# Package-boundary migration record

**Status:** Active implementation record.
**Decision:** [Mulga ADR-0001 — Spinifex Package Boundary and Layout](https://github.com/mulgadc/mulga/blob/main/docs/adr/0001-spinifex-package-boundary-layout.md).
**Scope:** Spinifex source layout only. This record does not establish a new
architecture decision, expand a customer-facing interface, or claim that the
current implementation conforms to the target layout.

## Purpose

This document records the implementation sequence for ADR-0001 in this
repository. The ADR owns the target layout and dependency rules; this record
captures the source-level entry-point inventory and the evidence needed for
each narrow structural slice.

The migration proceeds on one long-lived refactor branch. Each commit remains
small, independently buildable and reviewable; that does not require one pull
request per package move.

## Baseline

The inventory below was taken from Spinifex commit
`ecef5e4d2f793b4cf2c96d0a43d0a1ab37be3eed`, the revision pinned by Mulga when
ADR-0001 was accepted. It records ownership standing, not a promise that a
binary or script is AWS-compatible or supported beyond its documented scope.

## Entry-point and automation inventory

### Product operator and delivery entry points

| Current path | Standing | Target ownership | Migration rule |
|---|---|---|---|
| `cmd/spinifex` (`spx`) | Supported operator process | Thin main; command assembly in `spinifex/operator/cli` and individual supported use cases in `spinifex/operator/*` | Preserve binary and supported command compatibility. The CLI must reach a domain through an explicit capability, never its private state. |
| `cmd/installer` | Delivery executable | Thin main; interactive, unattended and host-installation work in `spinifex/operator/installer` | Preserve installation behaviour while separating executable startup from delivery logic. It is not, merely by existing, the permanent administration interface. |

`cmd/spinifex/cmd` and `cmd/installer/*` have since moved: commits `05f390e61`
and `918150758` below separate each executable's startup from its command and
installation logic, landing them in `spinifex/operator/cli` and
`spinifex/operator/installer/<same>`.

### Guest and named-role entry points

| Current path | Standing | Target ownership | Evidence of role boundary |
|---|---|---|---|
| `cmd/ecs-agent` | ECS guest agent | Thin main; `spinifex/agents/ecs/agent` | Baked into ECS node images; communicates with the control plane through the AWS gateway, not NATS. |
| `cmd/rds-agent` | RDS guest agent | Thin main; `spinifex/agents/rds/agent` | Runs in an RDS guest, handles bootstrap and engine directives through the gateway. |
| `cmd/lb-agent` | ELBv2 guest agent | Thin main; `spinifex/agents/elbv2` | Included in the load-balancer microVM and controls its local data plane. |
| `cmd/eks-token-webhook` | EKS control-plane guest role | Thin main; `spinifex/agents/eks/tokenwebhook` | Baked into the EKS node image as the Kubernetes TokenReview webhook. |
| `cmd/eks-gateway-fetch` | EKS control-plane guest helper | Thin main; `spinifex/agents/eks/gatewayfetch` | Fetches recovery and addon state through the AWS gateway. |
| `cmd/eks-gateway-publish` | EKS control-plane guest helper | Thin main; `spinifex/agents/eks/gatewaypublish` | Relays bootstrap and state reports through the AWS gateway. |
| `cmd/eks-webhook-cert` | EKS image-resident certificate helper | Thin main; `spinifex/agents/eks/webhookcert` | Invoked by EKS image scripts to create/reuse webhook serving certificates. |
| `cmd/eks-konnectivity-cert` | EKS image-resident certificate helper | Thin main; `spinifex/agents/eks/konnectivitycert` | Invoked by EKS image scripts to create/reuse Konnectivity serving certificates. |
| `cmd/ecr-credential-provider` | EKS node integration | Thin main; `spinifex/agents/eks/credentialprovider` | Kubelet exec credential provider baked into EKS images; it is not ECR control-plane ownership. |

No common agent package is introduced by this inventory. Shared mechanisms are
considered only when the existing role and least-privilege boundaries remain
intact; ADR-0001 explicitly defers that design.

### Development and qualification entry points

| Current path | Standing | Target ownership | Rule |
|---|---|---|---|
| `cmd/aws-model-coverage` | Qualification generator | Thin main; reusable code in `internal/tooling` | Produces the dispatch-versus-model inventory; never imported by product packages. |
| `cmd/dhcptest` | Development diagnostic | Thin main; reusable code in `internal/tooling` if extraction is useful | It is a DHCP probe, not a supported `spx admin` command. |
| `cmd/spx-loadgen` | Qualification/load tool | Thin main; reusable code in `internal/testkit` | It drives test load and is not shipped to nodes. |
| `tests/e2e/*/cmd/*`, `tests/bench/*/cmd/*` | Test and benchmark-private tools | Remain test-private | They are invoked by a test or benchmark harness, not a product process. |
| `docs/terraform-workbooks/demo-app/main.go` | Demonstration workload | Remain with the workbook | It is neither a Spinifex executable nor a product package. |

### Automation standing

| Path class | Standing | Rule during migration |
|---|---|---|
| `.github/scripts/` | CI-private qualification automation | Keep at the module root; the invoking workflow owns the evidence scope. |
| `build/`, `images/`, `scripts/images/`, image build and publish scripts | Delivery and guest-image inputs | Keep at the module root. In-guest helpers stay with their image; do not relocate shell sources into Go packages. |
| `scripts/setup.sh`, `setup-ovn.sh`, `install-node.sh`, `node-reset.sh`, `uninstall-spx.sh` | Transitional delivery and documented host-operation mechanics | Keep at the module root. They may implement a published procedure but are not an enduring public administration API solely because they are installed on a node. |
| `scripts/dev-env/`, `scripts/demo/`, benchmarks, diagnostics and Terraform experiments | Development or exploratory automation | Keep at the module root; they are not customer-facing contracts. |
| `scripts/check-coverage.sh`, `diff-coverage.sh`, `run-gate.sh`, `sync-aws-models.sh` and test harness scripts | Repository and qualification automation | Keep at the module root; their caller defines the contract and evidence. |

## First source move — ARN

The first source move is the cohesive ARN leaf package:

- old import path: `github.com/mulgadc/spinifex/spinifex/arn`
- target import path: `github.com/mulgadc/spinifex/spinifex/foundation/aws/arn`

Source commit `91ac70e29` moves the ten package files and updates all forty-four
Go importers. It changes no behaviour and leaves no forwarding package.

Verification passed with an isolated Go module/build cache:

- `go test ./spinifex/foundation/aws/arn`
- `go test` for the fourteen packages directly importing ARN
- a Go-source search for the old import path returned no matches
- `git diff --check`

The inventory was intentionally committed before this move so a later
thin-main refactor cannot silently choose an owner by convenience.

## Second source move — AWS filters

The second source move removes the generic `filterutil` location and name:

- old import path: `github.com/mulgadc/spinifex/spinifex/filterutil`
- target import path: `github.com/mulgadc/spinifex/spinifex/foundation/aws/filters`

Source commit `e707be942` moves the two package files, renames the Go package
to `filters`, and updates twenty-eight importing files. Callers use the
explicit import alias `awsfilters`: many filter implementations already hold
a local `filters` value, and the alias prevents a package-name collision
without changing that local state or any filter behaviour.

Verification passed with an isolated Go module/build cache:

- `go test ./spinifex/foundation/aws/filters`
- `go test` for the seventeen direct caller packages
- a Go-source search for the old import path returned no matches
- `git diff --check`

## Third source move — AWS Query parser

The third source move names the protocol concern rather than the first service
that happened to use it:

- old import path: `github.com/mulgadc/spinifex/spinifex/awsec2query`
- target import path: `github.com/mulgadc/spinifex/spinifex/ingress/aws/query`

Source commit `caaf98d9e` moves the two parser files, renames the Go package to
`query`, and updates thirteen importing files. The parser is used across EC2,
IAM, STS, ECS, ECR, ELBv2 and RDS, but owns only AWS Query wire decoding and no
service action or resource semantics.

Verification passed with an isolated Go module/build cache:

- `go test ./spinifex/ingress/aws/query`
- `go test -run '^$'` for six direct caller packages
- a Go-source search for the old import path returned no matches
- `git diff --check`

A broad `go test` run over those caller packages was stopped after two minutes
without output. It is not recorded as a passing test; the normal full suite
remains CI evidence for the branch.

## Subsequent source moves

The following slices follow the same rule as the first three: each is a
structural move with import rewrites, no compatibility shim, focused package
and direct-caller validation, and `git diff --check`. They are recorded here
while the branch is in flight; they do not describe the umbrella repository's
`main` until its Spinifex gitlink is updated.

