refactor: relocate handlers/elbv2 to domains/elbv2 (#1269 )

* refactor: relocate handlers/elbv2 to domains/elbv2 Mechanical move per the amended ADR-0001 handlers/elbv2 row. Package renamed handlers_elbv2 -> elbv2; importers alias elbv2domain. APIs, NATS subjects, storage and behaviour unchanged. Layering debt entries retargeted; Q-30 data-plane boundary stays deferred debt. * docs: cite spinifex#1269 in the ELBv2 relocation row * docs: match citation style in the ELBv2 relocation row
2026-10-26 05:59:41 +00:00 · 2026-10-26 15:23:17 +10:00
111 changed files with 326 additions and 325 deletions
@@ -128,7 +128,7 @@ var allowlist = []allowance{
 	{From: "handlers/ecs", To: "domains/ec2/ebs/metadata", Debt: "close-out: handlers/ecs (ADR-0004 blocked-dependency list; inventory-ecs boundary imports)", Reason: "legacy ECS calls another domain's implementation as an internal API"},
 	{From: "handlers/ecs", To: "domains/ec2/eip", Debt: "close-out: handlers/ecs (ADR-0004 blocked-dependency list; inventory-ecs boundary imports)", Reason: "legacy ECS calls another domain's implementation as an internal API"},
 	{From: "handlers/ecs", To: "domains/ec2/instancetypes", Debt: "close-out: handlers/ecs (ADR-0004 blocked-dependency list; inventory-ecs boundary imports)", Reason: "legacy ECS calls another domain's implementation as an internal API"},
-	{From: "handlers/ecs", To: "handlers/elbv2", Debt: "close-out: handlers/ecs (ADR-0004 blocked-dependency list; inventory-ecs boundary imports)", Reason: "legacy ECS calls another domain's implementation as an internal API"},
+	{From: "handlers/ecs", To: "domains/elbv2", Debt: "close-out: handlers/ecs (ADR-0004 blocked-dependency list; inventory-ecs boundary imports)", Reason: "legacy ECS calls another domain's implementation as an internal API"},
 	{From: "handlers/ecs", To: "domains/iam", Debt: "close-out: handlers/ecs (ADR-0004 blocked-dependency list; inventory-ecs boundary imports)", Reason: "legacy ECS calls another domain's implementation as an internal API"},

 	{From: "domains/eks/cluster", To: "domains/dns", Debt: "close-out: handlers/eks (ADR-0004 blocked-dependency list; inventory-eks boundary imports)", Reason: "legacy EKS calls another domain's or runtime implementation directly"},
@@ -140,13 +140,13 @@ var allowlist = []allowance{
 	{From: "domains/eks/cluster", To: "domains/iam", Debt: "close-out: handlers/eks (ADR-0004 blocked-dependency list; inventory-eks boundary imports)", Reason: "legacy EKS calls another domain's or runtime implementation directly"},
 	{From: "domains/eks/cluster", To: "runtime/compute/vm", Debt: "close-out: handlers/eks (ADR-0004 blocked-dependency list; inventory-eks boundary imports)", Reason: "legacy EKS calls another domain's or runtime implementation directly"},

-	{From: "handlers/elbv2", To: "domains/acm", Debt: "handlers/elbv2 (cross-domain)", Reason: "legacy ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
-	{From: "handlers/elbv2", To: "domains/dns", Debt: "handlers/elbv2 (cross-domain)", Reason: "legacy ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
-	{From: "handlers/elbv2", To: "domains/ec2/systeminstance", Debt: "handlers/elbv2 (cross-domain)", Reason: "legacy ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
-	{From: "handlers/elbv2", To: "domains/ec2/vpc", Debt: "handlers/elbv2 (cross-domain)", Reason: "legacy ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
-	{From: "handlers/elbv2", To: "domains/network/topology", Debt: "handlers/elbv2 (cross-domain)", Reason: "legacy ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
-	{From: "handlers/elbv2", To: "domains/iam", Debt: "IAM implementation consumers in STS, Ochre and ELBv2", Reason: "system-instance role ensurer; needs an IAM capability"},
-	{From: "handlers/elbv2", To: "agents/elbv2", Debt: "handlers/elbv2/{agent_types,haproxy,health_checker,nginx}.go import lbagent", Reason: "health-report and cert/PID-path vocabulary; needs a guest/controller contract"},
+	{From: "domains/elbv2", To: "domains/acm", Debt: "domains/elbv2 (cross-domain)", Reason: "ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
+	{From: "domains/elbv2", To: "domains/dns", Debt: "domains/elbv2 (cross-domain)", Reason: "ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
+	{From: "domains/elbv2", To: "domains/ec2/systeminstance", Debt: "domains/elbv2 (cross-domain)", Reason: "ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
+	{From: "domains/elbv2", To: "domains/ec2/vpc", Debt: "domains/elbv2 (cross-domain)", Reason: "ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
+	{From: "domains/elbv2", To: "domains/network/topology", Debt: "domains/elbv2 (cross-domain)", Reason: "ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
+	{From: "domains/elbv2", To: "domains/iam", Debt: "IAM implementation consumers in STS, Ochre and ELBv2", Reason: "system-instance role ensurer; needs an IAM capability"},
+	{From: "domains/elbv2", To: "agents/elbv2", Debt: "domains/elbv2/{agent_types,haproxy,health_checker,nginx}.go import lbagent", Reason: "health-report and cert/PID-path vocabulary; needs a guest/controller contract"},

 	{From: "domains/rds/instance", To: "domains/dns", Debt: "close-out: handlers/rds (ADR-0004 blocked-dependency list; inventory-rds boundary imports)", Reason: "legacy RDS calls another domain's or runtime implementation directly"},
 	{From: "domains/rds/instance", To: "domains/ec2/instance", Debt: "close-out: handlers/rds (ADR-0004 blocked-dependency list; inventory-rds boundary imports)", Reason: "legacy RDS calls another domain's or runtime implementation directly"},
@@ -16,7 +16,6 @@ var frozenLegacyPackages = []string{
 	"gateway/elbv2",
 	"gateway/spx",
 	"handlers/ecs",
-	"handlers/elbv2",
 }

