=
 github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
 github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
-github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI=
-github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
-github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
-github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
-github.com/openai/openai-go/v3 v3.24.0 h1:08x6GnYiB+AAejTo6yzPY8RkZMJQ8NpreiOyM5QfyYU=
-github.com/openai/openai-go/v3 v3.24.0/go.mod h1:cdufnVK14cWcT9qA1rRtrXx4FTRsgbDPW7Ia7SS5cZo=
 github.com/ovn-kubernetes/libovsdb v0.8.1 h1:M2J8bcJt5mXCom0HqzfEtuHkT80CTSQRcYG7acT8gf4=
 github.com/ovn-kubernetes/libovsdb v0.8.1/go.mod h1:ZlnHLzagmLOSvyd9qfxBIZp6wOSOw0IsRsc+6lNUGbU=
 github.com/pascaldekloe/goe v0.1.0 h1:cBOtyMzM9HTpWjXfbbunk26uA6nG3a8n06Wieeh0MwY=
@@ -326,8 +284,6 @@ github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g=
-github.com/prashantv/gostub v1.1.0/go.mod h1:A5zLQHz7ieHGG7is6LLXLz7I8+3LZzsrV0P1IAHhP5U=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.4.0/go.mod h1:e9GMxYsXl05ICDXkRhurwBS4Q3OK1iX/F2sw+iXX5zU=
@@ -370,17 +326,11 @@ github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sagikazarmark/locafero v0.12.0 h1:/NQhBAkUb4+fH1jivKHWusDYFjMOOKU88eegjfxfHb4=
 github.com/sagikazarmark/locafero v0.12.0/go.mod h1:sZh36u/YSZ918v0Io+U9ogLYQJ9tLLBmM4eneO6WwsI=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
-github.com/securego/gosec/v2 v2.24.7 h1:3k5yJnrhT1TTdsG0ZsnenlfCcT+7Y/+zeCPHbL7QAn8=
-github.com/securego/gosec/v2 v2.24.7/go.mod h1:AdDJbjcG/XxFgVv7pW19vMNYlFM6+Q6Qy3t6lWAUcEY=
 github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
 github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
-github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72 h1:qLC7fQah7D6K1B0ujays3HV9gkFtllcxhzImRR7ArPQ=
-github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
 github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
 github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
@@ -396,7 +346,6 @@ github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
@@ -411,17 +360,6 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
-github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
-github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
-github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
-github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
-github.com/tidwall/match v1.2.0 h1:0pt8FlkOwjN2fPt4bIl4BoNxb98gGHN2ObFEDkrfZnM=
-github.com/tidwall/match v1.2.0/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
-github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
-github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
-github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
-github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
-github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
 github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=
 github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778/go.mod h1:2MuV+tbUrU1zIOPMxZ5EncGwgmMJsa+9ucAQZXxsObs=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
@@ -431,20 +369,12 @@ go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
 go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.66.0 h1:PnV4kVnw0zOmwwFkAzCN5O07fw1YOIQor120zrh0AVo=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.66.0/go.mod h1:ofAwF4uinaf8SXdVzzbL4OsxJ3VfeEg3f/F6CeF49/Y=
 go.opentelemetry.io/otel v1.41.0 h1:YlEwVsGAlCvczDILpUXpIpPSL/VPugt7zHThEMLce1c=
 go.opentelemetry.io/otel v1.41.0/go.mod h1:Yt4UwgEKeT05QbLwbyHXEwhnjxNO6D8L5PQP51/46dE=
 go.opentelemetry.io/otel/metric v1.41.0 h1:rFnDcs4gRzBcsO9tS8LCpgR0dxg4aaxWlJxCno7JlTQ=
 go.opentelemetry.io/otel/metric v1.41.0/go.mod h1:xPvCwd9pU0VN8tPZYzDZV/BMj9CM9vs00GuBjeKhJps=
-go.opentelemetry.io/otel/sdk v1.41.0 h1:YPIEXKmiAwkGl3Gu1huk1aYWwtpRLeskpV+wPisxBp8=
-go.opentelemetry.io/otel/sdk v1.41.0/go.mod h1:ahFdU0G5y8IxglBf0QBJXgSe7agzjE4GiTJ6HT9ud90=
-go.opentelemetry.io/otel/sdk/metric v1.41.0 h1:siZQIYBAUd1rlIWQT2uCxWJxcCO7q3TriaMlf08rXw8=
-go.opentelemetry.io/otel/sdk/metric v1.41.0/go.mod h1:HNBuSvT7ROaGtGI50ArdRLUnvRTRGniSUZbxiWxSO8Y=
 go.opentelemetry.io/otel/trace v1.41.0 h1:Vbk2co6bhj8L59ZJ6/xFTskY+tGAbOnCtQGVVa9TIN0=
 go.opentelemetry.io/otel/trace v1.41.0/go.mod h1:U1NU4ULCoxeDKc09yCWdWe+3QoyweJcISEVa1RBzOis=
-go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
-go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
@@ -461,8 +391,6 @@ golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
 golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
 golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa h1:FRnLl4eNAQl8hwxVVC17teOw8kdjVDVAiFMtgUdTSRQ=
 golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa/go.mod h1:zk2irFbV9DP96SEBUUAy67IdHUaZuSnrz1n472HUCLE=
-golang.org/x/exp/typeparams v0.0.0-20260218203240-3dfff04db8fa h1:6Wi43P0isP8Nl8D4qJmA3VC4FswVH0RJkr5cauo67SQ=
-golang.org/x/exp/typeparams v0.0.0-20260218203240-3dfff04db8fa/go.mod h1:PqrXSW65cXDZH0k4IeUbhmg/bcAZDbzNz3byBpKCsXo=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
@@ -552,15 +480,7 @@ golang.org/x/vuln v1.1.4 h1:Ju8QsuyhX3Hk8ma3CesTbO8vfJD9EvUBgHvkxHBzj0I=
 golang.org/x/vuln v1.1.4/go.mod h1:F+45wmU18ym/ca5PLTPLsSzr2KppzswxPP603ldA67s=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
-gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/genai v1.49.0 h1:Se+QJaH2GYK1aaR1o5S38mlU2GD5FnVvP76nfkV7LH0=
-google.golang.org/genai v1.49.0/go.mod h1:A3kkl0nyBjyFlNjgxIwKq70julKbIxpSxqKO5gw/gmk=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.79.1 h1:zGhSi45ODB9/p3VAawt9a+O/MULLl9dpizzNNpq7flY=
-google.golang.org/grpc v1.79.1/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -589,5 +509,3 @@ gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C
 gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-honnef.co/go/tools v0.7.0 h1:w6WUp1VbkqPEgLz4rkBzH/CSU6HkoqNLp6GstyTx3lU=
-honnef.co/go/tools v0.7.0/go.mod h1:pm29oPxeP3P82ISxZDgIYeOaf9ta6Pi0EWvCFoLG2vc=
@@ -1,2 +0,0 @@
-minimum-release-time=3d
-exclude-packages-from-minimum-release-time=vite,@vitejs/*
@@ -1,132 +0,0 @@
-{
-  "$schema": "./node_modules/oxlint/configuration_schema.json",
-  "plugins": [
-    "eslint",
-    "typescript",
-    "unicorn",
-    "oxc",
-    "node",
-    "promise",
-    "react",
-    "react-perf",
-    "jsx-a11y"
-  ],
-  "jsPlugins": [
-    "@tanstack/eslint-plugin-query",
-    "@tanstack/eslint-plugin-router"
-  ],
-  "env": { "browser": true },
-  "categories": {
-    "correctness": "error",
-    "perf": "error",
-    "restriction": "error",
-    "suspicious": "error",
-    "pedantic": "error",
-    "style": "error"
-  },
-  "rules": {
-    "no-await-in-loop": "off",
-    "max-lines-per-function": "off",
-    "no-implicit-coercion": "off",
-    "no-magic-numbers": "off",
-    "no-console": "off",
-    "no-ternary": "off",
-    "no-undefined": "off",
-    "max-lines": "off",
-    "id-length": "off",
-    "func-style": "off",
-    "arrow-body-style": ["error", "as-needed"],
-    "max-depth": "off",
-    "max-params": "off",
-    "capitalized-comments": "off",
-    "new-cap": "off",
-    "no-continue": "off",
-    "init-declarations": "off",
-    "sort-imports": "off",
-    "no-duplicate-imports": ["error", { "allowSeparateTypeImports": true }],
-    "no-use-before-define": "off",
-    "sort-keys": "off",
-    "sort-vars": "off",
-    "prefer-destructuring": "off",
-    "max-statements": "off",
-    "complexity": "off",
-    "no-shadow": "off",
-
-    "unicorn/explicit-length-check": "off",
-    "unicorn/no-array-callback-reference": "off",
-    "unicorn/no-process-exit": "off",
-    "unicorn/prefer-global-this": "off",
-    "unicorn/no-null": "off",
-    "unicorn/prefer-top-level-await": "off",
-    "unicorn/prefer-string-raw": "off",
-    "unicorn/no-useless-undefined": "off",
-    "unicorn/filename-case": [
-      "error",
-      { "cases": { "kebabCase": true, "camelCase": true } }
-    ],
-
-    "typescript/no-import-type-side-effects": "off",
-    "typescript/explicit-module-boundary-types": "off",
-    "typescript/no-require-imports": "off",
-    "typescript/explicit-function-return-type": "off",
-    "typescript/no-var-requires": "off",
-    "typescript/require-await": "off",
-
-    "node/no-process-env": "off",
-
-    "oxc/no-map-spread": "off",
-    "oxc/no-async-await": "off",
-    "oxc/no-rest-spread-properties": "off",
-    "oxc/no-optional-chaining": "off",
-
-    "promise/catch-or-return": "off",
-    "promise/always-return": "off",
-    "promise/prefer-await-to-callbacks": "off",
-
-    "react/only-export-components": "off",
-    "react/jsx-boolean-value": "off",
-    "react/react-in-jsx-scope": "off",
-    "react/jsx-filename-extension": "off",
-    "react/no-unknown-property": "off",
-    "react/jsx-props-no-spreading": "off",
-    "react/jsx-max-depth": "off",
-    "react/no-multi-comp": "off",
-    "react/no-unescaped-entities": "off",
-    "react-perf/jsx-no-jsx-as-prop": "off",
-    "react-perf/jsx-no-new-object-as-prop": "off",
-    "react-perf/jsx-no-new-array-as-prop": "off",
-    "react-perf/jsx-no-new-function-as-prop": "off",
-    "react/jsx-handler-names": "off",
-
-    "jsx-a11y/no-autofocus": "off",
-
-    "@tanstack/query/exhaustive-deps": "error",
-    "@tanstack/query/stable-query-client": "error",
-    "@tanstack/query/no-rest-destructuring": "warn",
-    "@tanstack/query/no-unstable-deps": "error",
-    "@tanstack/query/infinite-query-property-order": "error",
-    "@tanstack/query/no-void-query-fn": "error",
-    "@tanstack/query/mutation-property-order": "error",
-    "@tanstack/router/create-route-property-order": "warn",
-    "@tanstack/router/route-param-names": "error"
-  },
-  "overrides": [
-    {
-      "files": ["**/routeTree.gen.ts"],
-      "rules": {
-        "unicorn/filename-case": "off",
-        "unicorn/no-abusive-eslint-disable": "off"
-      }
-    },
-    {
-      "files": [
-        "**/*.{test,spec}.{ts,tsx,js,jsx}",
-        "**/__tests__/**/*.{ts,tsx,js,jsx}"
-      ],
-      "rules": {
-        "typescript/consistent-type-imports": "off"
-      }
-    }
-  ],
-  "ignorePatterns": ["dist", "src/routeTree.gen.ts"]
-}
@@ -1 +0,0 @@
-import{a as e,n as t,r as n}from"./compiler-runtime.js";import{t as r}from"./useSuspenseQuery.js";import{t as i}from"./error-banner.js";import"./useRouterState.js";import{t as a}from"./link.js";import{a as o}from"./utils.js";import{t as s}from"./useNavigate.js";import{t as c}from"./button.js";import{t as l}from"./createLucideIcon.js";import{t as u}from"./back-link.js";import{t as d}from"./trash-2.js";import"./separator.js";import"./awsClient.js";import{d as f,n as p}from"./ec2.js";import{l as m,u as h}from"./ec22.js";import{O as g,i as _}from"./index.js";import{t as v}from"./page-heading.js";import{t as y}from"./state-badge.js";import{n as b,t as x}from"./detail-row.js";import{a as S,i as C,l as w,n as T,o as E,r as D,s as O,t as k}from"./alert-dialog.js";import{i as A,t as j}from"./field.js";import{t as M}from"./delete-confirmation-dialog.js";var N=l(`copy`,[[`rect`,{width:`14`,height:`14`,x:`8`,y:`8`,rx:`2`,ry:`2`,key:`17jyea`}],[`path`,{d:`M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2`,key:`zix9uf`}]]),P=e(n()),F=t();function I(){let{id:e}=_.useParams(),t=s(),{data:n}=r(h(e)),{data:l}=r(m),I=n.Snapshots?.[0],L=f(),R=p(),[z,B]=(0,P.useState)(!1),[V,H]=(0,P.useState)(!1),[U,W]=(0,P.useState)(``),G=l.Regions?.[0]?.RegionName??`ap-southeast-2`,K=I?.State===`completed`,q=async()=>{try{await L.mutateAsync(e),t({to:`/ec2/describe-snapshots`})}finally{B(!1)}},J=async()=>{try{await R.mutateAsync({sourceSnapshotId:e,sourceRegion:G,description:U||void 0}),H(!1),W(``)}catch{}};if(!I?.SnapshotId)return(0,F.jsxs)(F.Fragment,{children:[(0,F.jsx)(u,{to:`/ec2/describe-snapshots`,children:`Back to snapshots`}),(0,F.jsx)(`p`,{className:`text-muted-foreground`,children:`Snapshot not found.`})]});let Y=o(I.StartTime);return(0,F.jsxs)(F.Fragment,{children:[(0,F.jsx)(u,{to:`/ec2/describe-snapshots`,children:`Back to snapshots`}),L.error&&(0,F.jsx)(i,{error:L.error,msg:`Failed to delete snapshot`}),R.error&&(0,F.jsx)(i,{error:R.error,msg:`Failed to copy snapshot`}),(0,F.jsxs)(`div`,{className:`space-y-6`,children:[(0,F.jsx)(v,{actions:(0,F.jsxs)(`div`,{className:`flex items-center gap-2`,children:[(0,F.jsxs)(c,{disabled:!K,onClick:()=>B(!0),size:`sm`,variant:`destructive`,children:[(0,F.jsx)(d,{className:`size-4`}),`Delete`]}),(0,F.jsxs)(c,{disabled:!K,onClick:()=>H(!0),size:`sm`,variant:`outline`,children:[(0,F.jsx)(N,{className:`size-4`}),`Copy Snapshot`]}),(0,F.jsx)(y,{state:I.State})]}),subtitle:`EC2 Snapshot Details`,title:I.SnapshotId}),(0,F.jsxs)(b,{children:[(0,F.jsx)(b.Header,{children:`Snapshot Information`}),(0,F.jsxs)(b.Content,{children:[(0,F.jsx)(x,{label:`Snapshot ID`,value:I.SnapshotId}),(0,F.jsx)(x,{label:`Volume ID`,value:I.VolumeId?(0,F.jsx)(a,{className:`text-primary hover:underline`,params:{id:I.VolumeId},to:`/ec2/describe-volumes/$id`,children:I.VolumeId}):void 0}),(0,F.jsx)(x,{label:`Volume Size`,value:`${I.VolumeSize} GiB`}),(0,F.jsx)(x,{label:`State`,value:I.State}),(0,F.jsx)(x,{label:`Description`,value:I.Description}),(0,F.jsx)(x,{label:`Progress`,value:I.Progress}),(0,F.jsx)(x,{label:`Start Time`,value:Y}),(0,F.jsx)(x,{label:`Owner ID`,value:I.OwnerId}),(0,F.jsx)(x,{label:`Encrypted`,value:I.Encrypted?`Yes`:`No`})]})]})]}),(0,F.jsx)(M,{description:`Are you sure you want to delete the snapshot "${I.SnapshotId}"? This action cannot be undone.`,isPending:L.isPending,onConfirm:q,onOpenChange:B,open:z,title:`Delete Snapshot`}),(0,F.jsx)(k,{onOpenChange:H,open:V,children:(0,F.jsxs)(C,{children:[(0,F.jsxs)(O,{children:[(0,F.jsx)(w,{children:`Copy Snapshot`}),(0,F.jsx)(S,{children:`Create a copy of this snapshot in the current region.`})]}),(0,F.jsxs)(j,{children:[(0,F.jsx)(A,{children:(0,F.jsx)(`label`,{htmlFor:`copyDescription`,children:`Description (optional)`})}),(0,F.jsx)(g,{id:`copyDescription`,onChange:e=>W(e.target.value),placeholder:`Description for the snapshot copy`,value:U})]}),(0,F.jsxs)(E,{children:[(0,F.jsx)(D,{children:`Cancel`}),(0,F.jsx)(T,{disabled:R.isPending,onClick:J,children:R.isPending?`Copying…`:`Copy Snapshot`})]})]})})]})}export{I as component};
@@ -1 +0,0 @@