| Source commit | Old path | New path | Finding or boundary recorded |
|---|---|---|---|
| `04b41a62c` | `spinifex/idempotency` | `spinifex/foundation/lifecycle/idempotency` | Generic request coalescing is lifecycle infrastructure, not a domain owner. |
| `25fa01a3d` | `spinifex/preflight` | `spinifex/bootstrap/preflight` | Startup validation is bootstrap input, not a generic service. |
| `681fccc61` | `spinifex/systemd` | `spinifex/operator/host/systemd` | Host unit generation and reconciliation are operator-host work. |
| `23ca5d8aa` | `spinifex/resource` | `spinifex/foundation/lifecycle/resource` | Resource metadata is a generic lifecycle primitive. |
| `7a3c8de07` | `spinifex/nbd` | `spinifex/runtime/compute/nbd` | NBD process control is node-local compute runtime. |
| `ea65616be` | `spinifex/hostdns` | `spinifex/runtime/host/dns` | Host resolver integration is runtime host work. |
| `d80803807` | `spinifex/qmp` | `spinifex/runtime/compute/qmp` | QMP is local VM runtime control. |
| `41e2c1f10` | `spinifex/gpu` | `spinifex/runtime/compute/gpu` | GPU discovery and attachment are local compute runtime work. |
| `d78246d05` | `spinifex/instancetypes` | `spinifex/domains/ec2/instancetypes` | AWS-visible instance-type semantics belong to EC2. |
| `b2ce46124` | `spinifex/service` | `spinifex/runtime/service` | The named-role catalogue is runtime composition. |
| `573ee6761` | `spinifex/loadgen` | `internal/testkit/loadgen` | Load generation is qualification support, not product code. |
| `afdb6618c` | `spinifex/otelsetup` | `spinifex/foundation/telemetry` | Spinifex instrumentation primitives are shared telemetry foundation. |
| `956fe1490` | `spinifex/awserrors` | `spinifex/foundation/aws/errors` | AWS error vocabulary is shared AWS foundation. |
| `cbbf252e6` | `spinifex/testutil` | `internal/testkit` | Test doubles remain compiler-private and cannot become application dependencies. |
| `0c2d64413` | `spinifex/vm` | `spinifex/runtime/compute/vm` | VM lifecycle is node-local compute runtime, not EC2 API ownership. |
| `a74adc48b` | `spinifex/ebsmetadata` | `spinifex/domains/ec2/ebs/metadata` | EBS API metadata remains EC2-domain state. |
| `94ddc91a1` | `spinifex/ebsprovider` | `spinifex/providers/ebs` | The provider contract and conformance suite are replaceable storage adapters. |
| `3c1bce1eb` | `spinifex/cloud/oci` | `spinifex/providers/cloud/oci` | OCI access is a replaceable cloud-provider adapter. |
| `56970d079` | `spinifex/services/nats` | `spinifex/runtime/roles/nats` | NATS process startup is a named runtime role. |
| `d87326f64` | `spinifex/network/listenerinventory` | `internal/testkit/listenerinventory` | Listener inventory is test-only qualification support. |
| `4d4875b13` | `spinifex/services/spinifexui` | `spinifex/runtime/roles/spinifexui` | The web UI is a named runtime role, not a logical AWS domain. |
| `f39bc64c9` | `spinifex/admin` listener helpers | `spinifex/foundation/netaddr` | Listener-address parsing is a small shared network primitive. |
| `9e8e889fb` | `spinifex/services/qemunbdd` | `spinifex/runtime/roles/qemunbdd` | QEMU-NBD provider process startup is a runtime role. |
| `3494ae131` | `spinifex/services/qmpcollector` | `spinifex/runtime/roles/qmpcollector` | QMP collection is a named runtime role. |
| `f64931546` | `spinifex/services/spinifex` | `spinifex/runtime/roles/spinifex` | The core daemon executable role is runtime composition. |
| `57f238a0c` | `spinifex/tags` | `spinifex/foundation/aws/tags` | System-tag vocabulary is shared AWS foundation. |
| `7a6b00728`, `186ef7ebc` | `spinifex/kvutil` | `spinifex/foundation/state/kvutil` | Replica policy was made explicit before moving generic KV utilities to state foundation. |
| `57f9d2ccc` | `spinifex/kvstore` | `spinifex/foundation/state/kvstore` | Generic KV storage mechanics are state foundation. |
| `247e52ba3` | `spinifex/reconciler` | `spinifex/foundation/lifecycle/reconciler` | Generic reconciliation mechanics are lifecycle foundation. |
| `b1d0eba89` | inline KV migration mechanics | `spinifex/foundation/state/migrate` | KV migration is a reusable state concern. |
| `967f6904a` | `spinifex/kvlease` | `spinifex/foundation/state/kvlease` | Leases are state foundation, not a resource-domain owner. |
| `248f0e005`, `8c4af3030` | `spinifex/formation` | `spinifex/runtime/formation` | Formation owns its protocol payloads and remains runtime membership/bootstrap work. |
| `b8b97279c`, `c0c64cd53` | `spinifex/instancecache` | `spinifex/runtime/compute/cache` | Cache policy is decoupled from callers before becoming node-local compute runtime. |
| `aa0c36ff4` | `spinifex/types/ec2.go` | `contracts/ec2/v1` | The EC2 instance-command subject and JSON payload are an explicit versioned cross-process contract; `commands_test.go` is its compatibility evidence. |
| `60c9ed47d` | `spinifex/types/types.go` (`IGWEvent`) | `contracts/ec2/v1/igw.go` (`InternetGatewayEvent`, `InternetGatewayAttachSubject`, `InternetGatewayDetachSubject`) | The EC2-to-network internet-gateway attach/detach projection on `vpc.igw-attach`/`vpc.igw-detach` is an explicit versioned cross-process contract; `igw_test.go` pins its subject and JSON shape. |
| `c239fd897` | `spinifex/types/eni.go` | `spinifex/runtime/compute/vm/eni_requests.go` | PCIe hot-plug slot allocation is mutex-bearing, per-VM runtime state rather than a shared type or wire contract; `record_test.go` preserves its restart semantics. |
| `b49e55a58` | `spinifex/types/node.go` (`NodeDiscoverResponse`) | `contracts/cluster/v1/discovery.go` (`NodeDiscoverResponse`, `NodesDiscoverSubject`) | Fan-out node-membership discovery on `spinifex.nodes.discover` is a versioned cluster control-plane contract; `discovery_test.go` pins its subject and JSON shape. |
| `6d6275e78` | `spinifex/types/cluster.go` (`NodeHealthResponse`) | `contracts/cluster/v1/health.go` | Node health is a versioned cluster control-plane representation shared by the per-node NATS route and daemon HTTPS `/health`; `health_test.go` pins both wire forms. |
| `53a614717` | `spinifex/types/cluster.go` (`SharedClusterData`) | `spinifex/daemon/config_hash.go` | Shared-config hash input is daemon-local implementation data; focused config-hash tests preserve deterministic, shared-only semantics. |
| `5d88a3399` | `spinifex/types/storage.go` | `contracts/operator/v1/storage.go` (`StorageConfigResponse`, `StorageEncoding`, `StorageMetaNode`, `StorageBlobNode`, `StorageBucket`) | The `spinifex.storage.config` operator-plane response describing Predastore topology is a deployment-administration contract, not an AWS tenant-facing API; `storage_test.go` pins its subject and JSON shape. |
| `78fd017e0` | `spinifex/types/telemetry.go` (`GuestTelemetryMeta`) | `contracts/telemetry/v1/guest_meta.go` | QMP collector sidecar JSON is a versioned file contract between VM runtime and telemetry role; `guest_meta_test.go` pins its filename and payload. |
| `4b35a2a33` | `spinifex/types/node.go` (`NodeVMsResponse`, `VMInfo`, `VMGPUInfo`) | `contracts/cluster/v1/node_vms.go` | VM inventory is a versioned cluster fan-out payload used by SPX CLI and EKS host lookup; `node_vms_test.go` pins its subject and JSON shape. |
| `08bd335f0` | `spinifex/types/node.go` (`NodeStatusResponse`, capacity and GPU inventory) | `contracts/cluster/v1/status.go` | Node status is a versioned fan-out observation contract for operator inspection and EC2/EKS scheduling consumers; `status_test.go` pins its subject and JSON shape. |
| `f4cb550c9` | `spinifex/types/ebs.go` (GP3 policy constants) | `spinifex/domains/ec2/ebs/policy/gp3.go` | The supported GP3 product envelope is EC2 EBS domain policy, not generic runtime or Viperblockd wire state; `gp3_test.go` pins the deployed values. |
| `adb55de33` | `spinifex/types/ebs.go` (`NBDTransport`) | `spinifex/services/viperblockd/nbd_transport.go` | NBD endpoint transport selection is Viperblockd-local delivery configuration, not generic EBS state or a provider contract; `nbd_transport_test.go` pins the socket and TCP forms. |
| `94a6e7af2` | `spinifex/types/ebs.go` (`EBSConfigUpdateRequest`, `EBSConfigUpdateResponse`) | `contracts/viperblockd/legacy/v1/config_update.go` | Legacy configuration updates have deployed queue and volume-addressed NATS routes; the versioned compatibility contract is expressly transitional and separate from `providers/ebs`. |
| `0b82e1404` | `spinifex/types/ebs.go` (`EBSSyncRequest`, `EBSSyncResponse`) | `contracts/viperblockd/legacy/v1/sync.go` | The `ebs.sync` queue-group route that reloads a mounted volume's state from its backend is deployed Viperblockd legacy compatibility, not generic EBS state; `sync_test.go` pins its subject and JSON shape. |
| `b975f1ba9` | Remaining `spinifex/types/ebs.go` payloads | `runtime/compute/vm/ebs_requests.go` and `contracts/viperblockd/legacy/v1/volume.go` | The mutex-bearing attachment collection is VM-owned; deployed mount, unmount and delete routes plus their JSON payloads are versioned Viperblockd legacy compatibility. Contract tests pin every route and JSON shape. |
| `08d950770` | `spinifex/types/telemetry.go` (`MetricsEC2SubjectPrefix`, `TelemetrySeries`) | `spinifex/runtime/roles/qmpcollector/metrics.go` | The guest-metrics subject prefix has no versioned contract yet: its eventual consumer is Goanna, so it stays collector-local runtime data pending a cross-repository contract decision rather than being promoted to `contracts/`. This empties and removes `spinifex/types`; the package no longer exists in this repository. |
| `61cf833aa` | `spinifex/cloud/exoscale` | `spinifex/providers/cloud/exoscale` | Exoscale CLI access is a replaceable external-cloud adapter. The source move rewrites its four Exonet callers and preserves its adapter tests and CLI boundary. |
| `dbc62562c` | `spinifex/objectstore` | `spinifex/providers/objectstore` | The generic S3-compatible client is a replaceable object-storage adapter, not S3 resource authority. The mechanical move rewrites all direct callers; its focused suite and caller compilation passed. |
| `f11922986` | `spinifex/config` | `spinifex/bootstrap/config` | Root configuration parsing belongs to bootstrap. Its package API is unchanged; package tests and regular, integration, E2E and benchmark caller compilation passed. |
| `aa4b0b1bb` | `spinifex/paging` | `spinifex/foundation/aws/paging` | Opaque listing tokens, deterministic slicing and EC2 pagination validation are shared AWS protocol infrastructure rather than EC2 resource authority. The move rewrites all five EC2 callers; focused package tests, direct caller compilation and tagged integration compilation passed. |
| `6ac02a886` | `spinifex/clustersize` | `spinifex/foundation/state/clustersize` | The declared cluster size and its fail-closed JetStream/KV replica policy are shared state-tier infrastructure, not a resource-domain owner. Focused package tests, all direct caller compilation, integration and E2E-tagged harness compilation passed. |
| `93084043a` | `spinifex/handlers/ecr` | `spinifex/domains/ecr` | ECR repository metadata, blob semantics and lifecycle rules are ECR domain ownership. The full domain suite, direct callers and tagged integration callers passed. |
| `51b5c55b9` | `spinifex/gateway/ecrapi` | `spinifex/domains/ecr/awsapi` | AWS JSON 1.1 action inventory, validation, resource-scope derivation and NATS-backed action handlers are ECR action-adapter ownership. Focused, gateway and tagged integration validation passed. |
| `5e7311eb2` | `spinifex/gateway/ecr` | `spinifex/domains/ecr/registry` | The OCI Distribution v2 protocol adapter is ECR data-plane ownership. Focused registry, gateway/AWS-gateway and tagged integration validation passed. |
| `474c07316` | `spinifex/gateway/ecrauth` | `spinifex/domains/ecr/auth` | ECR token claims, issuer/verifier, encrypted signing-key persistence and rotation are ECR credential ownership. Focused, gateway/AWS-gateway and tagged integration validation passed. |
| `5ff0fa452` | Gateway `buildRepository`, `ecrRepositoryArn`, `ecrRegistryHost`, `ecrRepositoryUri` (`GatewayConfig` methods) | `spinifex/domains/ecr/awsapi.RepositoryEndpoint` (`RepositoryARN`, `RegistryURIHost`, `RepositoryURI`, `RepositoryFromMeta`) | ECR repository ARN, registry URI and AWS response projection are ECR-domain composition state; the endpoint profile is supplied by the composition root rather than read from `GatewayConfig` fields. |
| `f59b40ad1` | Gateway `DescribeRepositories` action semantics | `spinifex/domains/ecr/awsapi.DescribeRepositories` | Request validation, account scope, repository metadata lookup and AWS response projection are ECR AWS-action ownership. Gateway retains authenticated HTTP adaptation and response writing. Focused domain, gateway dispatch and tagged integration compilation passed. |
| `c558872e8` | Gateway `CreateRepository` action semantics | `spinifex/domains/ecr/awsapi.CreateRepository` | Request decoding, input defaults and validation, duplicate detection, account-scoped metadata persistence and AWS response projection are ECR AWS-action ownership. Gateway retains authenticated HTTP adaptation and response writing. Focused domain, gateway lifecycle and tagged integration validation passed. |
| `a6b209b7b` | Gateway `DeleteRepository` action semantics | `spinifex/domains/ecr/awsapi.DeleteRepository` | Request validation, account scope, non-empty protection, forced deletion, metadata cascade and AWS response projection are ECR AWS-action ownership. Blob reclamation remains the separately documented GC concern. Focused domain, gateway lifecycle and tagged integration validation passed. |
| `7a5159366` | Gateway `PutImageTagMutability` action | `spinifex/domains/ecr/awsapi.PutImageTagMutability` | This endpoint-free action is registered directly in the ECR action table rather than retained as a gateway wrapper. Request validation, account-scoped metadata update and AWS response construction are domain-adapter ownership; generic gateway auth and policy gating remain before dispatch. Focused domain, gateway and tagged integration validation passed. |
| `a2f6005d2` | Gateway `GetAuthorizationToken` action response | `spinifex/domains/ecr/awsapi.GetAuthorizationToken` | Gateway retains canonical IAM/STS principal construction from authenticated context. The ECR adapter consumes a narrow token-issuer capability and owns mint-result handling, Docker `AWS:<jwt>` encoding and AWS response projection. Focused domain, real issuer/verifier gateway round-trip and tagged integration validation passed. |
| `ee4610a75` | Gateway `ListImages` action semantics | `spinifex/domains/ecr/awsapi.ListImages` | The ECR AWS adapter consumes a narrow OCI image-catalog capability and owns request validation, account scope, tag-status projection and AWS response/error mapping. Gateway retains authenticated HTTP adaptation and supplies the configured registry. Focused domain, registry-backed gateway and tagged integration validation passed. |
| `b22b723a4` | Gateway `DescribeImages` action semantics | `spinifex/domains/ecr/awsapi.DescribeImages` | The ECR AWS adapter now shares the image-catalog capability and catalog error mapping with ListImages, and owns image selection/detail projection. The accepted-but-unapplied filter field is explicitly retained as an unchanged compatibility gap. Focused domain, registry-backed gateway and tagged integration validation passed. |
| `deabaa300` | Gateway `BatchGetImage` action semantics | `spinifex/domains/ecr/awsapi.BatchGetImage` | The ECR AWS adapter consumes a narrow manifest-reader capability and owns request validation, the 100-image cap, digest-over-tag selection and partial-failure response projection. Repository/account scope validation is now shared with ListImages and DescribeImages. Focused domain, registry-backed gateway and tagged integration validation passed. |
| `2542ce98e` | Gateway `PutImage` action semantics | `spinifex/domains/ecr/awsapi.PutImage` | The ECR AWS adapter consumes a narrow manifest-writer capability and owns request validation, tag/digest selection, AWS response projection and OCI manifest-store error translation. Gateway retains authenticated HTTP adaptation and supplies the configured registry. Focused domain, registry-backed gateway and tagged integration validation passed. |
| `7666ed208` | Gateway `BatchDeleteImage` action semantics and residual ECR helpers | `spinifex/domains/ecr/awsapi.BatchDeleteImage`, `awsapi.ValidateRepositoryScope`, gateway `ecr_request.go` | The ECR adapter consumes a narrow image-deleter capability and owns batch deletion/partial-failure projection. Completion exposed scope validation still needed by lifecycle-preview adapters, which now calls the exported ECR adapter utility; generic HTTP JSON decoding moved to a gateway ECR adapter helper. Focused domain, image/lifecycle gateway and tagged integration validation passed. |
| `72c20bf78` | Gateway lifecycle-preview evaluation and `StartLifecyclePolicyPreview` | `spinifex/domains/ecr/awsapi.EvaluateLifecyclePreview`, `StartLifecyclePolicyPreview` | Shared preview evaluation now consumes explicit policy-store and image-catalog capabilities, owns request/stored-policy resolution and lifecycle evaluation, and returns a reusable expiry set. Start preview is fully domain-owned; Get preview consumes the evaluator and retains only its response projection pending the next slice. Focused domain, lifecycle gateway and tagged integration validation passed. |
| `68945bbb1` | Gateway `GetLifecyclePolicyPreview` response projection | `spinifex/domains/ecr/awsapi.GetLifecyclePolicyPreview` | Get preview now joins Start preview in the ECR adapter, sharing the synchronous evaluator and explicit policy-store/image-catalog capabilities. Gateway retains only authenticated HTTP/body adaptation and capability supply. Focused domain, lifecycle gateway and tagged integration validation passed. |
| `4c9f3d681` | Gateway ECR image-action wrappers and residual JSON adapter | `spinifex/domains/ecr/awsapi.RegistryActionService` | ListImages, DescribeImages, BatchGetImage, PutImage and BatchDeleteImage now dispatch through one composed registry-action capability after the generic gateway's authentication and policy gate. The composition root supplies narrow OCI capabilities; the operation inventory derives their implemented status from that capability. The obsolete gateway wrappers and JSON helper are removed. Focused domain, gateway, AWS-gateway and tagged integration validation passed. |
| `40e7b14ad` | Gateway lifecycle-preview wrappers | `spinifex/domains/ecr/awsapi.LifecyclePreviewActionService` | StartLifecyclePolicyPreview and GetLifecyclePolicyPreview now dispatch through one composed policy-store-plus-image-catalog capability after generic authorization. Production reuses the registry's NATS metadata client; focused tests compose an in-memory metadata store. The obsolete wrappers are removed, and a missing composition fails closed rather than falling through to the raw action table. Focused domain, gateway, AWS-gateway and tagged integration validation passed. |
| `54f96ad78` | Gateway CreateRepository, DescribeRepositories and DeleteRepository wrappers | `spinifex/domains/ecr/awsapi.RepositoryActionService` | Repository actions now dispatch through one composed metadata-store-plus-endpoint-profile capability after generic authorization. The individual action adapters depend on a narrow repository metadata contract rather than constructing NATS clients themselves. The three obsolete wrappers are removed, and a missing composition fails closed. Focused domain, gateway, AWS-gateway and tagged integration validation passed. |
| `5ebbdcb53` | Gateway GetAuthorizationToken wrapper and endpoint adapter | `spinifex/domains/ecr/awsapi.AuthorizationTokenActionService` | GetAuthorizationToken now dispatches through a composed issuer-plus-endpoint capability after gateway constructs the canonical IAM/STS principal. The token subject remains gateway identity work; ECR retains credential response projection. The obsolete wrapper and endpoint adapter are removed, a missing action service fails closed, and an unavailable issuer retains the declared NotImplemented response. Focused domain, gateway, AWS-gateway and tagged integration validation passed. |
| `2b945ad88` | `spinifex/handlers/acm`, `spinifex/gateway/acm` | `spinifex/domains/acm`, `spinifex/domains/acm/awsapi` | ACM certificate state, issuance and renewal are ACM-domain ownership; its AWS JSON/NATS request adapters live beside them. All nine adapters, including the previously inlined RequestCertificate path, now use `domains/acm/awsapi`; generic gateway retains only routing, request context, policy gating and response writing. Focused domain, adapter and gateway request tests plus direct-caller and tagged integration compilation passed. |
| `47c6b2fcf` | `spinifex/gateway/bodyscope` | `spinifex/ingress/aws/bodyscope` | Case-aware, ambiguity-safe extraction of AWS JSON request identifiers is ingress policy machinery, not generic gateway ownership. Focused parser tests and compilation of all six direct service-policy consumers passed. |
| `d3cd6d520` | `spinifex/gateway/policy` | `spinifex/foundation/aws/policy` | AWS wire-service to IAM action-name mapping is protocol-neutral AWS vocabulary. Its focused suite and direct gateway/RDS/integration caller compilation passed. |
| `be7f0b1d0` | `spinifex/utils/platform` | `spinifex/domains/ec2/platform` | EC2 `Platform` and `UsageOperation` derivation is EC2 compatibility vocabulary, not a generic helper. Focused package and metadata-default tests, plus direct daemon/image/instance caller compilation, passed. |
| `e2ac3dbed` | `spinifex/utils/command` | `spinifex/runtime/host/command` | Bounded host-command execution is node-local runtime machinery. Focused command and host-DNS tests plus the direct SPX CLI caller compilation passed. |
| `3360382f5` | `spinifex/utils/idempotency` | `spinifex/foundation/lifecycle/idempotency` | Retry-token HTTP/NATS vocabulary now lives beside the idempotency store. Focused propagation and EIP retry behavior tests, affected package compilation and tagged integration compilation passed. |
| `b5bc8cd7d` | `spinifex/utils/images` (`SelectNewestImage`) | `spinifex/foundation/aws/ami` | Selecting the newest EC2 image from AWS SDK models is shared AWS-model logic used by EKS, ECS, RDS and Bedrock, not operator catalogue ownership. Focused selector and remaining catalogue tests plus all four direct caller compilations passed. |
| `9f83f899a` | `spinifex/utils` (`ClientIP`, `RequestClientIP`) | `spinifex/ingress/http` | HTTP remote-address parsing and loopback-trusted `X-Real-IP` handling are generic ingress policy shared by the AWS gateway and UI proxy. The moved test suite and all direct caller compilations passed. |
| `693109950` | `spinifex/utils` (`HashMAC`) | `spinifex/network/identifiers` | Deterministic locally-administered MAC derivation is network infrastructure shared by ENIs, DHCP, OVN topology, IMDS and VM tap setup. Focused MAC tests and every direct caller compilation passed. |
| `79cf93996` | `spinifex/utils` (`DistinctIDs`) | `spinifex/foundation/aws/identifiers` | Request-order-preserving normalization of AWS resource-ID lists is shared API-model handling used by image and snapshot enumeration. Focused tests and both direct caller compilations passed. |
| `7e29f2640` | `spinifex/utils` (download and terminal-progress helpers) | `spinifex/operator/progress` | Operator-facing downloads, terminal progress rendering and byte display are CLI presentation concerns. Focused tests and the `spx admin` compilation passed. |
| `56471479f` | `spinifex/utils` (`ValidateKeyPairName`) | `spinifex/handlers/ec2/key` | EC2 key-pair-name validation has one production owner and is now private to it. Its moved unit matrix and full key-handler suite passed. |
| `cf531cd73` | `spinifex/utils` (QMP telemetry filename convention) | `contracts/telemetry/v1` | The telemetry QMP prefix and metadata path are part of the existing VM-runtime-to-collector file contract. The contract test, focused VM telemetry tests, collector suite and caller compilations passed; the broader VM suite is sandbox-blocked by unrelated socket setup. |
| `83615f1f4` | `spinifex/utils` (AWS XML response helpers) | `spinifex/foundation/aws/xml` | EC2 XML response normalization/enveloping and IAM-style Query envelopes are shared AWS protocol mechanics. Focused XML tests and all direct caller compilations passed; the RDS-agent package was compile-checked without execution because its FIPS bootstrap requires a FIPS-enabled runtime. |
| `9896834b2` | `spinifex/utils` (`ExtractTags`, `MapToEC2Tags`) | `spinifex/foundation/aws/tags` | Generic EC2 tag-specification extraction and API-model projection join the AWS tag foundation; KV tag mirroring remains separate state-layer work. Focused tag tests and direct caller compilations passed; the volume package was compile-checked without execution because its test main opens a sandbox-blocked TCP listener. |
| `d8985c287` | `spinifex/utils` (`AccountKey`) | `spinifex/foundation/state/kvutil` | Account-scoped durable-key construction belongs to the state foundation; its `{accountID}.{resourceID}` layout is unchanged. AWS account policy (`GlobalAccountID`, `IsAccountID`) remains separate legacy utility work. Focused key and tag-mirror tests plus every direct resource-caller compilation passed. |
| `e6794d87d` | `spinifex/utils` (`SudoCommand`, `NeedsPrivilege`, `EndpointSysctlHelper`) | `spinifex/runtime/host/command` | Host-command privilege escalation is node-local runtime machinery and now sits beside bounded command execution. The RG-10 invariant restricting direct sudo construction to this package and `network/host/run.go` moves with it. Focused privilege, preflight, network-host, host-DNS and vpcd tests, every direct caller compilation and tagged integration/E2E compilation passed. |