 // retiredLegacyRoots were legacy roots whose every package has moved to its
@@ -311,7 +311,7 @@ spinifex/
 │   ├── operator/            # spx CLI commands, admin use cases, installer, upgrade
 │   ├── agents/              # In-guest agent libraries (ecs, eks, elbv2, rds)
 │   ├── gateway/             # Legacy root: HTTP route assembly, SigV4 auth, legacy per-service dispatch
-│   ├── handlers/            # Legacy root: ecs and elbv2 service implementations
+│   ├── handlers/            # Legacy root: ecs service implementation
 │   └── accountteardown/     # Legacy root: account deletion cleanup
 ├── internal/                # In-guest SigV4 clients, AWS Smithy models and test kits
 ├── architecture/            # Executable architecture rules (package layering)
@@ -347,7 +347,8 @@ while the branch is in flight; they do not describe the umbrella repository's
 | `spinifex#1265` | `spinifex/gateway/{iam,sts,eks,rds}` | `spinifex/domains/{iam,sts,eks,rds}/awsapi` (`awsapi`, imported as `iamawsapi`, `stsawsapi`, `eksawsapi`, `rdsawsapi`) | A mechanical relocation of the IAM, STS, EKS and RDS AWS action adapters to their ADR-0001 domain homes; APIs, NATS subjects, KV buckets and behaviour are unchanged. The root `gateway` dispatch still imports each package, recorded as `gateway` (service registration) debt. `gateway/bedrock` stays: ADR-0001 moves only its action adapters, and the package also holds the Ochre domain core, stores and inference engine. |
 | `spinifex#1266` | `spinifex/gateway/bedrock` | `spinifex/domains/ochre` (merged into package `ochre`) | A mechanical whole-package relocation: the Ochre domain core, stores, inference engine and Bedrock action layer join the existing `domains/ochre` package with their package-private code and tests intact. No identifier, API, NATS subject, KV bucket, metric, error string or behaviour changes; `domains/ochre` no longer imports a legacy package. Separating the action adapters into `domains/ochre/awsapi` is deferred, recorded as `domains/ochre` (action adapters) debt. |
 | `spinifex#1267` | `spinifex/daemon` | `spinifex/runtime/daemon` | A mechanical whole-package relocation under the 2026-10-26 ADR-0001 amendment: the per-node daemon keeps package name `daemon`, its files, tests and current dependencies. No identifier, API, NATS subject, KV bucket, metric, error string or behaviour changes. The interim daemon → gateway → handlers guardrail now matches `runtime/daemon`. Q-28's ownership and deployment refactor is deferred, recorded as `runtime/daemon` (Q-28 ownership and deployment) debt. |
-| — | `spinifex/lbagent` | `spinifex/agents/elbv2` (package `elbv2`) | A mechanical whole-package relocation under the 2026-10-26 ADR-0001 amendment: the load-balancer agent keeps its files, tests and current dependencies, and importers alias it `lbagent` so call sites are unchanged. No identifier, API, NATS subject, file path on the guest, metric, error string or behaviour changes; `cmd/lb-agent` stays the thin main. Q-30's data-plane boundary is deferred, recorded as `agents/elbv2` (Q-30 data-plane boundary) debt. |
+| `spinifex#1268` | `spinifex/lbagent` | `spinifex/agents/elbv2` (package `elbv2`) | A mechanical whole-package relocation under the 2026-10-26 ADR-0001 amendment: the load-balancer agent keeps its files, tests and current dependencies, and importers alias it `lbagent` so call sites are unchanged. No identifier, API, NATS subject, file path on the guest, metric, error string or behaviour changes; `cmd/lb-agent` stays the thin main. Q-30's data-plane boundary is deferred, recorded as `agents/elbv2` (Q-30 data-plane boundary) debt. |
+| `spinifex#1269` | `spinifex/handlers/elbv2` | `spinifex/domains/elbv2` (package `elbv2`) | A mechanical whole-package relocation under the 2026-10-26 ADR-0001 amendment: the ELBv2 control plane keeps its files, tests and current dependencies, and importers alias it `elbv2domain`. No identifier, API, NATS subject, KV bucket, metric, error string or behaviour changes. Its allowlist entries are now sourced from `domains/elbv2`. Q-30's data-plane boundary stays deferred, recorded as `agents/elbv2` (Q-30 data-plane boundary) debt. |
 The EC2 contract row is intentionally different from the directory moves: it creates
 a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS
 subscription and permission shape, while callers use
@@ -421,15 +422,15 @@ These residuals were recorded by individual slices and must be resolved once the
 - The public `/keys` endpoint (root `gateway`, `oidc_discovery.go`) serves malformed stored JWKS bytes with HTTP 200. Removal condition: validate before serving, or record it as accepted.
 - The public discovery and `/keys` endpoints return 404 for KV read errors, including timeouts; only a bucket-open failure returns 500. Removal condition: distinguish dependency failure from not-found.
 - The root `gateway` package imports `domains/eks/cluster` directly (`gateway/oidc_discovery.go`: `AccountBucketName`, `GetClusterMeta`). The layering rules don't see it because the root gateway has no domain classification, so it has no allowlist entry. Removal condition: the public OIDC discovery and JWKS endpoints consume an EKS-owned resolver injected at composition, the same pattern as STS, leaving the root gateway with no `domains/eks/cluster` import.
- `handlers/elbv2/{agent_types,haproxy,health_checker,nginx}.go` import `agents/elbv2` (`HealthReport`, `ServerStatus`, `CertDir`, `NginxPIDPath`, `NginxCertDir`), a domain reading an agent's implementation package rather than a declared wire contract. Removal condition: the health-report and cert/PID-path vocabulary moves behind a guest/controller contract the domain and the agent both consume.
- `agents/elbv2` (Q-30 data-plane boundary): the agent moved whole, keeping its current dependencies and the `handlers/elbv2` import above. Q-30's data-plane boundary and the common agent layout remain deferred by ADR-0001 and are not paid by the move.
+- `domains/elbv2/{agent_types,haproxy,health_checker,nginx}.go` import `agents/elbv2` (`HealthReport`, `ServerStatus`, `CertDir`, `NginxPIDPath`, `NginxCertDir`), a domain reading an agent's implementation package rather than a declared wire contract. Removal condition: the health-report and cert/PID-path vocabulary moves behind a guest/controller contract the domain and the agent both consume.
+- `agents/elbv2` (Q-30 data-plane boundary): the agent moved whole, keeping its current dependencies and the `domains/elbv2` import above. Q-30's data-plane boundary and the common agent layout remain deferred by ADR-0001 and are not paid by the move.
 - `domains/ec2/instance/state/imds_readers.go` (dependency, IMDS readers) imports `runtime/daemon` for `LocalState`, `ReadLocalState`, `LocalStatePath`, `NewJetStreamManager` and `InstanceStateBucket`. The local-file reader and the instance-record loader's `JetStreamManager` open, which `vpcd/imds_instance_state.go` held directly, moved here unchanged and are now injected into `vpcd` through `guestmetadata.LocalStateReader` and `guestmetadata.RecordLoader`. The readers already live in `domains/ec2/instance/state`. Removal condition: the legacy dependencies they call are extracted from `daemon` — `LocalStatePath`, `ReadLocalState` and `LocalState`, the instance bucket constants, and `JetStreamManager` with its bucket initialisation (`InitKVBucket`) — leaving `domains/ec2/instance/state` with no `daemon` import.
 - Advisory: 27 production files across `domains/{acm,dns,ec2/*,network/host,network/ovn,ochre}` import `bootstrap/config` directly rather than through typed constructor inputs, which ADR-0001's `config` row expects. `bootstrap/preflight/preflight.go:15` imports `runtime/host/command` and `services.go:13` imports `operator/host/systemd`; both are expected bootstrap-to-runtime/operator edges for startup validation and are not domain-rule violations.
 - Operator bootstrap credential generation: `operator/cli/admin.go` mints the bootstrap admin and Northstar access keys and secrets directly with `awscredentials` and writes them into config, rather than asking an IAM bootstrap capability to issue them. `awscredentials` only formats the values. Removal condition: a real IAM bootstrap capability issues these credentials and `operator/cli` calls it.
 - `domains/dns`: imports `runtime/compute/vm` (domain-to-runtime), `domains/network/reconcile` for the reconcile lock and `bootstrap/config` for node configuration.
 - ACM: the IAM AES-GCM helper import (ACM relocation residual).
 - `runtime/roles/awsgw`: the quota reconcile loop belongs to `domains/admission/quota`, and the EKS token-verify responder belongs with STS or EKS identity.
- `runtime/roles/awsgw` → `handlers/elbv2` (inherited from `gateway/tagging`): this is a new physical import in AWSGW that inherits the former `gateway/tagging` dependency, because the `elbv2Lister` adapter builds its client with `handlers_elbv2.NewNATSELBv2Service` and calls the `ELBv2Service` interface. It is permitted temporarily because AWSGW is the composition root, which may wire legacy packages, so the layering test needs no allowlist row. Removal condition: it must clear when ELBv2 exposes a domain-owned boundary (its NATS client or contract under its domain owner) and the adapter consumes that instead.
+- `runtime/roles/awsgw` → `domains/elbv2` (inherited from `gateway/tagging`): this is a new physical import in AWSGW that inherits the former `gateway/tagging` dependency, because the `elbv2Lister` adapter builds its client with `elbv2domain.NewNATSELBv2Service` and calls the `ELBv2Service` interface. AWSGW is the composition root, so the layering test needs no allowlist row. Removal condition: it must clear when ELBv2 exposes a domain-owned boundary (its NATS client or contract under its domain owner) and the adapter consumes that instead.
 - `runtime/roles/vpcd` (placement): the role still mixes process/role supervision with network-controller responsibilities. `lease_reaper.go` (orphaned external-pool DHCP lease sweep), `ovn_controller_watchdog.go` (OVN controller liveness and restart), `host_eip_loop.go` (host-EIP reconcile loop) and `lease_datapath_reconcile.go` (lease datapath reconcile) are periodic network-control loops, not role wiring; `vpcd.go` itself also carries bridge-mode detection and verification, chassis-list parsing, external-CIDR resolution, DHCP manager startup and lease/IP-change handling, and gateway/host-EIP allocator and neighbour flush/prime construction alongside `Service.Start`. The future placement question is whether these belong in `domains/network`. Removal condition: an accepted decision on network-controller placement, and extraction of those loops and helpers behind the role.
 - ECR control-plane registration: `awsapi.Deps.NATS` is a raw `*nats.Conn`, not a narrow capability. Every NATS-backed `Handler` passes it to `domains/ecr.NewNATSMetaStore`, which calls `natsmsg.NATSRequest`, so narrowing it means changing the exported `Handler` type, every handler and the meta store; it must not be broadened further meanwhile.
 - ACM control-plane registration: `domains/acm/awsapi.Deps.NATS` (`registration.go`) is likewise a raw `*nats.Conn` carried by every `Handler`, for the same reason; it must not be broadened further meanwhile.
@@ -474,8 +475,8 @@ Enforcement: the owner decided the layering test is blocking now, with a ratchet
 - `agents/rds/agent` (dependency, narrowed): engine metadata now arrives through the agent-declared `EngineCatalog`, but the agent still imports `domains/rds/instance` for the command protocol, wire and record types (`Command*`, `Parameter`, `EngineHealth*`, `BootstrapMode*`) and API output types. This clears when those move behind a guest/controller wire contract.
 - `domains/rds/awsapi` → `domains/rds/instance` (`InstanceSizing`): the gateway obtains its `Sizing` through the RDS handler package's adapter rather than its own composition root. This clears when the gateway's RDS composition moves to `runtime/roles/awsgw` and builds `Sizing` there.
 - `domains/admission/quota` → `domains/ec2/instancetypes`: `reconcile.go`, `records.go` and `vcpu.go` read `DefaultVCPUs` to size instances without a recorded vCPU count. This clears when quota receives vCPU sizing through a consumer-owned capability or an EC2 projection.
- IAM implementation consumers in STS, Ochre and ELBv2: `domains/sts` imports `domains/iam` across five files (`IAMService`, `SessionRevoker`, `EncryptSecret`/`DecryptSecret`, `AccessKeyStatusActive`, `ValidateTrustPolicyDocument`, `PolicyEffectAllow`/`PolicyEffectDeny`, `IAMAccountBucketName`, `OIDCProviderARN`, `OIDCProviderKey`), not only `oidc_jwks.go`; `domains/sts/awsapi/GetCallerIdentity.go` takes `IAMService`; `domains/ochre/credentials.go` uses `EncryptSecret`/`DecryptSecret`; and `handlers/elbv2/{lb_role,service_impl}.go` use `EnsureSystemInstanceProfile` and `SystemInstanceRoleEnsurer`. Each clears when its consumer receives a narrow IAM capability, or a shared crypto boundary for the secret helpers, rather than importing the IAM implementation.
- `handlers/elbv2` (cross-domain): `service_impl.go` imports `domains/acm` (`Store`, `NewStore`), `domains/dns` (`ELBChanges`, `ELBName`, `Change`, `ActionUpsert`, `ResolveBaseDomain`), `domains/ec2/vpc` (`VPCServiceImpl`) and `domains/network/topology` (`Port`), and `launcher.go` re-exports `domains/ec2/systeminstance` launch types as aliases. These clear when ELBv2 is extracted and each edge becomes a consumer-owned capability, which ADR-0001 sequences after the ELBv2 data-plane boundary is settled.
+- IAM implementation consumers in STS, Ochre and ELBv2: `domains/sts` imports `domains/iam` across five files (`IAMService`, `SessionRevoker`, `EncryptSecret`/`DecryptSecret`, `AccessKeyStatusActive`, `ValidateTrustPolicyDocument`, `PolicyEffectAllow`/`PolicyEffectDeny`, `IAMAccountBucketName`, `OIDCProviderARN`, `OIDCProviderKey`), not only `oidc_jwks.go`; `domains/sts/awsapi/GetCallerIdentity.go` takes `IAMService`; `domains/ochre/credentials.go` uses `EncryptSecret`/`DecryptSecret`; and `domains/elbv2/{lb_role,service_impl}.go` use `EnsureSystemInstanceProfile` and `SystemInstanceRoleEnsurer`. Each clears when its consumer receives a narrow IAM capability, or a shared crypto boundary for the secret helpers, rather than importing the IAM implementation.
+- `domains/elbv2` (cross-domain): `service_impl.go` imports `domains/acm` (`Store`, `NewStore`), `domains/dns` (`ELBChanges`, `ELBName`, `Change`, `ActionUpsert`, `ResolveBaseDomain`), `domains/ec2/vpc` (`VPCServiceImpl`) and `domains/network/topology` (`Port`), and `launcher.go` re-exports `domains/ec2/systeminstance` launch types as aliases. These clear when each edge becomes a consumer-owned capability.
 - `docs/service-interfaces.yaml` (ECS coverage gap, closed): the traced `ecs.bus.*` family and the ECS AWS-API action subjects are both listed. The action subjects are declared as `ecs.*`, the same wildcard convention as `rds.*`: `handlers/ecs/service_nats.go` publishes them from the gateway and `daemon/daemon.go` subscribes to them. Declaring `ecs.bus.*` alone had made `ecs` a managed prefix, so `manifest-lint` failed CI on all 34 undeclared action subjects until this was added.
 - `contracts/ecs/v1` (dead routes): four of five bus subjects have no producer. The scheduler leader still subscribes to `instance-register`, `instance-heartbeat` and `task-state`, which can never fire, and `assign` has neither producer nor consumer; only `service-reconcile` is live. Removal condition: an owner decision to retire these routes (a successor contract under the compatibility rules) or to adopt them in the agent.