-import{a as e,n as t,r as n}from"./compiler-runtime.js";import{A as r,E as ee,a as i,c as a,d as o,k as s,t as c}from"./useRouterState.js";import{f as te,p as ne,u as l}from"./utils.js";import{t as u}from"./useRouter.js";var d=`Error preloading route! ☝️`;t();var f=e(n(),1),re=e(l(),1);function p(e,t){let n=u(),l=te(t),{activeProps:p,inactiveProps:_,activeOptions:v,to:y,preload:fe,preloadDelay:pe,hashScrollIntoView:b,replace:me,startTransition:he,resetScroll:ge,viewTransition:_e,children:x,target:S,disabled:C,style:w,className:T,onClick:E,onBlur:D,onFocus:O,onMouseEnter:k,onMouseLeave:A,onTouchStart:j,ignoreBlocker:ve,params:ye,search:be,hash:xe,state:Se,mask:Ce,reloadDocument:we,unsafeRelative:Te,from:Ee,_fromLocation:De,...M}=e,N=i(),Oe=c({select:e=>{let t=e.matches[e.matches.length-1];return{search:t?.search,hash:e.location.hash,path:t?.pathname}},structuralSharing:!0}),P=e.from,F=f.useMemo(()=>({...e,from:P}),[n,Oe,P,e._fromLocation,e.hash,e.to,e.search,e.params,e.state,e.mask,e.unsafeRelative]),I=f.useMemo(()=>n.buildLocation({...F}),[n,F]),L=I.maskedLocation?I.maskedLocation.publicHref:I.publicHref,R=I.maskedLocation?I.maskedLocation.external:I.external,z=f.useMemo(()=>le(L,R,n.history,C),[C,R,L,n.history]),B=f.useMemo(()=>{if(z?.external)return r(z.href,n.protocolAllowlist)?void 0:z.href;if(!ue(y)&&!(typeof y!=`string`||y.indexOf(`:`)===-1))try{return new URL(y),r(y,n.protocolAllowlist)?void 0:y}catch{}},[y,z,n.protocolAllowlist]),V=c({select:e=>{if(B)return!1;if(v?.exact){if(!a(e.location.pathname,I.pathname,n.basepath))return!1}else{let t=o(e.location.pathname,n.basepath),r=o(I.pathname,n.basepath);if(!(t.startsWith(r)&&(t.length===r.length||t[r.length]===`/`)))return!1}return(v?.includeSearch??!0)&&!ee(e.location.search,I.search,{partial:!v?.exact,ignoreUndefined:!v?.explicitUndefined})?!1:v?.includeHash?N&&e.location.hash===I.hash:!0}}),H=V?s(p,{})??ie:m,U=V?m:s(_,{})??m,W=[T,H.className,U.className].filter(Boolean).join(` `),G=(w||H.style||U.style)&&{...w,...H.style,...U.style},[ke,K]=f.useState(!1),q=f.useRef(!1),J=e.reloadDocument||B?!1:fe??n.options.defaultPreload,Y=pe??n.options.defaultPreloadDelay??0,X=f.useCallback(()=>{n.preloadRoute({...F,_builtLocation:I}).catch(e=>{console.warn(e),console.warn(d)})},[n,F,I]);ne(l,f.useCallback(e=>{e?.isIntersecting&&X()},[X]),ce,{disabled:!!C||J!==`viewport`}),f.useEffect(()=>{q.current||!C&&J===`render`&&(X(),q.current=!0)},[C,X,J]);let Ae=e=>{let t=e.currentTarget.getAttribute(`target`),r=S===void 0?t:S;if(!C&&!de(e)&&!e.defaultPrevented&&(!r||r===`_self`)&&e.button===0){e.preventDefault(),(0,re.flushSync)(()=>{K(!0)});let t=n.subscribe(`onResolved`,()=>{t(),K(!1)});n.navigate({...F,replace:me,resetScroll:ge,hashScrollIntoView:b,startTransition:he,viewTransition:_e,ignoreBlocker:ve})}};if(B)return{...M,ref:l,href:B,...x&&{children:x},...S&&{target:S},...C&&{disabled:C},...w&&{style:w},...T&&{className:T},...E&&{onClick:E},...D&&{onBlur:D},...O&&{onFocus:O},...k&&{onMouseEnter:k},...A&&{onMouseLeave:A},...j&&{onTouchStart:j}};let Z=e=>{if(C||J!==`intent`)return;if(!Y){X();return}let t=e.currentTarget;if(h.has(t))return;let n=setTimeout(()=>{h.delete(t),X()},Y);h.set(t,n)},Q=e=>{C||J!==`intent`||X()},$=e=>{if(C||!J||!Y)return;let t=e.currentTarget,n=h.get(t);n&&(clearTimeout(n),h.delete(t))};return{...M,...H,...U,href:z?.href,ref:l,onClick:g([E,Ae]),onBlur:g([D,$]),onFocus:g([O,Z]),onMouseEnter:g([k,Z]),onMouseLeave:g([A,$]),onTouchStart:g([j,Q]),disabled:!!C,target:S,...G&&{style:G},...W&&{className:W},...C&&ae,...V&&oe,...N&&ke&&se}}var m={},ie={className:`active`},ae={role:`link`,"aria-disabled":!0},oe={"data-status":`active`,"aria-current":`page`},se={"data-transitioning":`transitioning`},h=new WeakMap,ce={rootMargin:`100px`},g=e=>t=>{for(let n of e)if(n){if(t.defaultPrevented)return;n(t)}};function le(e,t,n,r){if(!r)return t?{href:e,external:!0}:{href:n.createHref(e)||`/`,external:!1}}function ue(e){if(typeof e!=`string`)return!1;let t=e.charCodeAt(0);return t===47?e.charCodeAt(1)!==47:t===46}var _=f.forwardRef((e,t)=>{let{_asChild:n,...r}=e,{type:ee,...i}=p(r,t),a=typeof r.children==`function`?r.children({isActive:i[`data-status`]===`active`}):r.children;if(!n){let{disabled:e,...t}=i;return f.createElement(`a`,t,a)}return f.createElement(n,i,a)});function de(e){return!!(e.metaKey||e.altKey||e.ctrlKey||e.shiftKey)}export{_ as t};
@@ -1 +0,0 @@
-import{a as e,n as t,r as n,t as r}from"./compiler-runtime.js";import{u as i}from"./utils.js";import{F as a,P as o,R as s,_ as c,i as l,o as u,z as d}from"./button.js";import{V as f}from"./createBaseUIEventDetails.js";var p=function(e){return e.disabled=`data-disabled`,e.valid=`data-valid`,e.invalid=`data-invalid`,e.touched=`data-touched`,e.dirty=`data-dirty`,e.filled=`data-filled`,e.focused=`data-focused`,e}({}),m={badInput:!1,customError:!1,patternMismatch:!1,rangeOverflow:!1,rangeUnderflow:!1,stepMismatch:!1,tooLong:!1,tooShort:!1,typeMismatch:!1,valid:null,valueMissing:!1},h={valid(e){return e===null?null:e?{[p.valid]:``}:{[p.invalid]:``}}},g=e(n()),_=g.createContext({invalid:void 0,name:void 0,validityData:{state:m,errors:[],error:``,value:``,initialValue:null},setValidityData:a,disabled:void 0,touched:!1,setTouched:a,dirty:!1,setDirty:a,filled:!1,setFilled:a,focused:!1,setFocused:a,validate:()=>null,validationMode:`onSubmit`,validationDebounceTime:0,shouldValidateOnChange:()=>!1,state:{disabled:!1,valid:null,touched:!1,dirty:!1,filled:!1,focused:!1},markedDirtyRef:{current:!1},validation:{getValidationProps:(e=o)=>e,getInputValidationProps:(e=o)=>e,inputRef:{current:null},commit:async()=>{}}});function v(e=!0){let t=g.useContext(_);if(t.setValidityData===a&&!e)throw Error(d(28));return t}var y=g.createContext({formRef:{current:{fields:new Map}},errors:{},clearErrors:a,validationMode:`onSubmit`,submitAttemptedRef:{current:!1}});function b(){return g.useContext(y)}var x=g.createContext({controlId:void 0,registerControlId:a,labelId:void 0,setLabelId:a,messageIds:[],setMessageIds:a,getDescriptionProps:e=>e});function S(){return g.useContext(x)}function C(e,t){return{...e,state:{...e.state,valid:!t&&e.state.valid}}}function w({controlled:e,default:t,name:n,state:r=`value`}){let{current:i}=g.useRef(e!==void 0),[a,o]=g.useState(t);return[i?e:a,g.useCallback(e=>{i||o(e)},[])]}function T(e={}){let{id:t,implicit:n=!1,controlRef:r}=e,{controlId:i,registerControlId:o}=S(),d=f(t),p=n?i:void 0,m=s(()=>Symbol(`labelable-control`)),h=g.useRef(!1),_=g.useRef(t!=null),v=u(()=>{!h.current||o===a||(h.current=!1,o(m.current,void 0))});return l(()=>{if(o===a)return;let e;if(n){let n=r?.current;e=c(n)&&n.closest(`label`)!=null?t??null:p??d}else if(t!=null)_.current=!0,e=t;else if(_.current)e=d;else{v();return}if(e===void 0){v();return}h.current=!0,o(m.current,e)},[t,r,p,o,n,d,m,v]),g.useEffect(()=>v,[v]),i??d}var E=e(i());function D(e){let{enabled:t=!0,value:n,id:r,name:i,controlRef:a,commit:o}=e,{formRef:s}=b(),{invalid:c,markedDirtyRef:d,validityData:f,setValidityData:p}=v(),m=u(e.getValue);l(()=>{if(!t)return;let e=n;e===void 0&&(e=m()),f.initialValue===null&&e!==null&&p(t=>({...t,initialValue:e}))},[t,p,n,f.initialValue,m]),l(()=>{!t||!r||s.current.fields.set(r,{getValue:m,name:i,controlRef:a,validityData:C(f,c),validate(e=!0){let t=n;t===void 0&&(t=m()),d.current=!0,e?E.flushSync(()=>o(t)):o(t)}})},[o,a,t,s,m,r,c,d,i,f,n]),l(()=>{let e=s.current.fields;return()=>{r&&e.delete(r)}},[s,r])}r(),t();export{b as a,S as i,T as n,v as o,w as r,h as s,D as t};
@@ -1 +0,0 @@
-import{a as e,n as t,r as n,t as r}from"./compiler-runtime.js";import{t as i}from"./error-banner.js";import{t as a}from"./link.js";import{a as o,o as s}from"./utils.js";import{t as c}from"./button.js";import{t as l}from"./createLucideIcon.js";import{t as u}from"./download.js";import{t as d}from"./trash-2.js";import{Dt as f,Ht as p,It as m,g as h,i as g,jt as _,u as v}from"./awsClient.js";import{a as y,i as b,n as x}from"./s3.js";import{t as S}from"./delete-confirmation-dialog.js";var C=l(`file`,[[`path`,{d:`M6 22a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h8a2.4 2.4 0 0 1 1.704.706l3.588 3.588A2.4 2.4 0 0 1 20 8v12a2 2 0 0 1-2 2z`,key:`1oefj6`}],[`path`,{d:`M14 2v5a1 1 0 0 0 1 1h5`,key:`wfsgrz`}]]),w=l(`folder`,[[`path`,{d:`M20 20a2 2 0 0 0 2-2V8a2 2 0 0 0-2-2h-7.9a2 2 0 0 1-1.69-.9L9.6 3.9A2 2 0 0 0 7.93 3H4a2 2 0 0 0-2 2v13a2 2 0 0 0 2 2Z`,key:`1kt360`}]]),T=l(`upload`,[[`path`,{d:`M12 3v12`,key:`1x0j5s`}],[`path`,{d:`m17 8-5-5-5 5`,key:`7q97r8`}],[`path`,{d:`M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4`,key:`ih7n3h`}]]),E=e=>(e,t)=>async n=>{let r=await e(n),{response:i}=r;if(p.isInstance(i)&&i.headers.expires){i.headers.expiresstring=i.headers.expires;try{m(i.headers.expires)}catch(e){t.logger?.warn(`AWS SDK Warning for ${t.clientName}::${t.commandName} response parsing (${i.headers.expires}): ${e}`),delete i.headers.expires}}return r},D={tags:[`S3`],name:`s3ExpiresMiddleware`,override:!0,relation:`after`,toMiddleware:`deserializerMiddleware`},O=e=>({applyToStack:t=>{t.addRelativeTo(E(e),D)}}),k=class extends _.classBuilder().ep({...h,Bucket:{type:`contextParams`,name:`Bucket`},Key:{type:`contextParams`,name:`Key`}}).m(function(e,t,n,r){return[f(n,e.getEndpointParameterInstructions()),y(n,{requestChecksumRequired:!1,requestValidationModeMember:`ChecksumMode`,responseAlgorithms:[`CRC64NVME`,`CRC32`,`CRC32C`,`SHA256`,`SHA1`]}),b(n),O(n)]}).s(`AmazonS3`,`GetObject`,{}).n(`S3Client`,`GetObjectCommand`).sc(v).build(){},A=r(),j=t();function M(e){let t=(0,A.c)(9),{folderName:n,fullPrefix:r,bucketName:i}=e,o;t[0]!==i||t[1]!==r?(o={bucket:i,_splat:r},t[0]=i,t[1]=r,t[2]=o):o=t[2];let s;t[3]===Symbol.for(`react.memo_cache_sentinel`)?(s=(0,j.jsx)(w,{className:`size-5 text-muted-foreground`}),t[3]=s):s=t[3];let c;t[4]===n?c=t[5]:(c=(0,j.jsx)(`span`,{className:`font-medium`,children:n}),t[4]=n,t[5]=c);let l;return t[6]!==o||t[7]!==c?(l=(0,j.jsxs)(a,{className:`flex items-center gap-3 rounded-lg border bg-card p-4 transition-colors hover:bg-accent`,params:o,to:`/s3/ls/$bucket/$`,children:[s,c]}),t[6]=o,t[7]=c,t[8]=l):l=t[8],l}var N=e(n(),1);function P({object:e,bucketName:t,displayName:n,fullKey:r}){let[a,c]=(0,N.useState)(!1),l=x();async function f(){try{let e=new k({Bucket:t,Key:r}),i=await g().send(e);if(i.Body){let e=await i.Body.transformToByteArray(),t=URL.createObjectURL(new Blob([e])),r=document.createElement(`a`);r.href=t,r.download=n,document.body.append(r),r.click(),r.remove(),URL.revokeObjectURL(t)}}catch{throw Error(`Failed to download object`)}}async function p(){try{await l.mutateAsync({bucket:t,key:r})}finally{c(!1)}}return(0,j.jsxs)(`div`,{children:[l.error&&(0,j.jsx)(i,{error:l.error,msg:`Failed to delete object`}),(0,j.jsxs)(`div`,{className:`flex items-center justify-between rounded-lg border bg-card p-4`,children:[(0,j.jsxs)(`div`,{className:`flex items-center gap-3`,children:[(0,j.jsx)(C,{className:`size-5 text-muted-foreground`}),(0,j.jsxs)(`div`,{children:[(0,j.jsx)(`h3`,{className:`font-medium`,children:n}),e.LastModified&&(0,j.jsxs)(`p`,{className:`text-sm text-muted-foreground`,children:[`Last Modified: `,o(e.LastModified)]})]})]}),(0,j.jsxs)(`div`,{className:`flex items-center gap-3`,children:[(0,j.jsx)(`div`,{className:`text-sm text-muted-foreground`,children:s(e.Size||0)}),(0,j.jsx)(`button`,{className:`rounded-md p-2 transition-colors hover:bg-accent`,onClick:f,type:`button`,children:(0,j.jsx)(u,{className:`size-4`})}),(0,j.jsx)(`button`,{className:`rounded-md p-2 text-destructive transition-colors hover:bg-accent`,onClick:()=>c(!0),type:`button`,children:(0,j.jsx)(d,{className:`size-4`})})]}),(0,j.jsx)(S,{description:(0,j.jsxs)(j.Fragment,{children:[`Are you sure you want to delete `,(0,j.jsx)(`strong`,{children:n}),`? This action cannot be undone.`]}),isPending:l.isPending,onConfirm:p,onOpenChange:c,open:a,title:`Delete Object`})]})]},e.Key)}function F({bucket:e,prefix:t=``,isPending:n,onUpload:r}){let i=(0,N.useRef)(null);async function a(n){let a=n.target.files;if(!(!a||a.length===0))try{await Promise.all([...a].map(n=>r({bucket:e,key:`${t}${n.name}`,file:n})))}finally{i.current&&(i.current.value=``)}}return(0,j.jsxs)(j.Fragment,{children:[(0,j.jsx)(`input`,{accept:`*/*`,"aria-label":`Choose files to upload`,className:`hidden`,multiple:!0,onChange:a,ref:i,type:`file`}),(0,j.jsxs)(c,{disabled:n,onClick:()=>i.current?.click(),size:`sm`,children:[(0,j.jsx)(T,{className:`mr-2 size-4`}),n?`Uploading…`:`Upload Files`]})]})}export{P as n,M as r,F as t};
@@ -1 +0,0 @@
-import{a as e,r as t}from"./compiler-runtime.js";var n=!0;function r(e,t){if(!n){if(e)return;var r=`Warning: `+t;typeof console<`u`&&console.warn(r);try{throw Error(r)}catch{}}}var i=e(t(),1),a=i.createContext(null);function o(e){let t=i.useContext(a);return r(!((e?.warn??!0)&&!t),`useRouter must be used inside a <RouterProvider> component!`),t}export{a as n,r,o as t};
@@ -1,39 +0,0 @@
-package utils
-
-import "github.com/nats-io/nats.go"
-
-// GlobalAccountID is the root/system account. Pre-Phase4 resources are owned by this account.
-const GlobalAccountID = "000000000000"
-
-// AccountKey returns a KV key scoped to an account: "{accountID}.{resourceID}".
-func AccountKey(accountID, resourceID string) string {
-	return accountID + "." + resourceID
-}
-
-// IsAccountID checks if a string is a valid 12-digit AWS account ID.
-func IsAccountID(s string) bool {
-	if len(s) != 12 {
-		return false
-	}
-	for _, c := range s {
-		if c < '0' || c > '9' {
-			return false
-		}
-	}
-	return true
-}
-
-// GetOrCreateKVBucket creates or retrieves a NATS KV bucket.
-func GetOrCreateKVBucket(js nats.JetStreamContext, bucketName string, history int) (nats.KeyValue, error) {
-	kv, err := js.CreateKeyValue(&nats.KeyValueConfig{
-		Bucket:  bucketName,
-		History: SafeIntToUint8(history),
-	})
-	if err != nil {
-		kv, err = js.KeyValue(bucketName)
-		if err != nil {
-			return nil, err
-		}
-	}
-	return kv, nil
-}
@@ -1,54 +0,0 @@
-package utils
-
-import "testing"
-
-func TestAccountKey(t *testing.T) {
-	tests := []struct {
-		accountID  string
-		resourceID string
-		want       string
-	}{
-		{"000000000000", "vpc-123", "000000000000.vpc-123"},
-		{"123456789012", "igw-abc", "123456789012.igw-abc"},
-		{"", "vol-1", ".vol-1"},
-	}
-	for _, tt := range tests {
-		got := AccountKey(tt.accountID, tt.resourceID)
-		if got != tt.want {
-			t.Errorf("AccountKey(%q, %q) = %q, want %q", tt.accountID, tt.resourceID, got, tt.want)
-		}
-	}
-}
-
-func TestIsAccountID(t *testing.T) {
-	tests := []struct {
-		input string
-		want  bool
-	}{
-		{"000000000000", true},
-		{"123456789012", true},
-		{"999999999999", true},
-		{"self", false},
-		{"hive", false},
-		{"", false},
-		{"12345678901", false},   // 11 digits
-		{"1234567890123", false}, // 13 digits
-		{"12345678901a", false},  // non-digit
-		{"abcdefghijkl", false},
-	}
-	for _, tt := range tests {
-		got := IsAccountID(tt.input)
-		if got != tt.want {
-			t.Errorf("IsAccountID(%q) = %v, want %v", tt.input, got, tt.want)
-		}
-	}
-}
-
-func TestGlobalAccountID(t *testing.T) {
-	if GlobalAccountID != "000000000000" {
-		t.Errorf("GlobalAccountID = %q, want %q", GlobalAccountID, "000000000000")
-	}
-	if !IsAccountID(GlobalAccountID) {
-		t.Error("GlobalAccountID should be a valid account ID")
-	}
-}
@@ -39,7 +39,7 @@ Reset services first to apply latest changes:

 ```sh
 ./scripts/stop-dev.sh
-PPROF_ENABLED=1 PPROF_OUTPUT=/tmp/hive-vm.prof ./scripts/start-dev.sh
+PPROF_ENABLED=1 PPROF_OUTPUT=/tmp/spinifex-vm.prof ./scripts/start-dev.sh
 ```