| `fd6c12f14` | `spinifex/utils` (PID files, runtime directory, socket waits, process signalling and OOM score) | `spinifex/runtime/host/process` | Node-local process supervision shared by the daemon, VM runtime, Viperblockd and every named role is runtime host machinery. The remaining NBD endpoint helpers temporarily import it until they move to compute runtime. The shipped Viperblock unit comment still names `utils.KillProcess`; it is left unchanged so a structural move does not alter a delivered unit. Full preflight (excluding the pre-existing containerd advisory), focused caller suites and tagged integration/E2E compilation passed. |
| `e712c6a7f` | `spinifex/utils` (NBD socket paths, URI format/parse, readiness wait) | `spinifex/runtime/compute/nbd` | NBD endpoint naming and readiness join the node-local NBD runtime, removing the interim `utils` to runtime-host edge. The EBS provider conformance suite now imports compute runtime for the URI format; if a versioned EBS wire contract is introduced, that format is a candidate for `contracts/ebs/v1`. Full preflight (excluding the pre-existing containerd advisory), focused NBD, VM, Viperblockd, QEMU-NBD, EBS-provider and admin suites, and tagged integration/E2E compilation passed. |
| `366e2c2e4` | `spinifex/utils` (image catalogue, checksum verification, disk-image extraction) | `spinifex/operator/imagecatalog` | The published image catalogue and its download verification serve only `spx admin` image import, an operator use case. The package is named `imagecatalog` because the command tree already uses `images` as a local identifier. Moved tests reach repository fixtures one directory deeper; script and documentation pointers to the catalogue file were updated. Full preflight (excluding the pre-existing containerd advisory), focused catalogue and CLI suites, and tagged integration/E2E (including GPU) compilation passed. |
| `53f13f213` | `spinifex/utils` (`GenerateResourceID`) | `spinifex/foundation/aws/identifiers` | AWS-style `{prefix}-{17 hex}` resource-ID generation joins the AWS identifier foundation beside request-ID normalisation; callers use the established `awsidentifiers` alias, which also avoids the network-identifier package name. Format and CSPRNG failure handling are unchanged. Full preflight (excluding the pre-existing containerd advisory), focused tests and tagged integration/E2E compilation passed. |
| `eab631b42` | `spinifex/services/predastore` | `spinifex/runtime/roles/predastore` | Predastore process configuration and startup are a named runtime role; the package holds no S3 resource semantics. The service manifest path moved with it. Full preflight (excluding the pre-existing containerd advisory), focused role, role-catalogue and CLI suites, and tagged integration/E2E compilation passed. Commit `796fb52d4` separately corrects the manifest's stale `handlers/acm` path left by the ACM relocation; `manifest-check` now passes. |
| `ad6a158f8` | `spinifex/services/northstar` | `spinifex/runtime/roles/northstar` | Northstar process startup and reload are a named runtime role. `BootstrapBaseZone` moved with it unchanged but is DNS control-plane work (it imports `handlers/dns`); it belongs to `domains/dns` when that domain moves, so the role is not yet thin. Full preflight (excluding the pre-existing containerd advisory), focused role, role-catalogue and CLI suites, `manifest-check` and tagged integration/E2E compilation passed. |
| `931d86d5c` | `spinifex/services/awsgw` | `spinifex/runtime/roles/awsgw` | The AWS gateway process is a named runtime role and its composition root wires every domain, which runtime may do. The quota reconcile loop (`runQuotaReconcile`, `quotaKeyFor`) moved with it unchanged but belongs to `domains/admission/quota`, and the EKS token-verify responder belongs with STS or EKS identity; both are recorded residuals, so the role is not yet thin. Service-interface manifest, design doc and architecture diagram paths were updated. Full preflight (excluding the pre-existing containerd advisory), focused role, role-catalogue and CLI suites, `manifest-check` and tagged integration/E2E compilation passed. |
| `745338563` | `spinifex/utils` (`GenerateErrorPayload`, `GenerateErrorPayloadWithMessage`, `ValidateErrorPayload`, `UnmarshalJsonPayload`) | `spinifex/foundation/aws/errors` | The JSON error envelope every domain exchanges over NATS carries the shared AWS error vocabulary, so it sits beside the codes it encodes rather than in a per-domain contract. Behaviour is unchanged. Full preflight (excluding the pre-existing containerd advisory), focused error and caller suites and tagged integration/E2E compilation passed. |
| `02e0dd0dc` | `spinifex/utils` (`GlobalAccountID`, `IsAccountID`) | `spinifex/foundation/aws/identifiers` | The 12-digit account ID check and the system account ID constant are AWS identifier vocabulary and sit beside resource ID generation; no account policy changed. Full preflight (excluding the pre-existing containerd advisory), focused identifier and caller suites and tagged integration/E2E compilation passed. |
| `b5806ce63` | `spinifex/utils` (NATS connect/retry, request/serve, gather, headers, `PublishEvent`, trace propagation) | `spinifex/foundation/messaging/nats` (package `natsmsg`) | Generic NATS transport primitives are shared machinery with no resource owner; the package name avoids colliding with `nats.go` at every caller. The OTel instrumentation scope keeps its `spinifex/utils` value so existing APM queries still match. vpcd's request/ack protocol (`RequestEvent`, `AddNAT`, `PublishNATEvent`) stays in `utils/vpcd_event.go` for a future network contract, and `SubjectEnsureDefaultVpc` stays in `utils/ec2_subject.go` for an EC2 contract; both were split out byte-identical. Full preflight (excluding the pre-existing containerd advisory), focused transport and caller suites and tagged integration/E2E compilation passed. |
| `cabe0e99b` | `spinifex/handlers/sysinstance` | `spinifex/domains/ec2/systeminstance` | System-instance launch is compute ownership; managed services (ELBv2, EKS, RDS, Bedrock) consume the launcher contract. The package was renamed to its directory; runtime `sysinstance:` error strings are unchanged. Managed-service parent metadata is still only the `ManagedBy` tag value, short of the explicit parent metadata the ADR names. Full preflight (excluding the pre-existing containerd advisory), focused daemon and managed-service suites and tagged integration/E2E compilation passed. |
| `4d86296eb` | `spinifex/handlers/systemvpc` | `spinifex/domains/network/systemvpc` | Managed system-VPC realisation is network ownership; ELBv2, EKS, RDS and Bedrock consume its builder. The package was renamed from `handlers_systemvpc` to its directory and callers dropped the alias; it depends only on foundation packages. Full preflight (excluding the pre-existing containerd advisory), focused system-VPC, daemon and managed-service suites and tagged integration/E2E compilation passed. |
| `09de514ef` | `spinifex/handlers/imds` | `spinifex/domains/ec2/guestmetadata` | Guest metadata is a compute-domain interface served to guests on each node. The package was renamed from `handlers_imds` to its directory and its vpcd and E2E callers dropped the alias; five path comments were updated. The move exposes dependency-rule breaks it does not repair: imports of the DNS, EC2 instance, EC2 key, IAM and STS implementations, and the first domain-to-runtime edge (`runtime/compute/vm`); see Guest metadata relocation residuals. Full preflight (excluding the pre-existing containerd advisory), focused guest-metadata, vpcd and DNS suites and tagged integration/E2E compilation passed. |
| `99278d5ff` | `spinifex/handlers/dns` | `spinifex/domains/dns` | DNS control semantics (zone records, resolver and name policy) are DNS-domain ownership, distinct from OVN and host-network realisation. The package name was already `dns`, so callers dropped the `handlers_dns` alias; the multinode E2E test that also imports `miekg/dns` uses `dnsdomain`. Six path comments were updated. The move exposes imports of `runtime/compute/vm`, `network/reconcile` and `bootstrap/config`, recorded in the dependency-rule debt. The `integration,segscanoracle` build fails identically on `origin/dev` (`predastoreS3Client` is in package `integration` but called from `integration_test`) and was not touched. Full preflight (excluding the pre-existing containerd advisory), focused DNS, ACM, guest-metadata, daemon, northstar, admin and CLI suites, `manifest-check` and tagged integration, E2E and E2E bench compilation passed. |
| `06b1eefd9` | `spinifex/runtime/roles/northstar` (`BootstrapBaseZone`) | `spinifex/domains/dns` | Seeding the base zone and its NS topology is DNS control-plane work, so it joins the DNS domain and the northstar role is left with process startup and reload only. Its tests moved with it and reuse the DNS package's identical `fakeS3` helper. The daemon flakes seen during verification (`TestRestoreInstances_ClusterRecordWinsForSharedInstance` under load; `TestKVIPSecBarrier_*` and `TestDrainVolumeRecordsItsPointAfterTheWork` under `-count=3`) reproduce identically on `origin/dev`. Full preflight (excluding the pre-existing containerd advisory), focused DNS, northstar and CLI suites and tagged integration/E2E compilation passed. |
| `8ca318070` | `spinifex/admin` (`SystemAccountID`) | `spinifex/foundation/aws/identifiers` (`GlobalAccountID`) | `SystemAccountID()` duplicated the existing `GlobalAccountID` constant (`000000000000`), so its callers now use the constant and the function and its test are deleted rather than moved. `DefaultAccountID` and `DefaultAccountName` are Mulga bootstrap identity policy, not AWS identifier syntax, and stay in admin for a later IAM/account bootstrap slice. Full preflight (excluding the pre-existing containerd advisory), focused admin, account-teardown, EKS, CLI and identifier suites and tagged integration/E2E compilation passed. |
| `930040875` | `spinifex/admin` (`LoadCAKeyPair`) | `spinifex/foundation/pki` | Loading a PEM certificate and PKCS8 RSA key is a generic primitive; the new package imports no Spinifex package and holds no certificate identity or file layout. `GenerateCACert` and `GenerateSignedCert` stay in admin because they embed Spinifex certificate identity and validity policy. Full preflight (excluding the pre-existing containerd advisory), focused admin and RDS suites and tagged integration/E2E compilation passed. |
| `001aa2d42` | `spinifex/admin` (`TenantCACertPath`, `TenantCAKeyPath`) | `spinifex/domains/acm` | The tenant private CA's on-disk layout belongs to ACM, beside `LoadTenantCA` and `LoadOrCreateTenantCA`, which consume it; the daemon and the `spx admin acm` command now call the ACM domain. Full preflight (excluding the pre-existing containerd advisory), focused ACM, admin, daemon and CLI suites and tagged integration/E2E compilation passed. |
| `454defb00` | `spinifex/admin` (IPsec certificate paths, peer issuance, strongSwan CA install and reread) | `spinifex/network/host` | IPsec peer credentials belong with the host IPsec owner that consumes them; `network/host` no longer imports admin. Peer keys use their own `ipsecCertKeyBits` seam (4096, lowered in tests) instead of admin's `certKeyBits`, a deliberate duplicate of the key-size policy. The moved test now builds its throwaway CA locally instead of calling admin's `GenerateCACert`. Full preflight (excluding the pre-existing containerd advisory), the four moved tests, focused network-host, admin and CLI suites and tagged integration/E2E compilation passed. |
| `2c467988d` | `spinifex/handlers/bedrock` | `spinifex/domains/ochre` | Ochre is the platform service and owns model serving placement, launch, readiness, capacity and reaping; the Bedrock name now marks only the AWS API surface, per the amended ADR-0001 map row. Package renamed from `handlers_bedrock` to `ochre`, callers drop the alias, and KV bucket names, NATS subjects, metric names and error strings keep their `bedrock` names. The comment in the shipped `bedrock-serve` image script still names the old path because editing it changes image build input. Full preflight apart from the known govulncheck finding, focused Ochre, vector, Bedrock gateway, daemon, account teardown, awsgw, config and CLI tests, and tagged integration/E2E compilation passed. |
| `93f101c0f` | `spinifex/handlers/ochrevector` | `spinifex/domains/ochre/vector` | The tenant vector store (pgvector backend, KV index registry, ingest, jobs, backup and appliance orchestration) is Ochre domain state and now sits under the Ochre domain as the ADR-0001 map requires. Package renamed from `handlers_ochrevector` to `vector` with its existing package comment; callers use the `ochrevector` alias because `vector` is a common local identifier in the gateway, daemon and CLI. Error strings keep their `ochrevector:` prefix. The service-interface manifest names the new path. Full preflight apart from the known vulnerability-scan finding, focused Ochre, gateway, daemon, awsgw and CLI tests, tagged integration/E2E compilation and the manifest check passed. |
| `2b6131e21` | `spinifex/gateway/bedrock/hfhub` | `spinifex/domains/ochre/hfhub` | The Hugging Face Hub client resolves and streams model weights for Ochre and has no dependency on the rest of `gateway/bedrock`; its only caller is `spx admin ochre` weights pull. Package name unchanged. The rest of `gateway/bedrock` is not moved: it holds Ochre domain state, stores and the inference engine alongside the Bedrock action layer, and `domains/ochre` imports it, so moving it to `domains/ochre/awsapi` would invert the domain-to-adapter direction. It is recorded as dependency-rule debt. Full preflight apart from the known vulnerability-scan finding, focused hfhub and CLI tests, and tagged integration/E2E compilation passed. |
| `40964815b` | `spinifex/utils` (`MergeTagsMut`, `ApplyTagRemovals`, `RemoveTagsMut`, `UpdateKVRecordTags`, `MirrorKVRecordTags`) | `spinifex/domains/ec2/tagmirror` | EC2-wide AWS tag mutation over resource KV records is EC2 domain behaviour and imports only foundation packages. The EC2 tags resource package was not used because it imports the instance, key and VPC resources that call these helpers, which would create a resource-to-resource cycle. Twelve EC2 resource packages now call `tagmirror`; a stale `utils.ParseNBDURI` comment in the VM device code now names `nbd.ParseNBDURI`. Full preflight apart from the known vulnerability-scan finding, focused EC2, utils and VM tests, and tagged integration/E2E compilation passed. |
| `7003168bc` | `spinifex/network/*` (all 15 packages) | `spinifex/domains/network/*` | Network control, policy, topology, OVN, external and host realisation are network-domain ownership. The packages move as one enclosing move because the L0–L5 invariants classify layers by trimming a single `networkRoot` prefix; a partial move would silently drop moved packages out of S1. Package names, layer assignments, reconciliation authority and the vpcd boundary are unchanged. Invariant scan roots, the RG-10 sudo allow-list path, `.github/CODEOWNERS` and the IMDS netns unit test's repo-root walk follow the new path. Injected `host`→`topology` and L3 `CreateLogicalSwitch` violations failed S1 and S5 at the new paths, confirming the invariants still scan the moved packages; `domains/network/systemvpc` now also falls inside the host-containment and NAT-mode scans and passes them. Full preflight apart from the known vulnerability-scan finding, focused network, invariant, host-command and vpcd suites, `setup-ovn_test.sh`, `manifest-check` and tagged integration/E2E compilation passed. |
| `d8ab4017a` | `spinifex/handlers/ec2/{account,key,launchtemplate,placementgroup,spotinstance,volumestate}` | `spinifex/domains/ec2/<resource>` | These EC2 resources import no other EC2 handler package, so they move first as EC2 domain resources with their responsibilities unchanged. Each package is named after its directory and callers import it as `ec2<resource>`, because the bare names collide with common local identifiers; `volumestate` already carried its directory name. No package name appears in error text, KV keys or metrics. Path comments were updated. Full preflight apart from the known vulnerability-scan finding, focused EC2 domain, EC2 gateway, account-teardown and remaining EC2 handler suites, and tagged integration/E2E compilation passed. |
| `20b5deb5c` | `spinifex/handlers/ec2/{vpc,eigw,eip,igw,natgw,routetable}` | `spinifex/domains/ec2/<resource>` | VPC, egress-only and internet gateways, Elastic IPs, NAT gateways and route tables are EC2 API resources and keep their responsibilities. `vpc` moves whole; splitting it along VPC, subnet, ENI and security-group boundaries remains EC2 decomposition work. Packages are named after their directories and imported as `ec2<resource>`; one test's local `vpc` alias was kept. The reconcile drift-watch test located bucket constants by matching the `handlers_ec2_` qualifier text, so its pattern now matches `ec2<resource>`; removing `ec2eip.KVBucketEIPs` from the watched list made it fail as intended. `domains/network`'s imports of these packages are now visible domain-to-domain edges, already listed in the dependency-rule debt. Full preflight apart from the known vulnerability-scan finding, focused EC2 and network domain, EC2 gateway, handler, daemon and CLI suites, and tagged integration/E2E compilation passed. |
| `5d60184e8` | `spinifex/handlers/ec2/{instance,volume,snapshot,image,tags}` | `spinifex/domains/ec2/<resource>` | Instances, volumes, snapshots, images and tags are EC2 API resources and keep their responsibilities; `handlers/ec2` is now empty. Packages are named after their directories and imported as `ec2<resource>`; one test's local `instance` alias was kept. `docs/service-interfaces.yaml` mapped `spinifex/handlers/ec2` to the daemon for e2e suite selection, so since the first EC2 slice an EC2-only change fell back to the default suites; a throwaway commit changing only a `domains/ec2/key` file selected `e2e-cert e2e-lb` with the old manifest and the daemon suites with the new one, which lists the 17 moved resource paths rather than all of `domains/ec2` so selection is unchanged. The move exposes `domains/ec2/instance`'s runtime and DNS imports, recorded in the dependency-rule debt. Full preflight apart from the known vulnerability-scan finding, focused domain, EC2 gateway, handler, daemon, account-teardown, CLI and selector suites, `manifest-check` and tagged integration/E2E compilation passed. |
| `4501dbf69` | `cmd/ecr-credential-provider` (implementation) | `spinifex/agents/eks/credentialprovider` | The kubelet exec credential provider is EKS-node integration and moves under the agent tree as ADR-0001 maps it; it depends only on `internal/{ecrauth,guestenv,imdscreds}`, so no ECR domain code gains a guest-environment dependency. `main()` became `Main(in, out) int` with the same body writing to `out` and returning the exit code; the thin `cmd/ecr-credential-provider` main keeps the binary name and the `fipsboot` import. `.golangci.yml` excludes gosec for `cmd/`, so the move brings this code under gosec for the first time; its one G101 false positive is annotated. The moved test, full preflight apart from the known vulnerability-scan finding, a bad-CA smoke run (empty-auth response, exit 1) and a dependency check that `fipsboot` still links into the binary passed. |
| `fecf0b28a` | `cmd/eks-gateway-publish` (implementation) | `spinifex/agents/eks/gatewaypublish` | The control-plane VM's gateway publication relay is EKS in-guest behaviour. `cmd/eks-gateway-publish` keeps flag definitions, `EKS_*` environment defaults, parsing, the `fipsboot` import, the `eks-gateway-publish:` log prefix and exit code 1; the agent exposes only `Config` and `Run(ctx, Config) error` and imports no `flag`, `os.Args`, `os.Stdin` or `os.Exit`. The 11 former `fatal` sites had no defers or cleanup and return errors with identical text. `retryDelay` became a variable for tests and the retry wait honours context cancellation, which the binary's background context never triggers. New focused `Run` tests cover every validation and payload error, a wrapped publish, the 30-attempt budget and cancellation. Old and new binaries gave identical stderr and exit codes for nine command-path cases apart from the binary path in flag usage output. Full preflight apart from the known vulnerability-scan finding passed. |
| `8929ee47b` | `cmd/eks-gateway-fetch` (implementation) | `spinifex/agents/eks/gatewayfetch` | The control-plane VM's add-on and recovery fetch is EKS in-guest behaviour. `cmd/eks-gateway-fetch` keeps its nine flags in their original order with `EKS_*` environment defaults, parsing, the `fipsboot` import, the `eks-gateway-fetch:` log prefix and exit code 1; the agent exposes only `Config` (with `Out` supplied by the binary) and `Run(ctx, Config) error`. The 8 former `fatal` sites had no defers or cleanup and return errors with identical text; a render failure is still not retried. As with publish, `retryDelay` is a test variable and the retry wait honours a cancellation the binary never triggers. The TSV emitters and their tests moved unchanged; new `Run` tests cover the five startup errors, addons and recovery rendering at their gateway paths, an unretried render failure, the attempt budget and cancellation. Old and new binaries gave byte-identical stdout, stderr and exit codes for 11 cases against a local TLS gateway, including both TSV outputs and flags overriding environment. Full preflight apart from the known vulnerability-scan finding passed. |
| `d064924e6` | `cmd/eks-webhook-cert` (implementation) | `spinifex/agents/eks/webhookcert` | Minting and caching the in-cluster admission webhook's self-signed serving certificate is EKS in-guest behaviour. `cmd/eks-webhook-cert` keeps the `-dir`, `-cn` and `-dns` flags, parsing, the usage text, the `fipsboot` import, the `eks-webhook-cert:` log prefix and exit code 1; the agent exposes only `Config` (with `Out` supplied by the binary) and `Run(ctx, Config) error` and depends only on the standard library. The 3 former `fatal` sites had no defers or cleanup; a key-write failure still leaves `tls.crt` on disk, and a stdout write error is still ignored. Moving out of `cmd/` brought the file under gosec, whose G306 finding on the public certificate's 0644 mode is annotated with its reason. Existing tests moved unchanged; new `Run` tests cover the required-flag and blank-SAN errors, the cache-directory failure and the one-line CA/leaf/key output. Old and new binaries gave identical stdout, stderr, exit codes, file modes and output shape for 7 cases, and a second run reused the cached pair. Full preflight apart from the known vulnerability-scan finding passed. |
| `fba330b86` | `cmd/eks-konnectivity-cert` (implementation) | `spinifex/agents/eks/konnectivitycert` | Issuing and caching the on-node konnectivity-server certificate from the K3s cluster CA is EKS in-guest behaviour. `cmd/eks-konnectivity-cert` keeps its five flags and defaults (including `-cn konnectivity-server`), parsing, the usage text, the `fipsboot` import, the `eks-konnectivity-cert:` log prefix and exit code 1; the agent exposes only `Config` (with `Out` supplied by the binary) and `Run(ctx, Config) error` and depends only on the standard library. The 3 former `fatal` sites had no defers or cleanup; a key-write failure still leaves `tls.crt` on disk, and a stdout write error is still ignored. The gosec G306 finding on the public certificate's 0644 mode is annotated with its reason. Existing signing, reuse/reissue and SAN-splitting tests moved unchanged; new `Run` tests cover the required-flag and blank-SAN errors, an unreadable CA and the path output with IP and DNS SANs. Old and new binaries gave identical stdout, stderr, exit codes, file modes, CA verification, SANs and subject for 10 cases including SEC1 and PKCS8 CA keys, and the new binary reused the cached certificate and reissued it on a SAN change. Full preflight apart from the known vulnerability-scan finding passed. |
| `ac069d8f3` | `cmd/eks-token-webhook` (implementation) | `spinifex/agents/eks/tokenwebhook` | The control-plane VM's TokenReview webhook is EKS in-guest behaviour. `cmd/eks-token-webhook` keeps the `-addr` flag and loopback default, the environment-derived configuration (`loadConfig`, `envOr`, all eleven `EKS_*` variables, their default paths and the three required-variable errors, with its test), the slog text handler, both log lines and exit code 1; the agent exposes only `Config` and `Run(ctx, Config) error` and imports neither `flag` nor `os.Getenv`. The binary already returned errors from `run`, so no exit sites changed, and the certificate, kubeconfig, gateway-client and serve order is unchanged. Cancelling `ctx` now closes the server, which the binary never triggers. The relay, handler, certificate, kubeconfig and wire types moved unchanged with their tests; the public certificate's gosec G306 finding is annotated. New `Run` tests cover serving-cert, kubeconfig, gateway-client and listen failures and serving until cancelled. Old and new binaries matched for 12 cases including a live server's `/healthz` and `/authenticate` 405, 400 and 503 responses, file modes, kubeconfig body and log messages. Full preflight apart from the known vulnerability-scan finding passed. |
