spinifex/docs/PACKAGE_BOUNDARY_MIGRATION.md

Package-boundary migration record

Status: Active implementation record. Decision: Mulga ADR-0001 — Spinifex Package Boundary and Layout. Scope: Spinifex source layout only. This record does not establish a new architecture decision, expand a customer-facing interface, or claim that the current implementation conforms to the target layout.

Purpose

This document records the implementation sequence for ADR-0001 in this repository. The ADR owns the target layout and dependency rules; this record captures the source-level entry-point inventory and the evidence needed for each narrow structural slice.

The migration proceeds on one long-lived refactor branch. Each commit remains small, independently buildable and reviewable; that does not require one pull request per package move.

Baseline

The inventory below was taken from Spinifex commit ecef5e4d2f793b4cf2c96d0a43d0a1ab37be3eed, the revision pinned by Mulga when ADR-0001 was accepted. It records ownership standing, not a promise that a binary or script is AWS-compatible or supported beyond its documented scope.

Entry-point and automation inventory

Product operator and delivery entry points

Current path	Standing	Target ownership	Migration rule
cmd/spinifex (spx)	Supported operator process	Thin main; command assembly in spinifex/operator/cli and individual supported use cases in spinifex/operator/*	Preserve binary and supported command compatibility. The CLI must reach a domain through an explicit capability, never its private state.
cmd/installer	Delivery executable	Thin main; interactive, unattended and host-installation work in spinifex/operator/installer	Preserve installation behaviour while separating executable startup from delivery logic. It is not, merely by existing, the permanent administration interface.

cmd/spinifex/cmd and cmd/installer/* are presently implementation-bearing trees, not thin entry points. They are not moved until their individual receiving owners and test seams are selected.

Guest and named-role entry points

Current path	Standing	Target ownership	Evidence of role boundary
cmd/ecs-agent	ECS guest agent	Thin main; spinifex/agents/ecs/agent	Baked into ECS node images; communicates with the control plane through the AWS gateway, not NATS.
cmd/rds-agent	RDS guest agent	Thin main; spinifex/agents/rds/agent	Runs in an RDS guest, handles bootstrap and engine directives through the gateway.
cmd/lb-agent	ELBv2 guest agent	Thin main; spinifex/agents/elbv2	Included in the load-balancer microVM and controls its local data plane.
cmd/eks-token-webhook	EKS control-plane guest role	Thin main; spinifex/agents/eks/tokenwebhook	Baked into the EKS node image as the Kubernetes TokenReview webhook.
cmd/eks-gateway-fetch	EKS control-plane guest helper	Thin main; spinifex/agents/eks/gatewayfetch	Fetches recovery and addon state through the AWS gateway.
cmd/eks-gateway-publish	EKS control-plane guest helper	Thin main; spinifex/agents/eks/gatewaypublish	Relays bootstrap and state reports through the AWS gateway.
cmd/eks-webhook-cert	EKS image-resident certificate helper	Thin main; spinifex/agents/eks/webhookcert	Invoked by EKS image scripts to create/reuse webhook serving certificates.
cmd/eks-konnectivity-cert	EKS image-resident certificate helper	Thin main; spinifex/agents/eks/konnectivitycert	Invoked by EKS image scripts to create/reuse Konnectivity serving certificates.
cmd/ecr-credential-provider	EKS node integration	Thin main; spinifex/agents/eks/credentialprovider	Kubelet exec credential provider baked into EKS images; it is not ECR control-plane ownership.

No common agent package is introduced by this inventory. Shared mechanisms are considered only when the existing role and least-privilege boundaries remain intact; ADR-0001 explicitly defers that design.

Development and qualification entry points

Current path	Standing	Target ownership	Rule
cmd/aws-model-coverage	Qualification generator	Thin main; reusable code in internal/tooling	Produces the dispatch-versus-model inventory; never imported by product packages.
cmd/dhcptest	Development diagnostic	Thin main; reusable code in internal/tooling if extraction is useful	It is a DHCP probe, not a supported spx admin command.
cmd/spx-loadgen	Qualification/load tool	Thin main; reusable code in internal/testkit	It drives test load and is not shipped to nodes.
tests/e2e/*/cmd/*, tests/bench/*/cmd/*	Test and benchmark-private tools	Remain test-private	They are invoked by a test or benchmark harness, not a product process.
docs/terraform-workbooks/demo-app/main.go	Demonstration workload	Remain with the workbook	It is neither a Spinifex executable nor a product package.

Automation standing

Path class	Standing	Rule during migration
.github/scripts/	CI-private qualification automation	Keep at the module root; the invoking workflow owns the evidence scope.
build/, images/, scripts/images/, image build and publish scripts	Delivery and guest-image inputs	Keep at the module root. In-guest helpers stay with their image; do not relocate shell sources into Go packages.
scripts/setup.sh, setup-ovn.sh, install-node.sh, node-reset.sh, uninstall-spx.sh	Transitional delivery and documented host-operation mechanics	Keep at the module root. They may implement a published procedure but are not an enduring public administration API solely because they are installed on a node.
scripts/dev-env/, scripts/demo/, benchmarks, diagnostics and Terraform experiments	Development or exploratory automation	Keep at the module root; they are not customer-facing contracts.
scripts/check-coverage.sh, diff-coverage.sh, run-gate.sh, sync-aws-models.sh and test harness scripts	Repository and qualification automation	Keep at the module root; their caller defines the contract and evidence.

First source move — ARN

The first source move is the cohesive ARN leaf package:

• old import path: github.com/mulgadc/spinifex/spinifex/arn
• target import path: github.com/mulgadc/spinifex/spinifex/foundation/aws/arn

Source commit 91ac70e29 moves the ten package files and updates all forty-four Go importers. It changes no behaviour and leaves no forwarding package.

Verification passed with an isolated Go module/build cache:

• go test ./spinifex/foundation/aws/arn
• go test for the fourteen packages directly importing ARN
• a Go-source search for the old import path returned no matches
• git diff --check

The inventory was intentionally committed before this move so a later thin-main refactor cannot silently choose an owner by convenience.

Second source move — AWS filters

The second source move removes the generic filterutil location and name:

• old import path: github.com/mulgadc/spinifex/spinifex/filterutil
• target import path: github.com/mulgadc/spinifex/spinifex/foundation/aws/filters

Source commit e707be942 moves the two package files, renames the Go package to filters, and updates twenty-eight importing files. Callers use the explicit import alias awsfilters: many filter implementations already hold a local filters value, and the alias prevents a package-name collision without changing that local state or any filter behaviour.

Verification passed with an isolated Go module/build cache:

• go test ./spinifex/foundation/aws/filters
• go test for the seventeen direct caller packages
• a Go-source search for the old import path returned no matches
• git diff --check

Third source move — AWS Query parser

The third source move names the protocol concern rather than the first service that happened to use it:

• old import path: github.com/mulgadc/spinifex/spinifex/awsec2query
• target import path: github.com/mulgadc/spinifex/spinifex/ingress/aws/query

Source commit caaf98d9e moves the two parser files, renames the Go package to query, and updates thirteen importing files. The parser is used across EC2, IAM, STS, ECS, ECR, ELBv2 and RDS, but owns only AWS Query wire decoding and no service action or resource semantics.