 Once services are started, connect to the benchmarking VM
@@ -48,15 +48,15 @@ Once services are started, connect to the benchmarking VM
 ./scripts/run-bench.sh
 ```

-This will run the benchmark listed in `./scripts/disk-performance.sh` and store the results in `/tmp/hive-vm-disk.log`
+This will run the benchmark listed in `./scripts/disk-performance.sh` and store the results in `/tmp/spinifex-vm-disk.log`

-The Linux `perf` tool is also used to benchmark the `nbdkit` process used to create the QEMU > disk > NBD > viperblock > predastore sequence, which is an important tool for debugging purposes. The results will be stored in `/tmp/hive-nbdkit-perf.data`
+The Linux `perf` tool is also used to benchmark the `nbdkit` process used to create the QEMU > disk > NBD > viperblock > predastore sequence, which is an important tool for debugging purposes. The results will be stored in `/tmp/spinifex-nbdkit-perf.data`

 ### Analyze results

-Place the output of `/tmp/hive-vm-disk.log` into the results section below, increment the VM-$ID as the test case, and provide a short description of the last changes that were benchmarked.
+Place the output of `/tmp/spinifex-vm-disk.log` into the results section below, increment the VM-$ID as the test case, and provide a short description of the last changes that were benchmarked.

-Store the benchmark file in `predastore-rewrite/tests/hive-vm$id.prof` for later analysis.
+Store the benchmark file in `predastore-rewrite/tests/spinifex-vm$id.prof` for later analysis.

 # Results

@@ -575,7 +575,7 @@ Disk stats (read/write):

 ## Root Cause: TLS Handshakes Per Request

-**Profile analysis (`hive-vm.prof`) reveals 84% of CPU spent on TLS handshakes:**
+**Profile analysis (`spinifex-vm.prof`) reveals 84% of CPU spent on TLS handshakes:**