@@ -666,12 +667,13 @@ series above; "needs decision" is open.
 | `handlers/ecs` | Task, service and capacity resources (`taskdefinition` already extracted to `domains/ecs/taskdefinition`). | Deferred: ADR-0004 blocked-dependency list — `iam:PassRole` in the gateway adapter and EC2/ELBv2/EIP adapters called as internal APIs. |
 | `handlers/eks` | — | Done for the relocation: the remaining EKS implementation moved to `domains/eks/cluster` (package `cluster`) in `spinifex#1264` with no API, NATS subject, storage or behaviour change, alongside the already-extracted `access` and `addon` packages. Deferred follow-on: nodegroup service extraction. The nodegroup operations are methods on the shared `EKSServiceImpl` and use its private state, so moving them to their own resource package needs a nodegroup owner and interfaces, which is decomposition work, not a move. The ADR-0004 blocked-dependency imports (IAM role/instance-profile creation, Bluebottle `auth`, the NATS CA, and EKS identity: token review, OIDC) remain dependency-rule debt, with their allowlist entries now sourced from `domains/eks/cluster`. |
 | `handlers/rds` | — | Done. The remaining RDS instance resource moved to `domains/rds/instance` (package `instance`) in `spinifex#1251` with no API, NATS subject, storage or behaviour change, fulfilling ADR-0001's organise-by-resource condition alongside the already-extracted subnet group, parameter group and engine catalogue. The ADR-0004 blocked-dependency imports (quota admission, the duplicated expected-node fan-out, the IAM ensurer and the Bluebottle master key) remain dependency-rule debt, with their allowlist entries now sourced from `domains/rds/instance`. |
-| `handlers/elbv2` | Everything; not yet touched. | Deferred: ADR-0001 sequences this after the ELBv2 data-plane boundary is settled. Needs decision: what evidence establishes that boundary is settled. |
+| `handlers/elbv2` | — | Done. The implementation moved to `domains/elbv2` (package `elbv2`) with no API, NATS subject, storage or behaviour change. Q-30's data-plane boundary remains deferred debt; the amended ADR-0001 row makes it not a relocation prerequisite. Its cross-domain, IAM and `agents/elbv2` imports remain dependency-rule debt, with their allowlist entries now sourced from `domains/elbv2`. |
 | `handlers/iam/mock` | — | Done. Moved with the implementation to `domains/iam/mock`. |
 | `gateway` (root) | Generic HTTP route assembly, SigV4/registry authentication, the policy gate, request-audit middleware, request-context keys, and the legacy per-service dispatch switch for every service not yet registered. | Deferred: the ADR-0002 phases above (auth/IAM and request-context boundary design) gate moving the audit, context-key and legacy-dispatch mechanics. |
 | `gateway/bedrock` | — | Done. The whole package moved into `domains/ochre` in `spinifex#1266` with its package-private core and tests intact and no behaviour change. Separating the action adapters into `domains/ochre/awsapi` remains deferred, recorded as `domains/ochre` (action adapters) debt above. |
 | `gateway/{iam,sts,eks,rds}` | — | Done. The action adapters moved to `domains/{iam,sts,eks,rds}/awsapi` in `spinifex#1265` with no API, NATS subject, storage or behaviour change. ADR-0001 does not make ADR-0002 registration a prerequisite for relocating a domain's adapters, as the EC2 adapter moves already showed; the root `gateway` dispatch that still imports them is recorded `gateway` (service registration) debt. |
-| `gateway/{ecs,elbv2}` | Each service's AWS action adapters and dispatch, not yet registered through ADR-0002. | Deferred: each follows its `handlers/<svc>`, because a new-path `awsapi` cannot import a legacy handler. |
+| `gateway/ecs` | The ECS AWS action adapters and dispatch, not yet registered through ADR-0002. | Deferred: it follows `handlers/ecs`, because a new-path `awsapi` cannot import a legacy handler. |
+| `gateway/elbv2` | The ELBv2 AWS action adapters and dispatch, not yet registered through ADR-0002. | Not moved. Its handler is now `domains/elbv2`, so the follows-its-handler blocker no longer applies. |
 | `gateway/spx` | `promote_image.go` and `spx.go` dispatch (`storage.go` already consumes `contracts/operator/v1`). | Needs decision: which package owns operator-plane action dispatch registration — an `ingress/aws`-style seam for the operator plane, or `gateway` stays its home. |
 | `gateway/tagging` | — | Done. `domains/tagging` owns the read-only cross-resource `GetResources` aggregation and its API semantics (`0d830e901`, `aedd0b2c4`); AWSGW composes the owner listers, the EC2 tag index and ELBv2 (`f3545e3ea`); the root `gateway` keeps only the legacy dispatch in `gateway/tagging.go`. The package is removed, and its two allowlist rows and frozen-legacy entry are gone. Owner tag mutation capabilities remain future direction, so the RDS and ECS tag-writing edges above stay open. |
 | `services/viperblockd` | — | Done. The adapter is `providers/ebs/viperblock` (with the read-only `dirty` reader), the shared vocabulary is `contracts/viperblockd/legacy/v1`, and the role is `runtime/roles/viperblockd`. `services/` is empty. |
@@ -680,7 +682,7 @@ series above; "needs decision" is open.
 | `daemon` | `runtime/daemon` (whole-package move, above) | Done. Q-28's ownership and deployment refactor remains deferred debt; the amended ADR-0001 row makes it not a relocation prerequisite. |
 | `admin` | — | Done and deleted. The operator use cases moved to `operator/admin`, image promotion to `domains/ec2/image`, the bootstrap account identifiers to `foundation/aws/identifiers`, and the credential-format generators to `foundation/aws/credentials` (recorded above). Operator bootstrap's direct credential generation stays recorded as debt. |
 | `accountteardown` | The whole package, a frozen legacy root. Its direct cleanup calls into `domains/ec2/awsapi/*` action adapters, other domain and handler services, the object-store provider, raw NATS subjects and a raw KV bucket stay as recorded debt. | Assessed for relocation and not moved. ADR-0001's `accountteardown` row requires conversion to domain-owned cleanup capabilities before moving, and ADR-0008 does not authorise a mechanical rename. It remains a legacy root until its direct cleanup calls are converted to domain-owned capabilities; its destination after that conversion is `operator/accountlifecycle`. |
-| `lbagent` | `agents/elbv2` (whole-package move, above) | Done. Q-30's data-plane boundary remains deferred debt; the amended ADR-0001 row makes it not a relocation prerequisite. The `handlers/elbv2` import stays recorded debt. |
+| `lbagent` | `agents/elbv2` (whole-package move, above) | Done. Q-30's data-plane boundary remains deferred debt; the amended ADR-0001 row makes it not a relocation prerequisite. The `domains/elbv2` import stays recorded debt. |
 | `migrate` | Nothing at the old path. | Split, not an exact ADR row: ADR-0001 maps `migrate` to `foundation/state/migrate`, but the package held two responsibilities. The KV migration engine and its tests are in `foundation/state/migrate` (`8cd9cff75`); the config-file and object-store upgrade workflow moved to `operator/upgrade` (`919d5bfa6`) by owner decision. Needs an ADR-0001 map clarification before this row can be claimed as target conformance. |

 ### Remaining legacy roots by blocker class
@@ -693,7 +695,7 @@ ADR-0001 completion is structural, so none of these is cleared by remediating se
 |---|---|---|
 | No missing boundary (candidate moves) | `handlers/ecs/bus` → `contracts/ecs/v1` (`a130f6b8e`); `admin/images_promote.go` → `domains/ec2/image` (`263c58167`); `admin` bootstrap account identifiers → `foundation/aws/identifiers` (`3fdaa54d9`); `admin` credential-format generators → `foundation/aws/credentials` `0368e861a`, retiring `admin` | Done. |
 | One narrow missing boundary | Done: `handlers/sts` EKS JWKS lookup → `handlers/eks` `ClusterJWKSResolver` (`254d898a3`); `gateway/tagging` → `domains/tagging` with AWSGW-composed listers (`0d830e901`, `f3545e3ea`, `aedd0b2c4`). Open: `gateway/spx` (owner of operator-plane dispatch registration) | Each needs one decision or one capability, then a mechanical move. |
-| Broader boundary or follows another package | `handlers/{ecs,eks,rds}` (ADR-0004 blocked-dependency lists); `handlers/elbv2` (data-plane boundary evidence); `accountteardown` (domain cleanup capabilities); `gateway` root (ADR-0002 auth and request-context phase); `gateway/{ecs,elbv2}` (each follows its `handlers/<svc>`, because a new-path `awsapi` cannot import a legacy handler) | Recorded debt with removal conditions above. |
+| Broader boundary or follows another package | `handlers/{ecs,eks,rds}` (ADR-0004 blocked-dependency lists); `accountteardown` (domain cleanup capabilities); `gateway` root (ADR-0002 auth and request-context phase); `gateway/ecs` (follows `handlers/ecs`, because a new-path `awsapi` cannot import a legacy handler) | Recorded debt with removal conditions above. |

 Per-consumer IAM capabilities are the widest unblocker: they gate STS's IAM reads, Ochre's IAM reads, the ELBv2 role path and the ECS, EKS and RDS ensurers.

@@ -74,7 +74,7 @@ services:
      - spinifex/domains/ec2/volume
      - spinifex/domains/ec2/volumestate
      - spinifex/domains/ec2/vpc
-      - spinifex/handlers/elbv2
+      - spinifex/domains/elbv2
      - spinifex/domains/acm
      - spinifex/domains/iam
      - spinifex/handlers/ecs
@@ -136,7 +136,7 @@ services:
      - "spinifex.cluster.shutdown.infra"
      # Operator-plane Predastore topology contract (contracts/operator/v1).
      - "spinifex.storage.config"
-      # ELBv2 control plane (handlers/elbv2/service_nats.go topic map).
+      # ELBv2 control plane (domains/elbv2/service_nats.go topic map).
      - "elbv2.CreateLoadBalancer"
      - "elbv2.DeleteLoadBalancer"
      - "elbv2.DescribeLoadBalancers"
@@ -403,7 +403,7 @@ suites:
  e2e-lb:
    path: tests/e2e/lb
    covers: [awsgw, spinifex_daemon, vpcd, viperblockd, predastore]
-    # Exercises full ELBv2 control plane (handlers/elbv2) + data plane
+    # Exercises full ELBv2 control plane (domains/elbv2) + data plane
    # (LB agent on the system VM). ELBv2 is part of spinifex_daemon in
    # this manifest; revisit if it splits into a standalone service.