Verification passed with an isolated Go module/build cache:

• go test ./spinifex/ingress/aws/query
• go test -run '^$' for six direct caller packages
• a Go-source search for the old import path returned no matches
• git diff --check

A broad go test run over those caller packages was stopped after two minutes without output. It is not recorded as a passing test; the normal full suite remains CI evidence for the branch.

Subsequent source moves

The following slices follow the same rule as the first three: each is a structural move with import rewrites, no compatibility shim, focused package and direct-caller validation, and git diff --check. They are recorded here while the branch is in flight; they do not describe the umbrella repository's main until its Spinifex gitlink is updated.

Source commit	Old path	New path	Finding or boundary recorded
04b41a62c	spinifex/idempotency	spinifex/foundation/lifecycle/idempotency	Generic request coalescing is lifecycle infrastructure, not a domain owner.
25fa01a3d	spinifex/preflight	spinifex/bootstrap/preflight	Startup validation is bootstrap input, not a generic service.
681fccc61	spinifex/systemd	spinifex/operator/host/systemd	Host unit generation and reconciliation are operator-host work.
23ca5d8aa	spinifex/resource	spinifex/foundation/lifecycle/resource	Resource metadata is a generic lifecycle primitive.
7a3c8de07	spinifex/nbd	spinifex/runtime/compute/nbd	NBD process control is node-local compute runtime.
ea65616be	spinifex/hostdns	spinifex/runtime/host/dns	Host resolver integration is runtime host work.
d80803807	spinifex/qmp	spinifex/runtime/compute/qmp	QMP is local VM runtime control.
41e2c1f10	spinifex/gpu	spinifex/runtime/compute/gpu	GPU discovery and attachment are local compute runtime work.
d78246d05	spinifex/instancetypes	spinifex/domains/ec2/instancetypes	AWS-visible instance-type semantics belong to EC2.
b2ce46124	spinifex/service	spinifex/runtime/service	The named-role catalogue is runtime composition.
573ee6761	spinifex/loadgen	internal/testkit/loadgen	Load generation is qualification support, not product code.
afdb6618c	spinifex/otelsetup	spinifex/foundation/telemetry	Spinifex instrumentation primitives are shared telemetry foundation.
956fe1490	spinifex/awserrors	spinifex/foundation/aws/errors	AWS error vocabulary is shared AWS foundation.
cbbf252e6	spinifex/testutil	internal/testkit	Test doubles remain compiler-private and cannot become application dependencies.
0c2d64413	spinifex/vm	spinifex/runtime/compute/vm	VM lifecycle is node-local compute runtime, not EC2 API ownership.
a74adc48b	spinifex/ebsmetadata	spinifex/domains/ec2/ebs/metadata	EBS API metadata remains EC2-domain state.
94ddc91a1	spinifex/ebsprovider	spinifex/providers/ebs	The provider contract and conformance suite are replaceable storage adapters.
3c1bce1eb	spinifex/cloud/oci	spinifex/providers/cloud/oci	OCI access is a replaceable cloud-provider adapter.
56970d079	spinifex/services/nats	spinifex/runtime/roles/nats	NATS process startup is a named runtime role.
d87326f64	spinifex/network/listenerinventory	internal/testkit/listenerinventory	Listener inventory is test-only qualification support.
4d4875b13	spinifex/services/spinifexui	spinifex/runtime/roles/spinifexui	The web UI is a named runtime role, not a logical AWS domain.
f39bc64c9	spinifex/admin listener helpers	spinifex/foundation/netaddr	Listener-address parsing is a small shared network primitive.
9e8e889fb	spinifex/services/qemunbdd	spinifex/runtime/roles/qemunbdd	QEMU-NBD provider process startup is a runtime role.
3494ae131	spinifex/services/qmpcollector	spinifex/runtime/roles/qmpcollector	QMP collection is a named runtime role.
f64931546	spinifex/services/spinifex	spinifex/runtime/roles/spinifex	The core daemon executable role is runtime composition.
57f238a0c	spinifex/tags	spinifex/foundation/aws/tags	System-tag vocabulary is shared AWS foundation.
7a6b00728, 186ef7ebc	spinifex/kvutil	spinifex/foundation/state/kvutil	Replica policy was made explicit before moving generic KV utilities to state foundation.
57f9d2ccc	spinifex/kvstore	spinifex/foundation/state/kvstore	Generic KV storage mechanics are state foundation.
247e52ba3	spinifex/reconciler	spinifex/foundation/lifecycle/reconciler	Generic reconciliation mechanics are lifecycle foundation.
b1d0eba89	inline KV migration mechanics	spinifex/foundation/state/migrate	KV migration is a reusable state concern.
967f6904a	spinifex/kvlease	spinifex/foundation/state/kvlease	Leases are state foundation, not a resource-domain owner.
248f0e005, 8c4af3030	spinifex/formation	spinifex/runtime/formation	Formation owns its protocol payloads and remains runtime membership/bootstrap work.
b8b97279c, c0c64cd53	spinifex/instancecache	spinifex/runtime/compute/cache	Cache policy is decoupled from callers before becoming node-local compute runtime.
aa0c36ff4	spinifex/types/ec2.go	contracts/ec2/v1	The EC2 instance-command subject and JSON payload are an explicit versioned cross-process contract; commands_test.go is its compatibility evidence.
c239fd897	spinifex/types/eni.go	spinifex/runtime/compute/vm/eni_requests.go	PCIe hot-plug slot allocation is mutex-bearing, per-VM runtime state rather than a shared type or wire contract; record_test.go preserves its restart semantics.
6d6275e78	spinifex/types/cluster.go (NodeHealthResponse)	contracts/cluster/v1/health.go	Node health is a versioned cluster control-plane representation shared by the per-node NATS route and daemon HTTPS /health; health_test.go pins both wire forms.
53a614717	spinifex/types/cluster.go (SharedClusterData)	spinifex/daemon/config_hash.go	Shared-config hash input is daemon-local implementation data; focused config-hash tests preserve deterministic, shared-only semantics.
78fd017e0	spinifex/types/telemetry.go (GuestTelemetryMeta)	contracts/telemetry/v1/guest_meta.go	QMP collector sidecar JSON is a versioned file contract between VM runtime and telemetry role; guest_meta_test.go pins its filename and payload.
4b35a2a33	spinifex/types/node.go (NodeVMsResponse, VMInfo, VMGPUInfo)	contracts/cluster/v1/node_vms.go	VM inventory is a versioned cluster fan-out payload used by SPX CLI and EKS host lookup; node_vms_test.go pins its subject and JSON shape.
08bd335f0	spinifex/types/node.go (NodeStatusResponse, capacity and GPU inventory)	contracts/cluster/v1/status.go	Node status is a versioned fan-out observation contract for operator inspection and EC2/EKS scheduling consumers; status_test.go pins its subject and JSON shape.
f4cb550c9	spinifex/types/ebs.go (GP3 policy constants)	spinifex/domains/ec2/ebs/policy/gp3.go	The supported GP3 product envelope is EC2 EBS domain policy, not generic runtime or Viperblockd wire state; gp3_test.go pins the deployed values.
adb55de33	spinifex/types/ebs.go (NBDTransport)	spinifex/services/viperblockd/nbd_transport.go	NBD endpoint transport selection is Viperblockd-local delivery configuration, not generic EBS state or a provider contract; nbd_transport_test.go pins the socket and TCP forms.
94a6e7af2	spinifex/types/ebs.go (EBSConfigUpdateRequest, EBSConfigUpdateResponse)	contracts/viperblockd/legacy/v1/config_update.go	Legacy configuration updates have deployed queue and volume-addressed NATS routes; the versioned compatibility contract is expressly transitional and separate from providers/ebs.
b975f1ba9	Remaining spinifex/types/ebs.go payloads	runtime/compute/vm/ebs_requests.go and contracts/viperblockd/legacy/v1/volume.go	The mutex-bearing attachment collection is VM-owned; deployed mount, unmount and delete routes plus their JSON payloads are versioned Viperblockd legacy compatibility. Contract tests pin every route and JSON shape.