 ```
 84.06%  crypto/tls.(*Conn).HandshakeContext   ← 84% of CPU!
@@ -736,13 +736,13 @@ With many short-lived connections, ports stuck in TIME_WAIT can exhaust the rang

 ## Host Configuration (sysctl)

-### Recommended Settings for Hive Host
+### Recommended Settings for Spinifex Host

-Create `/etc/sysctl.d/99-hive.conf`:
+Create `/etc/sysctl.d/99-spinifex.conf`:

 ```bash
 # =============================================================================
-# Hive Platform - System Tuning for High-Connection Workloads
+# Spinifex Platform - System Tuning for High-Connection Workloads
 # =============================================================================

 # -----------------------------------------------------------------------------
@@ -827,21 +827,21 @@ vm.dirty_background_ratio = 5

 Apply settings:
 ```bash
-sudo sysctl -p /etc/sysctl.d/99-hive.conf
+sudo sysctl -p /etc/sysctl.d/99-spinifex.conf
 ```

 ### Process Limits (/etc/security/limits.conf)

 ```bash
-# Add to /etc/security/limits.conf or /etc/security/limits.d/hive.conf
+# Add to /etc/security/limits.conf or /etc/security/limits.d/spinifex.conf

-# For predastore/hive user
-hive    soft    nofile    1048576
-hive    hard    nofile    1048576
-hive    soft    nproc     unlimited
-hive    hard    nproc     unlimited
-hive    soft    memlock   unlimited
-hive    hard    memlock   unlimited
+# For predastore/spinifex user
+spinifex    soft    nofile    1048576
+spinifex    hard    nofile    1048576
+spinifex    soft    nproc     unlimited
+spinifex    hard    nproc     unlimited
+spinifex    soft    memlock   unlimited
+spinifex    hard    memlock   unlimited

 # Or for all users (dev environments)
 *       soft    nofile    1048576
@@ -891,7 +891,7 @@ MaxConnsPerHost:     64
 IdleConnTimeout:     60 * time.Second
 ```

-**sysctl:** Apply full 99-hive.conf settings.
+**sysctl:** Apply full 99-spinifex.conf settings.

 ### Large Deployment (65-256 VMs)

@@ -1105,7 +1105,7 @@ client := &http.Client{
 - [ ] Validate fix with fio benchmark (VM-4)
 - [ ] Add predastore connection metrics endpoint
 - [ ] Test with 8-VM deployment
- [ ] Create hive-tuning.sh script for automated sysctl configuration
+- [ ] Create spinifex-tuning.sh script for automated sysctl configuration
 - [ ] Add Prometheus metrics for connection tracking

 ---
@@ -1186,7 +1186,7 @@ After migrating predastore to net/http with HTTP/2 support, profiling still show
 Additionally, logs showed **126K+ HTTP/1.1 requests** despite HTTP/2 being configured:

 ```bash
-cat ~/hive/logs/predastore.log | grep "HTTP/1" | wc -l
+cat ~/spinifex/logs/predastore.log | grep "HTTP/1" | wc -l
 # 126277
 ```

@@ -1235,12 +1235,12 @@ All S3 clients across the codebase were updated:
 | File | Purpose |
 |------|---------|
 | `viperblock/viperblock/backends/s3/s3.go` | Block storage S3 backend |
-| `hive/s3client/s3client.go` | Hive S3 client |
-| `hive/handlers/ec2/key/service_impl.go` | EC2 key pair operations |
-| `hive/handlers/ec2/volume/service_impl.go` | EBS volume operations |
-| `hive/handlers/ec2/image/service_impl.go` | AMI image operations |
-| `hive/utils/utils.go` | Shared S3 client utility |
-| `hive/cmd/hive/cmd/admin.go` | Admin CLI operations |
+| `spinifex/s3client/s3client.go` | Spinifex S3 client |
+| `spinifex/handlers/ec2/key/service_impl.go` | EC2 key pair operations |
+| `spinifex/handlers/ec2/volume/service_impl.go` | EBS volume operations |
+| `spinifex/handlers/ec2/image/service_impl.go` | AMI image operations |
+| `spinifex/utils/utils.go` | Shared S3 client utility |
+| `spinifex/cmd/spinifex/cmd/admin.go` | Admin CLI operations |
 | `predastore/s3db/client.go` | S3DB distributed client |

 ### Complete HTTP/2 Client Pattern
@@ -1323,14 +1323,14 @@ After deploying the fix, verify HTTP/2 is working:

 ```bash
 # Check predastore logs for HTTP/2 requests
-grep "HTTP/2" ~/hive/logs/predastore.log | head
+grep "HTTP/2" ~/spinifex/logs/predastore.log | head

 # Count HTTP/1.1 vs HTTP/2 requests
-echo "HTTP/1.1: $(grep -c 'HTTP/1' ~/hive/logs/predastore.log)"
-echo "HTTP/2.0: $(grep -c 'HTTP/2' ~/hive/logs/predastore.log)"
+echo "HTTP/1.1: $(grep -c 'HTTP/1' ~/spinifex/logs/predastore.log)"
+echo "HTTP/2.0: $(grep -c 'HTTP/2' ~/spinifex/logs/predastore.log)"

 # Profile should show minimal TLS overhead
-go tool pprof -top hive-vm.prof | head -20
+go tool pprof -top spinifex-vm.prof | head -20
 # TLS functions should be <5% instead of 60-84%
 ```

@@ -1354,15 +1354,15 @@ go tool pprof -top hive-vm.prof | head -20

 ### Mandatory Testing Before Changes

-The Hive platform consists of three interdependent repositories:
+The Spinifex platform consists of three interdependent repositories:

 ```
-hive ──depends on──► viperblock ──depends on──► predastore
+spinifex ──depends on──► viperblock ──depends on──► predastore
 ```

 **CRITICAL: All tests must pass across all three repositories before committing changes.**

-Changes in predastore can break viperblock and hive. Changes in viperblock can break hive.
+Changes in predastore can break viperblock and spinifex. Changes in viperblock can break spinifex.

 ### Testing Workflow

@@ -1375,8 +1375,8 @@ LOG_IGNORE=1 go test ./... -count=1
 cd /path/to/viperblock
 LOG_IGNORE=1 go test ./... -count=1

-# 3. Finally test hive (depends on both)
-cd /path/to/hive
+# 3. Finally test spinifex (depends on both)
+cd /path/to/spinifex
 LOG_IGNORE=1 go test ./... -count=1
 ```

@@ -1384,7 +1384,7 @@ LOG_IGNORE=1 go test ./... -count=1

 Each repository uses `go.work` for local development with replace directives:

-**hive/go.work:**
+**spinifex/go.work:**
 ```go
 go 1.25.5

@@ -1423,7 +1423,7 @@ LOG_IGNORE=1  # Suppress log output during tests

 - [ ] `cd predastore && go test ./...` passes
 - [ ] `cd viperblock && go test ./...` passes
- [ ] `cd hive && go test ./...` passes
+- [ ] `cd spinifex && go test ./...` passes
 - [ ] `go build ./...` succeeds in all repos
 - [ ] No new compiler warnings

@@ -1799,7 +1799,7 @@ go tool trace /tmp/trace.out

 - `viperblock/viperblock/viperblock.go` - Core read/write logic (lines 1688-1856 for read path)
 - `viperblock/nbd/viperblock.go` - NBD plugin interface
- `predastore-rewrite/tests/hive-vm7.prof` - Predastore profile (post-HTTP2 fix)
+- `predastore-rewrite/tests/spinifex-vm7.prof` - Predastore profile (post-HTTP2 fix)
 - `/tmp/nbdkit-perf2.data` - Viperblock perf profile

 ### References
@@ -1851,7 +1851,7 @@ The `mapassign_fast64` bottleneck has been completely eliminated:
 | `crypto/md5.block` | 0.83% | AWS v4 signatures |
 | `crypto/sha256` | 0.58% | TLS crypto |

-**Predastore Server (hive-vm8.prof):**
+**Predastore Server (spinifex-vm8.prof):**

 | Function | CPU % | Category |
 |----------|-------|----------|
@@ -2011,7 +2011,7 @@ Profile is now evenly distributed:
 - `runtime.memclrNoHeapPointers`: 1.32%
 - All other functions < 1.5%

-### Predastore Profile (hive-vm9.prof) - Now the Bottleneck
+### Predastore Profile (spinifex-vm9.prof) - Now the Bottleneck

 | Function | CPU % | Category |
 |----------|-------|----------|
@@ -2058,7 +2058,7 @@ These logs were firing on every operation, adding unnecessary overhead.

 ### Chi Middleware Logger Overhead

-**Problem Identified:** The Go profile (hive-vm9.prof) showed significant overhead from chi's RequestLogger middleware:
+**Problem Identified:** The Go profile (spinifex-vm9.prof) showed significant overhead from chi's RequestLogger middleware:

 ```
 chi/v5/middleware.init.0.RequestLogger.func1.1  27.47s  17.39%
@@ -2166,11 +2166,11 @@ After deploying, run benchmark and verify:

 ```bash
 # Profile should show no chi Logger overhead
-go tool pprof -top hive-vm10.prof | grep -i logger
+go tool pprof -top spinifex-vm10.prof | grep -i logger
 # Expected: No results

 # I/O should now dominate
-go tool pprof -top hive-vm10.prof | head -10
+go tool pprof -top spinifex-vm10.prof | head -10
 # Expected: syscall.Syscall6 > 45%
 ```

@@ -2180,7 +2180,7 @@ go tool pprof -top hive-vm10.prof | head -10

 ### Profile Analysis

-**Predastore (hive-vm10.prof):**
+**Predastore (spinifex-vm10.prof):**
 | Function | CPU % | Notes |
 |----------|-------|-------|
 | `syscall.Syscall6` | **37.32%** | I/O bound - expected |
@@ -2346,7 +2346,7 @@ The `UnifiedBlockStore` has `EvictCache()` method but no automatic LRU eviction

 | File | Change |
 |------|--------|
-| `hive/services/viperblockd/viperblockd.go` | Fixed HasSuffix args, fixed cache logic |
+| `spinifex/services/viperblockd/viperblockd.go` | Fixed HasSuffix args, fixed cache logic |
 | `viperblock/viperblock/viperblock.go` | 8 read logs changed to Debug level |