@@ -5,7 +5,7 @@ import (

 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elbv2"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -15,7 +15,7 @@ import (
 // groups, so it has to go before either can be deleted. Target groups follow
 // their balancers because a group still referenced by a listener refuses.
 func ELBv2Reapers(nc *nats.Conn) []Reaper {
-	svc := handlers_elbv2.NewNATSELBv2Service(nc)
+	svc := elbv2domain.NewNATSELBv2Service(nc)
 	return []Reaper{
 		&loadBalancerReaper{svc: svc},
 		&targetGroupReaper{svc: svc},
@@ -23,7 +23,7 @@ func ELBv2Reapers(nc *nats.Conn) []Reaper {
 }

 type loadBalancerReaper struct {
-	svc handlers_elbv2.ELBv2Service
+	svc elbv2domain.ELBv2Service
 }

 func (r *loadBalancerReaper) Kind() string { return "load-balancer" }
@@ -58,7 +58,7 @@ func (r *loadBalancerReaper) Delete(ctx context.Context, accountID string, resou
 }

 type targetGroupReaper struct {
-	svc handlers_elbv2.ELBv2Service
+	svc elbv2domain.ELBv2Service
 }

 func (r *targetGroupReaper) Kind() string { return "target-group" }
@@ -10,7 +10,7 @@ import (

 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elbv2"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -18,7 +18,7 @@ import (
 // The embedded interface is nil, so a reaper reaching for anything beyond the
 // four methods below panics rather than passing.
 type fakeELBv2 struct {
-	handlers_elbv2.ELBv2Service
+	elbv2domain.ELBv2Service

 	loadBalancers []*elbv2.LoadBalancer
 	targetGroups  []*elbv2.TargetGroup
@@ -57,7 +57,7 @@ const (
 	registrationGrace = 60 * time.Second
 )

-// Data-plane engine names (duplicated from handlers/elbv2 to avoid an import cycle).
+// Data-plane engine names (duplicated from domains/elbv2 to avoid an import cycle).
 const (
 	EngineHAProxy = "haproxy"
 	EngineNginx   = "nginx"
@@ -82,7 +82,7 @@ type ACMServiceImpl struct {
 	// SAN) by deriveValidationMode. Wired by the daemon post-construction
 	// (mirroring CertMaterialUpdated below) to domains/dns.HostsZone. A func
 	// field stands in for a direct import of domains/dns, the same pattern
-	// CertMaterialUpdated uses for handlers/elbv2, so this package and its
+	// CertMaterialUpdated uses for domains/elbv2, so this package and its
 	// tests stay decoupled from domains/dns's S3/northstar-config
 	// dependencies. Nil means "northstar hosts nothing" — the safe default for
 	// tests and any deployment that never wires it, so an unwired service can
@@ -91,7 +91,7 @@ type ACMServiceImpl struct {

 	// CertMaterialUpdated, when set, is invoked after new certificate material
 	// is written under an existing ARN so the caller can re-render every load
-	// balancer that references it (see handlers/elbv2.UpdateStoredConfigForCert).
+	// balancer that references it (see domains/elbv2.UpdateStoredConfigForCert).
 	// Wired by the daemon post-construction to avoid an elbv2 -> acm import
 	// cycle; nil-safe — skipped in tests and whenever ELBv2 isn't wired up.
 	// Fan-out errors are logged, never propagated: a rendering problem on one
@@ -106,7 +106,7 @@ type CertRecord struct {
 	ImportedAt       time.Time         `json:"imported_at"`
 	Tags             map[string]string `json:"tags,omitempty"`
 	// InUseBy is the set of load balancer ARNs whose listeners currently
-	// reference this certificate. Maintained by handlers/elbv2 as listeners are
+	// reference this certificate. Maintained by domains/elbv2 as listeners are
 	// created, modified and deleted; also surfaces as the public
 	// CertificateDetail.InUseBy field.
 	InUseBy []string `json:"in_use_by,omitempty"`
@@ -443,7 +443,7 @@ const maxInUseByCASAttempts = 50
 // No-op if the certificate does not exist or already lists resourceArn.
 //
 // InUseBy is the sole mechanism by which a re-imported certificate reaches
-// the data plane (see UpdateStoredConfigForCert in handlers/elbv2), so a lost
+// the data plane (see UpdateStoredConfigForCert in domains/elbv2), so a lost
 // update here is not a cosmetic race: it silently drops a load balancer from
 // fan-out, and that load balancer's certificate expires in HAProxy while ACM
 // still reports it as renewed. Two listeners on different load balancers can
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"github.com/aws/aws-sdk-go/aws"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"testing"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"testing"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"fmt"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"strings"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import "github.com/mulgadc/spinifex/spinifex/domains/ec2/systeminstance"

@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"sync"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"log/slog"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	awsidentifiers "github.com/mulgadc/spinifex/spinifex/foundation/aws/identifiers"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"crypto/x509"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"strings"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,7 +1,7 @@
-// Package handlers_elbv2 implements the ELBv2 actions for application and
+// Package elbv2 implements the ELBv2 actions for application and
 // network load balancers: the daemon-side JetStream KV implementation, its NATS
 // client, and the HAProxy and nginx configs rendered for the LB VMs.
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"github.com/aws/aws-sdk-go/aws"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"testing"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"encoding/json"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"encoding/json"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"maps"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"testing"
@@ -7,10 +7,10 @@ import (
 	"net/http"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
 	awsxml "github.com/mulgadc/spinifex/spinifex/foundation/aws/xml"
 	gateway_elbv2 "github.com/mulgadc/spinifex/spinifex/gateway/elbv2"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/ingress/aws/query"
 )

@@ -118,10 +118,10 @@ var elbv2Actions = map[string]elbv2Action{
 	"RemoveTags": elbv2Handler(func(ctx context.Context, input *elbv2.RemoveTagsInput, gw *GatewayConfig, accountID string) (any, error) {
 		return gateway_elbv2.RemoveTags(ctx, input, gw.NATSConn, accountID)
 	}),
-	"LBAgentHeartbeat": elbv2Handler(func(ctx context.Context, input *handlers_elbv2.LBAgentHeartbeatInput, gw *GatewayConfig, accountID string) (any, error) {
+	"LBAgentHeartbeat": elbv2Handler(func(ctx context.Context, input *elbv2domain.LBAgentHeartbeatInput, gw *GatewayConfig, accountID string) (any, error) {
 		return gateway_elbv2.LBAgentHeartbeat(ctx, input, gw.NATSConn, accountID)
 	}),
-	"GetLBConfig": elbv2Handler(func(ctx context.Context, input *handlers_elbv2.GetLBConfigInput, gw *GatewayConfig, accountID string) (any, error) {
+	"GetLBConfig": elbv2Handler(func(ctx context.Context, input *elbv2domain.GetLBConfigInput, gw *GatewayConfig, accountID string) (any, error) {
 		return gateway_elbv2.GetLBConfig(ctx, input, gw.NATSConn, accountID)
 	}),
 	"ModifyTargetGroup": elbv2Handler(func(ctx context.Context, input *elbv2.ModifyTargetGroupInput, gw *GatewayConfig, accountID string) (any, error) {
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -19,7 +19,7 @@ func AddListenerCertificates(ctx context.Context, input *elbv2.AddListenerCertif
 		return output, errors.New(awserrors.ErrorMissingParameter)
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.AddListenerCertificates(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -20,7 +20,7 @@ func AddTags(ctx context.Context, input *elbv2.AddTagsInput, natsConn *nats.Conn
 		return output, errors.New(awserrors.ErrorMissingParameter)
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.AddTags(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -33,7 +33,7 @@ func CreateListener(ctx context.Context, input *elbv2.CreateListenerInput, natsC
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.CreateListener(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -30,7 +30,7 @@ func CreateLoadBalancer(ctx context.Context, input *elbv2.CreateLoadBalancerInpu
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.CreateLoadBalancer(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -39,7 +39,7 @@ func CreateRule(ctx context.Context, input *elbv2.CreateRuleInput, natsConn *nat
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.CreateRule(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -30,7 +30,7 @@ func CreateTargetGroup(ctx context.Context, input *elbv2.CreateTargetGroupInput,
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.CreateTargetGroup(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -30,7 +30,7 @@ func DeleteListener(ctx context.Context, input *elbv2.DeleteListenerInput, natsC
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.DeleteListener(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -30,7 +30,7 @@ func DeleteLoadBalancer(ctx context.Context, input *elbv2.DeleteLoadBalancerInpu
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.DeleteLoadBalancer(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -30,7 +30,7 @@ func DeleteRule(ctx context.Context, input *elbv2.DeleteRuleInput, natsConn *nat
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.DeleteRule(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -30,7 +30,7 @@ func DeleteTargetGroup(ctx context.Context, input *elbv2.DeleteTargetGroupInput,
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.DeleteTargetGroup(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -33,7 +33,7 @@ func DeregisterTargets(ctx context.Context, input *elbv2.DeregisterTargetsInput,
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.DeregisterTargets(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -19,7 +19,7 @@ func DescribeListenerCertificates(ctx context.Context, input *elbv2.DescribeList
 		return output, errors.New(awserrors.ErrorMissingParameter)
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.DescribeListenerCertificates(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -18,7 +18,7 @@ func DescribeListeners(ctx context.Context, input *elbv2.DescribeListenersInput,
 		return output, errors.New(awserrors.ErrorInvalidParameterValue)
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.DescribeListeners(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -8,8 +8,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -21,7 +21,7 @@ func DescribeLoadBalancers(ctx context.Context, input *elbv2.DescribeLoadBalance
 		return output, errors.New(awserrors.ErrorInvalidParameterValue)
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.DescribeLoadBalancers(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -32,7 +32,7 @@ func DescribeRules(ctx context.Context, input *elbv2.DescribeRulesInput, natsCon
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.DescribeRules(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -3,7 +3,7 @@ package gateway_elbv2
 import (
 	"context"
 	"github.com/aws/aws-sdk-go/service/elbv2"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -12,7 +12,7 @@ import (
 func DescribeSSLPolicies(ctx context.Context, input *elbv2.DescribeSSLPoliciesInput, natsConn *nats.Conn, accountID string) (elbv2.DescribeSSLPoliciesOutput, error) {
 	var output elbv2.DescribeSSLPoliciesOutput

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.DescribeSSLPolicies(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -20,7 +20,7 @@ func DescribeTags(ctx context.Context, input *elbv2.DescribeTagsInput, natsConn
 		return output, errors.New(awserrors.ErrorMissingParameter)
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.DescribeTags(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -18,7 +18,7 @@ func DescribeTargetGroups(ctx context.Context, input *elbv2.DescribeTargetGroups
 		return output, errors.New(awserrors.ErrorInvalidParameterValue)
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.DescribeTargetGroups(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -30,7 +30,7 @@ func DescribeTargetHealth(ctx context.Context, input *elbv2.DescribeTargetHealth
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.DescribeTargetHealth(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -4,14 +4,14 @@ import (
 	"context"
 	"errors"

+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

 // ValidateGetLBConfigInput rejects a nil input with InvalidParameterValue and a missing LBID with
 // MissingParameter.
-func ValidateGetLBConfigInput(input *handlers_elbv2.GetLBConfigInput) error {
+func ValidateGetLBConfigInput(input *elbv2domain.GetLBConfigInput) error {
 	if input == nil {
 		return errors.New(awserrors.ErrorInvalidParameterValue)
 	}
@@ -22,14 +22,14 @@ func ValidateGetLBConfigInput(input *handlers_elbv2.GetLBConfigInput) error {
 }

 // GetLBConfig handles the ELBv2 GetLBConfig API call.
-func GetLBConfig(ctx context.Context, input *handlers_elbv2.GetLBConfigInput, natsConn *nats.Conn, accountID string) (handlers_elbv2.GetLBConfigOutput, error) {
-	var output handlers_elbv2.GetLBConfigOutput
+func GetLBConfig(ctx context.Context, input *elbv2domain.GetLBConfigInput, natsConn *nats.Conn, accountID string) (elbv2domain.GetLBConfigOutput, error) {
+	var output elbv2domain.GetLBConfigOutput

 	if err := ValidateGetLBConfigInput(input); err != nil {
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.GetLBConfig(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -4,14 +4,14 @@ import (
 	"context"
 	"errors"

+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

 // ValidateLBAgentHeartbeatInput rejects a nil input with InvalidParameterValue and a missing LBID
 // with MissingParameter.
-func ValidateLBAgentHeartbeatInput(input *handlers_elbv2.LBAgentHeartbeatInput) error {
+func ValidateLBAgentHeartbeatInput(input *elbv2domain.LBAgentHeartbeatInput) error {
 	if input == nil {
 		return errors.New(awserrors.ErrorInvalidParameterValue)
 	}
@@ -22,14 +22,14 @@ func ValidateLBAgentHeartbeatInput(input *handlers_elbv2.LBAgentHeartbeatInput)
 }