61cf833aa	spinifex/cloud/exoscale	spinifex/providers/cloud/exoscale	Exoscale CLI access is a replaceable external-cloud adapter. The source move rewrites its four Exonet callers and preserves its adapter tests and CLI boundary.
dbc62562c	spinifex/objectstore	spinifex/providers/objectstore	The generic S3-compatible client is a replaceable object-storage adapter, not S3 resource authority. The mechanical move rewrites all direct callers; its focused suite and caller compilation passed.
f11922986	spinifex/config	spinifex/bootstrap/config	Root configuration parsing belongs to bootstrap. Its package API is unchanged; package tests and regular, integration, E2E and benchmark caller compilation passed.
aa4b0b1bb	spinifex/paging	spinifex/foundation/aws/paging	Opaque listing tokens, deterministic slicing and EC2 pagination validation are shared AWS protocol infrastructure rather than EC2 resource authority. The move rewrites all five EC2 callers; focused package tests, direct caller compilation and tagged integration compilation passed.
6ac02a886	spinifex/clustersize	spinifex/foundation/state/clustersize	The declared cluster size and its fail-closed JetStream/KV replica policy are shared state-tier infrastructure, not a resource-domain owner. Focused package tests, all direct caller compilation, integration and E2E-tagged harness compilation passed.
93084043a	spinifex/handlers/ecr	spinifex/domains/ecr	ECR repository metadata, blob semantics and lifecycle rules are ECR domain ownership. The full domain suite, direct callers and tagged integration callers passed.
51b5c55b9	spinifex/gateway/ecrapi	spinifex/domains/ecr/awsapi	AWS JSON 1.1 action inventory, validation, resource-scope derivation and NATS-backed action handlers are ECR action-adapter ownership. Focused, gateway and tagged integration validation passed.
5e7311eb2	spinifex/gateway/ecr	spinifex/domains/ecr/registry	The OCI Distribution v2 protocol adapter is ECR data-plane ownership. Focused registry, gateway/AWS-gateway and tagged integration validation passed.
474c07316	spinifex/gateway/ecrauth	spinifex/domains/ecr/auth	ECR token claims, issuer/verifier, encrypted signing-key persistence and rotation are ECR credential ownership. Focused, gateway/AWS-gateway and tagged integration validation passed.
f59b40ad1	Gateway DescribeRepositories action semantics	spinifex/domains/ecr/awsapi.DescribeRepositories	Request validation, account scope, repository metadata lookup and AWS response projection are ECR AWS-action ownership. Gateway retains authenticated HTTP adaptation and response writing. Focused domain, gateway dispatch and tagged integration compilation passed.
c558872e8	Gateway CreateRepository action semantics	spinifex/domains/ecr/awsapi.CreateRepository	Request decoding, input defaults and validation, duplicate detection, account-scoped metadata persistence and AWS response projection are ECR AWS-action ownership. Gateway retains authenticated HTTP adaptation and response writing. Focused domain, gateway lifecycle and tagged integration validation passed.
a6b209b7b	Gateway DeleteRepository action semantics	spinifex/domains/ecr/awsapi.DeleteRepository	Request validation, account scope, non-empty protection, forced deletion, metadata cascade and AWS response projection are ECR AWS-action ownership. Blob reclamation remains the separately documented GC concern. Focused domain, gateway lifecycle and tagged integration validation passed.
7a5159366	Gateway PutImageTagMutability action	spinifex/domains/ecr/awsapi.PutImageTagMutability	This endpoint-free action is registered directly in the ECR action table rather than retained as a gateway wrapper. Request validation, account-scoped metadata update and AWS response construction are domain-adapter ownership; generic gateway auth and policy gating remain before dispatch. Focused domain, gateway and tagged integration validation passed.
a2f6005d2	Gateway GetAuthorizationToken action response	spinifex/domains/ecr/awsapi.GetAuthorizationToken	Gateway retains canonical IAM/STS principal construction from authenticated context. The ECR adapter consumes a narrow token-issuer capability and owns mint-result handling, Docker AWS:<jwt> encoding and AWS response projection. Focused domain, real issuer/verifier gateway round-trip and tagged integration validation passed.
ee4610a75	Gateway ListImages action semantics	spinifex/domains/ecr/awsapi.ListImages	The ECR AWS adapter consumes a narrow OCI image-catalog capability and owns request validation, account scope, tag-status projection and AWS response/error mapping. Gateway retains authenticated HTTP adaptation and supplies the configured registry. Focused domain, registry-backed gateway and tagged integration validation passed.
b22b723a4	Gateway DescribeImages action semantics	spinifex/domains/ecr/awsapi.DescribeImages	The ECR AWS adapter now shares the image-catalog capability and catalog error mapping with ListImages, and owns image selection/detail projection. The accepted-but-unapplied filter field is explicitly retained as an unchanged compatibility gap. Focused domain, registry-backed gateway and tagged integration validation passed.
deabaa300	Gateway BatchGetImage action semantics	spinifex/domains/ecr/awsapi.BatchGetImage	The ECR AWS adapter consumes a narrow manifest-reader capability and owns request validation, the 100-image cap, digest-over-tag selection and partial-failure response projection. Repository/account scope validation is now shared with ListImages and DescribeImages. Focused domain, registry-backed gateway and tagged integration validation passed.
2542ce98e	Gateway PutImage action semantics	spinifex/domains/ecr/awsapi.PutImage	The ECR AWS adapter consumes a narrow manifest-writer capability and owns request validation, tag/digest selection, AWS response projection and OCI manifest-store error translation. Gateway retains authenticated HTTP adaptation and supplies the configured registry. Focused domain, registry-backed gateway and tagged integration validation passed.
7666ed208	Gateway BatchDeleteImage action semantics and residual ECR helpers	spinifex/domains/ecr/awsapi.BatchDeleteImage, awsapi.ValidateRepositoryScope, gateway ecr_request.go	The ECR adapter consumes a narrow image-deleter capability and owns batch deletion/partial-failure projection. Completion exposed scope validation still needed by lifecycle-preview adapters, which now calls the exported ECR adapter utility; generic HTTP JSON decoding moved to a gateway ECR adapter helper. Focused domain, image/lifecycle gateway and tagged integration validation passed.
72c20bf78	Gateway lifecycle-preview evaluation and StartLifecyclePolicyPreview	spinifex/domains/ecr/awsapi.EvaluateLifecyclePreview, StartLifecyclePolicyPreview	Shared preview evaluation now consumes explicit policy-store and image-catalog capabilities, owns request/stored-policy resolution and lifecycle evaluation, and returns a reusable expiry set. Start preview is fully domain-owned; Get preview consumes the evaluator and retains only its response projection pending the next slice. Focused domain, lifecycle gateway and tagged integration validation passed.
68945bbb1	Gateway GetLifecyclePolicyPreview response projection	spinifex/domains/ecr/awsapi.GetLifecyclePolicyPreview	Get preview now joins Start preview in the ECR adapter, sharing the synchronous evaluator and explicit policy-store/image-catalog capabilities. Gateway retains only authenticated HTTP/body adaptation and capability supply. Focused domain, lifecycle gateway and tagged integration validation passed.