 ### Expected Impact (VM-11)
@@ -2417,11 +2417,11 @@ if hitRate < 0.5 && cacheSize < maxCache {

 ```bash
 # Check cache is enabled for main volumes
-grep "Enabling 64MB cache" ~/hive/logs/viperblockd.log
+grep "Enabling 64MB cache" ~/spinifex/logs/viperblockd.log
 # Expected: One line per main volume

 # Check cache disabled for auxiliary volumes
-grep "Disabling cache for auxiliary" ~/hive/logs/viperblockd.log
+grep "Disabling cache for auxiliary" ~/spinifex/logs/viperblockd.log
 # Expected: Lines for *-cloudinit and *-efi volumes

 # Monitor cache hit rate (if stats endpoint available)
@@ -1,6 +1,6 @@
 #!/bin/bash

-# Hive Development Dependencies Setup Script
+# Spinifex Development Dependencies Setup Script
 # This script clones Viperblock and Predastore repositories for cross-repo development

 # TODO: Improve, remove CLAUDE readme reference, simplify next-steps
@@ -10,13 +10,13 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 MULGA_ROOT="$(cd "$PROJECT_ROOT/.." && pwd)"

-echo "🏗️  Setting up Hive development environment..."
+echo "🏗️  Setting up Spinifex development environment..."
 echo "Project root: $PROJECT_ROOT"
 echo "Mulga root: $MULGA_ROOT"

 # Check if we're in the correct directory structure
 if [[ ! -f "$PROJECT_ROOT/go.mod" ]]; then
-    echo "❌ Error: Cannot find go.mod. Please run this script from the hive repository."
+    echo "❌ Error: Cannot find go.mod. Please run this script from the spinifex repository."
    exit 1
 fi

@@ -70,7 +70,7 @@ fi
 # Verify directory structure
 echo ""
 echo "📁 Directory structure:"
-ls -la "$MULGA_ROOT" | grep -E "(hive|viperblock|predastore)" || true
+ls -la "$MULGA_ROOT" | grep -E "(spinifex|viperblock|predastore)" || true

 echo ""
 echo "🎉 Development environment setup complete!"
@@ -3,12 +3,12 @@ set -euo pipefail

 # Run Go tests with coverage and report total code coverage.

-COVERPROFILE=$(mktemp /tmp/hive-coverage-XXXXXX.out)
+COVERPROFILE=$(mktemp /tmp/spinifex-coverage-XXXXXX.out)
 trap 'rm -f "$COVERPROFILE"' EXIT

 echo "Running tests with coverage..."
 echo ""
-LOG_IGNORE=1 go test -timeout 120s -coverprofile="$COVERPROFILE" -covermode=atomic ./hive/... 2>&1
+LOG_IGNORE=1 go test -timeout 120s -coverprofile="$COVERPROFILE" -covermode=atomic ./spinifex/... 2>&1

 if [[ ! -s "$COVERPROFILE" ]]; then
    echo "No coverage data collected."
@@ -26,13 +26,13 @@ echo "========================="
 echo "Starting init node (127.0.0.1) and joining nodes (127.0.0.2, 127.0.0.3)..."

 # Init blocks until all nodes join, so run in background
-./bin/hive admin init \
+./bin/spx admin init \
  --node node1 \
  --nodes 3 \
  --bind 127.0.0.1 \
  --cluster-bind 127.0.0.1 \
  --port 4432 \
-  --hive-dir ~/node1/ \
+  --spinifex-dir ~/node1/ \
  --config-dir ~/node1/config/ \
  --region ap-southeast-2 \
  --az ap-southeast-2a &
@@ -42,7 +42,7 @@ INIT_PID=$!
 sleep 2

 # Join nodes concurrently
-./bin/hive admin join \
+./bin/spx admin join \
  --node node2 \
  --bind 127.0.0.2 \
  --cluster-bind 127.0.0.2 \
@@ -53,7 +53,7 @@ sleep 2
  --az ap-southeast-2a &
 JOIN2_PID=$!

-./bin/hive admin join \
+./bin/spx admin join \
  --node node3 \
  --bind 127.0.0.3 \
  --cluster-bind 127.0.0.3 \
@@ -1,9 +1,9 @@
 #!/bin/bash

-# Hive Platform Development Environment Setup
-# This script sets up a complete development environment for the Hive platform
+# Spinifex Platform Development Environment Setup
+# This script sets up a complete development environment for the Spinifex platform

-set -e
+set -euo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
@@ -12,18 +12,10 @@ MULGA_ROOT="$(cd "$PROJECT_ROOT/.." && pwd)"
 # Default configuration
 NATS_PORT=4222
 PREDASTORE_PORT=8443
-HIVE_GATEWAY_PORT=9999
-DATA_DIR="$HOME/hive"
-# Use CONFIG_DIR environment variable if set, otherwise default to ~/hive/config
-CONFIG_DIR="${CONFIG_DIR:-$HOME/hive/config}"
+SPINIFEX_GATEWAY_PORT=9999

-echo "🚀 Setting up Hive development environment..."
+echo "🚀 Setting up Spinifex development environment..."
 echo "Project root: $PROJECT_ROOT"
-echo "Data directory: $DATA_DIR"
-
-# Create necessary directories
-mkdir -p "$DATA_DIR"/{nats,predastore,viperblock,logs,hive}
-mkdir -p "$CONFIG_DIR"

 # Function to check if command exists
 command_exists() {
@@ -40,11 +32,13 @@ echo "🔍 Checking dependencies..."

 # Check for required commands
 required_commands=("go" "make")
+missing_required=false
 for cmd in "${required_commands[@]}"; do
    if command_exists "$cmd"; then
        echo "✅ $cmd found"
    else
        echo "❌ $cmd not found. Please install $cmd"
+        missing_required=true
        case "$cmd" in
            "go")
                echo "   Install Go: https://golang.org/dl/"
@@ -52,6 +46,10 @@ for cmd in "${required_commands[@]}"; do
        esac
    fi
 done
+if [ "$missing_required" = true ]; then
+    echo "❌ Missing required dependencies. Cannot continue."
+    exit 1
+fi

 # Check optional commands
 optional_commands=("air" "nbdkit")
@@ -124,7 +122,7 @@ done
 echo ""
 echo "🔌 Checking port availability..."

-ports=("$NATS_PORT:NATS" "$PREDASTORE_PORT:Predastore" "$HIVE_GATEWAY_PORT:Hive Gateway")
+ports=("$NATS_PORT:NATS" "$PREDASTORE_PORT:Predastore" "$SPINIFEX_GATEWAY_PORT:Spinifex Gateway")
 for port_info in "${ports[@]}"; do
    port="${port_info%:*}"
    service="${port_info#*:}"
@@ -135,25 +133,12 @@ for port_info in "${ports[@]}"; do
    fi
 done

-# Build Hive first (needed for admin init)
+# Build Spinifex first (needed for admin init)
 echo ""
-echo "🔨 Building Hive..."
+echo "🔨 Building Spinifex..."
 cd "$PROJECT_ROOT"
 make build
-echo "✅ Hive built successfully"
-
-# Initialize Hive configuration using admin init
-#echo ""
-#echo "🔐 Initializing Hive configuration..."
-
-#if [[ ! -f "$CONFIG_DIR/hive.toml" ]]; then
-#    echo "📋 Running hive admin init..."
-#    ./bin/hive admin init --config-dir "$CONFIG_DIR"
-#    echo "✅ Hive configuration initialized"
-#else
-#    echo "✅ Hive configuration already exists"
-#    echo "   To re-initialize, run: ./bin/hive admin init --force"
-#fi
+echo "✅ Spinifex built successfully"

 # Build components
 echo ""
@@ -182,23 +167,26 @@ fi
 echo ""
 echo "🎉 Development environment setup complete!"
 echo ""
-echo "When running Hive for the first time, run the init function to create the"
-echo "default directories for data, config files and layout required."
-echo "./bin/hive admin init"
+echo "📋 Next steps:"
 echo ""
-echo "🚀 To start the development environment:"
-echo "   ./scripts/start-dev.sh"
+echo "   1. Setup OVN networking:"
+echo "      ./scripts/setup-ovn.sh --management"
 echo ""
-echo "🛑 To stop the development environment:"
-echo "   ./scripts/stop-dev.sh"
+echo "   2. Initialize Spinifex (creates ~/spinifex/ directories, config, and certs):"
+echo "      ./bin/spx admin init --region ap-southeast-2 --az ap-southeast-2a --node node1 --nodes 1"
+echo ""
+echo "   3. Trust the CA certificate:"
+echo "      sudo cp ~/spinifex/config/ca.pem /usr/local/share/ca-certificates/spinifex-ca.crt"
+echo "      sudo update-ca-certificates"
+echo ""
+echo "   4. Start services:"
+echo "      ./scripts/start-dev.sh"
 echo ""
 echo "🔧 Development endpoints:"
-echo "   - Hive Gateway:  https://localhost:$HIVE_GATEWAY_PORT"
+echo "   - Spinifex Gateway:  https://localhost:$SPINIFEX_GATEWAY_PORT"
 echo "   - Predastore S3: https://localhost:$PREDASTORE_PORT"
 echo "   - NATS:          nats://localhost:$NATS_PORT"
 echo ""
-echo "📊 Monitor logs:"
-echo "   tail -f $DATA_DIR/logs/*.log"
-echo ""
 echo "🧪 Test with AWS CLI:"
-echo "   aws --endpoint-url https://localhost:$HIVE_GATEWAY_PORT --no-verify-ssl ec2 describe-instances"
+echo "   export AWS_PROFILE=spinifex"
+echo "   aws ec2 describe-instances"
@@ -13,7 +13,7 @@ set -euo pipefail

 PROFILE=""
 BASE_REF=""
-THRESHOLD=65
+THRESHOLD=60
 QUIET="${QUIET:-}"

 while [[ $# -gt 0 ]]; do
@@ -1,9 +1,9 @@
 # IAC

-Collection of OpenTofu/Terraform templates for creating Hive instances.
+Collection of OpenTofu/Terraform templates for creating Spinifex instances.

 | Template | Description |
 |---|---|
-| [proxmox/](proxmox/) | Provisions a 3-node Hive cluster on Proxmox VE bare-metal hypervisors |
+| [proxmox/](proxmox/) | Provisions a 3-node Spinifex cluster on Proxmox VE bare-metal hypervisors |
 | [aws/](aws/) | Provisions infrastructure using the Terraform AWS provider, with MulgaOS AWS-compatible API as the local endpoint |
-| [proxmox-template/](proxmox-template/) | Builds a Proxmox VM template with all Hive dependencies pre-installed (QEMU, Go, repos, modules) |
+| [proxmox-template/](proxmox-template/) | Builds a Proxmox VM template with all Spinifex dependencies pre-installed (QEMU, Go, repos, modules) |
@@ -14,7 +14,7 @@ This directory contains OpenTofu/Terraform configuration files for deploying inf
   ```

 2. **MulgaOS services running**
-   - `hive daemon` - Core daemon with NATS subscriptions
+   - `spinifex daemon` - Core daemon with NATS subscriptions
   - `awsd` - AWS API gateway (default: http://localhost:8080)
   - `predastore` - S3-compatible storage
   - `viperblock` - EBS-compatible block storage
@@ -26,14 +26,14 @@ This directory contains OpenTofu/Terraform configuration files for deploying inf
   export AWS_SECRET_ACCESS_KEY=your_secret_key

   # Option 2: AWS CLI profile
-   aws configure --profile hive
-   export AWS_PROFILE=hive
+   aws configure --profile spinifex
+   export AWS_PROFILE=spinifex
   ```

 4. **AMI available**
   Before running, ensure you have a Debian 12 AMI imported:
   ```bash
-   # Import an AMI using the hive CLI or aws CLI
+   # Import an AMI using the spinifex CLI or aws CLI
   aws --endpoint-url http://localhost:8080 ec2 describe-images
   ```

@@ -106,7 +106,7 @@ The `main.tf` creates:
 5. **Security Group** - Allows SSH (22), HTTP (80), HTTPS (443) inbound
 6. **Placement Group** - Spread strategy for HA
 7. **3 EC2 Instances** - t3.small Debian 12 VMs
-8. **SSH Key Pair** - ED25519 key saved to `hive-test.pem`
+8. **SSH Key Pair** - ED25519 key saved to `spinifex-test.pem`

 ## SSH Access

@@ -114,11 +114,11 @@ After `tofu apply`, SSH into instances:

 ```bash
 # Using the generated key
-ssh -i hive-test.pem admin@<public_ip>
+ssh -i spinifex-test.pem admin@<public_ip>

 # For local development with QEMU port forwarding
 # Find the forwarded port from QEMU args (-netdev user,id=net0,hostfwd=tcp:127.0.0.1:PORT-:22)
-ssh -p PORT -i hive-test.pem admin@127.0.0.1
+ssh -p PORT -i spinifex-test.pem admin@127.0.0.1
 ```

 ## Troubleshooting
@@ -143,7 +143,7 @@ Ensure MulgaOS services are running:
 curl http://localhost:8080/health

 # Check daemon status
-hive daemon status
+spinifex daemon status
 ```

 ### "InvalidAction" errors
@@ -193,7 +193,7 @@ resource "aws_instance" "vm" {
 | File | Description |
 |------|-------------|
 | `main.tf` | Main Terraform/OpenTofu configuration |
-| `hive-test.pem` | Generated SSH private key (after apply) |
+| `spinifex-test.pem` | Generated SSH private key (after apply) |
 | `.terraform/` | Provider plugins (after init) |
 | `terraform.tfstate` | State file (after apply) |
 | `terraform.tfvars` | Custom variables (optional) |
@@ -79,19 +79,19 @@ data "aws_ami" "debian12" {
  }
 }