 // LBAgentHeartbeat handles the ELBv2 LBAgentHeartbeat API call.
-func LBAgentHeartbeat(ctx context.Context, input *handlers_elbv2.LBAgentHeartbeatInput, natsConn *nats.Conn, accountID string) (handlers_elbv2.LBAgentHeartbeatOutput, error) {
-	var output handlers_elbv2.LBAgentHeartbeatOutput
+func LBAgentHeartbeat(ctx context.Context, input *elbv2domain.LBAgentHeartbeatInput, natsConn *nats.Conn, accountID string) (elbv2domain.LBAgentHeartbeatOutput, error) {
+	var output elbv2domain.LBAgentHeartbeatOutput

 	if err := ValidateLBAgentHeartbeatInput(input); err != nil {
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.LBAgentHeartbeat(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -30,7 +30,7 @@ func ModifyListener(ctx context.Context, input *elbv2.ModifyListenerInput, natsC
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.ModifyListener(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -33,7 +33,7 @@ func ModifyRule(ctx context.Context, input *elbv2.ModifyRuleInput, natsConn *nat
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.ModifyRule(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -31,7 +31,7 @@ func ModifyTargetGroup(ctx context.Context, input *elbv2.ModifyTargetGroupInput,
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.ModifyTargetGroup(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -33,7 +33,7 @@ func RegisterTargets(ctx context.Context, input *elbv2.RegisterTargetsInput, nat
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.RegisterTargets(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -19,7 +19,7 @@ func RemoveListenerCertificates(ctx context.Context, input *elbv2.RemoveListener
 		return output, errors.New(awserrors.ErrorMissingParameter)
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.RemoveListenerCertificates(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -20,7 +20,7 @@ func RemoveTags(ctx context.Context, input *elbv2.RemoveTagsInput, natsConn *nat
 		return output, errors.New(awserrors.ErrorMissingParameter)
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.RemoveTags(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -22,7 +22,7 @@ func SetIpAddressType(ctx context.Context, input *elbv2.SetIpAddressTypeInput, n
 		return output, errors.New(awserrors.ErrorMissingParameter)
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.SetIpAddressType(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -30,7 +30,7 @@ func SetRulePriorities(ctx context.Context, input *elbv2.SetRulePrioritiesInput,
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.SetRulePriorities(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -22,7 +22,7 @@ func SetSecurityGroups(ctx context.Context, input *elbv2.SetSecurityGroupsInput,
 		return output, errors.New(awserrors.ErrorMissingParameter)
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.SetSecurityGroups(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -23,7 +23,7 @@ func SetSubnets(ctx context.Context, input *elbv2.SetSubnetsInput, natsConn *nat
 		return output, errors.New(awserrors.ErrorMissingParameter)
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.SetSubnets(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -83,7 +83,7 @@ func ValidateDescribeLoadBalancerAttributesInput(input *elbv2.DescribeLoadBalanc
 // ModifyTargetGroupAttributes implements the ELBv2 ModifyTargetGroupAttributes action, validating
 // the input and forwarding it to the NATS ELBv2 service.
 func ModifyTargetGroupAttributes(ctx context.Context, input *elbv2.ModifyTargetGroupAttributesInput, natsConn *nats.Conn, accountID string) (elbv2.ModifyTargetGroupAttributesOutput, error) {
-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	return attributeOp(input, ValidateModifyTargetGroupAttributesInput,
 		func(i *elbv2.ModifyTargetGroupAttributesInput) (*elbv2.ModifyTargetGroupAttributesOutput, error) {
 			return svc.ModifyTargetGroupAttributes(ctx, i, accountID)
@@ -93,7 +93,7 @@ func ModifyTargetGroupAttributes(ctx context.Context, input *elbv2.ModifyTargetG
 // DescribeTargetGroupAttributes implements the ELBv2 DescribeTargetGroupAttributes action,
 // validating the input and forwarding it to the NATS ELBv2 service.
 func DescribeTargetGroupAttributes(ctx context.Context, input *elbv2.DescribeTargetGroupAttributesInput, natsConn *nats.Conn, accountID string) (elbv2.DescribeTargetGroupAttributesOutput, error) {
-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	return attributeOp(input, ValidateDescribeTargetGroupAttributesInput,
 		func(i *elbv2.DescribeTargetGroupAttributesInput) (*elbv2.DescribeTargetGroupAttributesOutput, error) {
 			return svc.DescribeTargetGroupAttributes(ctx, i, accountID)
@@ -103,7 +103,7 @@ func DescribeTargetGroupAttributes(ctx context.Context, input *elbv2.DescribeTar
 // ModifyLoadBalancerAttributes implements the ELBv2 ModifyLoadBalancerAttributes action,
 // validating the input and forwarding it to the NATS ELBv2 service.
 func ModifyLoadBalancerAttributes(ctx context.Context, input *elbv2.ModifyLoadBalancerAttributesInput, natsConn *nats.Conn, accountID string) (elbv2.ModifyLoadBalancerAttributesOutput, error) {
-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	return attributeOp(input, ValidateModifyLoadBalancerAttributesInput,
 		func(i *elbv2.ModifyLoadBalancerAttributesInput) (*elbv2.ModifyLoadBalancerAttributesOutput, error) {
 			return svc.ModifyLoadBalancerAttributes(ctx, i, accountID)
@@ -113,7 +113,7 @@ func ModifyLoadBalancerAttributes(ctx context.Context, input *elbv2.ModifyLoadBa
 // DescribeLoadBalancerAttributes implements the ELBv2 DescribeLoadBalancerAttributes action,
 // validating the input and forwarding it to the NATS ELBv2 service.
 func DescribeLoadBalancerAttributes(ctx context.Context, input *elbv2.DescribeLoadBalancerAttributesInput, natsConn *nats.Conn, accountID string) (elbv2.DescribeLoadBalancerAttributesOutput, error) {
-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	return attributeOp(input, ValidateDescribeLoadBalancerAttributesInput,
 		func(i *elbv2.DescribeLoadBalancerAttributesInput) (*elbv2.DescribeLoadBalancerAttributesOutput, error) {
 			return svc.DescribeLoadBalancerAttributes(ctx, i, accountID)
@@ -10,9 +10,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elbv2"
 	"github.com/mulgadc/spinifex/internal/testkit"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
 	gateway_elbv2 "github.com/mulgadc/spinifex/spinifex/gateway/elbv2"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -139,15 +139,15 @@ func dispatchCases() []dispatchCase {
 	sslIn := &elbv2.DescribeSSLPoliciesInput{Names: []*string{aws.String("ELBSecurityPolicy-2016-08")}}
 	sslOut := elbv2.DescribeSSLPoliciesOutput{SslPolicies: []*elbv2.SslPolicy{{Name: aws.String("ELBSecurityPolicy-2016-08")}}}

-	heartbeatIn := &handlers_elbv2.LBAgentHeartbeatInput{
+	heartbeatIn := &elbv2domain.LBAgentHeartbeatInput{
 		LBID: aws.String("lb-1"),
-		Servers: []*handlers_elbv2.LBAgentServerStatus{{
+		Servers: []*elbv2domain.LBAgentServerStatus{{
 			Backend: aws.String("be1"), Server: aws.String("srv1"), Status: aws.String("UP"),
 		}},
 	}
-	heartbeatOut := handlers_elbv2.LBAgentHeartbeatOutput{Status: aws.String("ok"), ConfigHash: aws.String("h1")}
-	lbConfigIn := &handlers_elbv2.GetLBConfigInput{LBID: aws.String("lb-1")}
-	lbConfigOut := handlers_elbv2.GetLBConfigOutput{
+	heartbeatOut := elbv2domain.LBAgentHeartbeatOutput{Status: aws.String("ok"), ConfigHash: aws.String("h1")}
+	lbConfigIn := &elbv2domain.GetLBConfigInput{LBID: aws.String("lb-1")}
+	lbConfigOut := elbv2domain.GetLBConfigOutput{
 		ConfigText: aws.String("global\n"), ConfigHash: aws.String("h1"), Engine: aws.String("haproxy"),
 	}

@@ -576,7 +576,7 @@ func TestGatewayDispatch_ValidationGuards(t *testing.T) {
 			return err
 		}},
 		{"LBAgentHeartbeat/MissingLBID", awserrors.ErrorMissingParameter, func() error {
-			_, err := gateway_elbv2.LBAgentHeartbeat(context.Background(), &handlers_elbv2.LBAgentHeartbeatInput{}, nil, testAccountID)
+			_, err := gateway_elbv2.LBAgentHeartbeat(context.Background(), &elbv2domain.LBAgentHeartbeatInput{}, nil, testAccountID)
 			return err
 		}},
 		{"GetLBConfig/NilInput", awserrors.ErrorInvalidParameterValue, func() error {
@@ -584,7 +584,7 @@ func TestGatewayDispatch_ValidationGuards(t *testing.T) {
 			return err
 		}},
 		{"GetLBConfig/MissingLBID", awserrors.ErrorMissingParameter, func() error {
-			_, err := gateway_elbv2.GetLBConfig(context.Background(), &handlers_elbv2.GetLBConfigInput{}, nil, testAccountID)
+			_, err := gateway_elbv2.GetLBConfig(context.Background(), &elbv2domain.GetLBConfigInput{}, nil, testAccountID)
 			return err
 		}},
 	}
@@ -16,8 +16,8 @@ import (
 	"github.com/aws/aws-sdk-go/service/ecs"
 	"github.com/aws/aws-sdk-go/service/elbv2"
 	ec2eip "github.com/mulgadc/spinifex/spinifex/domains/ec2/eip"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"
 )
@@ -43,7 +43,7 @@ func newNATSTargetRegistrar(nc *nats.Conn) *natsTargetRegistrar {
 }

 func (r *natsTargetRegistrar) Register(ctx context.Context, accountID, tgARN, ip string, port int) error {
-	_, err := handlers_elbv2.NewNATSELBv2Service(r.nc).RegisterTargets(ctx, &elbv2.RegisterTargetsInput{
+	_, err := elbv2domain.NewNATSELBv2Service(r.nc).RegisterTargets(ctx, &elbv2.RegisterTargetsInput{
 		TargetGroupArn: aws.String(tgARN),
 		Targets:        []*elbv2.TargetDescription{{Id: aws.String(ip), Port: aws.Int64(int64(port))}},
 	}, accountID)
@@ -51,7 +51,7 @@ func (r *natsTargetRegistrar) Register(ctx context.Context, accountID, tgARN, ip
 }