4c9f3d681	Gateway ECR image-action wrappers and residual JSON adapter	spinifex/domains/ecr/awsapi.RegistryActionService	ListImages, DescribeImages, BatchGetImage, PutImage and BatchDeleteImage now dispatch through one composed registry-action capability after the generic gateway's authentication and policy gate. The composition root supplies narrow OCI capabilities; the operation inventory derives their implemented status from that capability. The obsolete gateway wrappers and JSON helper are removed. Focused domain, gateway, AWS-gateway and tagged integration validation passed.
40e7b14ad	Gateway lifecycle-preview wrappers	spinifex/domains/ecr/awsapi.LifecyclePreviewActionService	StartLifecyclePolicyPreview and GetLifecyclePolicyPreview now dispatch through one composed policy-store-plus-image-catalog capability after generic authorization. Production reuses the registry's NATS metadata client; focused tests compose an in-memory metadata store. The obsolete wrappers are removed, and a missing composition fails closed rather than falling through to the raw action table. Focused domain, gateway, AWS-gateway and tagged integration validation passed.
54f96ad78	Gateway CreateRepository, DescribeRepositories and DeleteRepository wrappers	spinifex/domains/ecr/awsapi.RepositoryActionService	Repository actions now dispatch through one composed metadata-store-plus-endpoint-profile capability after generic authorization. The individual action adapters depend on a narrow repository metadata contract rather than constructing NATS clients themselves. The three obsolete wrappers are removed, and a missing composition fails closed. Focused domain, gateway, AWS-gateway and tagged integration validation passed.
5ebbdcb53	Gateway GetAuthorizationToken wrapper and endpoint adapter	spinifex/domains/ecr/awsapi.AuthorizationTokenActionService	GetAuthorizationToken now dispatches through a composed issuer-plus-endpoint capability after gateway constructs the canonical IAM/STS principal. The token subject remains gateway identity work; ECR retains credential response projection. The obsolete wrapper and endpoint adapter are removed, a missing action service fails closed, and an unavailable issuer retains the declared NotImplemented response. Focused domain, gateway, AWS-gateway and tagged integration validation passed.
2b945ad88	spinifex/handlers/acm, spinifex/gateway/acm	spinifex/domains/acm, spinifex/domains/acm/awsapi	ACM certificate state, issuance and renewal are ACM-domain ownership; its AWS JSON/NATS request adapters live beside them. All nine adapters, including the previously inlined RequestCertificate path, now use domains/acm/awsapi; generic gateway retains only routing, request context, policy gating and response writing. Focused domain, adapter and gateway request tests plus direct-caller and tagged integration compilation passed.
47c6b2fcf	spinifex/gateway/bodyscope	spinifex/ingress/aws/bodyscope	Case-aware, ambiguity-safe extraction of AWS JSON request identifiers is ingress policy machinery, not generic gateway ownership. Focused parser tests and compilation of all six direct service-policy consumers passed.
d3cd6d520	spinifex/gateway/policy	spinifex/foundation/aws/policy	AWS wire-service to IAM action-name mapping is protocol-neutral AWS vocabulary. Its focused suite and direct gateway/RDS/integration caller compilation passed.
be7f0b1d0	spinifex/utils/platform	spinifex/domains/ec2/platform	EC2 Platform and UsageOperation derivation is EC2 compatibility vocabulary, not a generic helper. Focused package and metadata-default tests, plus direct daemon/image/instance caller compilation, passed.
e2ac3dbed	spinifex/utils/command	spinifex/runtime/host/command	Bounded host-command execution is node-local runtime machinery. Focused command and host-DNS tests plus the direct SPX CLI caller compilation passed.
3360382f5	spinifex/utils/idempotency	spinifex/foundation/lifecycle/idempotency	Retry-token HTTP/NATS vocabulary now lives beside the idempotency store. Focused propagation and EIP retry behavior tests, affected package compilation and tagged integration compilation passed.
b5bc8cd7d	spinifex/utils/images (SelectNewestImage)	spinifex/foundation/aws/ami	Selecting the newest EC2 image from AWS SDK models is shared AWS-model logic used by EKS, ECS, RDS and Bedrock, not operator catalogue ownership. Focused selector and remaining catalogue tests plus all four direct caller compilations passed.
9f83f899a	spinifex/utils (ClientIP, RequestClientIP)	spinifex/ingress/http	HTTP remote-address parsing and loopback-trusted X-Real-IP handling are generic ingress policy shared by the AWS gateway and UI proxy. The moved test suite and all direct caller compilations passed.
693109950	spinifex/utils (HashMAC)	spinifex/network/identifiers	Deterministic locally-administered MAC derivation is network infrastructure shared by ENIs, DHCP, OVN topology, IMDS and VM tap setup. Focused MAC tests and every direct caller compilation passed.
79cf93996	spinifex/utils (DistinctIDs)	spinifex/foundation/aws/identifiers	Request-order-preserving normalization of AWS resource-ID lists is shared API-model handling used by image and snapshot enumeration. Focused tests and both direct caller compilations passed.
7e29f2640	spinifex/utils (download and terminal-progress helpers)	spinifex/operator/progress	Operator-facing downloads, terminal progress rendering and byte display are CLI presentation concerns. Focused tests and the spx admin compilation passed.
56471479f	spinifex/utils (ValidateKeyPairName)	spinifex/handlers/ec2/key	EC2 key-pair-name validation has one production owner and is now private to it. Its moved unit matrix and full key-handler suite passed.
cf531cd73	spinifex/utils (QMP telemetry filename convention)	contracts/telemetry/v1	The telemetry QMP prefix and metadata path are part of the existing VM-runtime-to-collector file contract. The contract test, focused VM telemetry tests, collector suite and caller compilations passed; the broader VM suite is sandbox-blocked by unrelated socket setup.
83615f1f4	spinifex/utils (AWS XML response helpers)	spinifex/foundation/aws/xml	EC2 XML response normalization/enveloping and IAM-style Query envelopes are shared AWS protocol mechanics. Focused XML tests and all direct caller compilations passed; the RDS-agent package was compile-checked without execution because its FIPS bootstrap requires a FIPS-enabled runtime.
9896834b2	spinifex/utils (ExtractTags, MapToEC2Tags)	spinifex/foundation/aws/tags	Generic EC2 tag-specification extraction and API-model projection join the AWS tag foundation; KV tag mirroring remains separate state-layer work. Focused tag tests and direct caller compilations passed; the volume package was compile-checked without execution because its test main opens a sandbox-blocked TCP listener.
d8985c287	spinifex/utils (AccountKey)	spinifex/foundation/state/kvutil	Account-scoped durable-key construction belongs to the state foundation; its {accountID}.{resourceID} layout is unchanged. AWS account policy (GlobalAccountID, IsAccountID) remains separate legacy utility work. Focused key and tag-mirror tests plus every direct resource-caller compilation passed.
e6794d87d	spinifex/utils (SudoCommand, NeedsPrivilege, EndpointSysctlHelper)	spinifex/runtime/host/command	Host-command privilege escalation is node-local runtime machinery and now sits beside bounded command execution. The RG-10 invariant restricting direct sudo construction to this package and network/host/run.go moves with it. Focused privilege, preflight, network-host, host-DNS and vpcd tests, every direct caller compilation and tagged integration/E2E compilation passed.
fd6c12f14	spinifex/utils (PID files, runtime directory, socket waits, process signalling and OOM score)	spinifex/runtime/host/process	Node-local process supervision shared by the daemon, VM runtime, Viperblockd and every named role is runtime host machinery. The remaining NBD endpoint helpers temporarily import it until they move to compute runtime. The shipped Viperblock unit comment still names utils.KillProcess; it is left unchanged so a structural move does not alter a delivered unit. Full preflight (excluding the pre-existing containerd advisory), focused caller suites and tagged integration/E2E compilation passed.