-# Keypair: hive-test
+# Keypair: spinifex-test
 resource "tls_private_key" "hive_test" {
  algorithm = "ED25519"
 }

 resource "aws_key_pair" "hive_test" {
-  key_name   = "hive-test"
+  key_name   = "spinifex-test"
  public_key = tls_private_key.hive_test.public_key_openssh
 }

 # Save private key locally for SSH
 resource "local_file" "hive_test_pem" {
-  filename        = "${path.module}/hive-test.pem"
+  filename        = "${path.module}/spinifex-test.pem"
  content         = tls_private_key.hive_test.private_key_openssh
  file_permission = "0600"
 }
@@ -103,7 +103,7 @@ resource "aws_vpc" "main" {
  enable_dns_support   = true

  tags = {
-    Name = "hive-test-vpc"
+    Name = "spinifex-test-vpc"
  }
 }

@@ -112,7 +112,7 @@ resource "aws_internet_gateway" "igw" {
  vpc_id = aws_vpc.main.id

  tags = {
-    Name = "hive-test-igw"
+    Name = "spinifex-test-igw"
  }
 }

@@ -124,7 +124,7 @@ resource "aws_subnet" "public" {
  map_public_ip_on_launch = true

  tags = {
-    Name = "hive-test-public-subnet"
+    Name = "spinifex-test-public-subnet"
  }
 }

@@ -137,7 +137,7 @@ resource "aws_route_table" "public" {
  }

  tags = {
-    Name = "hive-test-public-rt"
+    Name = "spinifex-test-public-rt"
  }
 }

@@ -148,7 +148,7 @@ resource "aws_route_table_association" "public" {

 # 3: Security group
 resource "aws_security_group" "web_ssh" {
-  name        = "hive-test-sg"
+  name        = "spinifex-test-sg"
  description = "Allow inbound 22,80,443; allow all outbound"
  vpc_id      = aws_vpc.main.id

@@ -185,13 +185,13 @@ resource "aws_security_group" "web_ssh" {
  }

  tags = {
-    Name = "hive-test-sg"
+    Name = "spinifex-test-sg"
  }
 }

 # 4: Ensure 3 servers on different underlying hardware (spread placement group)
 resource "aws_placement_group" "spread" {
-  name     = "hive-test-spread"
+  name     = "spinifex-test-spread"
  strategy = "spread"
 }

@@ -208,7 +208,7 @@ resource "aws_instance" "vm" {
  placement_group             = aws_placement_group.spread.name

  tags = {
-    Name = "hive-test-vm-${count.index + 1}"
+    Name = "spinifex-test-vm-${count.index + 1}"
  }
 }

@@ -219,6 +219,6 @@ output "instance_public_ips" {
 output "ssh_commands" {
  value = [
    for ip in aws_instance.vm[*].public_ip :
-    "ssh -i hive-test.pem admin@${ip}"
+    "ssh -i spinifex-test.pem admin@${ip}"
  ]
 }
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail

-# Configure a provisioned Hive cluster: clone repo, build, form cluster, start services.
+# Configure a provisioned Spinifex cluster: clone repo, build, form cluster, start services.
 # Usage: configure-cluster.sh <cluster_name> <state_file>

 CLUSTER_NAME="${1:?Usage: configure-cluster.sh <cluster_name> <state_file>}"
@@ -64,15 +64,15 @@ done

 # --- Step 2: Clone repo and build on all nodes ---
 echo ""
-echo "==> Cloning hive repo and building on all nodes..."
+echo "==> Cloning Spinifex repo and building on all nodes..."
 PIDS=()
 for i in $(seq 0 $((NODE_COUNT - 1))); do
    ip="${MGMT_IPS[$i]}"
    (
        echo "    node$((i + 1)) ($ip): cloning..."
-        remote "$ip" "mkdir -p ~/Development/mulga && cd ~/Development/mulga && git clone https://github.com/mulgadc/hive.git && export PATH=\$PATH:/usr/local/go/bin && sudo make -C hive quickinstall"
+        remote "$ip" "mkdir -p ~/Development/mulga && cd ~/Development/mulga && git clone https://github.com/mulgadc/spinifex.git && export PATH=\$PATH:/usr/local/go/bin && sudo make -C spinifex quickinstall"
        echo "    node$((i + 1)) ($ip): clone-deps + dev-setup..."
-        remote "$ip" "export PATH=\$PATH:/usr/local/go/bin && cd ~/Development/mulga/hive && ./scripts/clone-deps.sh && ./scripts/dev-setup.sh"
+        remote "$ip" "export PATH=\$PATH:/usr/local/go/bin && cd ~/Development/mulga/spinifex && ./scripts/clone-deps.sh && ./scripts/dev-setup.sh"
        echo "    node$((i + 1)) ($ip): build complete"
    ) &
    PIDS+=($!)
@@ -93,7 +93,7 @@ NODE1_IP="${MGMT_IPS[0]}"

 # Node 1: init
 echo "    Starting init on node1 ($NODE1_IP)..."
-remote_bg "$NODE1_IP" "export PATH=\$PATH:/usr/local/go/bin && cd ~/Development/mulga/hive && ./bin/hive admin init \
+remote_bg "$NODE1_IP" "export PATH=\$PATH:/usr/local/go/bin && cd ~/Development/mulga/spinifex && ./bin/spx admin init \
    --node node1 \
    --bind $NODE1_IP \
    --cluster-bind $NODE1_IP \
@@ -103,8 +103,8 @@ remote_bg "$NODE1_IP" "export PATH=\$PATH:/usr/local/go/bin && cd ~/Development/
    --nodes $NODE_COUNT \
    --region $REGION \
    --az $AZ \
-    --hive-dir ~/hive/ \
-    --config-dir ~/hive/config/"
+    --spinifex-dir ~/spinifex/ \
+    --config-dir ~/spinifex/config/"
 INIT_PID=$!

 # Wait for formation server to be ready
@@ -128,14 +128,14 @@ if [ "$NODE_COUNT" -gt 1 ]; then
        ip="${MGMT_IPS[$i]}"
        node_num=$((i + 1))
        echo "    Starting join on node$node_num ($ip)..."
-        remote_bg "$ip" "export PATH=\$PATH:/usr/local/go/bin && cd ~/Development/mulga/hive && ./bin/hive admin join \
+        remote_bg "$ip" "export PATH=\$PATH:/usr/local/go/bin && cd ~/Development/mulga/spinifex && ./bin/spx admin join \
            --node node$node_num \
            --bind $ip \
            --cluster-bind $ip \
            --cluster-routes $NODE1_IP:4248 \
            --host $NODE1_IP:4432 \
-            --data-dir ~/hive/ \
-            --config-dir ~/hive/config/ \
+            --data-dir ~/spinifex/ \
+            --config-dir ~/spinifex/config/ \
            --region $REGION \
            --az $AZ"
        JOIN_PIDS+=($!)
@@ -158,7 +158,7 @@ for i in $(seq 0 $((NODE_COUNT - 1))); do
    ip="${MGMT_IPS[$i]}"
    (
        echo "    node$((i + 1)) ($ip): starting services..."
-        remote "$ip" "export PATH=\$PATH:/usr/local/go/bin && cd ~/Development/mulga/hive && ./scripts/start-dev.sh"
+        remote "$ip" "export PATH=\$PATH:/usr/local/go/bin && cd ~/Development/mulga/spinifex && ./scripts/start-dev.sh"
        echo "    node$((i + 1)) ($ip): services started"
    ) &
    PIDS+=($!)
@@ -1,6 +1,6 @@
-# Hive Node Template Builder
+# Spinifex Node Template Builder

-Builds a Proxmox VM template with all Hive dependencies pre-installed. Cloning from this template reduces cluster spin-up from ~15 minutes to ~1-2 minutes (`git pull` + `make build`).
+Builds a Proxmox VM template with all Spinifex dependencies pre-installed. Cloning from this template reduces cluster spin-up from ~15 minutes to ~1-2 minutes (`git pull` + `make build`).

 ## What's in the template

@@ -9,7 +9,7 @@ Builds a Proxmox VM template with all Hive dependencies pre-installed. Cloning f
 | System packages | QEMU, nbdkit, libvirt, gcc, jq, curl, etc. (`make install-system`) |
 | Go | 1.26.1 (`make install-go`) |
 | AWS CLI | v2 (`make install-aws`) |
-| Repositories | hive, viperblock, predastore (with `go.work` configured) |
+| Repositories | spinifex, viperblock, predastore (with `go.work` configured) |
 | Module cache | `go mod download` completed for all repos |
 | Cloud images | Ubuntu 24.04 for nested VMs (`~/images/ubuntu-24.04.img`) |
 | Tuning | sysctl (rmem_max/wmem_max), kvm group, ufw disabled |
@@ -65,12 +65,12 @@ On each cloned VM after boot:

 ```bash
 # Pull latest code
-cd ~/Development/mulga/hive && git pull
+cd ~/Development/mulga/spinifex && git pull
 cd ~/Development/mulga/viperblock && git pull
 cd ~/Development/mulga/predastore && git pull

 # Build (~30s with cached modules)
-cd ~/Development/mulga/hive && export PATH=/usr/local/go/bin:$PATH && make build
+cd ~/Development/mulga/spinifex && export PATH=/usr/local/go/bin:$PATH && make build
 ```

 ## Testing a Different Base Image
@@ -1,5 +1,5 @@
 #!/bin/bash
-# provision.sh — Installs all Hive dependencies, clones repos, caches Go modules,
+# provision.sh — Installs all Spinifex dependencies, clones repos, caches Go modules,
 # and generalizes the VM for use as a Proxmox template.
 #
 # Runs as tf-user via Terraform remote-exec. Uses sudo for system operations.
@@ -11,7 +11,7 @@ GIT_BRANCH="${GIT_BRANCH:-main}"
 WORK_DIR="$HOME/Development/mulga"

 echo "========================================"
-echo "  Hive Template Provisioning"
+echo "  Spinifex Template Provisioning"
 echo "  Branch: ${GIT_BRANCH}"
 echo "  Arch:   $(uname -m)"
 echo "========================================"
@@ -27,7 +27,7 @@ echo "=== [2/8] Cloning repositories ==="
 mkdir -p "$WORK_DIR"
 cd "$WORK_DIR"

-for repo in hive viperblock predastore; do
+for repo in spinifex viperblock predastore; do
    if [ ! -d "$repo" ]; then
        echo "  Cloning $repo (branch: $GIT_BRANCH)..."
        git clone -b "$GIT_BRANCH" "https://github.com/mulgadc/${repo}.git"
@@ -39,7 +39,7 @@ done
 # ── 3. Install system dependencies via Makefile ─────────────────────────────
 echo ""
 echo "=== [3/8] Installing system dependencies ==="
-cd "$WORK_DIR/hive"
+cd "$WORK_DIR/spinifex"
 sudo make quickinstall

 # Ensure Go is in PATH for the rest of the script
@@ -52,10 +52,10 @@ echo ""
 echo "=== [4/8] Creating go.work ==="

 # Detect Go version from go.mod
-GO_VERSION=$(grep '^go ' "$WORK_DIR/hive/go.mod" | awk '{print $2}')
+GO_VERSION=$(grep '^go ' "$WORK_DIR/spinifex/go.mod" | awk '{print $2}')
 echo "  Using Go version from go.mod: ${GO_VERSION}"

-cat > "$WORK_DIR/hive/go.work" << GOWORK
+cat > "$WORK_DIR/spinifex/go.work" << GOWORK
 go ${GO_VERSION}

 use (
@@ -67,12 +67,12 @@ use (
 )
 GOWORK

-echo "  Created $WORK_DIR/hive/go.work"
+echo "  Created $WORK_DIR/spinifex/go.work"

 # ── 5. Download Go modules ──────────────────────────────────────────────────
 echo ""
 echo "=== [5/8] Downloading Go modules ==="
-cd "$WORK_DIR/hive"       && go mod download && echo "  hive: done"
+cd "$WORK_DIR/spinifex"    && go mod download && echo "  spinifex: done"
 cd "$WORK_DIR/viperblock"  && go mod download && echo "  viperblock: done"
 cd "$WORK_DIR/predastore"  && go mod download && echo "  predastore: done"

@@ -110,7 +110,7 @@ echo ""
 echo "=== [7/8] Applying system tuning ==="

 # Persistent sysctl for NATS / high-throughput networking
-sudo tee /etc/sysctl.d/99-hive.conf > /dev/null << 'SYSCTL'
+sudo tee /etc/sysctl.d/99-spinifex.conf > /dev/null << 'SYSCTL'
 net.core.rmem_max=4194304
 net.core.wmem_max=4194304
 SYSCTL
@@ -1,6 +1,6 @@
 # Proxmox IaC

-OpenTofu/Terraform templates for provisioning Hive development clusters on Proxmox VE.
+OpenTofu/Terraform templates for provisioning Spinifex development clusters on Proxmox VE.

