Josh Siviour
a52b078678
* test: pin the ECR /v2 pipeline through the gateway handler * feat: rehydrate a principal from an access key id in credverify Adds credential.Rehydrator and CallerARN on Principal, implemented beside Authenticate and Resolve on the same key, session and user lookups, with a parity table against the gateway's ECR rehydrate. * refactor: share the credverify key and session lookups with Rehydrate Authenticate, Resolve and Rehydrate now call one lookup per credential kind, so the checks cannot drift. The parity table also asserts the gateway and credverify caller ARN builders agree. * refactor: move registry host matching to ingress/http The matcher takes its service labels from the caller and exposes the parsed account and region through accessors, so ingress names no service. * refactor: extract the identity-policy evaluator into policyauth The SigV4 gateway path and the ECR registry authorize through one evaluator and one set of request condition keys, over the credential principal. * refactor: extract account admission into accountadmission The SigV4 gateway path asks one Admitter for account status, with the ACTIVE-only cache moved with it, so the ECR registry can use the same capability. * refactor: move the ECR /v2 bridge out of the gateway The bridge, token exchange and per-operation authorization now live in domains/ecr/registry behind registry-owned Principal, Rehydrator and Authorizer types, so the package imports no ingress code. The awsgw role adapts credverify, policyauth and host matching to them, and the gateway keeps only a RegistryHandler mounted at /v2. The bridge refuses to compose without a verifier, issuer, rehydrator, authorizer or admission, so the open-registry mode for a nil verifier is gone. * test: carry the retired ECR principal parity rows into credverify Global root, a verifier with no IAM, a record with no principal type and the gone, replaced and legacy session verdicts for user and role sessions were only exercised by the gateway tests that went with the old path. * docs: record the ECR /v2 bridge move in the package boundary migration * docs: record the ECR /v2 bridge PR number
Spinifex Documentation
This directory contains the Spinifex documentation. This is available in individual markdown files, and a generated website to aid navigation and browsing documentation at: https://docs.mulgadc.com
The AWS API coverage pages are generated from Spinifex's dispatch tables and the pinned AWS API models, one page per service. Run make aws-model-coverage to regenerate them and print a summary. Only pages.json and the intro.md files under coverage/ are hand-written; every README.md there is generated and will be overwritten.
The same run writes coverage/coverage.json, a versioned machine-readable model-versus-dispatch inventory. It is generated and must not be edited. Its operation states are structural: implemented means a registered action has neither a stub nor an explicit refusal. It is not a behavioural compatibility claim; conformance evidence and capability profiles establish that separately.
A published page names the operations Spinifex serves, and nothing else. It carries no percentage, no unimplemented operation and no operation the platform will never offer: the same run writes those to coverage/internal-report.md, which no slug in the docs site's configuration points at, so it stays internal. A notApplicable declaration in pages.json therefore publishes nothing; it keeps a permanent absence out of the report's candidate work.
Frontmatter
Each published page lives at <category>/<slug>/README.md and carries YAML frontmatter that the docs site turns into page metadata. Three fields have length rules, because search engines flag a title tag or meta description that falls outside them:
| Field | Renders as | Length |
|---|---|---|
title |
Page heading, sidebar label, landing card | Short — it is UI text |
seoTitle |
The browser and search-result title | 50-60 characters |
description |
The search-result snippet, not shown on the page | 150-160 characters |
seoTitle is used exactly as written and must end with — Spinifex Docs. Leave it out and the title falls back to title plus that suffix, which is normally too short to satisfy the rule.
Keep the two titles distinct. title is navigation text in a narrow sidebar, so stretching it to reach 50 characters damages the layout to satisfy a rule that only applies to the title tag. Put the search-facing wording in seoTitle.
A new page is only published once its path is added to scripts/docs-config.json in the mulga-docs repo. That repo's scripts/build-docs.js warns about any field outside its range.