| `3c82c69ad` | `cmd/ecs-agent/{runtime,credentials}` | `spinifex/agents/ecs/{runtime,credentials}` | The containerd runtime adapter and the instance-role credential provider are ECS-agent-private mechanism and move under the ECS agent tree unchanged, keeping their package names. `cmd/ecs-agent` is their only importer; its import paths and one comment changed. Both packages now fall under gosec, which reported nothing. ECS agent and subpackage tests passed 10 times under the race detector and in full preflight apart from the known vulnerability-scan finding. |
| `59decbc25` | `cmd/ecs-agent` (implementation) | `spinifex/agents/ecs/agent` | The ECS container-instance agent is ECS in-guest behaviour; package `agent`, imported by the binary as `ecsagent`. `cmd/ecs-agent` keeps process lifecycle only: the signal context, the separate `New(cfg)` and `Run(ctx)` calls, the `ecs-agent: startup failed` and `ecs-agent: run failed` log lines and exit code 1. `Config`, `LoadConfig(envFile)` and `DefaultEnvFile` stay in the agent as the guest-agent/AMI contract. The ldflags-set `var version` stays in the binary's main package so `-X main.version` keeps working, and reaches the register message through a new `Config.AgentVersion` field that `LoadConfig` never sets; a new test pins that `New` carries it into the identity. `runtime` and `credentials` remain ECS-agent-private subpackages. Moving out of `cmd/` brought the code under gosec; its one finding, G101 on the `mulga.ecs.credID` container label key, is annotated as a key name. Old and new binaries built with the same `-X main.version` sent identical register bodies (including the injected version) to a fake TLS gateway with a fake IMDS, logged the same messages, exited the same on SIGTERM and failed identically with IMDS unreachable. Full preflight apart from the known vulnerability-scan finding passed. |
| `55e858788` | `cmd/rds-agent` (implementation) | `spinifex/agents/rds/agent` | The RDS guest agent is RDS in-guest behaviour and moves as one slice: its engines, commander, bootstrap handoff, quiesce, storage and parameter recovery share unexported types, so a finer split would need new exports. Package `agent`, imported by the binary as `rdsagent`. `cmd/rds-agent` keeps process lifecycle only: the signal context, `Start(ctx, cfg)` then `Run(ctx)`, cancellation as a clean stop, the `rds-agent: startup failed` and `rds-agent: run failed` messages and exit code 1. The agent owns `Config`, `DefaultEnvFile`, `LoadConfig` with the engine-layout derivation, `New`, `Start` and `Run`; `Start` is the existing startup retry around `New`, kept as guest-agent readiness policy, and no generic retry helper is exported. The ldflags-set `var version` stays in the binary's main package and reaches the agent through `Config.AgentVersion`. Three image fixture paths gained one directory level and their regeneration hints name the new package; the fixture tests were confirmed to fail on the old paths. Moving out of `cmd/` brought the code under errcheck and gosec, which reported no findings. Old and new binaries built with the same `-X main.version` produced the same startup retry messages, retry cadence, error text, stdout and SIGTERM exit status with no gateway URL and with a missing gateway CA; the post-registration path is covered by the moved unit tests. Full preflight apart from the known vulnerability-scan finding passed. |
| `918150758` | `cmd/installer/{autoinstall,branding,firstboot,install,netprobe,systemd,ui}` | `spinifex/operator/installer/<same>` | Installation, UI and autoinstall logic is operator delivery behaviour; the seven packages were already libraries and keep their names, and `cmd/installer/main.go` stays the thin executable with its TTY detection, messages and exit codes unchanged. The installer's `systemd` package writes the installed system's bridge, firstboot, banner and getty units, which is distinct from `operator/host/systemd`'s Spinifex unit reconciliation, so the two are not merged. `scripts/diff-coverage.sh`'s UI exclusion and a `scripts/setup.sh` comment follow the new path; the Makefile still builds `cmd/installer/main.go`. Moving out of `cmd/` brought the code under gosec and errcheck for the first time. All 47 gosec findings are annotated per line with the artifact and why its mode is required: 0755 directories, executables and mount points, 0644 OS configuration, units, networkd files, fstab, GRUB assets and the public CA certificate, and 0444 machine-id, each stating that it contains no secret material; `spinifex-firstboot.sh` is annotated as never permitted to contain credentials or tokenised callback URLs, and the two G115 conversions are annotated as bounded Linux statfs and sysinfo values. The PSK-bearing WPA configuration was already written 0600 and the root password goes through `chpasswd`. The one errcheck finding, an unchecked `*syscall.Stat_t` assertion in the ownership check, is now a checked assertion returning a `verify` error instead of panicking. Installer tests and full preflight apart from the known vulnerability-scan finding passed. |
| `05f390e61` | `cmd/spinifex/cmd` | `spinifex/operator/cli` | The `spx` command tree is operator CLI assembly; package `cmd` becomes `cli` and `cmd/spinifex/main.go` stays the thin entry point calling `cli.Execute()`. The `-X` version and commit ldflags in the Makefile and `build/Dockerfile.distro` follow the new import path, and a build using the Makefile `LDFLAGS` printed the injected version rather than `dev`. Template paths in `scripts/reset-dev-env.sh`, `migrate/VERSIONS.md` and the NATS role test follow the move. The listener-bind invariant globbed the old template path, found nothing and passed without examining any template; it now uses the new path and fails when the glob is empty, confirmed against the old path. Moving out of `cmd/` brought the tree under errcheck and gosec (105 findings uncapped). Config and flag wiring now goes through unexported `mustBindEnv`, `mustBindPFlag` and `mustMarkFlagRequired` helpers that panic with the config key, flag and command at startup instead of silently dropping a binding; all 110 sites are covered by the package's init and existing bind-function tests. Listing tables are written with `Srender` and a checked write because pterm's `Render` discards write errors; output is byte-identical and writing to a full device now exits 1. The formation-server shutdown discards are explicit, the `http.DefaultTransport` assertion is checked, twelve permission findings are annotated per line, and the formation join's `InsecureSkipVerify` is annotated as a known security gap (see dependency-rule debt). Full preflight apart from the known vulnerability-scan finding passed. |
| `5032e24a7`, `d500e3802`, `e630703d7`, `eb68ec460`, `ebcafa01f` | `gateway/ec2/{account,capacityreservation,key,launchtemplate,placementgroup}` | `spinifex/domains/ec2/awsapi/<same>` | EC2 action adapters are domain-owned AWS API surface, so they move under the EC2 domain's `awsapi`, one commit per resource. Each package takes its directory name and callers use `ec2<resource>api`; moved files change only their package line. `gateway/ec2.go` keeps the dispatch map unchanged as the transitional registration point. Callers are the gateway dispatch and account teardown's EC2 reapers. Adapter, gateway dispatch and account-teardown tests, the integration and E2E builds, and full preflight passed. |
| `c38bf99e4`, `2ee60b20f`, `eaa5c971e`, `f6d8060f2`, `f50687210`, `817e19bf2`, `67992c8f5` | `gateway/ec2/{zone,vpc,eigw,eip,igw,natgw,routetable}` | `spinifex/domains/ec2/awsapi/<same>` | The VPC-networking action adapters follow the same per-resource pattern; `zone` moves first because the instance adapter depends on it. Moved files change only their package line (`vpc_test` for its external tests). Callers are the gateway dispatch, account teardown's EC2 reapers, the quota live counters and the not-yet-moved instance adapter. Adapter, gateway and account-teardown tests, the integration and E2E builds, and full preflight passed. |
| `4b315469f`, `8b106e796`, `7ee808d2d`, `0485c77e6` | `gateway/ec2/{image,snapshot,volume,tags}` | `spinifex/domains/ec2/awsapi/<same>` | Image, snapshot, volume and tag action adapters follow the same per-resource pattern; moved files change only their package line. Callers are the gateway dispatch, account teardown's EC2 reapers and the quota storage counter. The volume adapter still imports the instance adapter, which moves next. Adapter, gateway, account-teardown and quota tests, the integration and E2E builds, and full preflight passed. |
| `b9a5eaf19`, `d4c68007e`, `534c5b49d`, `931af0ea5` | `gateway/ec2` (root), `gateway/ec2/{idem,instance,spotinstance}` | `spinifex/domains/ec2/awsapi`, `spinifex/domains/ec2/awsapi/<same>` | The root package holds EC2 resource-ARN resolution for authorization and becomes package `awsapi` (imported as `ec2awsapi`); the completeness test's failure messages now name its new path. The idempotency, instance and spot-instance adapters follow the per-resource pattern, instance and spot instance last because they carry cross-domain and runtime dependencies (see dependency-rule debt). Moved files change only their package line; `docs/DESIGN.md` examples use the new alias. `gateway/ec2` no longer exists and `gateway/ec2.go` remains the transitional dispatch point. E2E suite selection is unchanged: neither the old nor the new path is in the manifest. EC2 domain, gateway, account-teardown, quota, daemon and awsgw tests, the integration and E2E builds, and full preflight passed. |
| `cd9266176` | `gateway/restrouter.go` | `spinifex/ingress/aws/rest` | The REST-JSON router maps method and path to an AWS action and percent-decodes path parameters because ARNs appear in paths, so it is AWS protocol mechanics rather than protocol-neutral HTTP and sits beside `ingress/aws/query`. The exported surface is `Route[H]`, `NewRouter` and `(*Router).Lookup`; pattern parsing stays package-private and tested in place. The Bedrock and EKS route tables and their duplicate-route and completeness assertions stay in `gateway`, which computes the two former helper values inline rather than widening the API. Ingress and gateway tests, the integration and E2E builds, and full preflight passed. |
| `ba2d59b29` | `gateway/ratelimit.go` | `spinifex/ingress/aws/ratelimit` | Per-IP lockout after repeated failed SigV4 authentication returns AWS `RequestLimitExceeded`, so it is AWS ingress protection. Moved code changes only its package line and the four exports the gateway needs: `MaxFailures`, `Fingerprint`, `TokenDigest` and `Anonymous`; limiter behaviour is unchanged. `gateway` imports it as `authlimit` because it already imports Bluebottle's `ratelimit` throttler. The 14 implementation tests move with the package; the end-to-end gateway tests stay. The session-principal verdict and success-reset tests now read the record table through the lockout boundary instead of the limiter's private fields, and three mutations (success not clearing, double counting, legacy verdict recording) each fail them. Ingress and gateway tests, the integration and E2E builds, and full preflight passed. |
| — | `cmd/dhcptest`, `cmd/spx-loadgen` | unchanged | Both already conform to ADR-0001's tooling row: the load engine is `internal/testkit/loadgen` and the DHCP probe's shared pieces come from the network domain's `dhcp` package. What remains in each `main` is its own flag parsing and one-off orchestration that nothing else imports, so extracting it would create a package solely to satisfy the directory map. No source change. |
| `7047f6b36` | — | — | ADR-0002 phase 0: characterization tests pin the ECR control plane as it behaves today before dispatch moves. Full-pipeline tests fix the 400/501 error envelopes, JSON 1.1 content type and `X-Amzn-Errortype`, 413 before dispatch for an oversized body, 503 for stub and composed actions when NATS is down, and authorization before a composed action. Unit tests fix target parsing (dispatch and telemetry agree on every malformed form), the stub and inventory sets, `GetAuthorizationToken` ignoring body-supplied identity, and the action reaching the throttle key, trace span and audit record. Mutation of the target parser, the authorization gate and the audit action each failed the new tests. Test-only; full preflight passed. |
| `89364c100` | — | `spinifex/ingress/aws/dispatch`, `spinifex/ingress/aws/invariants` | ADR-0002 phase 1: the registration contract. A startup `Builder` validates and seals registrations into an immutable `Registry` keyed by credential-scope service, with aliases, an inventory name, an advisory action resolver, the dispatcher, the error envelope and the operation inventory; `Invocation` carries the bounded request, account, Region, an `AuthorizeFunc` and a lazy `ActorFunc`. It imports only `foundation/aws/errors` and Bluebottle's `iampolicy` condition-key vocabulary, and no domain moved. `TestS4_IngressAWSImportsNoDomainOrRuntimeImplementation` binds ADR-0002 S4 for all of `ingress/aws` and failed on an injected domain import. Contract tests at 100% statement coverage under `-race`; full preflight passed. |
| `86a2de3ff` | `spinifex/gateway` (dispatch switch) | `spinifex/gateway` consuming `spinifex/ingress/aws/dispatch` | ADR-0002 phase 2: the gateway consumes the registry with no service registered. A registered service passes the auth gate, resolves its own action label, renders errors in its declared envelope through one `gw.jsonErrorService` method, and is dispatched with an `Invocation` whose `Authorize` calls the existing policy check and whose lazy `Actor` reuses `buildCallerARN`. The NATS-unavailable guard still runs ahead of both paths; every existing service takes the unchanged switch, now named the legacy path that must only shrink. The awsgw role wires an empty registry and fails startup on any overlap with the legacy table. Fake JSON, XML and resolver-less registrations prove dispatch, telemetry labels, authorisation deny/allow, the verified actor, both envelopes, the 503 and unknown-service paths and the overlap guard through the full pipeline; four production mutations were each caught. Phase 0 ECR characterisation and the unserved-service tests passed unchanged; full preflight passed. |
| `6c48ab6b7` | `spinifex/gateway` (`ECR_Request`, `ecrActionFromTarget`, `ecrAuthorizationPrincipal`, the four `ECR*` `GatewayConfig` fields, the `ecr` legacy table/switch entries) | `spinifex/domains/ecr/awsapi` (`NewRegistration`, `OperationInventory`), wired by `spinifex/runtime/roles/awsgw` | ADR-0002 phase 3: ECR's AWS JSON 1.1 control plane registers from its domain. The dispatcher reproduces the removed gateway path step for step (error codes and order, one bounded body read feeding scope and invocation, `Authorize` before every use case, nil capability as ServerInternal, the token principal from the verified `Actor`, the JSON writer). The gateway no longer imports `domains/ecr/awsapi`; the OCI `/v2` route is unchanged. Operation coverage reads the pure `OperationInventory()` that the registration uses verbatim, proved equal by `TestRegistrationInventoryIsTheDeclaredInventory`; `coverage.json` and every coverage page were byte-identical. `TestS4_OnlyAWSGWRoleImportsDispatchAndECRAWSAPI` binds acceptance item 3, with `cmd/aws-model-coverage` as the only named, non-serving tool exception. Five mutations (authorise after use, prefix-strict resolver, inventory drop, body-derived token principal, probe import) were each caught; Phase 0 characterisation kept every assertion except one rebound from the deleted parser to the registration's resolver; full preflight passed. Remaining temporary edge: `Deps.NATS` is a raw `*nats.Conn`. |
| `5f66bd2a3` | `spinifex/gateway` (`GenerateEC2ErrorResponse`, `GenerateIAMErrorResponse`, `GenerateS3ErrorResponse`, `requestSignalsJSONProtocol`, `jsonErrorType`, error content types), `spinifex/gateway/eks` (`GenerateEKSErrorResponse`) | `spinifex/ingress/aws/envelope` | ADR-0002 phase 4, error rendering: pure EC2, IAM-style and S3 XML builders, the AWS JSON 1.1 body and error type, the header-only JSON-protocol detector and content types, importing only the standard library. `ErrorHandler`, the cluster-unavailable, throttle and SigV4 writers and the legacy service-to-envelope selection stay in `gateway`. A 140-case golden of status, headers and body across 14 service cases and every error writer was identical before and after; two mutations were caught; the S4 ingress import invariant scans the new package; full preflight passed. |
| `b81ae4eb4` | `spinifex/gateway` (service served/action/error-protocol selection, overlap check) | `spinifex/ingress/aws/dispatch` (`Selector`, `Legacy`) | ADR-0002 phase 4 slice 2: one selector decides whether a service is served, its throttle/trace/audit action, its error protocol, its registered entry and the startup overlap; a registered service always wins and a resolver-less registration does not fall back to legacy action resolution. The gateway supplies its legacy tables through the three-method `dispatch.Legacy` interface, so ingress imports nothing from gateway; legacy dispatch, the Bedrock sub-service mapping and invocation building (which read gateway request-context keys) stay in gateway. A 160-case golden capture through the real SigV4, trace and `Request` chain with live test NATS and the ECR registration was identical before and after; mutating `Served`, `ResolveAction` and `Validate` each failed tests. Only startup-visible change: the overlap error now begins `dispatch:` and names the first overlap in sorted order. Full preflight passed. |
| `4b0a4dd6b` | — | — | ACM characterization before registration: full-pipeline 400 MissingAction/InvalidAction envelopes, a 200 `ListCertificates` against a live NATS responder, dispatch and telemetry target-parser agreement, authorization before the NATS call (subject counter stays zero), 413 before dispatch, 503 when NATS is down (ACM's own nil-connection check is unreachable over HTTP), the action reaching throttle, trace and audit, and the nine-action inventory. Mutating the parser, the authorization call and the action table each failed tests. Test-only; full preflight passed. |
| `fdaf589ca` | `spinifex/gateway` (`ACM_Request`, `acmActions`, `acmActionFromTarget`, legacy `acm` entries) | `spinifex/domains/acm/awsapi` (`NewRegistration`, `OperationInventory`) | ACM registers its AWS JSON 1.1 control plane from its domain, wired only by the awsgw role; the dispatcher reproduces the old order (missing/unknown action, `InternalError` without an account, bounded body, resource ARNs, authorization, then nil-NATS and the action). The S4 composition invariant now covers every registered domain `awsapi` with the same named coverage-tool exception. Coverage output was byte-identical and the ACM integration conformance summary was identical at the parent and after. Mutating authorization order, the target parser, the inventory and gateway imports each failed tests. Temporary edge: `Deps.NATS` is a raw `*nats.Conn` because every ACM action function takes one. Full preflight passed. |
| `01276bf29` | — | — | RDS DB subnet group characterization before extraction (ADR-0003 S1, ADR-0004): repeat delete reports not found, name scoped to the account, modify never moves a placed instance, snapshots do not block delete, restore rejects an unknown group, tags reached through the ARN and gone with the group, persisted record field names. Present contract and gaps in `docs/package-boundary/rds-db-subnet-group-lifecycle.md`; no conformance claimed. |
| `17dc29251` | `spinifex/handlers/rds` (`DBSubnetGroupRecord`, `DBSubnetGroupSubnet`, `DBSubnetGroupKey`, `DBSubnetGroupsPrefix`, `getDBSubnetGroup`, `resolveGroupSubnets` and the create/modify/delete bodies) | `spinifex/domains/rds/subnetgroup` (`Owner`, `Record`, `Subnet`, `Key`, `Prefix`) | First ADR-0004 resource owner. The handler keeps AWS validation, projection and paging; delete reaches instances through the owner-declared `Dependants`, and instance placement reaches the group through the instance-declared `subnetGroupPlacement`. Stored shape unchanged; `docs/service-interfaces.yaml` lists the package with the RDS daemon. No conformance claimed; gaps in the lifecycle contract. |
| `1cb868e68` | — | — | ECS task definition characterization before extraction (ADR-0003 S1, ADR-0004): stored keys and field names, every reference form and its not-found fault, repeatable deregister, an inactive revision still launching, bare-family launch resolution, a service pinning its resolved revision. Present contract and gaps, including the bare-family `iam:PassRole` re-resolution security gap, in `docs/package-boundary/ecs-task-definition-lifecycle.md`; no conformance claimed. |
| `544b0c6a0` | `spinifex/handlers/ecs` (`TaskDefRecord`, `ContainerDef`, `TaskDefRevKey`, `TaskDefLatestRevKey`, `ParseTaskDefRef`, `TaskDefARN`, `TaskDefRefARN`, revision register/deregister/resolve/list) | `spinifex/domains/ecs/taskdefinition` (`Owner`, `Record`, `Container`, `PortMapping`, `SystemControl`, `ParseRef`, `ARN`, `RefARN`, keys) | ADR-0004 owner extraction (ADR-0003 S1 contract in `docs/package-boundary/ecs-task-definition-lifecycle.md`). Stored keys and JSON field names unchanged; the owner declares its own persisted `PortMapping`/`SystemControl` so it does not import `handlers/ecs/bus`. Launches use the launch-side `taskDefinitionResolver`; gateway authz and all `iam:PassRole` checks unchanged. `docs/service-interfaces.yaml` now lists `spinifex/handlers/ecs` and the new package under `spinifex_daemon`. Proves ownership and dependency direction only; no conformance claimed. |
| `b36d70b22` | — | — | EKS access entry characterization before extraction (ADR-0003 S1, ADR-0004): persisted and nested field names, pre-existing JSON decodes, actions ignore cluster status, associate without an entry is not found, disassociating an unbound policy is a no-op, an empty update keeps username and groups, cluster delete sweeps only that cluster's entries, token review needs no cluster record. Present contract and gaps in `docs/package-boundary/eks-access-entry-lifecycle.md`; no conformance claimed. |
| `68ee6f620` | `spinifex/handlers/eks` (`AccessEntryRecord`, `AssociatedAccessPolicy`, `AccessScope`, `AccessEntriesPrefix`, `AccessEntryKey`, `PrincipalARNHash`, access-entry KV helpers, policy catalogue, `effectiveGroups`, the access mutation logic) | `spinifex/domains/eks/access` (`Owner`, `Record`, `AssociatedPolicy`, `Scope`, `Spec`, `Get`, `List`, `Key`, `Prefix`, `PrincipalARNHash`, `SupportedPolicies`, `EffectiveGroups`) | ADR-0004 owner extraction (ADR-0003 S1 contract in `docs/package-boundary/eks-access-entry-lifecycle.md`). Stored keys and JSON field names unchanged; writes go only through `Owner`, including the creator-admin seed at cluster launch. The handler keeps AWS validation, the cluster existence check, error mapping and projection; gateway authz switches only its hash import. `docs/service-interfaces.yaml` now lists `spinifex/handlers/eks` and the new package under `spinifex_daemon`. Proves ownership and dependency direction only; no conformance claimed. |
| `955486421` | — | — | RDS engine catalogue characterization before extraction (ADR-0004): family normalisation, exact error codes, per-parameter agent metadata, internal-fault outcomes, recovery text, reference class. Static metadata, so no ADR-0003 lifecycle contract; boundary and evidence note in `docs/package-boundary/rds-engine-catalogue-boundary.md`. |
| `f1f194b16` | — | — | Discovered and corrected during the catalogue characterization: a missing `MasterUserPassword` on `CreateDBInstance` returned HTTP 500 `ServerInternal`; it now returns 400 `InvalidParameterValue`, covered through the gateway by `gateway/rds_test.go` `TestRDSRequest_CreateDBInstance_EmptyMasterUserPasswordReturns400`. |
| `4b5524781` | `spinifex/handlers/rds` (`Engine`, engine registry and lookup, family mapping, version/username/DB-name validation, `postgres`/`mariadb` catalogues, `ParameterSpec`, `ApplyType*`, `ParamType*`, `ResolveEffectiveParameters`, `db.*` classes, engine-version and orderable selection) | `spinifex/domains/rds/engine` (`Engine`, `LookupEngine`, `EngineForFamily`, `ParameterSpec`, `Setting`, `InstanceTypes`, `Sizing`, `NewSizing`, `EngineVersions`, `OrderableOptions`) | ADR-0004 owner move of static metadata; boundary note in `docs/package-boundary/rds-engine-catalogue-boundary.md`. Two deliberate boundaries: EC2 instance-type memory is consumed only through `Sizing`, never by a direct RDS to EC2 package dependency; agent engine metadata is consumed only through the agent-declared `EngineCatalog` contract composed in `cmd/rds-agent`, never by importing the catalogue. Effective parameters cross as engine-owned `Setting`, converted to `Parameter` in `handlers/rds`. AWS output, paging, apply-method mapping, storage limits and the runnable check stay in the adapter path. |
| `ca1dd9aa9` | — | — | RDS DB parameter group characterization before extraction (ADR-0003 S1, ADR-0004): persisted meta and override field names, pre-existing JSON decodes, default groups synthesised and never stored, repeated delete is not found, a pending attachment blocks delete, a dynamic `pending-reboot` override is still applied live, propagation reaches a stopped instance. Present contract and gaps in `docs/package-boundary/rds-db-parameter-group-lifecycle.md`; propagation to instances is recorded as instance-side realization outside the group, and no conformance is claimed. |