 ## Prerequisites

@@ -12,9 +12,9 @@ OpenTofu/Terraform templates for provisioning Hive development clusters on Proxm
 - SSH keypair for cloud-init VM access
 - A hardcoded Debian ISO is used, which needs to be pre-installed on each Proxmox host ("debian-12-genericcloud-amd64-20240211-1654.img") https://cdimage.debian.org/images/cloud/bookworm/20240211-1654/debian-12-genericcloud-amd64-20240211-1654.qcow2

-## Quick Start (hive-test.sh)
+## Quick Start (spinifex-test.sh)

-The `hive-test.sh` wrapper script manages the full lifecycle: provision, configure, test, and destroy.
+The `spinifex-test.sh` wrapper script manages the full lifecycle: provision, configure, test, and destroy.

 ```sh
 # Source environment
@@ -22,25 +22,25 @@ source scripts/iac/proxmox/.env
 source ~/prox   # Proxmox API token

 # Provision a 3-node cluster
-./scripts/iac/hive-test.sh up my-cluster
+./scripts/iac/spinifex-test.sh up my-cluster

 # Configure: clone repo, build, form cluster, start services
-./scripts/iac/hive-test.sh configure my-cluster
+./scripts/iac/spinifex-test.sh configure my-cluster

 # Run smoke tests
-./scripts/iac/hive-test.sh test my-cluster
+./scripts/iac/spinifex-test.sh test my-cluster

 # Check cluster health
-./scripts/iac/hive-test.sh status my-cluster
+./scripts/iac/spinifex-test.sh status my-cluster

 # SSH to a specific node
-./scripts/iac/hive-test.sh ssh my-cluster 2
+./scripts/iac/spinifex-test.sh ssh my-cluster 2

 # Destroy when done
-./scripts/iac/hive-test.sh down my-cluster
+./scripts/iac/spinifex-test.sh down my-cluster

 # Or run the full lifecycle (up → configure → test → down)
-./scripts/iac/hive-test.sh full my-cluster
+./scripts/iac/spinifex-test.sh full my-cluster
 ```

 ### Options
@@ -55,7 +55,7 @@ source ~/prox   # Proxmox API token
 Example with custom sizing:

 ```sh
-./scripts/iac/hive-test.sh up my-cluster --node-count=5 --memory-mb=8192 --cpu-cores=2
+./scripts/iac/spinifex-test.sh up my-cluster --node-count=5 --memory-mb=8192 --cpu-cores=2
 ```

 Per-cluster state is stored in `scripts/iac/proxmox/clusters/<name>/terraform.tfstate`, allowing multiple clusters to coexist.
@@ -185,7 +185,7 @@ ssh -i ~/.ssh/your-cloud-init-key tf-user@<VM_IP>

 ## Known issues

- `~/hive/config/hive.toml` - Does not add node1, node2, node3 from config automatically
- `~/hive/config/predastore/predastore.toml` - Uses previous static local node config, needs to use the IPs for each node in the cluster
+- `~/spinifex/config/spinifex.toml` - Does not add node1, node2, node3 from config automatically
+- `~/spinifex/config/predastore/predastore.toml` - Uses previous static local node config, needs to use the IPs for each node in the cluster
 - On multi-node deployments, NATS on the primary can timeout waiting for other nodes to start, causing a race condition where NATS fails and all dependent services fail
 - When adding 3 nodes, `nats.conf` is not updated with the 3rd node. Each node's cluster name is hardcoded to `C1` instead of per-node names
@@ -62,7 +62,7 @@ variable "nodes" {

 variable "cluster_name" {
  type        = string
-  description = "Name for the Hive cluster (used in VM names and tags)"
+  description = "Name for the Spinifex cluster (used in VM names and tags)"

  validation {
    condition     = can(regex("^[a-z0-9-]+$", var.cluster_name))
@@ -72,7 +72,7 @@ variable "cluster_name" {

 variable "node_count" {
  type        = number
-  description = "Number of Hive VMs to create"
+  description = "Number of Spinifex VMs to create"
  default     = 3