 func (r *natsTargetRegistrar) Deregister(ctx context.Context, accountID, tgARN, ip string, port int) error {
-	_, err := handlers_elbv2.NewNATSELBv2Service(r.nc).DeregisterTargets(ctx, &elbv2.DeregisterTargetsInput{
+	_, err := elbv2domain.NewNATSELBv2Service(r.nc).DeregisterTargets(ctx, &elbv2.DeregisterTargetsInput{
 		TargetGroupArn: aws.String(tgARN),
 		Targets:        []*elbv2.TargetDescription{{Id: aws.String(ip), Port: aws.Int64(int64(port))}},
 	}, accountID)
@@ -64,6 +64,7 @@ import (
 	ec2vpc "github.com/mulgadc/spinifex/spinifex/domains/ec2/vpc"
 	"github.com/mulgadc/spinifex/spinifex/domains/ecr"
 	ekscluster "github.com/mulgadc/spinifex/spinifex/domains/eks/cluster"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	iamdomain "github.com/mulgadc/spinifex/spinifex/domains/iam"
 	"github.com/mulgadc/spinifex/spinifex/domains/network/external"
 	"github.com/mulgadc/spinifex/spinifex/domains/network/external/dhcp"
@@ -79,7 +80,6 @@ import (
 	"github.com/mulgadc/spinifex/spinifex/foundation/state/kvutil"
 	"github.com/mulgadc/spinifex/spinifex/foundation/telemetry"
 	handlers_ecs "github.com/mulgadc/spinifex/spinifex/handlers/ecs"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/providers/ebs"
 	"github.com/mulgadc/spinifex/spinifex/providers/objectstore"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/gpu"
@@ -165,7 +165,7 @@ type Daemon struct {
 	spotInstanceService   *ec2spotinstance.SpotInstanceServiceImpl
 	vpcService            *ec2vpc.VPCServiceImpl
 	eipService            ec2eip.EIPService
-	elbv2Service          *handlers_elbv2.ELBv2ServiceImpl
+	elbv2Service          *elbv2domain.ELBv2ServiceImpl
 	eksService            *ekscluster.EKSServiceImpl
 	ecsService            *handlers_ecs.Service
 	ecsScheduler          *handlers_ecs.Scheduler
@@ -2047,12 +2047,12 @@ func (d *Daemon) startCluster() error {
 	// the identical master key: unlike EKS/ECS's IAM dependency, there is no
 	// safe degraded mode for certificate private keys, so a missing key must
 	// fail daemon startup rather than leave HTTPS listeners uncreatable.
-	d.elbv2Service, err = initServiceWithRetry("ELBv2 service", func() (*handlers_elbv2.ELBv2ServiceImpl, error) {
+	d.elbv2Service, err = initServiceWithRetry("ELBv2 service", func() (*elbv2domain.ELBv2ServiceImpl, error) {
 		masterKey, mkErr := masterkey.ReadShared(filepath.Join(filepath.Dir(d.configPath), "master.key"))
 		if mkErr != nil {
 			return nil, fmt.Errorf("load ELBv2 master key: %w", mkErr)
 		}
-		return handlers_elbv2.NewELBv2ServiceImplWithNATS(d.config, d.natsConn, masterKey)
+		return elbv2domain.NewELBv2ServiceImplWithNATS(d.config, d.natsConn, masterKey)
 	})
 	if err != nil {
 		return fmt.Errorf("failed to initialize ELBv2 service: %w", err)
@@ -2072,7 +2072,7 @@ func (d *Daemon) startCluster() error {
 	}

 	// Route system VM launches through NATS so they fan out across the cluster.
-	d.elbv2Service.InstanceLauncher = handlers_elbv2.NewNATSSystemInstanceLauncher(d.natsConn, 0)
+	d.elbv2Service.InstanceLauncher = elbv2domain.NewNATSSystemInstanceLauncher(d.natsConn, 0)

 	// Provide a lazily-built KV-backed IAM service so an LB VM gets a system
 	// instance profile and authenticates with IMDS instance-role creds. The
@@ -10,9 +10,9 @@ import (
 	"time"

 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/systeminstance"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
 	"github.com/mulgadc/spinifex/spinifex/foundation/telemetry"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -25,8 +25,8 @@ const nodeSystemLaunchTimeout = 5 * time.Minute
 // system.LaunchInstance.{type}[.{nodeID}] replies. Either Output or Error
 // is set. Encoded as JSON so non-Go consumers stay possible later.
 type systemInstanceLaunchEnvelope struct {
-	Output *handlers_elbv2.SystemInstanceOutput `json:"output,omitempty"`
-	Error  string                               `json:"error,omitempty"`
+	Output *elbv2domain.SystemInstanceOutput `json:"output,omitempty"`
+	Error  string                            `json:"error,omitempty"`
 }

 // systemInstanceTerminateEnvelope is the wire format for
@@ -61,7 +61,7 @@ func (d *Daemon) handleSystemLaunchInstance(msg *nats.Msg) string {
 // serveSystemLaunchInstance is the synchronous body of handleSystemLaunchInstance,
 // run on a per-request goroutine.
 func (d *Daemon) serveSystemLaunchInstance(msg *nats.Msg) string {
-	input := new(handlers_elbv2.SystemInstanceInput)
+	input := new(elbv2domain.SystemInstanceInput)
 	if err := json.Unmarshal(msg.Data, input); err != nil {
 		slog.Error("system.LaunchInstance: invalid JSON payload", "subject", msg.Subject, "err", err)
 		respondWithSystemLaunchError(msg, awserrors.ErrorServerInternal)
@@ -91,7 +91,7 @@ func (d *Daemon) serveSystemLaunchInstance(msg *nats.Msg) string {
 // LaunchSystemInstanceOnNode launches a system VM on a specific host.
 // An empty nodeID or the local node runs in-process; any other node is
 // reached via system.LaunchInstance.{type}.{nodeID} — the VM stays on that node.
-func (d *Daemon) LaunchSystemInstanceOnNode(nodeID string, input *handlers_elbv2.SystemInstanceInput) (*handlers_elbv2.SystemInstanceOutput, error) {
+func (d *Daemon) LaunchSystemInstanceOnNode(nodeID string, input *elbv2domain.SystemInstanceInput) (*elbv2domain.SystemInstanceOutput, error) {
 	if nodeID == "" || nodeID == d.node {
 		return d.LaunchSystemInstance(input)
 	}
@@ -243,7 +243,7 @@ func (d *Daemon) serveSystemTerminateInstance(msg *nats.Msg) {
 	respondWithSystemTerminateOK(msg)
 }

-func respondWithSystemLaunchOutput(msg *nats.Msg, out *handlers_elbv2.SystemInstanceOutput) {
+func respondWithSystemLaunchOutput(msg *nats.Msg, out *elbv2domain.SystemInstanceOutput) {
 	payload, err := json.Marshal(systemInstanceLaunchEnvelope{Output: out})
 	if err != nil {
 		slog.Error("system.LaunchInstance: marshal output failed", "err", err)
@@ -7,8 +7,8 @@ import (
 	"time"

 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/systeminstance"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
 	"github.com/nats-io/nats.go"
 	"github.com/stretchr/testify/assert"
@@ -28,7 +28,7 @@ func TestRespondWithSystemLaunchOutput(t *testing.T) {
 	t.Cleanup(func() { _ = sub.Unsubscribe() })

 	msg := &nats.Msg{Subject: "system.LaunchInstance.sys.micro", Reply: "test.launch.ok.reply", Sub: sub}
-	out := &handlers_elbv2.SystemInstanceOutput{InstanceID: "i-abc", PrivateIP: "10.0.0.5"}
+	out := &elbv2domain.SystemInstanceOutput{InstanceID: "i-abc", PrivateIP: "10.0.0.5"}
 	msg = msgWithConn(nc, msg)

 	respondWithSystemLaunchOutput(msg, out)
@@ -36,8 +36,8 @@ func TestRespondWithSystemLaunchOutput(t *testing.T) {
 	select {
 	case payload := <-replyCh:
 		var env struct {
-			Output *handlers_elbv2.SystemInstanceOutput `json:"output,omitempty"`
-			Error  string                               `json:"error,omitempty"`
+			Output *elbv2domain.SystemInstanceOutput `json:"output,omitempty"`
+			Error  string                            `json:"error,omitempty"`
 		}
 		require.NoError(t, json.Unmarshal(payload, &env))
 		require.NotNil(t, env.Output)
@@ -287,20 +287,20 @@ func TestLaunchSystemInstanceOnNode_RemoteRoundTrip(t *testing.T) {
 	d := &Daemon{natsConn: nc, node: "node-a", natsSubscriptions: make(map[string]*nats.Subscription)}

 	// Stand in for the remote node's owning daemon on the node-targeted subject.
-	gotCh := make(chan *handlers_elbv2.SystemInstanceInput, 1)
+	gotCh := make(chan *elbv2domain.SystemInstanceInput, 1)
 	sub, err := nc.Subscribe("system.LaunchInstance.sys.medium.node-b", func(msg *nats.Msg) {
-		var in handlers_elbv2.SystemInstanceInput
+		var in elbv2domain.SystemInstanceInput
 		_ = json.Unmarshal(msg.Data, &in)
 		gotCh <- &in
 		payload, _ := json.Marshal(systemInstanceLaunchEnvelope{
-			Output: &handlers_elbv2.SystemInstanceOutput{InstanceID: "i-remote", PrivateIP: "10.0.2.7"},
+			Output: &elbv2domain.SystemInstanceOutput{InstanceID: "i-remote", PrivateIP: "10.0.2.7"},
 		})
 		_ = msg.Respond(payload)
 	})
 	require.NoError(t, err)
 	t.Cleanup(func() { _ = sub.Unsubscribe() })

-	out, err := d.LaunchSystemInstanceOnNode("node-b", &handlers_elbv2.SystemInstanceInput{
+	out, err := d.LaunchSystemInstanceOnNode("node-b", &elbv2domain.SystemInstanceInput{
 		InstanceType: "sys.medium", ImageID: "ami-x",
 	})
 	require.NoError(t, err)
@@ -329,14 +329,14 @@ func TestLaunchSystemInstanceOnNode_RemoteErrorPropagated(t *testing.T) {
 	require.NoError(t, err)
 	t.Cleanup(func() { _ = sub.Unsubscribe() })

-	_, err = d.LaunchSystemInstanceOnNode("node-b", &handlers_elbv2.SystemInstanceInput{InstanceType: "sys.medium"})
+	_, err = d.LaunchSystemInstanceOnNode("node-b", &elbv2domain.SystemInstanceInput{InstanceType: "sys.medium"})
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "insufficient capacity")
 }

 func TestLaunchSystemInstanceOnNode_RemoteWithoutConn(t *testing.T) {
 	d := &Daemon{node: "node-a"}
-	_, err := d.LaunchSystemInstanceOnNode("node-b", &handlers_elbv2.SystemInstanceInput{InstanceType: "sys.medium"})
+	_, err := d.LaunchSystemInstanceOnNode("node-b", &elbv2domain.SystemInstanceInput{InstanceType: "sys.medium"})
 	require.Error(t, err, "remote placement requires a NATS connection")
 }

@@ -459,7 +459,7 @@ func TestHandleSystemLaunchInstance_PanicRecovered(t *testing.T) {
 	require.NoError(t, err)
 	t.Cleanup(func() { _ = sub.Unsubscribe() })