| `d9c3f3ca6` | `spinifex/handlers/rds` (`DBParameterGroupRecord`, `DBParameterRecord`, the parameter-group key helpers, `ListDBParameterGroupNames`, `ListDBParameterOverrides`, `getDBParameterGroup` and the create/modify/delete writes) | `spinifex/domains/rds/parametergroup` (`Owner`, `Record`, `Override`, `MetaKey`, `ParamsPrefix`, `ParamKey`, `Prefix`) | ADR-0004 owner extraction (contract in `docs/package-boundary/rds-db-parameter-group-lifecycle.md`). Stored keys and JSON field names unchanged. Delete reaches instances through the owner-declared `Dependants`; instance-side resolution reads through the instance-declared `parameterGroupValues`. `SetOverrides` refuses an unknown group. The handler keeps AWS validation (it refuses every `default.*` name; the owner refuses only a real engine default), projection, paging and propagation. Proves ownership and dependency direction only; no conformance claimed. |
| `52de5e517` | — | — | EKS add-on characterization before extraction (ADR-0003 S1, ADR-0004): persisted record and manifest keys and field names, durable CREATING and staged descriptor, installer failure as CREATE_FAILED (update too), update returning Successful while UPDATING, mismatched-version reports accepted, delete erasing both keys while answering DELETING, the ignored client token, no PassRole check on serviceAccountRoleArn, and the exact internal add-ons body (Go field names, not the declared json tags) and agent TSV. Present contract and gaps in `docs/package-boundary/eks-addon-lifecycle.md`; no conformance claimed. |
| `d89963054` | `spinifex/handlers/eks` (`addon_catalog.go`, `addon_state.go`, `addon_installer.go`, the add-on key helpers, the create/update/delete transitions, `markAddonFailed`, `nextAddonStatus` and report application) | `spinifex/domains/eks/addon` (`Owner`, `Record`, `Manifest`, `Status`, `Spec`, `Installer`, `StagingInstaller`, `Report`, `Key`, `ManifestKey`, `Prefix`) | ADR-0004 owner extraction (contract in `docs/package-boundary/eks-addon-lifecycle.md`). The owner is the sole writer; stored keys and JSON fields unchanged. The handler checks cluster existence (`acctKVForCluster`) and keeps AWS validation, error mapping and projection. `ClusterReconciler` remains the subscriber host and delegates through the reconciler-declared `addonReports`; node groups call `EnsureGPUDevicePlugin`. Guest wire types stay in `handlers/eks`. Behaviour preserving: proves ownership and dependency direction only; every lifecycle gap remains. |
| `692d929b4` | `spinifex/handlers/eks` (`AddonStatusSubject`, `AddonDeliveryPhase`, `AddonStatusReport`, `StagedAddonManifest`), `gateway/eks` (`internalAddonsOutput`), `agents/eks/gatewayfetch` (`stagedAddon`, `internalAddonsResponse`) | `contracts/eks/v1` | The add-on guest/controller wire is an explicit versioned contract; v1 is the deployed form and a generation-aware protocol needs a successor version. Bytes unchanged: the internal add-ons body is rendered by `jsonutil.BuildJSON` with Go field names, which the contract documents and pins. Compatibility tests cover the status report, the guest printf form, the manifest, both body forms and the TSV. The guest script still builds report JSON by hand without escaping. |
| `4e822fa34` | — | — | EKS add-on v1 compatibility characterization: pins which owner (`domains/eks/addon`) writes drop unknown record and manifest fields, that reads and deletes ignore or erase them, that one undecodable stored entry fails a listing rather than the whole set, and that `contracts/eks/v1` and `agents/eks/gatewayfetch` wire consumers ignore extra fields. Test-only; no conformance claimed. |
| `7e504c1dd` | — | — | Stale paths left by the moves: `.gitignore` un-ignores the moved `runtime/roles/spinifexui/frontend/dist/`, UI CI and the Dependabot npm job point at the moved frontend, the depguard `ec2-control-plane` rule covers `domains/**` as well as `handlers/**`, and CODEOWNERS names the network-layer proposal rather than an accepted ADR. |
| `d5849c6b3` | `spinifex/handlers/quota` | `spinifex/domains/admission/quota` | ADR-0001's `handlers/quota` current-to-target map row. Package renamed to `quota` (imported as `admissionquota` where a local `quota` identifier exists); KV buckets, subjects and error codes unchanged. Its existing debt edges moved with it and are recorded below; `runQuotaReconcile` stays in `runtime/roles/awsgw`. Full preflight passed apart from the recorded Go 1.27.0 advisory exception. |
| `8cd9cff75` | `spinifex/migrate/migrate_test.go` (the `Registry`/`RunKV` tests and their NATS helpers) | `spinifex/foundation/state/migrate/kv_test.go` | The KV migration engine's only tests lived in the operator upgrade package's test file. They move to the package that owns the engine before the workflow moves, so `operator/upgrade` does not hold another package's test suite. No test name, assertion or behaviour changed. |
| `919d5bfa6` | `spinifex/migrate` | `spinifex/operator/upgrade` | Owner decision: the operator-driven config-file and object-store upgrade workflow behind `spx admin upgrade` belongs to `operator/upgrade`, distinct from `foundation/state/migrate`. Package renamed to `upgrade`; no registry types, migration names, versions, file formats or command names changed. It imports only `foundation/state/{kvutil,migrate}`, `providers/objectstore` and jetstream, so it carries no layering debt. `scripts/diff-coverage.sh` and `VERSIONS.md` point at the new path. Full preflight passed apart from the recorded Go 1.27.0 advisory exception. |
| `5292bd22c` | — | — | ADR-0001 layering ratchet added, with the nine import edges it found missing from this record recorded below; it lives at `architecture/layering` beside `tests/`, outside the product tree. |
| `8bf162fb7` | `spinifex/utils/ec2_subject.go` (`SubjectEnsureDefaultVpc`) | `contracts/ec2/v1` (`EnsureDefaultVpcSubject`) | The default-VPC request/reply subject crosses the gateway–daemon process boundary, so its home is the EC2 contract. Only the subject moved; the request and reply bodies remain anonymous structs on each side, as the contract README states. |
| `6b01f39e7` | `spinifex/admin` (config generation, certificate issuance, host discovery, telemetry, email validation, image import/removal, orphan volumes) | `spinifex/operator/admin` | These are operator use cases consumed only by `operator/cli` and `operator/installer/ui`. Certificate issuance moves as an operator use case; `foundation/pki` keeps generic CA-key loading and the tenant ACM CA stays in `domains/acm`. Legacy `admin` keeps `DefaultAccountID`/`DefaultAccountName`, `GenerateAWSAccessKey`/`GenerateAWSSecretKey` and `images_promote.go`; the private `readAMI` helper and the removal test fixtures are duplicated there rather than shared. No forwarding shim; `operator/cli` imports the legacy package as `legacyadmin`. Full preflight (excluding the recorded Go 1.27.0 advisories) passed. |
| `29f9ad07f` | (characterisation only) | — | Pins the `ebs.<node>.fenced` and `ebs.<node>.abandon` subjects (named and single-node forms), the exact JSON of `VolumeFencedEvent`, `VolumeAbandonRequest`/`Response` and `DirtyRecord`, the `VIPERBLOCK_VOLUME_DIRTY` bucket name and the volume key rule against golden literals before anything moved. |
| `53697bc76` | `spinifex/services/viperblockd/vbwire` (fence and abandon subjects and payloads, `DirtyBucket`, key rule, `DirtyRecord`) | `contracts/viperblockd/legacy/v1` (`fence.go`, `abandon.go`, `dirty_marker.go`) | These routes and the dirty marker cross the daemon–viperblockd process boundary and, for the marker, persist across nodes, so they are deployed legacy contract vocabulary. The characterisation tests moved with them, literals unchanged. The README records the approved dirty-marker boundary: the adapter owns it, only the adapter writes, recovery on any node and `spx admin` (read-only) consume it, no TTL, N/N-1, no renames or reinterpretation, and a breaking change needs a successor contract. `docs/service-interfaces.yaml` now lists both routes for the daemon and viperblockd. |
| `f17e93aed` | `spinifex/services/viperblockd` (lease, fence, dirty-marker writes, nbdkit recovery, provider handlers, `Config`) and `vbwire` I/O helpers | `spinifex/providers/ebs/viperblock` and `spinifex/providers/ebs/viperblock/dirty` | The Viperblock EBS adapter is a provider; it and `internal/testkit/vbscan` are the only importers of the Viperblock library. `dirty` exposes only `ListUnsealedVolumes`; it never creates the bucket (unchanged behaviour), and write, clear and purge stay unexported in the adapter. `operator/cli` uses the reader, so it is not a raw KV client. `vbwire` is deleted and its frozen-list and allowlist entries removed. The adapter loads its key through `bluebottle/pkg/masterkey`, so `utils/encryption.go` was not needed. |
| `7e70222f1` | `spinifex/services/viperblockd` (role supervision, opt-in live data-path tests) | `spinifex/runtime/roles/viperblockd` | ADR-0001 maps `services/*` to `runtime/roles/*`; what remained is an 82-line role. It was the last package under `services/`, which now holds nothing. Full preflight (excluding the recorded Go 1.27.0 advisories) and `manifest-check` passed for each of the four commits. |
| `7a45e7a3e` | (characterisation only) | — | Pins the subject, JSON, reply envelope, delivery mode and queue group of all 22 inbound `vpc.*` network-realisation routes where they lived. `docs/service-interfaces.yaml` gains six live routes it was missing (IGW routes, subnet egress gating, system egress). |
| `77ac0f0f7` | (new contract) | `contracts/network/v1` | Versioned vocabulary for the `vpc.*` control-plane-to-network-realisation boundary: one file per route family, the `{success,error}` acknowledgement envelope and the `vpcd-workers` queue group. Network owns the meaning and wire contract because it owns OVN and host realisation; EC2 and managed-service domains own their AWS-visible transitions and decide when to project them. The README states it does not move `vpcd` and changes no lifecycle or reliability semantics. |
| `105048594` | Subjects and payload types in `domains/network/subscribers`, `domains/ec2/{vpc,eip,natgw}`, `handlers/eks` and `contracts/ec2/v1/igw.go` | `contracts/network/v1` | Producers and the subscribers use one vocabulary; the duplicates are deleted, including the IGW attach/detach declarations in `contracts/ec2/v1` (network is the sole owner). Wire bytes are unchanged: `networkv1.SecurityGroupRule` carries the publisher's nine fields with its tags (the subscriber-side golden now pins the `"rule_id"` the publisher always sent), and both NAT-gateway publisher shapes marshal as before. `domains/ec2/vpc.SGRule` stays because it is EC2's persisted rule record, converted at the publish boundary. |
| `3aa82953e`, `46f448963` | `spinifex/utils/vpcd_event.go` and the raw `vpc.*` publishes in EC2, ELBv2, EKS, the daemon and `domains/network/systemvpc` | `spinifex/domains/network/projection` | A typed projection client with one method per operation and delivery mode; callers pass no subject strings. Timeouts (5s, 45s NAT add, 15s NAT delete), the NAT add barrier, the ErrNoResponders retry (3 attempts, 500ms) and non-fatal teardown are unchanged, and the inconsistent NAT paths keep their current mode under honest names (recorded below). The IGW, NAT-gateway, IGW-route and egress-gate publishes previously logged their own `WarnContext` messages with `subnetId`; they now log the shared publish warning without request context or subnet, a diagnostic loss only. |
| `fd88e8ceb` | `spinifex/utils/encryption.go` (`LoadViperblockMasterKey`) | `spinifex/domains/ec2/ebs/encryption` (`Enabled`) | EC2's AWS-visible EBS encryption posture, a temporary reading of the provider's key-file setting rather than an encryption implementation. Cache, error text and each caller's handling are unchanged (image reports unencrypted on a load failure; instance and volume return InternalError). `utils/` is deleted; the layering test retires `utils` and `services` and fails if either regains files. The S7 subject-prefix scan now walks `contracts/network`, where the `vpc.*` literals live; after the projection move it had silently stopped listing them. Full preflight (excluding the recorded Go 1.27.0 advisories) and `manifest-check` passed for each commit. |
| `38fbd1499` | (characterisation only) | — | ADR-0007 slice 0: pins the local file's exact bytes and schema failure modes, the instance bucket configuration, the `i.<id>` key and wire form, the bucket version gate, generation preservation across every KV writer and the VM conversion, and what a returning node does with a missing, foreign, terminal or unreadable canonical record. Current behaviour, not the ADR target; see the slice 0 section below. |
| `6fa09d336` | (governance only) | — | ADR-0007 slice 0 ratchet at `architecture/instancestate`: freezes the 73 direct production uses of raw instance state found by the inventory below. |
| `2a196f9ba` | (governance only) | — | ADR-0007 slice 0 ratchet narrowed to instance-state access: the `JetStreamManager` type and constructor are no longer matched, the cluster-state consumers INV-09 and INV-19 leave the allowlist, and 67 entries remain. |
| `09646388e` | (revert only) | — | The ADR-0007 slice 1a design and slice 1b step 1 codec stack (`e9e11d531` to `c3f302423`) leaves this ADR-0001 checkpoint: no production reader or writer called the codec, so carrying it would ship dormant lifecycle implementation. `record_codec.go`, its tests and `docs/package-boundary/instance-state-transition-record-design.md` are removed, with the codec's instance-state ratchet owner-file line and the record rows and section describing them. The slice 0 evidence (`38fbd1499`, `6fa09d336`, `c04222b27`, `2a196f9ba`, `830f70489`) stays, and `domains/ec2/instance/state` stays for the vpcd IMDS readers. The stack is reapplied on a fresh ADR-0007 branch from `dev` after this checkpoint merges. |
| `e40e699e5` | `spinifex/vpcd/imds_instance_state.go` | `spinifex/domains/ec2/instance/state/imds_readers.go` | The local-file reader (`LocalVMReader`/`NewLocalVMReader`, formerly `localVMStateReader`) and the instance-record loader opener (`OpenInstanceRecordLoader`, formerly `newInstanceRecordLoader`) move unchanged to the instance-state boundary; `vpcd.Config` gains `LocalVMs guestmetadata.LocalStateReader` and `OpenInstanceRecords func(ctx, nc) (guestmetadata.RecordLoader, error)`, wired by `operator/cli` with `state.NewLocalVMReader(nodeConfig.DataDir)` and `state.OpenInstanceRecordLoader`, so `vpcd` no longer imports `daemon` directly. `guestmetadata`'s own narrow interfaces are exported (`LocalStateReader`, `RecordLoader`) with no semantic change so `vpcd.Config` can name them. The opener's absence is now a fatal startup error rather than an unchecked call, matching the existing mandatory-open behaviour. The instance-state ratchet's INV-13 entries move with the file; `OpenInstanceRecordLoader` returning `guestmetadata.RecordLoader` directly (so the two packages' function types match exactly) removes the file's local `recordLoader` interface and its `vm.InstanceRecord` reference, so INV-13 now cites 5 symbols rather than 6. `vpcd` still runs the legacy bucket-opening path (`InitKVBucket`, the version gate and the instance migrations) through the injected opener; that is ADR-0007 debt (INV-13) and is deliberately not fixed here. Full preflight passed except the recorded Go 1.27.0 advisories. |
| `7bf6c10d7` | `spinifex/vpcd` | `spinifex/runtime/roles/vpcd` | The whole vpcd role moves unchanged to its ADR-0001 runtime-role target: all sixteen production and test files (`vpcd.go`, the lease reaper, the OVN controller watchdog, the host-EIP loop, lease datapath reconcile and their tests), with no split and no lifecycle-behaviour change. The package name stays `vpcd`. `operator/cli/service.go` and `runtime/service/{service,service_test}.go` update their import path. `docs/service-interfaces.yaml`'s `vpcd` service entry, `.github/CODEOWNERS` and the real-manifest case in `tests/e2e/select-suites/selector_test.go` follow the new path; that package's own synthetic `testManifest()` fixture keeps its illustrative `spinifex/vpcd` string by design, decoupled from the real manifest. The network invariant scan roots in `domains/network/invariants/{nat_mode,nats_subjects,names}_test.go` and the S3 exemption for `vpcd.go` follow the new path; injected `UplinkMode()` and `vpc-`-prefixed concat faults in moved files failed S3 and S4 respectively, confirming the scan still covers them, and were reverted by hand. `ingress/aws/invariants/deps_test.go` keeps `vpcd` in its `forbiddenRoots` as defence in depth: `runtime` already rejects an import of the new path, confirmed by an injected import of `runtime/roles/vpcd` into an `ingress/aws` file, and the retained entry still rejects an ingress import of a recreated legacy `vpcd` directly. The layering package drops `vpcd` from `legacyRoots`, `runtimeLegacy` and `frozenLegacyPackages` and adds it to `retiredLegacyRoots`, so `runtime/roles/vpcd` classifies as runtime automatically and a revived `spinifex/vpcd` directory fails the frozen-root guard, both confirmed by fault injection and reverted; the stale `operator/cli` → `vpcd` allowlist entry is deleted rather than repointed, because operator already imports other `runtime/roles/*` packages with no allowlist entry and no rule forbids it. The instance-state ratchet's allowlist cites no vpcd path and is unchanged. |
| `a130f6b8e` | `spinifex/handlers/ecs/bus` | `contracts/ecs/v1` (`ecsv1`) | The ECS scheduler-agent wire vocabulary moves with no legacy shim: five subject builders and the message types (`RegisterInstance`, `Heartbeat`, `Assign`, `AssignContainer`, `StopDirective`, `TaskState`, `ContainerStatus`, `InstanceCapacity`, `PortMapping`, `SystemControl`, status constants). Subject strings, JSON fields and types are byte-identical; the old-agent `AssignContainer` compatibility test moves unchanged and new golden pins cover every message type that had none. A trace found only `service-reconcile` live on the bus (`handlers/ecs/instances.go` publishes, the scheduler leader subscribes); the agent reuses `Assign`, `StopDirective` and `TaskState` as payloads of the gateway's `PollAssignments` and `SubmitTaskStateChange` actions, and the README route table and type comments say so. `docs/service-interfaces.yaml` lists `ecs.bus.*` and the contract path under the daemon. The layering package drops the stale `agents/ecs/agent` → `handlers/ecs/bus` allowlist entry and the frozen-package entry. |
| `263c58167` | `spinifex/admin` (`images_promote.go`: `SystemOwnerAlias`, `PromoteImageOpts`/`PromoteImageResult`, `PromoteSystemImage`, `GetAMIMetadata`, the private `readPromotedSnapshot`, and its test fixtures) | `spinifex/domains/ec2/image` | The cohesive image-promotion API moves to its existing domain owner with only the package line changed: no storage, key, ordering, error or promotion-behaviour change, and no name collisions. `daemon/daemon_handlers_image.go` and `gateway/spx/promote_image.go` drop their `admin` import and use `ec2image`; `operator/cli/admin.go` adds `ec2image` and keeps `legacyadmin` for the account identifiers and key generators. `admin` now holds only `accounts.go`. No new forbidden edge and no stale allowlist entry. |
| `3fdaa54d9` | `spinifex/admin` (`DefaultAccountID`, `DefaultAccountName`) | `spinifex/foundation/aws/identifiers` | The fixed, platform-reserved bootstrap account identifiers join `GlobalAccountID`: the ID and name of the first human-facing account created during bootstrap, used by `daemon`, `gateway`, `runtime/roles/awsgw`, `accountteardown` and `operator/cli`. Function names and values are unchanged, and they stay fixed rather than configurable. Callers use the existing `awsidentifiers` alias; `daemon`, `gateway`, `runtime/roles/awsgw`, `accountteardown` and the other `operator/cli` files drop their `admin` import, and `operator/cli/admin.go` keeps `legacyadmin` only for the credential generators. The `TestDefaultAccountID` assertion moves with the function, plus a name pin and a check that the ID is valid and distinct from `GlobalAccountID`. `admin` now holds only the IAM credential generators. |
| `254d898a3` | `spinifex/handlers/sts` (`oidc_jwks.go`: the `handlers_eks.AccountBucketName`/`OIDCJWKSKey` import) | `spinifex/handlers/eks` (`OIDCJWKSReader`, a `ClusterJWKSResolver` implementation), wired by `spinifex/runtime/roles/awsgw` | The Q-22 STS-to-EKS dependency is cut by a consumer-owned resolver: `handlers/sts` declares `ClusterJWKSResolver` (raw-bytes lookup, the same found/error split `FetchClusterJWKS` already had), and `handlers/eks` implements it beside `AccountBucketName`/`OIDCJWKSKey` with the same bucket-open-then-get, timeouts and not-found classification `oidc_jwks.go` used. STS still decodes the JWKS, applies the empty-keys rule and maps every outcome to `InvalidIdentityToken`, unchanged. `runtime/roles/awsgw` and `tests/integration/harness.go` construct the resolver and pass it to `NewSTSServiceImpl`, now a required, nil-checked argument; the compile-time interface check lives in `awsgw` because `handlers/eks` must not import `handlers/sts`. The literal bucket/key, KV-dependency-failure and cluster-status-not-consulted characterisation tests move to `handlers/eks`, next to the layout they pin; every remaining `handlers/sts` test, including the web-identity fixtures and `newTestSetup`, is rewritten against a test-owned `fakeJWKSResolver` and imports no EKS package. The one test proving an EKS-minted issuer URL parses through STS's `ParseEKSIssuerURL` moves to `tests/integration` as a composition test. The stale `handlers/sts` → `handlers/eks` allowlist entry is deleted. |
| `0368e861a` | `spinifex/admin` (`accounts.go`: `GenerateAWSAccessKey`, `GenerateAWSSecretKey`, and their format and uniqueness tests) | `spinifex/foundation/aws/credentials` (`awscredentials`) | A stateless AWS credential-format primitive: it generates an `AKIA` + 16-alphanumeric access key ID and a 40-character base64 secret key, and issues, stores and authorises nothing. It is not IAM issuance and does not implement ADR-0005 S5. Output, randomness source, errors and names are unchanged; only the package line and doc comment changed. It is deliberately not unified with `handlers/iam`'s internal `generateAccessKeyID`, whose IDs are `AKIA` + 20 uppercase hex characters. `handlers/iam` and `operator/cli/admin.go` import `awscredentials`; `operator/cli` no longer imports any `legacyadmin`. The `spinifex/admin` directory is deleted: `admin` leaves the legacy-root, frozen-package and operator-legacy lists, joins the retired roots so it cannot return, and its two allowlist entries (`handlers/iam` → `admin`, `operator/cli` → `admin`) are removed. Operator bootstrap still generates the admin and Northstar credentials directly, recorded as debt below. |
| `0d830e901` | — | `spinifex/domains/tagging` (`TaggedLister`, `TaggedResource`) | The read-only list capability for the Resource Groups Tagging aggregation, declared by its consumer per ADR-0001. `ListTagged` takes the caller's account and the lower-cased `ResourceTypeFilters` set, where an entry is a full `service:type` or a bare service, and returns ARNs with read-only tag maps. The package imports no domain, handler or contract package and the layering ratchet classifies it with no allowlist row. It carries no mutation, limit or ever-tagged surface. |
| `f3545e3ea` | `spinifex/gateway/tagging` (`listEC2`, `buildEC2Mappings`, `ec2ARN`, `elbv2Resources`, `matchesType`), copied | `spinifex/runtime/roles/awsgw` (`ec2IndexLister`, `elbv2Lister`), `spinifex/domains/tagging` (`MatchesType`) | AWSGW-side NATS client adapters implement `tagging.TaggedLister`, each with its compile-time check beside it in the composition root; no owner package carries one. The EC2 index adapter wraps `ec2.DescribeTags` and builds each ARN in the gateway's region from the stored resource type, including the unresolved-ID shapes today's code produces. The ELBv2 adapter lists load balancers and target groups admitted by the type filter, tagged or not, and reads tags in `DescribeTags` batches of 20. Both reuse existing subjects and clients, so no wire contract is added, and each call builds fresh tag maps. Type matching is exported once from `domains/tagging` so no copy survives the move. Embedded-JetStream tests cover type filters including a bare service, untagged ELBv2 resources, EC2 ARN mapping, account scoping, batch sizes and owner error propagation. |
| `aedd0b2c4` | `spinifex/gateway/tagging` (`GetResources` parsing, tag filtering, sorting, offset token, authorization, response writing) | `spinifex/domains/tagging` (`Aggregator`, `NewAggregator`, `HasScope`, `ScopedActions`), wired by `spinifex/runtime/roles/awsgw` | The aggregation moves unchanged and consumes `[]TaggedLister`: ELBv2 is called before EC2, the non-stable ARN sort is kept, lister errors propagate with the same codes, and tag maps return as key-sorted tag lists with `[]` for untagged resources. AWSGW builds the aggregator with both adapters and sets the new `GatewayConfig.TaggingResources` field; the dispatch in `gateway/tagging.go` stays and still answers `ServerInternal` when NATS or the aggregator is not wired. The `TestCurrentBehaviour_Tagging_GetResources*` tests move to `runtime/roles/awsgw` with unchanged assertions, seeding EC2 tags through the existing EC2 tags client over NATS; pure aggregator tests move to `domains/tagging` against fake listers; the gateway keeps dispatch and error-path tests. The gateway's private copies of the listing helpers and the legacy NATS lister are deleted with their tests, `gateway/tagging` is removed, and its two allowlist rows (`gateway/tagging` → `domains/ec2/tags`, `gateway/tagging` → `handlers/elbv2`) and its frozen-legacy entry go with it. |
The EC2 contract row is intentionally different from the directory moves: it creates
a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS
subscription and permission shape, while callers use
`InstanceCommandSubject` rather than reconstructing the subject. The
contract's README states the route, scope and change rule.