  validation {
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Julian Sommer	02931567ac	release: update go.mod for v0.4.2	2026-03-20 13:09:48 +10:00
dependabot[bot]	c4890c80d3	build(deps): bump fast-xml-parser (#83 )	2026-03-20 12:48:53 +11:00
Julian Sommer	d2d3e52522	feat: migrate to golangci-lint (#82 )	2026-03-20 12:14:42 +11:00
Julian Sommer	42cb6dbed0	fix: add better error message	2026-03-20 11:12:32 +10:00
Julian Sommer	6cdeea3aa8	chore: more tests	2026-03-20 09:27:21 +10:00
Julian Sommer	4884b68b51	feat: version bootstrap file	2026-03-20 09:12:42 +10:00
Julian Sommer	726528bd9d	feat: version jetstream buckets	2026-03-20 09:07:40 +10:00
Julian Sommer	593920ce7d	feat: E2E test redistribution and dev-setup cleanup Redistribute E2E tests between single-node and multi-node suites, slim down pseudo multi-node suite, and remove directory creation from dev-setup.sh so spx admin init is the single source of truth for ~/spinifex/ setup.	2026-03-20 08:24:15 +10:00
Julian Sommer	ea8700df99	fix: increase sleep time	2026-03-19 15:02:50 +10:00
Julian Sommer	857cbd75ac	fix: use spx service stop instead of shell PID kill in stop-dev.sh	2026-03-19 14:50:50 +10:00
Julian Sommer	0fa38f7986	fix: write credentials to user even when running as sudo	2026-03-19 14:05:48 +10:00
Julian Sommer	1a4d590bf3	fix: nbd log level	2026-03-19 13:45:27 +10:00
Julian Sommer	b7678ab7c5	feat: fix silent failures across spinifex (P2 audit H-25 through H-43) - PID file failures now prevent service start instead of logging and continuing - Status() methods use PID-based health checks instead of returning empty string - NewResourceManager returns error instead of silently defaulting to 8GB - Crash recovery re-allocates resources before relaunch - restoreInstances stops after failed resource allocation - Cluster manager bind errors propagated to Start() - NATS disconnect/reconnect logged at Warn level - VPC CIDR fallback logs warning about overbroad rule - vpcd respond() handles json.Marshal failure - Network cleanup failures logged instead of silently discarded - fmt.Println replaced with slog.Debug in NATS service - Signature mismatch no longer logs expected signature - extractDiskImagePath uses errors.Is for EOF - validateDiskImagePath checks file command error - os.Stat uncommented in admin image import - net.SplitHostPort errors checked - Gateway response write errors logged - vpcd OVN NB address uses leader IP on non-primary nodes - Release workflow parallelized with native arm64 runner	2026-03-19 13:37:41 +10:00
Julian Sommer	11730be685	fix: locate release assets by filename instead of hardcoded path	2026-03-19 12:13:28 +10:00
Julian Sommer	a4bc8bee74	fix: pending instance terminate (#80 )	2026-03-19 12:47:00 +11:00
Julian Sommer	fafc104c30	feat: add release verification job with draft-then-promote flow	2026-03-19 10:52:39 +10:00
dependabot[bot]	efa6257850	build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 (#79 )	2026-03-19 11:35:06 +11:00
Julian Sommer	7e46f0012b	chore: bump more action versions	2026-03-19 10:23:52 +10:00
Julian Sommer	58e6817efe	chore: bump docker build action ver	2026-03-19 10:19:02 +10:00
Julian Sommer	71ec2b7ee5	release: update go.mod for v0.4.0	2026-03-19 08:28:16 +10:00
Julian Sommer	9c430eea07	fix: release workflow	2026-03-19 08:17:30 +10:00
Julian Sommer	1be6c69e51	format	2026-03-19 08:03:23 +10:00
Ben Duncan	c523f78403	Merge branch 'dev' of github.com:mulgadc/spinifex into dev	2026-03-18 05:08:30 +00:00
Ben Duncan	2918a02fac	correct spx path	2026-03-18 05:08:15 +00:00
Julian Sommer	8e3210f023	fix	2026-03-18 14:36:12 +10:00
Julian Sommer	6ba9d3dbf0	remove trailing slash	2026-03-18 14:24:52 +10:00
Ben Duncan	27cdfc4653	Merge branch 'dev' of github.com:mulgadc/spinifex into dev	2026-03-18 04:14:22 +00:00
Ben Duncan	adadb5ef4c	Fixed noninteractive error on apt get	2026-03-18 04:13:53 +00:00
Julian Sommer	d0fc2a2120	last fix	2026-03-18 13:40:27 +10:00
Julian Sommer	a09a8efe3c	build frontend with new branding	2026-03-18 13:38:47 +10:00
Julian Sommer	7d43d0f782	hopefully last rename	2026-03-18 13:24:45 +10:00
Julian Sommer	ba0d8b67ff	feat: e2e pipeline speedup (#78 )	2026-03-18 13:50:45 +11:00
Ben Duncan	454f381826	Moved to GNU Affero General Public License v3	2026-03-18 02:04:41 +00:00
Ben Duncan	b95ff42a2f	feat: rename product from Hive to Spinifex Trademark conflict — bulk rename across entire codebase: - Go module: github.com/mulgadc/hive → github.com/mulgadc/spinifex - Binary: hive → spx - Directories: hive/ → spinifex/, hiveui → spinifexui - Env vars: HIVE_* → SPINIFEX_* - Config: hive.toml → spinifex.toml - Systemd: hive-* → spinifex-* - NATS: hive-workers → spinifex-workers - All paths, docs, scripts, CI workflows updated	2026-03-18 01:42:53 +00:00
Ben Duncan	2064c338b3	chore: gofmt formatting after rename	2026-03-18 01:23:11 +00:00
Ben Duncan	4f00cf9e4c	refactor: update Dockerfile and build artifacts for spinifex rename - Dockerfile.distro: update all paths from hive → spinifex - Binary output name: spx - Logrotate: logrotate-spinifex	2026-03-18 01:20:27 +00:00
Ben Duncan	48012a4058	refactor: rename all documentation from hive to spinifex - Rename .claude/rules/hive.md → spinifex.md - Update CLAUDE.md component description - Rename doc directories: hive-admin-cli → spinifex-admin-cli, etc. - Rename doc files: hive-cluster-stats, hive-code-consolidation, etc. - Bulk update all markdown files across docs/ tree - Update internal docs: CLUSTER-INSTALL, TESTING, DEVNOTES, BRANCHES	2026-03-18 01:19:05 +00:00
Ben Duncan	55186d95f2	refactor: rename CI/CD workflows from hive to spinifex - Rename hive.yml → spinifex.yml - Update workflow names, path triggers, working directories - Update release.yml tarball references - Update e2e.yml test paths - Update ui.yml frontend paths	2026-03-18 01:09:02 +00:00
Ben Duncan	c11ac04892	refactor: rename frontend UI branding from hive to spinifex - package.json: name → spinifex-ui - index.html: page title → Spinifex Control Panel - sidebar-layout: Mulga Hive → Mulga Spinifex - auth.ts: localStorage key → spinifex:v1:aws-credentials - main.tsx: theme storage key → spinifex-ui-theme - spinifexui_test.go: update service name assertion	2026-03-18 01:06:55 +00:00
Ben Duncan	9e744e5be6	refactor: rename NATS queue group and topics from hive to spinifex - hive-workers → spinifex-workers queue group (~16 files) - hive.admin.* → spinifex.admin.* topics - hive.nodes.* → spinifex.nodes.* topics - hive.node.* → spinifex.node.* topics - hive.cluster.* → spinifex.cluster.* topics - spinifex-nats server_name already updated in Phase 5	2026-03-18 01:06:03 +00:00
Ben Duncan	5d93786995	refactor: rename hive to spinifex in all shell scripts - Update scripts/: start-dev, stop-dev, dev-setup, setup, setup-ovn, etc. - Update tests/e2e/: all E2E test scripts - Update scripts/iac/: rename hive-test.sh → spinifex-test.sh, update TF files - Update config/: rename hive.service and install script - Binary refs use spx, env vars use SPINIFEX_, paths use spinifex	2026-03-18 01:04:12 +00:00
Ben Duncan	b97a98e2b7	refactor: rename systemd units and logrotate from hive to spinifex - Rename all build/systemd/hive-* → spinifex-* - Rename build/logrotate/hive → spinifex - Update unit contents: descriptions, dependencies, user/group, paths - Binary path set to /usr/local/bin/spx	2026-03-18 00:53:34 +00:00
Ben Duncan	ee0b92c192	refactor: rename config files, paths, and env vars from hive to spinifex - Rename hive.toml template → spinifex.toml - Update all default paths: /etc/hive → /etc/spinifex, ~/hive → ~/spinifex - Rename all HIVE_* env vars → SPINIFEX_* (SetEnvPrefix, BindEnv calls) - Update nats.conf template server_name - Update admin.go init/join commands for new paths and names - Update paths.go, paths_test.go, config.go, config_test.go	2026-03-18 00:47:01 +00:00
Ben Duncan	00f5b6590e	refactor: rename CLI binary to spx and update all command names - Makefile: GO_PROJECT_NAME → spx, update build/test/dist paths - root.go: Use → spx, update branding to Spinifex - service.go: hive/hive-ui commands → spinifex/spinifex-ui - Service name constants: hive → spinifex, hive-ui → spinifex-ui - Update service_test.go switch cases	2026-03-18 00:42:34 +00:00
Ben Duncan	06804f5775	refactor: rename directory structure hive → spinifex - git mv hive/ → spinifex/ - git mv cmd/hive/ → cmd/spinifex/ - git mv services/hive/ → services/spinifex/ - git mv services/hiveui/ → services/spinifexui/ - Update package declarations and all internal import paths - Update service.go switch cases for new service names	2026-03-18 00:37:30 +00:00
Ben Duncan	767ad0bf5c	refactor: rename Go module path from hive to spinifex Bulk rename github.com/mulgadc/hive → github.com/mulgadc/spinifex across go.mod and all 178 Go files (~411 import occurrences).	2026-03-18 00:29:24 +00:00
Julian Sommer	4152e4422f	chore: remove redundant x/net/http2 and automaxprocs deps ForceAttemptHTTP2 + NextProtos ALPN already handle HTTP/2 on Go 1.22+. Go 1.25+ runtime is container-aware for GOMAXPROCS by default.	2026-03-18 10:14:52 +10:00
Julian Sommer	48bbe423df	fix: complete termination lifecycle for failed instances	2026-03-18 09:53:48 +10:00
Julian Sommer	e6b5b3b135	chore: update vite react plugin	2026-03-18 08:54:57 +10:00
Julian Sommer	f526972607	chore: go back to ultracite	2026-03-18 08:46:49 +10:00
Julian Sommer	ddcd7f622f	chore: bump deps	2026-03-18 08:20:18 +10:00
Ben Duncan	2459e5f7ac	improved docs	2026-03-16 12:52:14 +00:00
				`@@ -1 +0,0 @@`
				import{a as e,n as t,r as n}from"./compiler-runtime.js";import{t as r}from"./useSuspenseQuery.js";import{t as i}from"./error-banner.js";import"./useRouterState.js";import{t as a}from"./link.js";import{a as o}from"./utils.js";import{t as s}from"./useNavigate.js";import{t as c}from"./button.js";import{t as l}from"./createLucideIcon.js";import{t as u}from"./back-link.js";import{t as d}from"./trash-2.js";import"./separator.js";import"./awsClient.js";import{d as f,n as p}from"./ec2.js";import{l as m,u as h}from"./ec22.js";import{O as g,i as _}from"./index.js";import{t as v}from"./page-heading.js";import{t as y}from"./state-badge.js";import{n as b,t as x}from"./detail-row.js";import{a as S,i as C,l as w,n as T,o as E,r as D,s as O,t as k}from"./alert-dialog.js";import{i as A,t as j}from"./field.js";import{t as M}from"./delete-confirmation-dialog.js";var N=l(`copy`,[[`rect`,{width:`14`,height:`14`,x:`8`,y:`8`,rx:`2`,ry:`2`,key:`17jyea`}],[`path`,{d:`M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2`,key:`zix9uf`}]]),P=e(n()),F=t();function I(){let{id:e}=_.useParams(),t=s(),{data:n}=r(h(e)),{data:l}=r(m),I=n.Snapshots?.[0],L=f(),R=p(),[z,B]=(0,P.useState)(!1),[V,H]=(0,P.useState)(!1),[U,W]=(0,P.useState)(``),G=l.Regions?.[0]?.RegionName??`ap-southeast-2`,K=I?.State===`completed`,q=async()=>{try{await L.mutateAsync(e),t({to:`/ec2/describe-snapshots`})}finally{B(!1)}},J=async()=>{try{await R.mutateAsync({sourceSnapshotId:e,sourceRegion:G,description:U\|\|void 0}),H(!1),W(``)}catch{}};if(!I?.SnapshotId)return(0,F.jsxs)(F.Fragment,{children:[(0,F.jsx)(u,{to:`/ec2/describe-snapshots`,children:`Back to snapshots`}),(0,F.jsx)(`p`,{className:`text-muted-foreground`,children:`Snapshot not found.`})]});let Y=o(I.StartTime);return(0,F.jsxs)(F.Fragment,{children:[(0,F.jsx)(u,{to:`/ec2/describe-snapshots`,children:`Back to snapshots`}),L.error&&(0,F.jsx)(i,{error:L.error,msg:`Failed to delete snapshot`}),R.error&&(0,F.jsx)(i,{error:R.error,msg:`Failed to copy snapshot`}),(0,F.jsxs)(`div`,{className:`space-y-6`,children:[(0,F.jsx)(v,{actions:(0,F.jsxs)(`div`,{className:`flex items-center gap-2`,children:[(0,F.jsxs)(c,{disabled:!K,onClick:()=>B(!0),size:`sm`,variant:`destructive`,children:[(0,F.jsx)(d,{className:`size-4`}),`Delete`]}),(0,F.jsxs)(c,{disabled:!K,onClick:()=>H(!0),size:`sm`,variant:`outline`,children:[(0,F.jsx)(N,{className:`size-4`}),`Copy Snapshot`]}),(0,F.jsx)(y,{state:I.State})]}),subtitle:`EC2 Snapshot Details`,title:I.SnapshotId}),(0,F.jsxs)(b,{children:[(0,F.jsx)(b.Header,{children:`Snapshot Information`}),(0,F.jsxs)(b.Content,{children:[(0,F.jsx)(x,{label:`Snapshot ID`,value:I.SnapshotId}),(0,F.jsx)(x,{label:`Volume ID`,value:I.VolumeId?(0,F.jsx)(a,{className:`text-primary hover:underline`,params:{id:I.VolumeId},to:`/ec2/describe-volumes/$id`,children:I.VolumeId}):void 0}),(0,F.jsx)(x,{label:`Volume Size`,value:`${I.VolumeSize} GiB`}),(0,F.jsx)(x,{label:`State`,value:I.State}),(0,F.jsx)(x,{label:`Description`,value:I.Description}),(0,F.jsx)(x,{label:`Progress`,value:I.Progress}),(0,F.jsx)(x,{label:`Start Time`,value:Y}),(0,F.jsx)(x,{label:`Owner ID`,value:I.OwnerId}),(0,F.jsx)(x,{label:`Encrypted`,value:I.Encrypted?`Yes`:`No`})]})]})]}),(0,F.jsx)(M,{description:`Are you sure you want to delete the snapshot "${I.SnapshotId}"? This action cannot be undone.`,isPending:L.isPending,onConfirm:q,onOpenChange:B,open:z,title:`Delete Snapshot`}),(0,F.jsx)(k,{onOpenChange:H,open:V,children:(0,F.jsxs)(C,{children:[(0,F.jsxs)(O,{children:[(0,F.jsx)(w,{children:`Copy Snapshot`}),(0,F.jsx)(S,{children:`Create a copy of this snapshot in the current region.`})]}),(0,F.jsxs)(j,{children:[(0,F.jsx)(A,{children:(0,F.jsx)(`label`,{htmlFor:`copyDescription`,children:`Description (optional)`})}),(0,F.jsx)(g,{id:`copyDescription`,onChange:e=>W(e.target.value),placeholder:`Description for the snapshot copy`,value:U})]}),(0,F.jsxs)(E,{children:[(0,F.jsx)(D,{children:`Cancel`}),(0,F.jsx)(T,{disabled:R.isPending,onClick:J,children:R.isPending?`Copying…`:`Copy Snapshot`})]})]})})]})}export{I as component};
				`@@ -1 +0,0 @@`
				import{a as e,n as t,r as n,t as r}from"./compiler-runtime.js";import{u as i}from"./utils.js";import{F as a,P as o,R as s,_ as c,i as l,o as u,z as d}from"./button.js";import{V as f}from"./createBaseUIEventDetails.js";var p=function(e){return e.disabled=`data-disabled`,e.valid=`data-valid`,e.invalid=`data-invalid`,e.touched=`data-touched`,e.dirty=`data-dirty`,e.filled=`data-filled`,e.focused=`data-focused`,e}({}),m={badInput:!1,customError:!1,patternMismatch:!1,rangeOverflow:!1,rangeUnderflow:!1,stepMismatch:!1,tooLong:!1,tooShort:!1,typeMismatch:!1,valid:null,valueMissing:!1},h={valid(e){return e===null?null:e?{[p.valid]:``}:{[p.invalid]:``}}},g=e(n()),_=g.createContext({invalid:void 0,name:void 0,validityData:{state:m,errors:[],error:``,value:``,initialValue:null},setValidityData:a,disabled:void 0,touched:!1,setTouched:a,dirty:!1,setDirty:a,filled:!1,setFilled:a,focused:!1,setFocused:a,validate:()=>null,validationMode:`onSubmit`,validationDebounceTime:0,shouldValidateOnChange:()=>!1,state:{disabled:!1,valid:null,touched:!1,dirty:!1,filled:!1,focused:!1},markedDirtyRef:{current:!1},validation:{getValidationProps:(e=o)=>e,getInputValidationProps:(e=o)=>e,inputRef:{current:null},commit:async()=>{}}});function v(e=!0){let t=g.useContext(_);if(t.setValidityData===a&&!e)throw Error(d(28));return t}var y=g.createContext({formRef:{current:{fields:new Map}},errors:{},clearErrors:a,validationMode:`onSubmit`,submitAttemptedRef:{current:!1}});function b(){return g.useContext(y)}var x=g.createContext({controlId:void 0,registerControlId:a,labelId:void 0,setLabelId:a,messageIds:[],setMessageIds:a,getDescriptionProps:e=>e});function S(){return g.useContext(x)}function C(e,t){return{...e,state:{...e.state,valid:!t&&e.state.valid}}}function w({controlled:e,default:t,name:n,state:r=`value`}){let{current:i}=g.useRef(e!==void 0),[a,o]=g.useState(t);return[i?e:a,g.useCallback(e=>{i\|\|o(e)},[])]}function T(e={}){let{id:t,implicit:n=!1,controlRef:r}=e,{controlId:i,registerControlId:o}=S(),d=f(t),p=n?i:void 0,m=s(()=>Symbol(`labelable-control`)),h=g.useRef(!1),_=g.useRef(t!=null),v=u(()=>{!h.current\|\|o===a\|\|(h.current=!1,o(m.current,void 0))});return l(()=>{if(o===a)return;let e;if(n){let n=r?.current;e=c(n)&&n.closest(`label`)!=null?t??null:p??d}else if(t!=null)_.current=!0,e=t;else if(_.current)e=d;else{v();return}if(e===void 0){v();return}h.current=!0,o(m.current,e)},[t,r,p,o,n,d,m,v]),g.useEffect(()=>v,[v]),i??d}var E=e(i());function D(e){let{enabled:t=!0,value:n,id:r,name:i,controlRef:a,commit:o}=e,{formRef:s}=b(),{invalid:c,markedDirtyRef:d,validityData:f,setValidityData:p}=v(),m=u(e.getValue);l(()=>{if(!t)return;let e=n;e===void 0&&(e=m()),f.initialValue===null&&e!==null&&p(t=>({...t,initialValue:e}))},[t,p,n,f.initialValue,m]),l(()=>{!t\|\|!r\|\|s.current.fields.set(r,{getValue:m,name:i,controlRef:a,validityData:C(f,c),validate(e=!0){let t=n;t===void 0&&(t=m()),d.current=!0,e?E.flushSync(()=>o(t)):o(t)}})},[o,a,t,s,m,r,c,d,i,f,n]),l(()=>{let e=s.current.fields;return()=>{r&&e.delete(r)}},[s,r])}r(),t();export{b as a,S as i,T as n,v as o,w as r,h as s,D as t};
				`@@ -1 +0,0 @@`
				import{a as e,r as t}from"./compiler-runtime.js";var n=!0;function r(e,t){if(!n){if(e)return;var r=`Warning: `+t;typeof console<`u`&&console.warn(r);try{throw Error(r)}catch{}}}var i=e(t(),1),a=i.createContext(null);function o(e){let t=i.useContext(a);return r(!((e?.warn??!0)&&!t),`useRouter must be used inside a <RouterProvider> component!`),t}export{a as n,r,o as t};