e712c6a7f	spinifex/utils (NBD socket paths, URI format/parse, readiness wait)	spinifex/runtime/compute/nbd	NBD endpoint naming and readiness join the node-local NBD runtime, removing the interim utils to runtime-host edge. The EBS provider conformance suite now imports compute runtime for the URI format; if a versioned EBS wire contract is introduced, that format is a candidate for contracts/ebs/v1. Full preflight (excluding the pre-existing containerd advisory), focused NBD, VM, Viperblockd, QEMU-NBD, EBS-provider and admin suites, and tagged integration/E2E compilation passed.
366e2c2e4	spinifex/utils (image catalogue, checksum verification, disk-image extraction)	spinifex/operator/imagecatalog	The published image catalogue and its download verification serve only spx admin image import, an operator use case. The package is named imagecatalog because the command tree already uses images as a local identifier. Moved tests reach repository fixtures one directory deeper; script and documentation pointers to the catalogue file were updated. Full preflight (excluding the pre-existing containerd advisory), focused catalogue and CLI suites, and tagged integration/E2E (including GPU) compilation passed.
53f13f213	spinifex/utils (GenerateResourceID)	spinifex/foundation/aws/identifiers	AWS-style {prefix}-{17 hex} resource-ID generation joins the AWS identifier foundation beside request-ID normalisation; callers use the established awsidentifiers alias, which also avoids the network-identifier package name. Format and CSPRNG failure handling are unchanged. Full preflight (excluding the pre-existing containerd advisory), focused tests and tagged integration/E2E compilation passed.
eab631b42	spinifex/services/predastore	spinifex/runtime/roles/predastore	Predastore process configuration and startup are a named runtime role; the package holds no S3 resource semantics. The service manifest path moved with it. Full preflight (excluding the pre-existing containerd advisory), focused role, role-catalogue and CLI suites, and tagged integration/E2E compilation passed. Commit 796fb52d4 separately corrects the manifest's stale handlers/acm path left by the ACM relocation; manifest-check now passes.
ad6a158f8	spinifex/services/northstar	spinifex/runtime/roles/northstar	Northstar process startup and reload are a named runtime role. BootstrapBaseZone moved with it unchanged but is DNS control-plane work (it imports handlers/dns); it belongs to domains/dns when that domain moves, so the role is not yet thin. Full preflight (excluding the pre-existing containerd advisory), focused role, role-catalogue and CLI suites, manifest-check and tagged integration/E2E compilation passed.
931d86d5c	spinifex/services/awsgw	spinifex/runtime/roles/awsgw	The AWS gateway process is a named runtime role and its composition root wires every domain, which runtime may do. The quota reconcile loop (runQuotaReconcile, quotaKeyFor) moved with it unchanged but belongs to domains/admission/quota, and the EKS token-verify responder belongs with STS or EKS identity; both are recorded residuals, so the role is not yet thin. Service-interface manifest, design doc and architecture diagram paths were updated. Full preflight (excluding the pre-existing containerd advisory), focused role, role-catalogue and CLI suites, manifest-check and tagged integration/E2E compilation passed.
745338563	spinifex/utils (GenerateErrorPayload, GenerateErrorPayloadWithMessage, ValidateErrorPayload, UnmarshalJsonPayload)	spinifex/foundation/aws/errors	The JSON error envelope every domain exchanges over NATS carries the shared AWS error vocabulary, so it sits beside the codes it encodes rather than in a per-domain contract. Behaviour is unchanged. Full preflight (excluding the pre-existing containerd advisory), focused error and caller suites and tagged integration/E2E compilation passed.
02e0dd0dc	spinifex/utils (GlobalAccountID, IsAccountID)	spinifex/foundation/aws/identifiers	The 12-digit account ID check and the system account ID constant are AWS identifier vocabulary and sit beside resource ID generation; no account policy changed. Full preflight (excluding the pre-existing containerd advisory), focused identifier and caller suites and tagged integration/E2E compilation passed.
b5806ce63	spinifex/utils (NATS connect/retry, request/serve, gather, headers, PublishEvent, trace propagation)	spinifex/foundation/messaging/nats (package natsmsg)	Generic NATS transport primitives are shared machinery with no resource owner; the package name avoids colliding with nats.go at every caller. The OTel instrumentation scope keeps its spinifex/utils value so existing APM queries still match. vpcd's request/ack protocol (RequestEvent, AddNAT, PublishNATEvent) stays in utils/vpcd_event.go for a future network contract, and SubjectEnsureDefaultVpc stays in utils/ec2_subject.go for an EC2 contract; both were split out byte-identical. Full preflight (excluding the pre-existing containerd advisory), focused transport and caller suites and tagged integration/E2E compilation passed.
cabe0e99b	spinifex/handlers/sysinstance	spinifex/domains/ec2/systeminstance	System-instance launch is compute ownership; managed services (ELBv2, EKS, RDS, Bedrock) consume the launcher contract. The package was renamed to its directory; runtime sysinstance: error strings are unchanged. Managed-service parent metadata is still only the ManagedBy tag value, short of the explicit parent metadata the ADR names. Full preflight (excluding the pre-existing containerd advisory), focused daemon and managed-service suites and tagged integration/E2E compilation passed.
4d86296eb	spinifex/handlers/systemvpc	spinifex/domains/network/systemvpc	Managed system-VPC realisation is network ownership; ELBv2, EKS, RDS and Bedrock consume its builder. The package was renamed from handlers_systemvpc to its directory and callers dropped the alias; it depends only on foundation packages. Full preflight (excluding the pre-existing containerd advisory), focused system-VPC, daemon and managed-service suites and tagged integration/E2E compilation passed.
09de514ef	spinifex/handlers/imds	spinifex/domains/ec2/guestmetadata	Guest metadata is a compute-domain interface served to guests on each node. The package was renamed from handlers_imds to its directory and its vpcd and E2E callers dropped the alias; five path comments were updated. The move exposes dependency-rule breaks it does not repair: imports of the DNS, EC2 instance, EC2 key, IAM and STS implementations, and the first domain-to-runtime edge (runtime/compute/vm); see Guest metadata relocation residuals. Full preflight (excluding the pre-existing containerd advisory), focused guest-metadata, vpcd and DNS suites and tagged integration/E2E compilation passed.
99278d5ff	spinifex/handlers/dns	spinifex/domains/dns	DNS control semantics (zone records, resolver and name policy) are DNS-domain ownership, distinct from OVN and host-network realisation. The package name was already dns, so callers dropped the handlers_dns alias; the multinode E2E test that also imports miekg/dns uses dnsdomain. Six path comments were updated. The move exposes imports of runtime/compute/vm, network/reconcile and bootstrap/config, recorded in the dependency-rule debt. The integration,segscanoracle build fails identically on origin/dev (predastoreS3Client is in package integration but called from integration_test) and was not touched. Full preflight (excluding the pre-existing containerd advisory), focused DNS, ACM, guest-metadata, daemon, northstar, admin and CLI suites, manifest-check and tagged integration, E2E and E2E bench compilation passed.