### ECR composition boundary remaining

The ECR AWS JSON dispatcher and `/v2/*` route assembly remain methods on the
generic `GatewayConfig`. They establish the generic HTTP route, authenticated
request context, bounded-body read and policy gate, then invoke the ECR domain
packages above. They are not moved merely to remove the last ECR-named files
from `gateway`: doing so first would make the ECR domain own generic gateway
state and policy mechanics.

Registry-backed image actions have now crossed this boundary through
`awsapi.RegistryActionService`: the composition root supplies the OCI
capabilities, and the generic gateway dispatches through it after authorization.

Lifecycle-preview actions have likewise crossed it through
`awsapi.LifecyclePreviewActionService`, whose policy-store-plus-image-catalog
dependencies remain explicit and separate from the registry image-action
service.

Repository metadata actions have crossed it through
`awsapi.RepositoryActionService`, which makes both their narrow metadata-store
dependency and advertised endpoint profile composition explicit.

Authorization-token issuance has crossed it through
`awsapi.AuthorizationTokenActionService`. Gateway intentionally still builds
the canonical IAM/STS principal before dispatch, because ECR must not depend on
gateway identity context or ARN construction.

All implemented ECR control-plane actions now dispatch through explicit ECR
capabilities. The remaining ECR-named gateway code is generic `/v2/*` route
assembly, SigV4/registry authentication and policy enforcement; it remains in
gateway rather than inverting those dependencies into the ECR domain.

### ACM relocation residuals

The ACM move leaves two pre-existing dependency seams visible rather than
changing their behaviour in a structural slice:

- `domains/acm.Store` still imports IAM's AES-GCM helper functions. It does
  not read IAM records, but the crypto mechanism must move behind a shared
  crypto boundary before the final domain-dependency lint can prohibit that
  implementation import.

The ACM action-name dispatch map has since cleared: `fdaf589ca` below registers
ACM's AWS JSON 1.1 control plane from `domains/acm/awsapi`, wired only by
`runtime/roles/awsgw`, and no `ACM_Request` or `acmActions`/`acmActionFromTarget`
dispatch remains in `gateway`.

### Guest metadata relocation residuals

The guest-metadata move keeps every existing import unchanged, so the domain package now shows these breaks of the target dependency rules.
Each needs a consumer-owned capability, projection or versioned contract before the dependency lint (ADR step 8) can be enabled.

- `domains/ec2/guestmetadata` imports the DNS, IAM and STS implementations, which breaks rule 3 (no domain reads another domain's implementation). Its EC2 key and instance imports are same-domain once those resources sit under `domains/ec2`; they remain resource-to-resource implementation imports for the EC2 decomposition to review.
- `domains/ec2/guestmetadata` imports `runtime/compute/vm` for instance records and VM reconstruction, the first domain-to-runtime edge; runtime is meant to compose domains, not be imported by them.

### Dependency-rule debt to clear after the moves

These residuals were recorded by individual slices and must be resolved once the structural moves are complete, before the dependency lint is enabled.

- Guest metadata: the cross-domain and runtime imports above.
- EC2 → network implementation: `domains/ec2/vpc/eni.go:18` and `eni_lease_rebind.go:11` import `domains/network/topology`, `eni.go:17` also imports `domains/network/identifiers`, `external_ipam.go:10-11` imports `domains/network/external` and `domains/network/external/dhcp`, `domains/ec2/eip/service_impl.go:17` and `lease_rebind.go:11` import `domains/network/topology`, and `domains/ec2/instance/service_impl.go:31` imports `domains/network/topology`. EC2 reads network's implementation directly rather than through a capability or projection; this clears when EC2's network-facing reads and writes go through the EC2-owned projection recorded above (step 7).
- Cross-domain: `domains/ecr/auth/signingkey.go:24` and `domains/ochre/vector/appliance.go:15` import `handlers/iam`; this needs an IAM capability rather than the IAM implementation package. `domains/ochre/launch.go:17-18` and `domains/ochre/vpc.go:9` import `domains/ec2/systeminstance` and `domains/network/systemvpc`; Ochre consumes managed-service launch and system-VPC realisation as domain implementations rather than capabilities.
- Domain → runtime: `domains/ochre/capacity.go:9` imports `runtime/compute/gpu`; `domains/ec2/volume/service_impl.go:30` and `volume_leak_reaper.go:8` import `runtime/compute/vm`; `domains/ec2/instance/status_selection.go:9` also imports `runtime/compute/vm`. Each reads VM or GPU runtime state directly instead of through a domain-owned projection.
- STS web-identity verification never consults cluster status: tokens verify while a cluster is DELETING until teardown sweeps the prefix, and a FAILED launch keeps its JWKS. AWS behaviour must be established before calling it a divergence. Removal condition: AWS behaviour verified, and the resolver or EKS lifecycle aligned with it.
- The public `/keys` endpoint (root `gateway`, `oidc_discovery.go`) serves malformed stored JWKS bytes with HTTP 200. Removal condition: validate before serving, or record it as accepted.
- The public discovery and `/keys` endpoints return 404 for KV read errors, including timeouts; only a bucket-open failure returns 500. Removal condition: distinguish dependency failure from not-found.
- The root `gateway` package imports `handlers/eks` directly (`gateway/oidc_discovery.go`: `AccountBucketName`, `GetClusterMeta`). The layering rules don't see it because the root gateway has no domain classification, so it has no allowlist entry. Removal condition: the public OIDC discovery and JWKS endpoints consume an EKS-owned resolver injected at composition, the same pattern as STS, leaving the root gateway with no `handlers/eks` import.
- `handlers/elbv2/{agent_types,haproxy,health_checker,nginx}.go` import `lbagent` (`HealthReport`, `ServerStatus`, `CertDir`, `NginxPIDPath`, `NginxCertDir`), a domain reading an agent's implementation package rather than a declared wire contract. Removal condition: the health-report and cert/PID-path vocabulary moves behind a guest/controller contract the domain and the agent both consume.
- `domains/ec2/instance/state/imds_readers.go` (dependency, IMDS readers) imports `daemon` for `LocalState`, `ReadLocalState`, `LocalStatePath`, `NewJetStreamManager` and `InstanceStateBucket`. The local-file reader and the instance-record loader's `JetStreamManager` open, which `vpcd/imds_instance_state.go` held directly, moved here unchanged and are now injected into `vpcd` through `guestmetadata.LocalStateReader` and `guestmetadata.RecordLoader`. The readers already live in `domains/ec2/instance/state`. Removal condition: the legacy dependencies they call are extracted from `daemon` — `LocalStatePath`, `ReadLocalState` and `LocalState`, the instance bucket constants, and `JetStreamManager` with its bucket initialisation (`InitKVBucket`) — leaving `domains/ec2/instance/state` with no `daemon` import.
- Advisory: 27 production files across `domains/{acm,dns,ec2/*,network/host,network/ovn,ochre}` import `bootstrap/config` directly rather than through typed constructor inputs, which ADR-0001's `config` row expects. `bootstrap/preflight/preflight.go:15` imports `runtime/host/command` and `services.go:13` imports `operator/host/systemd`; both are expected bootstrap-to-runtime/operator edges for startup validation and are not domain-rule violations.
- Operator bootstrap credential generation: `operator/cli/admin.go` mints the bootstrap admin and Northstar access keys and secrets directly with `awscredentials` and writes them into config, rather than asking an IAM bootstrap capability to issue them. `awscredentials` only formats the values. Removal condition: a real IAM bootstrap capability issues these credentials and `operator/cli` calls it.
- `domains/dns`: imports `runtime/compute/vm` (domain-to-runtime), `domains/network/reconcile` for the reconcile lock and `bootstrap/config` for node configuration.
- ACM: the IAM AES-GCM helper import (ACM relocation residual).
- `runtime/roles/awsgw`: the quota reconcile loop belongs to `domains/admission/quota`, and the EKS token-verify responder belongs with STS or EKS identity.
- `runtime/roles/awsgw` → `handlers/elbv2` (inherited from `gateway/tagging`): this is a new physical import in AWSGW that inherits the former `gateway/tagging` dependency, because the `elbv2Lister` adapter builds its client with `handlers_elbv2.NewNATSELBv2Service` and calls the `ELBv2Service` interface. It is permitted temporarily because AWSGW is the composition root, which may wire legacy packages, so the layering test needs no allowlist row. Removal condition: it must clear when ELBv2 exposes a domain-owned boundary (its NATS client or contract under its domain owner) and the adapter consumes that instead.
- `runtime/roles/vpcd` (placement): the role still mixes process/role supervision with network-controller responsibilities. `lease_reaper.go` (orphaned external-pool DHCP lease sweep), `ovn_controller_watchdog.go` (OVN controller liveness and restart), `host_eip_loop.go` (host-EIP reconcile loop) and `lease_datapath_reconcile.go` (lease datapath reconcile) are periodic network-control loops, not role wiring; `vpcd.go` itself also carries bridge-mode detection and verification, chassis-list parsing, external-CIDR resolution, DHCP manager startup and lease/IP-change handling, and gateway/host-EIP allocator and neighbour flush/prime construction alongside `Service.Start`. The future placement question is whether these belong in `domains/network`. Removal condition: an accepted decision on network-controller placement, and extraction of those loops and helpers behind the role.
- ECR control-plane registration: `awsapi.Deps.NATS` is a raw `*nats.Conn`, not a narrow capability. Every NATS-backed `Handler` passes it to `domains/ecr.NewNATSMetaStore`, which calls `natsmsg.NATSRequest`, so narrowing it means changing the exported `Handler` type, every handler and the meta store; it must not be broadened further meanwhile.
- ACM control-plane registration: `domains/acm/awsapi.Deps.NATS` (`registration.go`) is likewise a raw `*nats.Conn` carried by every `Handler`, for the same reason; it must not be broadened further meanwhile.
- `cmd/aws-model-coverage` imports `ingress/aws/dispatch`, `domains/ecr/awsapi`, `domains/acm/awsapi` and `gateway` to read ECR's and ACM's declared inventories. It is a non-serving tool and the only named exception to the ADR-0002 composition invariant; it must not construct a registration.
- Ingress pipeline (ADR-0002 phase 4): the request-audit record, the trace action enricher, the throttle key functions and the gateway request-context keys stay in `gateway` until the auth/IAM and request-context boundary is designed. SigV4 authentication writes the audit record and context keys from four places, so moving them now would export exactly the setters ADR-0002 says must not be exported solely to make a directory move possible.
- NAT projection delivery is inconsistent and is preserved as found: EIP `AssociateAddress` sends `vpc.add-nat` unacknowledged (`AnnounceNATAdd`), skipping the 45s OVN barrier every other add path waits on, and `DeleteNetworkInterface` sends `vpc.delete-nat` unacknowledged (`AnnounceNATDelete`), skipping the ack and the ErrNoResponders retry. The reconciler's orphan sweep is the only backstop for both. Clears when those call sites use `AddNAT`/`AddNATBestEffort` and `RemoveNAT`, a reliability change of its own.
- `vpc.add-system-egress` has a `vpcd` subscriber and a contract entry but no producer (its former `domains/ec2/eip` publisher is gone); `handlers/eks` still publishes the delete. Either a producer is missing or the add route is dead; it needs an owner decision.
- EBS encryption posture: `domains/ec2/ebs/encryption` reads the Viperblock key-file setting to decide what EC2 reports. Clears when `providers/ebs` reports each volume's encryption posture and EC2 stops reading key files.
- `foundation/messaging/nats/nats_trace.go` still names its OpenTelemetry tracer `github.com/mulgadc/spinifex/spinifex/utils`. It is an emitted instrumentation-scope name that dashboards may filter on, so renaming it is a telemetry change, not a path fix.
- `runtime/compute/cache.New`: two construction-time panics carry a lint exemption pending a constructor that returns an error.
- `domains/ec2/systeminstance`: managed-service parent metadata is only the `ManagedBy` tag value.
- `gateway/bedrock`: holds the Ochre domain core (model catalogue, provisioned throughput, guardrail, access, credential, usage, price, logging and weights stores), the inference engine (provider, vLLM, Anthropic, embeddings, reranker, admission) and the Bedrock action layer in one package with internal cycles. `domains/ochre` imports it, which is the ADR step 7 Ochre gateway import. Splitting it needs a plan: domain core and stores to `domains/ochre/<resource>`, inference to an Ochre-owned package, and only the action layer to `domains/ochre/awsapi`. The top-level `gateway/bedrock*.go` HTTP handlers additionally wait for the ingress registration seam.
- `domains/network`: `reconcile/intent.go` builds desired network state by reading EC2's KV buckets and decoding EC2's private VPC, subnet, ENI, route-table, gateway, EIP, NAT and security-group records, and `reconcile/drift.go` watches those buckets. ADR-0001 names this pair explicitly: EC2 and network communicate through a capability/projection or versioned contract, never by one being the other's KV reader. Step 7 fix: an EC2-owned `domains/ec2/projection` exposing network intent with list and watch (it may stay KV-backed, so no data moves); a narrow intent interface declared by `reconcile`; wiring at the composition root; and the duplicated `PurposeEIP`/`PurposeIGWLRP` constants and mirrored `SGRule`/`SGEvent` folded into the projection or `contracts/ec2/v1`. The drift-watch coverage test and reconcile scenario tests are the evidence the projection must keep. `domains/network` also imports `runtime/compute/vm` and `runtime/host/command` (domain-to-runtime).
- `domains/ec2/instance`: imports `runtime/compute/vm` and `runtime/compute/gpu` (domain-to-runtime) and `domains/dns` (cross-domain implementation import).
- `domains/ec2/instance/state` (dependency): the vpcd IMDS local reader imports `runtime/compute/vm` to return `vm.VM`. Removal condition: that type moves into a domain-owned package that `runtime/compute/vm` consumes (runtime to domain is allowed).
- `agents/eks/tokenwebhook`: imports `handlers/eks` for `WebhookTokenReviewResult`, an agent depending on a domain implementation. Temporary: the eventual EKS contract or projection for the token-review reply needs its own design, and no contract is invented to complete the move.
- `agents/ecs/agent`: takes its wire types from `contracts/ecs/v1`, and still imports `handlers/ecs` for the poll-assignment and GPU-report inputs and outputs and the instance-type and availability-zone attribute names. Temporary agent-to-domain debt; no contract is created during the relocation.
- `agents/rds/agent` (wire contract): imports `handlers/rds` for the command, reply, parameter, health and bootstrap types exchanged with the control plane. Temporary agent-to-domain debt; no contract is created during the relocation. The earlier `LookupEngine` dependency on the RDS domain's engine registry has since cleared: `controlPlaneRulesFrom` and both engine constructors now take the agent-declared `EngineCatalog` (see the narrowed entry below), with zero production uses of `LookupEngine` remaining in `agents/rds/agent`.
- `operator/installer/firstboot` (security): `Config.InstallCallback` is rendered into `spinifex-firstboot.sh`, which is world-readable (0755). The field is currently unused (`fireInstallCallback` reads `SPINIFEX_INSTALL_CALLBACK` from the environment instead), but any future wiring must not place secrets or tokenised callback URLs in the generated script; sensitive callback credentials should reach first boot through a protected channel such as a 0600 file or a credential store.
- `operator/cli` (known security risk): `spx admin join` contacts the formation server with `InsecureSkipVerify`, sends the join token as a bearer credential and receives the cluster CA certificate and key, master key, Viperblock key and shared credentials, so an on-path attacker during formation can capture the token and the cluster root secrets or substitute a CA. This predates the move; lint surfaced it when the tree left `cmd/`. It is accepted for now and carries a line-level gosec annotation stating it is not a false positive. Removal condition: authenticate formation TLS with a pinned key or certificate delivered with the join material, or an out-of-band CA, with tests proving a mismatched server certificate fails before credentials are sent.
- `handlers/eks` (potential security risk): `ClusterMeta.ControlPlaneTemplate` (`handlers/eks/service_impl.go`) clears the template's credentials but keeps `OIDCPrivateKeyPEM` and the k3s `JoinToken`, so both are persisted in the `eks-account-{acct}` cluster record, which the gateway also reads. Whether that record is encrypted at rest is unconfirmed; if it is not, a reader of the bucket can forge service-account tokens for the cluster's OIDC issuer and join nodes to it. This predates the refactor and is not fixed in it. Removal condition: the key and token are held by a dedicated secret store (a future KMS or Secrets Manager capability is the likely owner) and the cluster record keeps only a reference, with a test proving the persisted record contains neither secret.
- `operator/cli` (dependency): the command tree still imports domain and service implementations directly (`handlers/{iam,eks}`, `domains/admission/quota`, `gateway`, `gateway/bedrock`, `daemon`, `vpcd`, `accountteardown`, the Viperblock adapter and runtime roles). The ADR's `cmd/spinifex` current-to-target map row requires command packages to reach domains through public capabilities; splitting supported use cases into `operator/*` packages is later work.
- `providers/ebs/viperblock` → `runtime/compute/nbd` and `runtime/host/process` (dependency, moved unchanged from `services/viperblockd`): the adapter formats NBD endpoints and manages nbdkit processes through runtime packages. ADR-0001 does not list providers → runtime as forbidden and the layering test does not enforce it (same category as `providers/ebs/conformance` → `runtime/compute/nbd`), but a provider should not depend on node runtime. Clears when NBD endpoint naming has a provider-facing home (a candidate for `contracts/ebs/v1`) and process supervision is injected by the role. The adapter also imports `providers/objectstore`, a provider-to-provider edge that is allowed.
- `gateway/ec2.go` (registration): the EC2 dispatch map stays a `GatewayConfig` method in `gateway` and imports every `domains/ec2/awsapi/*` package; `gateway/ec2_idempotency.go` also imports `domains/ec2/awsapi/idem` (`KVBucket`, `TTL`, `TokenAndParams`) for the dispatch-time idempotency wrapper. ADR-0001 makes the domain own its action registration; moving the map waits on the generic ingress registration seam and must not be done as a package move.
- `gateway/requestaudit.go`: the outermost request-audit middleware records AWS fields and is updated from four places in the gateway's authentication flow through the gateway's own context key. Moving it would export about seven names used only by that flow, so it stays in `gateway` until the generic ingress registration seam defines how ingress middleware receives authentication results.
- `accountteardown` (dependency): its EC2 reapers call `domains/ec2/awsapi/*` action adapters directly, as they did under `gateway/ec2`. The ADR's `accountteardown` current-to-target map row replaces this with domain-owned cleanup capabilities before the package moves. It also holds a read-only consumer of the EC2 platform-inventory contract (`contracts/ec2/v1`, `ec2.v1.PlatformInventory`), served by `domains/ec2/accountinventory`; only the explicit dry run (`Engine.DryRun`) calls it, to log a shadow comparison, and the key-pair, placement-group and launch-template reapers still use the `awsapi` adapters. A domain-owned cleanup capability for the proven-safe subset of those three kinds (key pairs and empty placement groups no instance, spot request or live launch-template version names, and launch-template residue; never live launch templates) exists as `domains/ec2/accountcleanup` (a Go interface with injected owners and reference readers, no NATS subject); nothing calls it yet.
- `domains/admission/quota` (dependency, moved from `handlers/quota` unchanged): `live.go` imports `gateway/elbv2` and `handlers/rds` for its live ELBv2 and RDS counters; `records.go` imports `runtime/compute/vm` for the instance-record vCPU sweep; `live.go`, `vcpu.go` and `storage.go` call `domains/ec2/awsapi/{vpc,eip,volume}` describe adapters to count VPCs, subnets, addresses and volumes, as they did under `gateway/ec2`. The ADR's `handlers/quota` current-to-target map row replaces these with reader capabilities once their final locations exist.
- `domains/ec2/awsapi/instance` (dependency): imports `handlers/iam` (`IAMService` in `DescribeInstances.go`, `RunInstances.go` and `IamInstanceProfileAssociation.go`; `InstanceProfile` in the latter two), `runtime/compute/cache` (`NodeState`, `NodeUnknown`, `NodeLive`) and `runtime/compute/vm` (`VM`), both in `status_synthesis.go`. The IAM edge needs an IAM capability; the runtime edges are domain-to-runtime and need the instance record and node liveness exposed through an EC2-owned projection.
- `domains/ec2/awsapi/spotinstance` (dependency): imports `handlers/iam.IAMService` and `domains/admission/quota.Service` in `RequestSpotInstances.go`.
- Instance adapter consumers outside EC2: `gateway/rds/enginecatalog.go`, `daemon/eks_cp_control.go`, `daemon/rds_deps.go`, `domains/admission/quota`'s `vcpu.go` and `gateway/iam.go` (`CountInstanceProfileAssociations`) call `domains/ec2/awsapi/instance` directly; each needs an EC2 capability rather than the AWS action adapter.