-	payload, err := json.Marshal(&handlers_elbv2.SystemInstanceInput{InstanceType: "sys.medium"})
+	payload, err := json.Marshal(&elbv2domain.SystemInstanceInput{InstanceType: "sys.medium"})
 	require.NoError(t, err)
 	msg := msgWithConn(nc, &nats.Msg{
 		Subject: "system.LaunchInstance.sys.medium",
@@ -596,19 +596,19 @@ func TestLaunchSystemInstanceOnNode_Failures(t *testing.T) {
 	d := &Daemon{natsConn: nc, node: "node-a", resourceMgr: rm}

 	t.Run("local target validates the type", func(t *testing.T) {
-		_, err := d.LaunchSystemInstanceOnNode("node-a", &handlers_elbv2.SystemInstanceInput{InstanceType: "zz9.none"})
+		_, err := d.LaunchSystemInstanceOnNode("node-a", &elbv2domain.SystemInstanceInput{InstanceType: "zz9.none"})
 		assert.ErrorContains(t, err, "unknown instance type")
 	})

 	t.Run("remote without a type", func(t *testing.T) {
-		_, err := d.LaunchSystemInstanceOnNode("node-b", &handlers_elbv2.SystemInstanceInput{})
+		_, err := d.LaunchSystemInstanceOnNode("node-b", &elbv2domain.SystemInstanceInput{})
 		assert.ErrorContains(t, err, "missing InstanceType")
 		_, err = d.LaunchSystemInstanceOnNode("node-b", nil)
 		assert.ErrorContains(t, err, "missing InstanceType")
 	})

 	t.Run("remote node not listening", func(t *testing.T) {
-		_, err := d.LaunchSystemInstanceOnNode("node-gone", &handlers_elbv2.SystemInstanceInput{InstanceType: "sys.p1"})
+		_, err := d.LaunchSystemInstanceOnNode("node-gone", &elbv2domain.SystemInstanceInput{InstanceType: "sys.p1"})
 		assert.ErrorIs(t, err, nats.ErrNoResponders)
 	})

@@ -629,7 +629,7 @@ func TestLaunchSystemInstanceOnNode_Failures(t *testing.T) {
 			require.NoError(t, err)
 			t.Cleanup(func() { _ = sub.Unsubscribe() })

-			_, err = d.LaunchSystemInstanceOnNode(node, &handlers_elbv2.SystemInstanceInput{InstanceType: "sys.p1"})
+			_, err = d.LaunchSystemInstanceOnNode(node, &elbv2domain.SystemInstanceInput{InstanceType: "sys.p1"})
 			assert.ErrorContains(t, err, wantErr[name])
 		})
 	}
@@ -17,17 +17,17 @@ import (
 	"github.com/mulgadc/spinifex/contracts/ec2/v1"
 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/systeminstance"
 	ec2vpc "github.com/mulgadc/spinifex/spinifex/domains/ec2/vpc"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/domains/network/projection"
 	"github.com/mulgadc/spinifex/spinifex/domains/network/topology"
 	awsidentifiers "github.com/mulgadc/spinifex/spinifex/foundation/aws/identifiers"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/tags"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
 	hostprocess "github.com/mulgadc/spinifex/spinifex/runtime/host/process"
 )

 // Compile-time check that Daemon implements SystemInstanceLauncher.
-var _ handlers_elbv2.SystemInstanceLauncher = (*Daemon)(nil)
+var _ elbv2domain.SystemInstanceLauncher = (*Daemon)(nil)

 // resolveENIAccount returns owner when set, else fallback. A cross-account ENI
 // (e.g. an EKS cluster NLB fronting a customer-VPC ENI) carries its own account;
@@ -80,7 +80,7 @@ func (d *Daemon) attachExtraENI(eniAccountID string, extra systeminstance.ExtraE
 // customer DescribeInstances calls, and always boots via direct kernel boot
 // (bundled vmlinuz+initramfs, fw_cfg-delivered config). There is no AMI,
 // volume, or cloud-init path.
-func (d *Daemon) LaunchSystemInstance(input *handlers_elbv2.SystemInstanceInput) (*handlers_elbv2.SystemInstanceOutput, error) {
+func (d *Daemon) LaunchSystemInstance(input *elbv2domain.SystemInstanceInput) (*elbv2domain.SystemInstanceOutput, error) {
 	if input.BootMode == systeminstance.BootAMI {
 		return d.launchAMISystemInstance(input)
 	}
@@ -229,7 +229,7 @@ func (d *Daemon) LaunchSystemInstance(input *handlers_elbv2.SystemInstanceInput)
 	// DescribeAddresses and their provisioning flow hangs. Falls back to
 	// direct IPAM allocation for daemons where the EIP service isn't wired.
 	publicIP := ""
-	if input.Scheme == handlers_elbv2.SchemeInternetFacing && d.vpcService != nil && instance.ENIId != "" {
+	if input.Scheme == elbv2domain.SchemeInternetFacing && d.vpcService != nil && instance.ENIId != "" {
 		if d.eipService != nil {
 			allocOut, allocErr := d.eipService.AllocateAddress(context.Background(), &ec2.AllocateAddressInput{}, eniAccountID)
 			if allocErr != nil {
@@ -349,7 +349,7 @@ func (d *Daemon) LaunchSystemInstance(input *handlers_elbv2.SystemInstanceInput)

 		mgmtIP, allocErr := d.mgmtIPAllocator.Allocate(instance.ID)
 		if allocErr != nil {
-			if input.Scheme == handlers_elbv2.SchemeInternal {
+			if input.Scheme == elbv2domain.SchemeInternal {
 				d.cleanupFailedSystemInstance(instance, instanceType)
 				return nil, fmt.Errorf("allocate mgmt IP for internal-scheme ALB: %w", allocErr)
 			}
@@ -372,7 +372,7 @@ func (d *Daemon) LaunchSystemInstance(input *handlers_elbv2.SystemInstanceInput)
 				d.mgmtIPAllocator.Release(instance.ID)
 				instance.MgmtMAC = ""
 				instance.MgmtIP = ""
-				if input.Scheme == handlers_elbv2.SchemeInternal {
+				if input.Scheme == elbv2domain.SchemeInternal {
 					d.cleanupFailedSystemInstance(instance, instanceType)
 					return nil, fmt.Errorf("setup mgmt tap for internal-scheme ALB: %w", tapErr)
 				}
@@ -417,7 +417,7 @@ func (d *Daemon) LaunchSystemInstance(input *handlers_elbv2.SystemInstanceInput)
 		"scheme", input.Scheme,
 	)

-	return &handlers_elbv2.SystemInstanceOutput{
+	return &elbv2domain.SystemInstanceOutput{
 		InstanceID: instance.ID,
 		PrivateIP:  privateIP,
 		PublicIP:   publicIP,
@@ -681,7 +681,7 @@ func (d *Daemon) refreshSystemInstanceState(inst *vm.VM) error {
 	if d.elbv2Service == nil {
 		return fmt.Errorf("elbv2 service unavailable: cannot refresh fw_cfg blobs for system VM %s", inst.ID)
 	}
-	ctx := handlers_elbv2.RecoveryContext{
+	ctx := elbv2domain.RecoveryContext{
 		InstanceID:   inst.ID,
 		InstanceType: inst.InstanceType,
 		ENIMac:       inst.ENIMac,
@@ -781,7 +781,7 @@ func (d *Daemon) WaitForSystemInstance(instanceID string, timeout time.Duration)
 //
 // Network topology from input.NICs is serialised to three fw_cfg tmpfiles
 // (netcfg, lb-agent-env, ca-cert) under hostprocess.RuntimeDir().
-func (d *Daemon) buildDirectBootConfig(instanceID string, input *handlers_elbv2.SystemInstanceInput) (vm.Config, error) {
+func (d *Daemon) buildDirectBootConfig(instanceID string, input *elbv2domain.SystemInstanceInput) (vm.Config, error) {
 	it := d.resourceMgr.instanceTypes[input.InstanceType]
 	architecture := "x86_64"
 	if it != nil && it.ProcessorInfo != nil && len(it.ProcessorInfo.SupportedArchitectures) > 0 && it.ProcessorInfo.SupportedArchitectures[0] != nil {
@@ -879,7 +879,7 @@ func microvmMachineType() string {
 // net1 = mgmt (if present), net2+ = extra ENIs. Extra ENIs beyond the primary
 // are only included when corresponding ExtraENIs entries exist. A gap at
 // net1 (single-node hosts with no br-mgmt) is expected and fine for QEMU.
-func buildNICNetdevs(instanceID string, input *handlers_elbv2.SystemInstanceInput, machineType string, guestMTU int) nicNetdevResult {
+func buildNICNetdevs(instanceID string, input *elbv2domain.SystemInstanceInput, machineType string, guestMTU int) nicNetdevResult {
 	var res nicNetdevResult

 	for i, nic := range input.NICs {
@@ -903,13 +903,13 @@ func buildNICNetdevs(instanceID string, input *handlers_elbv2.SystemInstanceInpu
 // launch (LaunchSystemInstance); single-node hosts without br-mgmt leave it
 // blank, so it must be excluded from netdevs, mmio slots, and guest config —
 // not just any empty-MAC NIC, only this specific, expected slot.
-func nicProvisioned(i int, nic handlers_elbv2.NICConfig) bool {
+func nicProvisioned(i int, nic elbv2domain.NICConfig) bool {
 	return i != 1 || nic.MAC != ""
 }

 // tapNameForNIC returns the Linux tap device name for a NIC at the given index.
 // Index 0 → primary ENI tap, index 1 → mgmt tap, index 2+ → extra ENI taps.
-func tapNameForNIC(idx int, _ handlers_elbv2.NICConfig, instanceID string, input *handlers_elbv2.SystemInstanceInput) string {
+func tapNameForNIC(idx int, _ elbv2domain.NICConfig, instanceID string, input *elbv2domain.SystemInstanceInput) string {
 	switch idx {
 	case 0:
 		return vm.TapDeviceName(input.ENIID)
@@ -928,7 +928,7 @@ func tapNameForNIC(idx int, _ handlers_elbv2.NICConfig, instanceID string, input
 // per-VM tmpfiles under hostprocess.RuntimeDir(). Returns the fw_cfg entries for the
 // three blobs and an error if any write fails or the NIC default invariant is
 // violated.
-func (d *Daemon) writeFwCfgBlobs(instanceID string, input *handlers_elbv2.SystemInstanceInput) ([]vm.FwCfgEntry, error) {
+func (d *Daemon) writeFwCfgBlobs(instanceID string, input *elbv2domain.SystemInstanceInput) ([]vm.FwCfgEntry, error) {
 	runtimeDir := hostprocess.RuntimeDir()

 	netcfgPath := filepath.Join(runtimeDir, fmt.Sprintf("fwcfg-%s-netcfg.tmp", instanceID))
@@ -938,7 +938,7 @@ func (d *Daemon) writeFwCfgBlobs(instanceID string, input *handlers_elbv2.System
 	// Exclude any unprovisioned mgmt NIC so the guest is only ever told about
 	// interfaces that physically exist — mirrors the netdev/mmio-slot skip
 	// in buildNICNetdevs/buildDirectBootConfig.
-	provisionedNICs := make([]handlers_elbv2.NICConfig, 0, len(input.NICs))
+	provisionedNICs := make([]elbv2domain.NICConfig, 0, len(input.NICs))
 	for i, nic := range input.NICs {
 		if nicProvisioned(i, nic) {
 			provisionedNICs = append(provisionedNICs, nic)
@@ -981,7 +981,7 @@ func (d *Daemon) writeFwCfgBlobs(instanceID string, input *handlers_elbv2.System
 // buildNetcfgBlob serialises a slice of NICConfig entries to the shell KEY=value
 // format consumed by the initramfs init script. Exactly one NIC must have
 // IsDefault=true; returns an error otherwise.
-func buildNetcfgBlob(nics []handlers_elbv2.NICConfig) (string, error) {
+func buildNetcfgBlob(nics []elbv2domain.NICConfig) (string, error) {
 	defaultCount := 0
 	for _, n := range nics {
 		if n.IsDefault {
@@ -17,9 +17,9 @@ import (
 	ec2instance "github.com/mulgadc/spinifex/spinifex/domains/ec2/instance"
 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/systeminstance"
 	ec2vpc "github.com/mulgadc/spinifex/spinifex/domains/ec2/vpc"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/domains/network/external"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/tags"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/providers/ebs"
 	"github.com/mulgadc/spinifex/spinifex/providers/objectstore"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
@@ -90,15 +90,15 @@ func (f *sysInstFixture) newENI(t *testing.T) *ec2.NetworkInterface {