06b1eefd9	spinifex/runtime/roles/northstar (BootstrapBaseZone)	spinifex/domains/dns	Seeding the base zone and its NS topology is DNS control-plane work, so it joins the DNS domain and the northstar role is left with process startup and reload only. Its tests moved with it and reuse the DNS package's identical fakeS3 helper. The daemon flakes seen during verification (TestRestoreInstances_ClusterRecordWinsForSharedInstance under load; TestKVIPSecBarrier_* and TestDrainVolumeRecordsItsPointAfterTheWork under -count=3) reproduce identically on origin/dev. Full preflight (excluding the pre-existing containerd advisory), focused DNS, northstar and CLI suites and tagged integration/E2E compilation passed.
8ca318070	spinifex/admin (SystemAccountID)	spinifex/foundation/aws/identifiers (GlobalAccountID)	SystemAccountID() duplicated the existing GlobalAccountID constant (000000000000), so its callers now use the constant and the function and its test are deleted rather than moved. DefaultAccountID and DefaultAccountName are Mulga bootstrap identity policy, not AWS identifier syntax, and stay in admin for a later IAM/account bootstrap slice. Full preflight (excluding the pre-existing containerd advisory), focused admin, account-teardown, EKS, CLI and identifier suites and tagged integration/E2E compilation passed.
930040875	spinifex/admin (LoadCAKeyPair)	spinifex/foundation/pki	Loading a PEM certificate and PKCS8 RSA key is a generic primitive; the new package imports no Spinifex package and holds no certificate identity or file layout. GenerateCACert and GenerateSignedCert stay in admin because they embed Spinifex certificate identity and validity policy. Full preflight (excluding the pre-existing containerd advisory), focused admin and RDS suites and tagged integration/E2E compilation passed.
001aa2d42	spinifex/admin (TenantCACertPath, TenantCAKeyPath)	spinifex/domains/acm	The tenant private CA's on-disk layout belongs to ACM, beside LoadTenantCA and LoadOrCreateTenantCA, which consume it; the daemon and the spx admin acm command now call the ACM domain. Full preflight (excluding the pre-existing containerd advisory), focused ACM, admin, daemon and CLI suites and tagged integration/E2E compilation passed.
454defb00	spinifex/admin (IPsec certificate paths, peer issuance, strongSwan CA install and reread)	spinifex/network/host	IPsec peer credentials belong with the host IPsec owner that consumes them; network/host no longer imports admin. Peer keys use their own ipsecCertKeyBits seam (4096, lowered in tests) instead of admin's certKeyBits, a deliberate duplicate of the key-size policy. The moved test now builds its throwaway CA locally instead of calling admin's GenerateCACert. Full preflight (excluding the pre-existing containerd advisory), the four moved tests, focused network-host, admin and CLI suites and tagged integration/E2E compilation passed.
2c467988d	spinifex/handlers/bedrock	spinifex/domains/ochre	Ochre is the platform service and owns model serving placement, launch, readiness, capacity and reaping; the Bedrock name now marks only the AWS API surface, per the amended ADR-0001 map row. Package renamed from handlers_bedrock to ochre, callers drop the alias, and KV bucket names, NATS subjects, metric names and error strings keep their bedrock names. The comment in the shipped bedrock-serve image script still names the old path because editing it changes image build input. Full preflight apart from the known govulncheck finding, focused Ochre, vector, Bedrock gateway, daemon, account teardown, awsgw, config and CLI tests, and tagged integration/E2E compilation passed.
93f101c0f	spinifex/handlers/ochrevector	spinifex/domains/ochre/vector	The tenant vector store (pgvector backend, KV index registry, ingest, jobs, backup and appliance orchestration) is Ochre domain state and now sits under the Ochre domain as the ADR-0001 map requires. Package renamed from handlers_ochrevector to vector with its existing package comment; callers use the ochrevector alias because vector is a common local identifier in the gateway, daemon and CLI. Error strings keep their ochrevector: prefix. The service-interface manifest names the new path. Full preflight apart from the known vulnerability-scan finding, focused Ochre, gateway, daemon, awsgw and CLI tests, tagged integration/E2E compilation and the manifest check passed.
2b6131e21	spinifex/gateway/bedrock/hfhub	spinifex/domains/ochre/hfhub	The Hugging Face Hub client resolves and streams model weights for Ochre and has no dependency on the rest of gateway/bedrock; its only caller is spx admin ochre weights pull. Package name unchanged. The rest of gateway/bedrock is not moved: it holds Ochre domain state, stores and the inference engine alongside the Bedrock action layer, and domains/ochre imports it, so moving it to domains/ochre/awsapi would invert the domain-to-adapter direction. It is recorded as dependency-rule debt. Full preflight apart from the known vulnerability-scan finding, focused hfhub and CLI tests, and tagged integration/E2E compilation passed.
40964815b	spinifex/utils (MergeTagsMut, ApplyTagRemovals, RemoveTagsMut, UpdateKVRecordTags, MirrorKVRecordTags)	spinifex/domains/ec2/tagmirror	EC2-wide AWS tag mutation over resource KV records is EC2 domain behaviour and imports only foundation packages. The EC2 tags resource package was not used because it imports the instance, key and VPC resources that call these helpers, which would create a resource-to-resource cycle. Twelve EC2 resource packages now call tagmirror; a stale utils.ParseNBDURI comment in the VM device code now names nbd.ParseNBDURI. Full preflight apart from the known vulnerability-scan finding, focused EC2, utils and VM tests, and tagged integration/E2E compilation passed.
7003168bc	spinifex/network/* (all 15 packages)	spinifex/domains/network/*	Network control, policy, topology, OVN, external and host realisation are network-domain ownership. The packages move as one enclosing move because the L0–L5 invariants classify layers by trimming a single networkRoot prefix; a partial move would silently drop moved packages out of S1. Package names, layer assignments, reconciliation authority and the vpcd boundary are unchanged. Invariant scan roots, the RG-10 sudo allow-list path, .github/CODEOWNERS and the IMDS netns unit test's repo-root walk follow the new path. Injected host→topology and L3 CreateLogicalSwitch violations failed S1 and S5 at the new paths, confirming the invariants still scan the moved packages; domains/network/systemvpc now also falls inside the host-containment and NAT-mode scans and passes them. Full preflight apart from the known vulnerability-scan finding, focused network, invariant, host-command and vpcd suites, setup-ovn_test.sh, manifest-check and tagged integration/E2E compilation passed.
d8ab4017a	spinifex/handlers/ec2/{account,key,launchtemplate,placementgroup,spotinstance,volumestate}	spinifex/domains/ec2/<resource>	These EC2 resources import no other EC2 handler package, so they move first as EC2 domain resources with their responsibilities unchanged. Each package is named after its directory and callers import it as ec2<resource>, because the bare names collide with common local identifiers; volumestate already carried its directory name. No package name appears in error text, KV keys or metrics. Path comments were updated. Full preflight apart from the known vulnerability-scan finding, focused EC2 domain, EC2 gateway, account-teardown and remaining EC2 handler suites, and tagged integration/E2E compilation passed.