Enforcement: the owner decided the layering test is blocking now, with a ratchet. Its allowlist mirrors this debt list exactly, each edge carrying its owner and removal condition; any new unrecorded forbidden edge fails local preflight and CI, and an allowlisted edge that no longer exists must be removed from the list.
- `handlers/rds` → `domains/rds/subnetgroup` (legacy edges): `instanceReferences` binds `Dependants` by scanning instance records, and `tags.go` writes the group record through its generic tag registry. The first clears when the RDS instance gains its own owner and answers `Dependants` from it. The second clears when tagging invokes a subnet-group-owned tag/untag capability rather than writing the record; moving the tagging adapter to `domains/rds/awsapi` alone does not clear it.
- `handlers/rds` → `domains/rds/parametergroup` (legacy edges): `parameterGroupReferences` binds `Dependants` by scanning instance records; this clears when the RDS instance gains its own owner and answers `Dependants` from it. `tags.go` writes the meta record through its generic tag registry; this clears when tagging invokes a parameter-group-owned tag mutation capability, and moving the tagging adapter to `domains/rds/awsapi` alone does not clear it. The Modify handler still calls `propagateParameterGroup` after the owner's write; propagation is instance-side realization and stays legacy until it is designed as asynchronous realization (group generation, instance staleness, retry). `parameterGroupValues` returns the persisted `Record` and overrides to instance code; when the instance owner is extracted, replace them with a consumer-owned resolved-parameters projection.
- `handlers/ecs` → `domains/ecs/taskdefinition` (legacy edges): `tags.go` reads and writes the revision record through its generic tag registry; this clears when ECS tagging invokes an owner-provided tag mutation capability, and moving `tags.go` to `domains/ecs/awsapi` alone does not clear it. `taskDefinitionResolver` returns the persisted `Record` to task and service launch code; when the task and service owners are extracted, replace the record crossing that boundary with a consumer-owned resolved task-definition (launch-spec) projection. Moving packages has not made the record private.
- `domains/ecs/taskdefinition` (deliberate duplication, not debt): private `getJSON`, `putJSON` and `keysWithPrefix` copy the raw-KV helpers in `handlers/ecs` so the extraction keeps ECS's get/put/list error and recovery semantics. Revisit only if a later, tested state abstraction proves it preserves those semantics; do not migrate ECS to `kvstore` merely to remove them.
- `handlers/eks` → `domains/eks/access` (legacy edges): `ResolveTokenReview` opens the EKS bucket in the gateway process and reads records through the exported `access.Get`; this clears when token review asks the owner across a contract rather than opening the bucket itself. `DeleteClusterPrefix` erases access-entry keys as part of its blanket cluster sweep; this clears when cluster delete invokes an owner-provided removal of the cluster's entries. The owner returns the persisted `Record` to the AWS adapter and token review; replace it with consumer-owned projections when those consumers are extracted.
- `handlers/eks` → `domains/eks/addon` (legacy edges): `DeleteClusterPrefix` erases add-on records and manifests in its blanket cluster sweep; this clears when cluster delete invokes an add-on-owned teardown capability. `stageGPUDeviceAddon` is a temporary node-group-to-add-on orchestration edge: best-effort, errors logged and swallowed, never undone on node-group delete; it clears when the node-group owner is extracted and the dependency is designed. `ClusterReconciler` hosts the add-on status subscription; it clears when add-on delivery observation has its own host under the lifecycle correction. Cluster existence is checked in the handler, not through an owner-declared capability; it moves into the owner when cluster admission is defined (today status is ignored). Guest wire types (`AddonStatusReport`, `AddonDeliveryPhase`, `AddonStatusSubject`, `StagedAddonManifest`, `InternalAddonsResponse`) are owned by `contracts/eks/v1`, which `handlers/eks`, `gateway/eks` and `agents/eks/gatewayfetch` import directly.
- `handlers/eks` and `gateway/eks` → `domains/eks/addon` (further edges): the AWS adapter reads the persisted `Record` through `addon.Get`/`addon.List`; this clears when the owner returns a view and the add-on adapter moves to `domains/eks/awsapi`. The guest route reaches the owner through the `handlers_eks` NATS RPC (`ListStagedAddonManifests`); this clears with per-resource commands behind EKS registration. The add-on ARN is derived in both the owner and `gateway/eks/authz.go`; this clears when authorization obtains the ARN from the owner, which an incarnation suffix would require. The owner's `Manifest`/`Report` beside the `contracts/eks/v1` types is deliberate duplication, not debt.
- `agents/rds/agent` (dependency, narrowed): engine metadata now arrives through the agent-declared `EngineCatalog`, but the agent still imports `handlers/rds` for the command protocol, wire and record types (`Command*`, `Parameter`, `EngineHealth*`, `BootstrapMode*`) and API output types. This clears when those move behind a guest/controller wire contract.
- `gateway/rds` → `handlers/rds` (`InstanceSizing`): the gateway obtains its `Sizing` through the RDS handler package's adapter rather than its own composition root. This clears when the gateway's RDS composition moves to `runtime/roles/awsgw` and builds `Sizing` there.
- `domains/admission/quota` → `domains/ec2/instancetypes`: `reconcile.go`, `records.go` and `vcpu.go` read `DefaultVCPUs` to size instances without a recorded vCPU count. This clears when quota receives vCPU sizing through a consumer-owned capability or an EC2 projection.
- IAM implementation consumers in STS, Ochre and ELBv2: `handlers/sts` imports `handlers/iam` across five files (`IAMService`, `SessionRevoker`, `EncryptSecret`/`DecryptSecret`, `AccessKeyStatusActive`, `ValidateTrustPolicyDocument`, `PolicyEffectAllow`/`PolicyEffectDeny`, `IAMAccountBucketName`, `OIDCProviderARN`, `OIDCProviderKey`), not only `oidc_jwks.go`; `gateway/sts/GetCallerIdentity.go` takes `IAMService`; `gateway/bedrock/credentials.go` uses `EncryptSecret`/`DecryptSecret`; and `handlers/elbv2/{lb_role,service_impl}.go` use `EnsureSystemInstanceProfile` and `SystemInstanceRoleEnsurer`. Each clears when its consumer receives a narrow IAM capability, or a shared crypto boundary for the secret helpers, rather than importing the IAM implementation.
- `handlers/elbv2` (cross-domain): `service_impl.go` imports `domains/acm` (`Store`, `NewStore`), `domains/dns` (`ELBChanges`, `ELBName`, `Change`, `ActionUpsert`, `ResolveBaseDomain`), `domains/ec2/vpc` (`VPCServiceImpl`) and `domains/network/topology` (`Port`), and `launcher.go` re-exports `domains/ec2/systeminstance` launch types as aliases. These clear when ELBv2 is extracted and each edge becomes a consumer-owned capability, which ADR-0001 sequences after the ELBv2 data-plane boundary is settled.
- `docs/service-interfaces.yaml` (ECS coverage gap, closed): the traced `ecs.bus.*` family and the ECS AWS-API action subjects are both listed. The action subjects are declared as `ecs.*`, the same wildcard convention as `rds.*`: `handlers/ecs/service_nats.go` publishes them from the gateway and `daemon/daemon.go` subscribes to them. Declaring `ecs.bus.*` alone had made `ecs` a managed prefix, so `manifest-lint` failed CI on all 34 undeclared action subjects until this was added.
- `contracts/ecs/v1` (dead routes): four of five bus subjects have no producer. The scheduler leader still subscribes to `instance-register`, `instance-heartbeat` and `task-state`, which can never fire, and `assign` has neither producer nor consumer; only `service-reconcile` is live. Removal condition: an owner decision to retire these routes (a successor contract under the compatibility rules) or to adopt them in the agent.

The layering test enforcing these rules (`architecture/layering`, a module-root repository governance test, not Spinifex product code; run by `make test`, `test-cover` and `test-race`) is blocking, with a ratchet: the debt recorded in this section is narrowly allow-listed by owner and removal condition, and any new, unrecorded forbidden edge fails local preflight and CI. The allow-list mirrors the edges in this section that break an import rule; same-domain legacy edges, placement residuals and security notes are not import-rule violations and have no allow-list entry.

- Pointer-bump follow-up in the umbrella repository: `make docs-portal` for this branch's source moves is deferred to the Mulga gitlink pointer-bump PR, so the portal evaluates the same Spinifex revision being proposed.
- Merge-time follow-up in the umbrella repository: the `Makefile` `invariants-check` target, the `docs-pr.yml` clause cross-check, `.claude/hooks/architecture-traps.sh` and a `check-invariants.sh` comment hard-code `spinifex/spinifex/network/invariants`. They must change with the pointer bump that brings in this branch, or the docs-pr cross-check silently skips. Live specs and proposals citing `spinifex/network/` will report unresolved citations until updated. A read-only mulga-repository count (excluding submodules, `docs/development/archive/` and agent worktrees) confirms four items still open: `spinifex/network/` appears in 49 mulga files; `services/awsgw` appears in 19 (`.claude/rules/spinifex.md` plus 18 docs; the umbrella `.claude/CLAUDE.md` does not contain it but cites the old `network/policy/policy.go:28`); and `services/spinifexui` (including its `/frontend` subpath) appears in 20 mulga files, including `ansible/roles/build/tasks/main.yml`, the `.claude/settings.json` formatting hook, the `.claude/rules/frontend-standards.md` glob, `.claude/skills/run-spinifex/SKILL.md` and `ui-dev.sh`, `.vscode/settings.json` and `README.md`. The same `SKILL.md` also names `cmd/spinifex/cmd`, the obs-agent Ansible role's `otelsetup` path mirrors the pre-move name, and `docs/specs/guides/dependency-enforcement.md`'s "Known open edges" section carries the same pre-move paths; all four are mulga-repository updates, out of scope for a Spinifex-only commit.

### Security corrections and branch preflight exception

These are security corrections found during discovery, not lifecycle work.

- `ee13be950`: `PublishInternal` required only the IAM policy, built from the body account and URL cluster, and the control-plane role grants it on `*`. Any control-plane VM session, any tenant holding `eks:*`, or static system credentials could publish cluster state, bootstrap and add-on reports for another cluster or account. It now passes the internal-route membership gate, with one body decoder shared by the gate and the handler. Evidence: `gateway/eks_authz_test.go` `TestEKSRequest_PublishInternal*`.
- `a23e1ccf5`: `WebhookTokenReview` had the same flaw and could reveal another cluster's Kubernetes group mappings. It now passes the same gate, and every unauthorised target returns the same `AccessDenied` without reaching STS. Evidence: `TestEKSRequest_WebhookTokenReview*`, `gateway/eks/internal_authz_test.go` `TestInternalBodyAccounts_CoverEveryBodyScopedRoute`.
- `642cb4889`: `serviceAccountRoleArn` on CreateAddon and UpdateAddon must be syntactically an IAM role ARN (`foundation/aws/arn.ValidateRoleARN`), returning `InvalidParameterException`; `iam:PassRole` remains the permission and existence check. Evidence: `handlers/eks/addons_test.go` `TestCreateAddon_RejectsMalformedServiceAccountRoleArn`, `TestUpdateAddon_*ServiceAccountRoleArn*`.
- `097e19109`: `CreateAddon` and `UpdateAddon` accepted `serviceAccountRoleArn` with no `iam:PassRole` check, the gap the `52de5e517` characterization recorded ("no PassRole check on serviceAccountRoleArn"). `PassedRoleARNs` now resolves the field for both actions, so the caller needs `iam:PassRole` on the role for `eks.amazonaws.com`, matching `CreateCluster` and `CreateNodegroup`. Evidence: `spinifex/gateway/eks_passrole_test.go`.
- Remaining render gap: IAM's path grammar permits `"`, `&`, `\` and `|`, which the guest's `sed` replacement and double-quoted YAML value in `mulga-eks-addon-sync.sh` do not escape. A role whose path contains them must also exist and pass `iam:PassRole`. Removal condition: the guest renders the role ARN with escaping for both `sed` and YAML (or a structured renderer), with a test rendering such a path verbatim.
- Static-credential control-plane VMs (IAM wiring failed) are now denied every internal route and cannot bootstrap; that fallback is unsupported.

Preflight exception (branch only): from `ee13be950`, full `make preflight` on this branch is red solely because the vulnerability gate reports GO-2026-6599 to GO-2026-6617 against the pinned Go 1.27.0 toolchain. Every other gate passes. This branch is not production. No advisory is accepted or suppressed, and the accepted-advisory list, `go.mod` and the toolchain pins are unchanged; the toolchain is updated through Dependabot. Normal full-preflight enforcement resumes when the toolchain baseline is updated.
Resolved by `b42373efb`: merging `dev` brought the Go 1.27.2 toolchain, the vulnerability gate passes with no advisory accepted or suppressed, full `make preflight` is green, and normal enforcement has resumed.

Merge from `dev` (`b42373efb`): `dev`'s lint fix replacing `strings.LastIndex` with `strings.CutLast` in `actionFromTarget` touched `spinifex/gateway/acm.go` and `spinifex/gateway/ecrapi.go`, which this branch had deleted when it moved those registrations. The change was ported to the moved code in `spinifex/domains/acm/awsapi/registration.go` and `spinifex/domains/ecr/awsapi/registration.go`, and the deletions were kept. The same merge carried `dev`'s ACM tag private-key fix into `spinifex/domains/acm` with import paths adjusted to this branch's layout.

Merge from `dev` (`316a1b7c0`): `dev`'s IMDS PUT hop-limit enforcement was ported into `spinifex/domains/ec2/guestmetadata` with the package renamed. `dev`'s fail-closed instance inventory for account teardown (`DescribeAccountInstancesComplete`) landed in `spinifex/domains/ec2/awsapi/instance`, and its callers and tests in `spinifex/accountteardown`, `spinifex/gateway` and `spinifex/operator/cli` were adjusted to this branch's import paths (`natsmsg.NodeIDHeader`, `awserrors.GenerateErrorPayload`, `ec2instanceapi`). The spinifexui frontend source and `dist` were taken from `dev` at `spinifex/runtime/roles/spinifexui/frontend`, keeping only this branch's path-comment update in `src/types/rds.ts`.

Merge from `dev` (`62870d350`): `dev`'s identity-checked volume holder proof for account teardown landed in `spinifex/accountteardown` and its `DeleteVolume` guard in `spinifex/domains/ec2/awsapi/volume`, with call sites renamed to this branch's packages (`natsmsg`, `ec2volumeapi`, `ec2instanceapi`). The new gateway guard test and the teardown test fixtures were adjusted to this branch's import paths, and public `DeleteVolume` passes `gw.NodeIDs` as on `dev`.

Gates outside preflight and CI (follow-up, not merge-blocking): `make test-package-check`, which the `Makefile` keeps out of preflight, reports 87 test files added on this branch in their own package rather than `<pkg>_test`; they include the contract, agent, new-domain, ingress, layering and split-out ECR tests. Converting each to an external test package, or marking it `//test:in-package` with a reason, is follow-up work before that gate returns to preflight. `make nilaway` was killed by the host on both local attempts (15 GB, including `GOGC=25 GOMAXPROCS=2`) before it reported anything, so this branch has no nilaway evidence.

## ADR-0004 source inventory and first-resource ranking

The per-file inventories for ECS, EKS and RDS are in `docs/package-boundary/adr-0004-inventory-{ecs,eks,rds}.md`.
Each classifies every production file as resource owner, cross-resource orchestration, AWS protocol adapter, guest/controller wire contract, or temporary residue, and maps actions, durable records, identity and scope, lifecycle paths, NATS subjects and boundary-crossing imports.
They were produced by reading the code at `6c50349bd` and are not verified against a live system.

Observed gaps common to all three: no resource carries a desired generation, all resources of a service share one per-account KV bucket, and deletes remove records before dependent cleanup is confirmed.

First-resource ranking:

1. RDS DB subnet group: about 340 lines with its own `db-subnet-groups/{name}` keys, synchronous AWS semantics, and no quota, expected-node, IAM, Bluebottle or agent dependency.
   It has a real deletion graph, because delete refuses while an instance references the group, so it exercises a consumer-owned capability in both directions: an instance-owned "instances referencing this group" query for delete, and a subnet-group-owned placement query for instance create.
2. ECS task definition: own keys and good tests, but `RegisterTaskDefinition` allocates revisions non-atomically and the gateway adapter carries the `iam:PassRole` checks, so it sits closer to a blocked boundary.
3. EKS access entry: own keys, but entries are read during token review, which places it next to EKS identity.

Blocked dependencies recorded, not designed around:

- RDS instance: quota admission, the duplicated expected-node fan-out (`gateway/rds/enginecatalog.go`, `daemon/rds_deps.go`), IAM ensurer and Bluebottle master key.
- RDS `DescribeOrderableDBInstanceOptions`: the EC2 instance-type-availability projection.
- ECS task, service and capacity: `iam:PassRole` in the gateway adapter, IAM `ecsInstanceRole`, and EC2/ELBv2/EIP adapters called as internal APIs.
- EKS nodegroup and cluster: IAM role and instance-profile creation, Bluebottle `auth`, the NATS CA, and EKS identity (token review, OIDC).
- Guest agents: `agents/ecs`, `agents/rds` and `agents/eks/tokenwebhook` import the service implementation packages, which ADR-0004 S5 forbids; they need wire contracts.

Findings to resolve before extraction:

- `dev` is merged in (`9e77181f2`), including `ModifyDBSubnetGroup` (#1152); the subnet-group inventory is superseded by its lifecycle contract, `docs/package-boundary/rds-db-subnet-group-lifecycle.md`.
- The EKS control-plane template persists the OIDC signing key and k3s join token; see the `handlers/eks` potential security risk in the dependency-rule debt.

## ADR-0007 instance-state inventory (slice 0)

This is the baseline for ADR-0007 (instance state authority and partition recovery), produced by reading the code at `cf9e8ce0d` and pinned by tests in `38fbd1499` and `6fa09d336`.
Nothing here conforms to ADR-0007 yet.
Every behaviour below is current behaviour, recorded so later slices can show what they change; none of it is a target.
`vpcd` stays blocked: it still reads the daemon's local file and opens the instance bucket through the daemon's manager (INV-13), and no slice has given it a narrower capability.

Shared KV is primary for accepted lifecycle intent and assignment.
The local file is a durable execution journal for an already-assigned local guest and is not authority to create or reassign resources.
The characterisation below shows several places where today's code treats it as more than that.

### Persisted state

| Item | Location | Shape |
|---|---|---|
| Local file | `daemon/local_state.go` | `<DataDir>/state/instance-state.json` (default `DataDir` `/var/lib/spinifex`), mode `0640`, parent `0750`, written to a temp file then renamed. Body is `{"schema_version":1,"vms":{<id>: vm.VM}}`, compact JSON, no trailing newline, the whole `vm.VM` per instance, no generation of any kind. |
| Live bucket | `daemon/jetstream.go:130` | `spinifex-instance-state`, history 1, no TTL, `RecreateIfMissing`, version stamp 5 via `kvutil` on open through `migrate.DefaultRegistry.RunKV`. Created at one replica and raised to cluster size by `kvutil.RaiseAllBucketReplicas` (`daemon/daemon.go:2536`). |
| Terminated bucket | `daemon/jetstream.go:146` | `spinifex-terminated-instances`, history 1, TTL 1 hour, version stamp 3, same open hook. |
| Record keys | `daemon/instance_records.go` | `i.<id>` holds a `vm.InstanceRecord` (`metadata`, `spec`, `status`) in both buckets; the live bucket also holds node presence and ownership keys and the legacy per-node and stopped prefixes. Records carry no per-record schema version. |
| KV migrations | `daemon/instance_records_migrate.go` | Live 1→2 stopped instances to per-resource keys, 2→3 running sets to per-resource keys, 3→4 `i/<id>` to `i.<id>`, 4→5 node presence and ownership out of the running-set blob; terminated 1→2 per-resource keys, 2→3 re-key. `operator/upgrade` touches no instance state; its `VERSIONS.md` points KV migrations at the owning package. |
| Record type | `runtime/compute/vm/record.go` | `vm.InstanceRecord` with `resource.Metadata` (`Generation`, `ObservedGeneration`, `UID`, `Region`, `OwnerRefs`, `Finalizers`, `Tags`, `DeletionTimestamp`); `VM.Record()` and `VMFromRecord` convert to and from `vm.VM`. |

### Consumer inventory

The owner files (`daemon/{instance_membership,instance_records,instance_records_migrate,instance_running_set,jetstream,local_state}.go` and `runtime/compute/vm/record.go`) define the state and are not listed as consumers.
Line numbers are the first use in each file.

| Item | Location | Package | Process | Access |
|---|---|---|---|---|
| INV-01 | `daemon/daemon.go:2686`, `:2889`, `:2912`, `:2922` | `daemon` | daemon | Reads the local file at boot (`LoadState`) and rewrites it whole in `persistState`, the single path every state change reaches, before the KV write and regardless of its outcome. |
| INV-02 | `daemon/daemon.go:221`, `:2485`–`:2495` | `daemon` | daemon | Constructs the manager and opens both buckets, which runs the version gate and migrations. |
| INV-03 | `daemon/daemon.go:2936`–`:2937`, `daemon/instance_record_repair.go:65` | `daemon` | daemon | Writes the node marker and projects the in-memory running set to `i.<id>` records (whole-record write from `vm.VM`). |
| INV-04 | `daemon/daemon.go:2423` | `daemon` | daemon | Lists terminated instances (decodes to `vm.VM`). |
| INV-05 | `daemon/vm_adapters.go:32`–`:91` | `daemon` | daemon | Adapts the manager into `vm.StateStore`: `LoadState`, stopped and terminated read, write, update, claim, list and delete, all through `vm.VM`. |
| INV-06 | `runtime/compute/vm/{migrate,shutdown,orphan_qemu_reaper,teardown_reaper}.go` | `vm` | daemon | Uses the `StateStore` port for stopped and terminated writes, terminated listing, update and delete. |
| INV-07 | `domains/ec2/instance/service_impl.go:511`–`:2847` | `ec2/instance` | daemon | Stopped and terminated read, update, claim, write and delete through the `StateStore`-shaped port. |
| INV-08 | `daemon/daemon_handlers_image.go:35`, `:89` | `daemon` | daemon | Loads and updates a stopped instance for image creation. |
| INV-09 | `daemon/daemon_mgmt_ip.go:18` | `daemon` | daemon | Cluster-state consumer outside the ratchet: names `JetStreamManager` only for management-IP allocation in the cluster-state bucket and touches no instance key. |
| INV-10 | `daemon/instance_recovery.go:85`–`:546` | `daemon` | daemon | Lists and decodes records, claims, releases and abandons recovery, reloads a record. Typed CAS writes. |
| INV-11 | `daemon/dns_reconcile.go:38`, `:48`, `:179` | `daemon` | daemon | Constructs keys from the prefix, names the bucket, lists records for DNS. |
| INV-12 | `daemon/eni_orphan_reaper.go:26`–`:27` | `daemon` | daemon | Lists live and terminated records to find orphaned ENIs. |
| INV-13 | `domains/ec2/instance/state/imds_readers.go:20`–`:92` | `domains/ec2/instance/state` | vpcd | Reads and caches the daemon's local file by path and mtime; constructs a `JetStreamManager` and calls `InitKVBucket`, which runs the version gate and the instance migrations; decodes records. Injected into `vpcd` through `guestmetadata.LocalStateReader` and `guestmetadata.RecordLoader`. |
| INV-14 | `domains/ec2/guestmetadata/instance_lookup.go:60`, `:120` | `guestmetadata` | vpcd (IMDS) | Loads a record through a `LoadInstanceRecord` interface satisfied by the manager and converts it to `vm.VM`. |
| INV-15 | `domains/network/reconcile/intent.go:48`, `:444`–`:474` | `network/reconcile` | vpcd | Duplicates the bucket name and prefix as literals, opens the bucket by name with no gate, gets `i.<id>` and decodes `vm.InstanceRecord`. |
| INV-16 | `runtime/roles/awsgw/awsgw.go:573`–`:633` | `awsgw` | gateway | Opens the bucket by name with no migration hook for the instance cache and the quota reconcile loop. |
| INV-17 | `runtime/compute/cache/cache.go:97`, `:248` | `instancecache` | gateway | Watches `i.` records into a `vm.VM` map through `kvstore.Store[vm.InstanceRecord]`. |
| INV-18 | `domains/admission/quota/records.go:33` | `quota` | gateway | Snapshots records to count vCPUs. |
| INV-19 | `operator/cli/cluster.go:170` | `operator/cli` | operator CLI | Cluster-state consumer outside the ratchet: constructs a `JetStreamManager` only for the cluster-state shutdown marker and touches no instance key. |

Test packages are excluded; `daemon/instance_records_vpcd_test.go` pins INV-15's duplicated literals to the daemon constants.