 // input returns a direct-boot launch on a pre-created customer ENI with a
 // valid single-NIC network config.
-func (f *sysInstFixture) input(eni *ec2.NetworkInterface) *handlers_elbv2.SystemInstanceInput {
-	return &handlers_elbv2.SystemInstanceInput{
+func (f *sysInstFixture) input(eni *ec2.NetworkInterface) *elbv2domain.SystemInstanceInput {
+	return &elbv2domain.SystemInstanceInput{
 		InstanceType: f.itype,
 		SubnetID:     f.subnetID,
 		AccountID:    testAccountID,
 		ENIID:        aws.StringValue(eni.NetworkInterfaceId),
 		ENIMac:       aws.StringValue(eni.MacAddress),
 		ENIIP:        aws.StringValue(eni.PrivateIpAddress),
-		NICs:         []handlers_elbv2.NICConfig{{MAC: aws.StringValue(eni.MacAddress), CIDR: "10.81.1.5/24", IsDefault: true}},
+		NICs:         []elbv2domain.NICConfig{{MAC: aws.StringValue(eni.MacAddress), CIDR: "10.81.1.5/24", IsDefault: true}},
 	}
 }

@@ -172,7 +172,7 @@ func (s *sysInstReclaimingEIP) ReleaseAddressByInstanceID(id string) error {

 func TestLaunchSystemInstance_EarlyErrors(t *testing.T) {
 	t.Run("BootAMI dispatches to the AMI path", func(t *testing.T) {
-		_, err := (&Daemon{}).LaunchSystemInstance(&handlers_elbv2.SystemInstanceInput{BootMode: systeminstance.BootAMI})
+		_, err := (&Daemon{}).LaunchSystemInstance(&elbv2domain.SystemInstanceInput{BootMode: systeminstance.BootAMI})
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "instance service not initialized")
 	})
@@ -181,7 +181,7 @@ func TestLaunchSystemInstance_EarlyErrors(t *testing.T) {
 	itype := getTestInstanceType(t)

 	t.Run("unknown instance type", func(t *testing.T) {
-		_, err := d.LaunchSystemInstance(&handlers_elbv2.SystemInstanceInput{InstanceType: "zz9.none"})
+		_, err := d.LaunchSystemInstance(&elbv2domain.SystemInstanceInput{InstanceType: "zz9.none"})
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "unknown instance type: zz9.none")
 	})
@@ -197,7 +197,7 @@ func TestLaunchSystemInstance_EarlyErrors(t *testing.T) {
 			d.resourceMgr.mu.Unlock()
 		})

-		_, err := d.LaunchSystemInstance(&handlers_elbv2.SystemInstanceInput{InstanceType: itype})
+		_, err := d.LaunchSystemInstance(&elbv2domain.SystemInstanceInput{InstanceType: itype})
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "insufficient capacity for "+itype)
 	})
@@ -214,7 +214,7 @@ func TestLaunchSystemInstance_EarlyErrors(t *testing.T) {
 		before := d.resourceMgr.allocatedVCPU
 		d.resourceMgr.mu.Unlock()

-		_, err := d.LaunchSystemInstance(&handlers_elbv2.SystemInstanceInput{InstanceType: itype})
+		_, err := d.LaunchSystemInstance(&elbv2domain.SystemInstanceInput{InstanceType: itype})
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "create instance")

@@ -320,10 +320,10 @@ func TestLaunchSystemInstance_AutoCreateENI(t *testing.T) {
 	sysInstLaunchRuns(d)

 	t.Run("creates and attaches an ENI in the system account", func(t *testing.T) {
-		out, err := d.LaunchSystemInstance(&handlers_elbv2.SystemInstanceInput{
+		out, err := d.LaunchSystemInstance(&elbv2domain.SystemInstanceInput{
 			InstanceType: f.itype,
 			SubnetID:     f.sysSubnetID,
-			NICs:         []handlers_elbv2.NICConfig{{MAC: "02:00:00:00:00:01", IsDefault: true}},
+			NICs:         []elbv2domain.NICConfig{{MAC: "02:00:00:00:00:01", IsDefault: true}},
 		})
 		require.NoError(t, err)
 		assert.True(t, strings.HasPrefix(out.PrivateIP, "10.82.1."), "private IP %q must come from the subnet", out.PrivateIP)
@@ -337,7 +337,7 @@ func TestLaunchSystemInstance_AutoCreateENI(t *testing.T) {
 	})

 	t.Run("unknown subnet", func(t *testing.T) {
-		_, err := d.LaunchSystemInstance(&handlers_elbv2.SystemInstanceInput{
+		_, err := d.LaunchSystemInstance(&elbv2domain.SystemInstanceInput{
 			InstanceType: f.itype,
 			SubnetID:     "subnet-madeup",
 		})
@@ -350,9 +350,9 @@ func TestLaunchSystemInstance_EIPService(t *testing.T) {
 	f := newSysInstFixture(t)
 	d := f.d

-	internetFacing := func(t *testing.T) *handlers_elbv2.SystemInstanceInput {
+	internetFacing := func(t *testing.T) *elbv2domain.SystemInstanceInput {
 		in := f.input(f.newENI(t))
-		in.Scheme = handlers_elbv2.SchemeInternetFacing
+		in.Scheme = elbv2domain.SchemeInternetFacing
 		return in
 	}
 	allocated := &ec2.AllocateAddressOutput{
@@ -437,7 +437,7 @@ func TestLaunchSystemInstance_IPAM(t *testing.T) {
 		t.Cleanup(func() { _ = sub.Unsubscribe() })

 		in := f.input(f.newENI(t))
-		in.Scheme = handlers_elbv2.SchemeInternetFacing
+		in.Scheme = elbv2domain.SchemeInternetFacing
 		out, err := d.LaunchSystemInstance(in)
 		require.NoError(t, err)
 		require.True(t, strings.HasPrefix(out.PublicIP, "198.51.100."), "public IP %q must come from the pool", out.PublicIP)
@@ -456,7 +456,7 @@ func TestLaunchSystemInstance_IPAM(t *testing.T) {
 		})

 		in := f.input(f.newENI(t))
-		in.Scheme = handlers_elbv2.SchemeInternetFacing
+		in.Scheme = elbv2domain.SchemeInternetFacing
 		_, err := d.LaunchSystemInstance(in)
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "allocate public IP for internet-facing ALB")
@@ -480,13 +480,13 @@ func TestLaunchSystemInstance_MgmtNIC(t *testing.T) {
 		wantMgmt  bool
 		wantAlloc int
 	}{
-		{name: "internal allocate error", scheme: handlers_elbv2.SchemeInternal, alloc: sysInstUnboundMgmtAllocator,
+		{name: "internal allocate error", scheme: elbv2domain.SchemeInternal, alloc: sysInstUnboundMgmtAllocator,
 			wantErr: "allocate mgmt IP for internal-scheme ALB"},
 		{name: "internet-facing allocate error continues", scheme: "", alloc: sysInstUnboundMgmtAllocator},
-		{name: "internal tap error", scheme: handlers_elbv2.SchemeInternal, tapErr: tapErr,
+		{name: "internal tap error", scheme: elbv2domain.SchemeInternal, tapErr: tapErr,
 			wantErr: "setup mgmt tap for internal-scheme ALB"},
 		{name: "internet-facing tap error continues", scheme: "", tapErr: tapErr},
-		{name: "success", scheme: handlers_elbv2.SchemeInternal, wantMgmt: true, wantAlloc: 1},
+		{name: "success", scheme: elbv2domain.SchemeInternal, wantMgmt: true, wantAlloc: 1},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
@@ -503,7 +503,7 @@ func TestLaunchSystemInstance_MgmtNIC(t *testing.T) {

 			in := f.input(f.newENI(t))
 			in.Scheme = tc.scheme
-			in.NICs = append(in.NICs, handlers_elbv2.NICConfig{})
+			in.NICs = append(in.NICs, elbv2domain.NICConfig{})

 			out, err := d.LaunchSystemInstance(in)
 			if tc.wantErr != "" {
@@ -792,10 +792,10 @@ func TestBuildDirectBootConfig_InstanceTypeShape(t *testing.T) {
 	it := rm.instanceTypes[itype]
 	d := &Daemon{resourceMgr: rm}

-	cfg, err := d.buildDirectBootConfig("i-shape", &handlers_elbv2.SystemInstanceInput{
+	cfg, err := d.buildDirectBootConfig("i-shape", &elbv2domain.SystemInstanceInput{
 		InstanceType: itype,
 		ENIID:        "eni-shape",
-		NICs:         []handlers_elbv2.NICConfig{{MAC: "02:00:00:00:00:02", IsDefault: true}},
+		NICs:         []elbv2domain.NICConfig{{MAC: "02:00:00:00:00:02", IsDefault: true}},
 	})
 	require.NoError(t, err)
 	assert.Equal(t, int(instanceTypeVCPUs(it)), cfg.CPUCount)
@@ -809,8 +809,8 @@ func TestBuildDirectBootConfig_FwCfgWriteError(t *testing.T) {
 	require.NoError(t, os.WriteFile(notADir, nil, 0o600))
 	t.Setenv("XDG_RUNTIME_DIR", notADir)

-	_, err := (&Daemon{resourceMgr: &ResourceManager{}}).buildDirectBootConfig("i-werr", &handlers_elbv2.SystemInstanceInput{
-		NICs: []handlers_elbv2.NICConfig{{MAC: "02:00:00:00:00:03", IsDefault: true}},
+	_, err := (&Daemon{resourceMgr: &ResourceManager{}}).buildDirectBootConfig("i-werr", &elbv2domain.SystemInstanceInput{
+		NICs: []elbv2domain.NICConfig{{MAC: "02:00:00:00:00:03", IsDefault: true}},
 	})
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "write fw_cfg blobs")
@@ -819,8 +819,8 @@ func TestBuildDirectBootConfig_FwCfgWriteError(t *testing.T) {
 // A directory at a blob's path fails that write; the blobs written before it
 // must be removed so no partial fw_cfg set is left behind.
 func TestWriteFwCfgBlobs_LaterWriteErrorsCleanUp(t *testing.T) {
-	input := &handlers_elbv2.SystemInstanceInput{
-		NICs: []handlers_elbv2.NICConfig{{MAC: "02:00:00:00:00:04", IsDefault: true}},
+	input := &elbv2domain.SystemInstanceInput{
+		NICs: []elbv2domain.NICConfig{{MAC: "02:00:00:00:00:04", IsDefault: true}},
 	}
 	for _, blob := range []string{"lbenv", "cacert"} {
 		t.Run(blob, func(t *testing.T) {
--- a/Show More
+++ b/Show More