20b5deb5c	spinifex/handlers/ec2/{vpc,eigw,eip,igw,natgw,routetable}	spinifex/domains/ec2/<resource>	VPC, egress-only and internet gateways, Elastic IPs, NAT gateways and route tables are EC2 API resources and keep their responsibilities. vpc moves whole; splitting it along VPC, subnet, ENI and security-group boundaries remains EC2 decomposition work. Packages are named after their directories and imported as ec2<resource>; one test's local vpc alias was kept. The reconcile drift-watch test located bucket constants by matching the handlers_ec2_ qualifier text, so its pattern now matches ec2<resource>; removing ec2eip.KVBucketEIPs from the watched list made it fail as intended. domains/network's imports of these packages are now visible domain-to-domain edges, already listed in the dependency-rule debt. Full preflight apart from the known vulnerability-scan finding, focused EC2 and network domain, EC2 gateway, handler, daemon and CLI suites, and tagged integration/E2E compilation passed.
5d60184e8	spinifex/handlers/ec2/{instance,volume,snapshot,image,tags}	spinifex/domains/ec2/<resource>	Instances, volumes, snapshots, images and tags are EC2 API resources and keep their responsibilities; handlers/ec2 is now empty. Packages are named after their directories and imported as ec2<resource>; one test's local instance alias was kept. docs/service-interfaces.yaml mapped spinifex/handlers/ec2 to the daemon for e2e suite selection, so since the first EC2 slice an EC2-only change fell back to the default suites; a throwaway commit changing only a domains/ec2/key file selected e2e-cert e2e-lb with the old manifest and the daemon suites with the new one, which lists the 17 moved resource paths rather than all of domains/ec2 so selection is unchanged. The move exposes domains/ec2/instance's runtime and DNS imports, recorded in the dependency-rule debt. Full preflight apart from the known vulnerability-scan finding, focused domain, EC2 gateway, handler, daemon, account-teardown, CLI and selector suites, manifest-check and tagged integration/E2E compilation passed.
4501dbf69	cmd/ecr-credential-provider (implementation)	spinifex/agents/eks/credentialprovider	The kubelet exec credential provider is EKS-node integration and moves under the agent tree as ADR-0001 maps it; it depends only on internal/{ecrauth,guestenv,imdscreds}, so no ECR domain code gains a guest-environment dependency. main() became Main(in, out) int with the same body writing to out and returning the exit code; the thin cmd/ecr-credential-provider main keeps the binary name and the fipsboot import. .golangci.yml excludes gosec for cmd/, so the move brings this code under gosec for the first time; its one G101 false positive is annotated. The moved test, full preflight apart from the known vulnerability-scan finding, a bad-CA smoke run (empty-auth response, exit 1) and a dependency check that fipsboot still links into the binary passed.
fecf0b28a	cmd/eks-gateway-publish (implementation)	spinifex/agents/eks/gatewaypublish	The control-plane VM's gateway publication relay is EKS in-guest behaviour. cmd/eks-gateway-publish keeps flag definitions, EKS_* environment defaults, parsing, the fipsboot import, the eks-gateway-publish: log prefix and exit code 1; the agent exposes only Config and Run(ctx, Config) error and imports no flag, os.Args, os.Stdin or os.Exit. The 11 former fatal sites had no defers or cleanup and return errors with identical text. retryDelay became a variable for tests and the retry wait honours context cancellation, which the binary's background context never triggers. New focused Run tests cover every validation and payload error, a wrapped publish, the 30-attempt budget and cancellation. Old and new binaries gave identical stderr and exit codes for nine command-path cases apart from the binary path in flag usage output. Full preflight apart from the known vulnerability-scan finding passed.
8929ee47b	cmd/eks-gateway-fetch (implementation)	spinifex/agents/eks/gatewayfetch	The control-plane VM's add-on and recovery fetch is EKS in-guest behaviour. cmd/eks-gateway-fetch keeps its nine flags in their original order with EKS_* environment defaults, parsing, the fipsboot import, the eks-gateway-fetch: log prefix and exit code 1; the agent exposes only Config (with Out supplied by the binary) and Run(ctx, Config) error. The 8 former fatal sites had no defers or cleanup and return errors with identical text; a render failure is still not retried. As with publish, retryDelay is a test variable and the retry wait honours a cancellation the binary never triggers. The TSV emitters and their tests moved unchanged; new Run tests cover the five startup errors, addons and recovery rendering at their gateway paths, an unretried render failure, the attempt budget and cancellation. Old and new binaries gave byte-identical stdout, stderr and exit codes for 11 cases against a local TLS gateway, including both TSV outputs and flags overriding environment. Full preflight apart from the known vulnerability-scan finding passed.
d064924e6	cmd/eks-webhook-cert (implementation)	spinifex/agents/eks/webhookcert	Minting and caching the in-cluster admission webhook's self-signed serving certificate is EKS in-guest behaviour. cmd/eks-webhook-cert keeps the -dir, -cn and -dns flags, parsing, the usage text, the fipsboot import, the eks-webhook-cert: log prefix and exit code 1; the agent exposes only Config (with Out supplied by the binary) and Run(ctx, Config) error and depends only on the standard library. The 3 former fatal sites had no defers or cleanup; a key-write failure still leaves tls.crt on disk, and a stdout write error is still ignored. Moving out of cmd/ brought the file under gosec, whose G306 finding on the public certificate's 0644 mode is annotated with its reason. Existing tests moved unchanged; new Run tests cover the required-flag and blank-SAN errors, the cache-directory failure and the one-line CA/leaf/key output. Old and new binaries gave identical stdout, stderr, exit codes, file modes and output shape for 7 cases, and a second run reused the cached pair. Full preflight apart from the known vulnerability-scan finding passed.
fba330b86	cmd/eks-konnectivity-cert (implementation)	spinifex/agents/eks/konnectivitycert	Issuing and caching the on-node konnectivity-server certificate from the K3s cluster CA is EKS in-guest behaviour. cmd/eks-konnectivity-cert keeps its five flags and defaults (including -cn konnectivity-server), parsing, the usage text, the fipsboot import, the eks-konnectivity-cert: log prefix and exit code 1; the agent exposes only Config (with Out supplied by the binary) and Run(ctx, Config) error and depends only on the standard library. The 3 former fatal sites had no defers or cleanup; a key-write failure still leaves tls.crt on disk, and a stdout write error is still ignored. The gosec G306 finding on the public certificate's 0644 mode is annotated with its reason. Existing signing, reuse/reissue and SAN-splitting tests moved unchanged; new Run tests cover the required-flag and blank-SAN errors, an unreadable CA and the path output with IP and DNS SANs. Old and new binaries gave identical stdout, stderr, exit codes, file modes, CA verification, SANs and subject for 10 cases including SEC1 and PKCS8 CA keys, and the new binary reused the cached certificate and reissued it on a SAN change. Full preflight apart from the known vulnerability-scan finding passed.