### Characterised behaviour

Local file (`daemon/instance_state_baseline_test.go`):

- `TestCurrentBehaviour_LocalStateFileExactBytes` pins the exact bytes.
- `TestCurrentBehaviour_LocalStateSchemaVersionFailures`: a missing or older `schema_version` reads as `unknown schema_version 0 (expected 1)`, a newer one as `unknown schema_version 2 (expected 1)`, a wrong type or truncated body as `parse local state`; every case returns no state.
  `Daemon.LoadState` turns any of these into a boot failure (`TestDaemonLoadState_CorruptFile`).
- `TestCurrentBehaviour_LocalStateUnknownFieldsAreDroppedOnRewrite`: a file at the same version with fields this binary does not know is accepted, and those fields are gone after the next rewrite.
- Already covered and relied on: `daemon/local_state_test.go` (`TestWriteLocalState_GroupReadable`, `_AtomicReplace`, `_NoTmpLeftBehind`, `_MkdirParent`, `_Failures`, `TestReadLocalState_Missing`, `_CorruptJSON`, `_UnknownSchema`, `_Unreadable`) and `daemon/disconnect_test.go` (`TestDaemonWriteState_LocalFile`, `TestDaemonLoadState_*`).

KV (`daemon/instance_state_baseline_test.go`):

- `TestCurrentBehaviour_InstanceBucketConfiguration` pins names, history, TTL and version stamps.
- `TestCurrentBehaviour_RecordKeyAndWireForm` pins the `i.<id>` key and the exact record bytes; the running-set writer stamps the node and AZ it was given over whatever the instance carried.
- `TestCurrentBehaviour_BucketVersionGate`: a daemon-configured open of a bucket stamped ahead fails with `migrate.SchemaAheadError`, a handle already open keeps writing, and a reader configured without the migration hook (the gateway's form) opens and decodes regardless.
- Already covered and relied on: `daemon/instance_records_test.go` (round trip, absent is nil, disjoint prefixes, `TestWriteInstanceRecord_ReplacesWholesale`, `TestUpdateInstanceRecord_*`), `daemon/instance_claim_test.go` (claim, release and abandon CAS), `daemon/instance_running_set_test.go`, `daemon/instance_records_transition_test.go` (every migration step), `daemon/jetstream_test.go` (`TestJetStreamManager_InitBuckets_WritesVersion`, `_InstanceRecordKVErrors`), `foundation/state/kvutil/kvutil_test.go` and `foundation/state/migrate/kv_test.go`.

Recovery on return (`daemon/instance_state_recovery_baseline_internal_test.go`), with the local file reloaded and `restoreInstances` run:

| Case | Current outcome | Test |
|---|---|---|
| Canonical key missing | Local instance kept; the next state write recreates the record from the local file, owned by this node. | `TestCurrentBehaviour_RestoreMissingCanonicalKeyRepublishesFromLocal` |
| Live key missing, terminated record present | Terminated bucket not consulted; the instance is revived from the local file and republished as live and non-terminal. | `TestCurrentBehaviour_RestoreIgnoresTerminatedBucket` |
| Record owned by another node | Local copy dropped and removed from the rewritten file; the other node's record is left untouched. | `TestCurrentBehaviour_RestoreRecordOwnedElsewhereDropsLocal` |
| Terminal record owned by this node | The canonical record wins the merge and the instance is migrated to the terminated bucket, not restarted. | `TestCurrentBehaviour_RestoreTerminalCanonicalRecordRetiresLocal` |
| KV unavailable | Restore stops after the failed cluster read; local instances stay as the file left them, are not reset or relaunched, and the file is rewritten unchanged. | `TestCurrentBehaviour_RestoreWithKVUnavailableLeavesLocalUnlaunched` |

The first two cases are the ones ADR-0007 S5 rules out: a node republishes local state as authority without the canonical record.

Owner disposition of the KV-unavailable result:

- Correct: while canonical KV is unavailable, the daemon does not launch, recreate, migrate or report a healthy new realization.
- Permitted later: reattaching only to a demonstrably already-running local guest covered by a valid local journal assignment and fence.
- Not acceptable as the final model: keeping an in-memory record as `running` when no live process has been confirmed; the later recovery slice must make that an explicit unconfirmed or degraded state.

The safety goal is that a partition does not kill an existing workload, while a daemon restart plus a stale file cannot resurrect one.
`TestCurrentBehaviour_RestoreWithKVUnavailableLeavesLocalUnlaunched` stays as the current-behaviour pin until that slice changes it.

### Generation preservation

`Generation` and `ObservedGeneration` are the only generation fields; KV entry revisions are used for CAS and never persisted in the record.
Unknown fields are a field a newer binary adds.

| Path | Generation and ObservedGeneration | Unknown fields | Test |
|---|---|---|---|
| `UpdateInstanceRecord` | Preserved | Lost | `TestCurrentBehaviour_GenerationAcrossKVWriters` |
| `LoadInstanceRecord` then `WriteInstanceRecord` | Preserved | Lost | same |
| `ClaimRecoverableInstance`, `AbandonRecovery` | Preserved | Lost | same |
| `ClaimStoppedInstance` | Preserved | Lost | same |
| `UpdateTerminatedInstanceRecord` | Preserved | Lost | same |
| `WriteRunningSet` | Lost | Lost | same |
| `UpdateStoppedInstance`, `WriteStoppedInstance` | Lost | Lost | same |
| `UpdateTerminatedInstance`, `WriteTerminatedInstance` | Lost | Lost | same |
| KV → `LoadState` → running set → recovery merge | Lost | Lost | `TestCurrentBehaviour_LoadStateDropsGeneration` |
| Record → `VMFromRecord` → `Record()` | Lost, with `UID`, `Region`, `OwnerRefs`, `Finalizers` and `Metadata.Tags`; `Name`, `AccountID` and `DeletionTimestamp` survive | Lost | `runtime/compute/vm/record_generation_test.go` `TestCurrentBehaviour_RecordThroughVMLosesGenerationAndBookkeeping` |
| `vm.VM` → `Record()` | Never written | n/a | `TestCurrentBehaviour_RecordFromVMHasNoGenerationKeys` |
| Typed record decode then encode | Preserved | Lost at every level | `TestCurrentBehaviour_TypedRecordRoundTripDropsUnknownFields` |
| `vm.VM` → local file → `vm.VM` | Not represented | Lost | `TestCurrentBehaviour_LocalStateFileExactBytes`, `TestCurrentBehaviour_LocalStateUnknownFieldsAreDroppedOnRewrite` |

### Regression ratchet

`architecture/instancestate` parses every non-test production file with `go/parser` and fails on any new use of the daemon's instance-state bucket, key and local-file identifiers, `vm.InstanceRecord`, `InstanceSpec`, `InstanceStatus`, `VMFromRecord` and `VM.Record()`, the `JetStreamManager` instance-state methods (instance and terminated record access, the running-set projection, `LoadState`, and `InitKVBucket` and `InitTerminatedInstanceBucket`, which open the instance buckets), or the bucket and file names as string literals.
The `JetStreamManager` type and `NewJetStreamManager` are not matched, because the manager also serves cluster state; a cluster-state-only consumer such as INV-09 or INV-19 is not instance-state debt and is not flagged.
`TestADR0007_S6_NoNewRawInstanceStateConsumers` holds 67 allow-listed file and symbol pairs, each citing an inventory item above; the list only shrinks, a stale entry fails, and a walk that finds too little fails rather than passing vacuously.
`TestADR0007_S6_RatchetDetectsFaults` and `TestADR0007_S6_RatchetSeesBareIdentifiersInOwnerPackages` inject synthetic sources to prove the matcher detects each kind of use, ignores declarations, and does not flag the manager type, its constructor or a cluster-state method.
Adding a `daemon.LocalStatePath` use to `runtime/roles/awsgw` and renaming one allowlist file were each confirmed to fail the gate.
After narrowing, a `runtime/roles/awsgw` file constructing a manager and calling `InitClusterStateBucket` passed, the same file calling `WriteRunningSet` failed `NoUnrecordedConsumer`, and restoring the removed INV-19 entry failed `Allowlist_NoStaleEntries`.

## Close-out status

The table records every legacy directory still standing, what remains in it
and what blocks its move. "Deferred: <series>" names a recorded blocked-work
series above; "needs decision" is open.

| Legacy path | What remains | What blocks it |
|---|---|---|
| `handlers/iam` | Private identity state and credential issuance; consumed by the EC2 instance and spot-instance AWS adapters, `handlers/sts`, `gateway/sts`, `gateway/bedrock`, the ELBv2 system-instance role path, ECR/Ochre signing-key crypto and `operator/cli`. | Deferred: the ADR's `handlers/iam` row states a shared IAM contract is not inferred from current KV readers; each cross-domain reader needs an IAM capability first. |
| `handlers/sts` | Everything except the EKS OIDC JWKS lookup, which now reaches `handlers/eks` only through the injected `ClusterJWKSResolver`. | Deferred: per-consumer IAM capabilities (dependency-rule debt above); `handlers/sts` still imports `handlers/iam` directly. |
| `handlers/ecs` | Task, service and capacity resources (`taskdefinition` already extracted to `domains/ecs/taskdefinition`). | Deferred: ADR-0004 blocked-dependency list — `iam:PassRole` in the gateway adapter and EC2/ELBv2/EIP adapters called as internal APIs. |
| `handlers/eks` | Nodegroup and cluster resources (`access` and `addon` already extracted). | Deferred: ADR-0004 blocked-dependency list — IAM role/instance-profile creation, Bluebottle `auth`, the NATS CA, and EKS identity (token review, OIDC). |
| `handlers/rds` | The RDS instance resource (subnet group, parameter group and engine catalogue already extracted). | Deferred: ADR-0004 blocked-dependency list — quota admission, the duplicated expected-node fan-out, the IAM ensurer and the Bluebottle master key. |
| `handlers/elbv2` | Everything; not yet touched. | Deferred: ADR-0001 sequences this after the ELBv2 data-plane boundary is settled. Needs decision: what evidence establishes that boundary is settled. |
| `handlers/iam/mock` | A test double for `handlers/iam`. | Moves with `handlers/iam`; it has no independent target. |
| `gateway` (root) | Generic HTTP route assembly, SigV4/registry authentication, the policy gate, request-audit middleware, request-context keys, and the legacy per-service dispatch switch for every service not yet registered. | Deferred: the ADR-0002 phases above (auth/IAM and request-context boundary design) gate moving the audit, context-key and legacy-dispatch mechanics. |
| `gateway/bedrock` | The Ochre domain core, its stores and the inference engine, together with the Bedrock action layer, in one package with internal cycles. | Deferred: needs the split plan recorded above — domain core and stores to `domains/ochre/<resource>`, inference to an Ochre-owned package, and only the action layer to `domains/ochre/awsapi`. |
| `gateway/{ecs,eks,rds,iam,sts,elbv2}` | Each service's AWS action adapters and dispatch, not yet registered through ADR-0002. | Deferred: the ADR-0002 registration contract has only reached ECR and ACM so far; each service needs its own registration slice. |
| `gateway/spx` | `promote_image.go` and `spx.go` dispatch (`storage.go` already consumes `contracts/operator/v1`). | Needs decision: which package owns operator-plane action dispatch registration — an `ingress/aws`-style seam for the operator plane, or `gateway` stays its home. |
| `gateway/tagging` | — | Done. `domains/tagging` owns the read-only cross-resource `GetResources` aggregation and its API semantics (`0d830e901`, `aedd0b2c4`); AWSGW composes the owner listers, the EC2 tag index and ELBv2 (`f3545e3ea`); the root `gateway` keeps only the legacy dispatch in `gateway/tagging.go`. The package is removed, and its two allowlist rows and frozen-legacy entry are gone. Owner tag mutation capabilities remain future direction, so the RDS and ECS tag-writing edges above stay open. |
| `services/viperblockd` | — | Done. The adapter is `providers/ebs/viperblock` (with the read-only `dirty` reader), the shared vocabulary is `contracts/viperblockd/legacy/v1`, and the role is `runtime/roles/viperblockd`. `services/` is empty. |
| `utils` | — | Done and deleted. `ec2_subject.go` went to `contracts/ec2/v1`, the vpcd protocol to `contracts/network/v1` with the typed client in `domains/network/projection`, and the master-key loader to `domains/ec2/ebs/encryption`. |
| `vpcd` | — | Done. The IMDS local-file reader and record-space opener moved to `domains/ec2/instance/state` and are injected through `guestmetadata.LocalStateReader`/`RecordLoader` (recorded above), so `vpcd` no longer imports `daemon` directly; its inter-process boundary now exists (`contracts/network/v1`, with `domains/network/subscribers` as the consumer and `domains/network/projection` as the producer client). The package moved unchanged to `runtime/roles/vpcd` (recorded below), and the legacy directory is removed. |
| `daemon` | Reserved as `runtime/daemon`'s home only; not split or moved. | Deferred: Q-28's write-side consolidation is a prerequisite ADR-0001 names explicitly. |
| `admin` | — | Done and deleted. The operator use cases moved to `operator/admin`, image promotion to `domains/ec2/image`, the bootstrap account identifiers to `foundation/aws/identifiers`, and the credential-format generators to `foundation/aws/credentials` (recorded above). Operator bootstrap's direct credential generation stays recorded as debt. |
| `accountteardown` | The whole package, a frozen legacy root. Its direct cleanup calls into `domains/ec2/awsapi/*` action adapters, other domain and handler services, the object-store provider, raw NATS subjects and a raw KV bucket stay as recorded debt. | Assessed for relocation and not moved. ADR-0001's `accountteardown` row requires conversion to domain-owned cleanup capabilities before moving, and ADR-0008 does not authorise a mechanical rename. It remains a legacy root until its direct cleanup calls are converted to domain-owned capabilities; its destination after that conversion is `operator/accountlifecycle`. |
| `lbagent` | The whole package; `handlers/elbv2` imports it as a domain-to-agent implementation edge (recorded above). | Deferred: Q-30 reserves `agents/elbv2` as its destination but forbids moving it as an isolated rename ahead of the common-agent design. |
| `migrate` | Nothing at the old path. | Split, not an exact ADR row: ADR-0001 maps `migrate` to `foundation/state/migrate`, but the package held two responsibilities. The KV migration engine and its tests are in `foundation/state/migrate` (`8cd9cff75`); the config-file and object-store upgrade workflow moved to `operator/upgrade` (`919d5bfa6`) by owner decision. Needs an ADR-0001 map clarification before this row can be claimed as target conformance. |

### Remaining legacy roots by blocker class

Five legacy roots remain: `accountteardown`, `daemon`, `gateway`, `handlers` and `lbagent`.
The rows above give each path's blocker; this summary groups them so a deferral is not mistaken for unfinished mechanical work.
ADR-0001 completion is structural, so none of these is cleared by remediating service lifecycle behaviour.

| Class | Paths | Status |
|---|---|---|
| Explicitly deferred by ADR-0001 | `daemon` (Q-28), `lbagent` (Q-30) | Closed for this refactor; the ADR names the prerequisite. |
| No missing boundary (candidate moves) | `handlers/ecs/bus` → `contracts/ecs/v1` (`a130f6b8e`); `admin/images_promote.go` → `domains/ec2/image` (`263c58167`); `admin` bootstrap account identifiers → `foundation/aws/identifiers` (`3fdaa54d9`); `admin` credential-format generators → `foundation/aws/credentials` `0368e861a`, retiring `admin` | Done. |
| One narrow missing boundary | Done: `handlers/sts` EKS JWKS lookup → `handlers/eks` `ClusterJWKSResolver` (`254d898a3`); `gateway/tagging` → `domains/tagging` with AWSGW-composed listers (`0d830e901`, `f3545e3ea`, `aedd0b2c4`). Open: `gateway/spx` (owner of operator-plane dispatch registration) | Each needs one decision or one capability, then a mechanical move. |
| Broader boundary or follows another package | `handlers/iam` and `handlers/iam/mock` (per-consumer IAM capabilities); `handlers/{ecs,eks,rds}` (ADR-0004 blocked-dependency lists); `handlers/elbv2` (data-plane boundary evidence); `accountteardown` (domain cleanup capabilities); `gateway` root (ADR-0002 auth and request-context phase); `gateway/{iam,sts,ecs,eks,rds,elbv2}` (each follows its `handlers/<svc>`, because a new-path `awsapi` cannot import a legacy handler); `gateway/bedrock` (the recorded Ochre split plan) | Recorded debt with removal conditions above. |

Per-consumer IAM capabilities are the widest unblocker: they gate `handlers/iam` itself, STS's IAM reads, Ochre's IAM reads, the ELBv2 role path and the ECS, EKS and RDS ensurers.

`runtime/roles/awsgw` carries two recorded residuals from its own move (`931d86d5c`
above) that are not yet re-homed: `runQuotaReconcile`/`quotaKeyFor` belong to
`domains/admission/quota`, which would become a domain-to-daemon edge if the reconcile loop stays where it runs today; and the
EKS token-verify responder belongs with STS or EKS identity.

Deliberately kept on their old names for telemetry continuity, not debt:
`providers/ebs/telemetry.go` keeps `package ebsprovider`, its `tracerName`
(`.../spinifex/ebsprovider`) and `ebs.`-prefixed span/attribute names;
`runtime/compute/cache/metrics.go` keeps `package instancecache` and the
`mulga.instancecache.*` counter names; `runtime/compute/vm/lifecycle.go` keeps
`vmTracerName` as `.../spinifex/vm`; and `runtime/roles/qmpcollector` keeps its
`qmp-collector:` log prefix. Changing any of these is a telemetry and APM-query
change, not a package move.

Image inputs deliberately left on their pre-move paths, for the same reason a
structural move must not alter delivery material: `images/mkosi.profiles/ecs/mkosi.conf`
and `scripts/images/ecs-agent/manifest.conf` still comment-reference
`cmd/ecs-agent/credendpoint.go` (now `agents/ecs/agent/credendpoint.go`);
`images/mkosi.profiles/vllm/bedrock-serve_test.sh` and its sibling
`bedrock-serve` script keep their Bedrock-era names; and
`build/systemd/spinifex-viperblock.service` keeps a comment naming
`utils.KillProcess`, as already recorded above.

## Recording rule

For every later slice, add the old and new path, source commit, focused
verification, and any finding exposed by the move. Record a conflict rather
than folding a behavioural repair into a structural commit. When this branch
is merged, the umbrella repository's execution plan records the resulting
Spinifex commit.