ac069d8f3	cmd/eks-token-webhook (implementation)	spinifex/agents/eks/tokenwebhook	The control-plane VM's TokenReview webhook is EKS in-guest behaviour. cmd/eks-token-webhook keeps the -addr flag and loopback default, the environment-derived configuration (loadConfig, envOr, all eleven EKS_* variables, their default paths and the three required-variable errors, with its test), the slog text handler, both log lines and exit code 1; the agent exposes only Config and Run(ctx, Config) error and imports neither flag nor os.Getenv. The binary already returned errors from run, so no exit sites changed, and the certificate, kubeconfig, gateway-client and serve order is unchanged. Cancelling ctx now closes the server, which the binary never triggers. The relay, handler, certificate, kubeconfig and wire types moved unchanged with their tests; the public certificate's gosec G306 finding is annotated. New Run tests cover serving-cert, kubeconfig, gateway-client and listen failures and serving until cancelled. Old and new binaries matched for 12 cases including a live server's /healthz and /authenticate 405, 400 and 503 responses, file modes, kubeconfig body and log messages. Full preflight apart from the known vulnerability-scan finding passed.
3c82c69ad	cmd/ecs-agent/{runtime,credentials}	spinifex/agents/ecs/{runtime,credentials}	The containerd runtime adapter and the instance-role credential provider are ECS-agent-private mechanism and move under the ECS agent tree unchanged, keeping their package names. cmd/ecs-agent is their only importer; its import paths and one comment changed. Both packages now fall under gosec, which reported nothing. ECS agent and subpackage tests passed 10 times under the race detector and in full preflight apart from the known vulnerability-scan finding.
59decbc25	cmd/ecs-agent (implementation)	spinifex/agents/ecs/agent	The ECS container-instance agent is ECS in-guest behaviour; package agent, imported by the binary as ecsagent. cmd/ecs-agent keeps process lifecycle only: the signal context, the separate New(cfg) and Run(ctx) calls, the ecs-agent: startup failed and ecs-agent: run failed log lines and exit code 1. Config, LoadConfig(envFile) and DefaultEnvFile stay in the agent as the guest-agent/AMI contract. The ldflags-set var version stays in the binary's main package so -X main.version keeps working, and reaches the register message through a new Config.AgentVersion field that LoadConfig never sets; a new test pins that New carries it into the identity. runtime and credentials remain ECS-agent-private subpackages. Moving out of cmd/ brought the code under gosec; its one finding, G101 on the mulga.ecs.credID container label key, is annotated as a key name. Old and new binaries built with the same -X main.version sent identical register bodies (including the injected version) to a fake TLS gateway with a fake IMDS, logged the same messages, exited the same on SIGTERM and failed identically with IMDS unreachable. Full preflight apart from the known vulnerability-scan finding passed.
55e858788	cmd/rds-agent (implementation)	spinifex/agents/rds/agent	The RDS guest agent is RDS in-guest behaviour and moves as one slice: its engines, commander, bootstrap handoff, quiesce, storage and parameter recovery share unexported types, so a finer split would need new exports. Package agent, imported by the binary as rdsagent. cmd/rds-agent keeps process lifecycle only: the signal context, Start(ctx, cfg) then Run(ctx), cancellation as a clean stop, the rds-agent: startup failed and rds-agent: run failed messages and exit code 1. The agent owns Config, DefaultEnvFile, LoadConfig with the engine-layout derivation, New, Start and Run; Start is the existing startup retry around New, kept as guest-agent readiness policy, and no generic retry helper is exported. The ldflags-set var version stays in the binary's main package and reaches the agent through Config.AgentVersion. Three image fixture paths gained one directory level and their regeneration hints name the new package; the fixture tests were confirmed to fail on the old paths. Moving out of cmd/ brought the code under errcheck and gosec, which reported no findings. Old and new binaries built with the same -X main.version produced the same startup retry messages, retry cadence, error text, stdout and SIGTERM exit status with no gateway URL and with a missing gateway CA; the post-registration path is covered by the moved unit tests. Full preflight apart from the known vulnerability-scan finding passed.
918150758	cmd/installer/{autoinstall,branding,firstboot,install,netprobe,systemd,ui}	spinifex/operator/installer/<same>	Installation, UI and autoinstall logic is operator delivery behaviour; the seven packages were already libraries and keep their names, and cmd/installer/main.go stays the thin executable with its TTY detection, messages and exit codes unchanged. The installer's systemd package writes the installed system's bridge, firstboot, banner and getty units, which is distinct from operator/host/systemd's Spinifex unit reconciliation, so the two are not merged. scripts/diff-coverage.sh's UI exclusion and a scripts/setup.sh comment follow the new path; the Makefile still builds cmd/installer/main.go. Moving out of cmd/ brought the code under gosec and errcheck for the first time. All 47 gosec findings are annotated per line with the artifact and why its mode is required: 0755 directories, executables and mount points, 0644 OS configuration, units, networkd files, fstab, GRUB assets and the public CA certificate, and 0444 machine-id, each stating that it contains no secret material; spinifex-firstboot.sh is annotated as never permitted to contain credentials or tokenised callback URLs, and the two G115 conversions are annotated as bounded Linux statfs and sysinfo values. The PSK-bearing WPA configuration was already written 0600 and the root password goes through chpasswd. The one errcheck finding, an unchecked *syscall.Stat_t assertion in the ownership check, is now a checked assertion returning a verify error instead of panicking. Installer tests and full preflight apart from the known vulnerability-scan finding passed.
05f390e61	cmd/spinifex/cmd	spinifex/operator/cli	The spx command tree is operator CLI assembly; package cmd becomes cli and cmd/spinifex/main.go stays the thin entry point calling cli.Execute(). The -X version and commit ldflags in the Makefile and build/Dockerfile.distro follow the new import path, and a build using the Makefile LDFLAGS printed the injected version rather than dev. Template paths in scripts/reset-dev-env.sh, migrate/VERSIONS.md and the NATS role test follow the move. The listener-bind invariant globbed the old template path, found nothing and passed without examining any template; it now uses the new path and fails when the glob is empty, confirmed against the old path. Moving out of cmd/ brought the tree under errcheck and gosec (105 findings uncapped). Config and flag wiring now goes through unexported mustBindEnv, mustBindPFlag and mustMarkFlagRequired helpers that panic with the config key, flag and command at startup instead of silently dropping a binding; all 110 sites are covered by the package's init and existing bind-function tests. Listing tables are written with Srender and a checked write because pterm's Render discards write errors; output is byte-identical and writing to a full device now exits 1. The formation-server shutdown discards are explicit, the http.DefaultTransport assertion is checked, twelve permission findings are annotated per line, and the formation join's InsecureSkipVerify is annotated as a known security gap (see dependency-rule debt). Full preflight apart from the known vulnerability-scan finding passed.
5032e24a7, d500e3802, e630703d7, eb68ec460, ebcafa01f	gateway/ec2/{account,capacityreservation,key,launchtemplate,placementgroup}	spinifex/domains/ec2/awsapi/<same>	EC2 action adapters are domain-owned AWS API surface, so they move under the EC2 domain's awsapi, one commit per resource. Each package takes its directory name and callers use ec2<resource>api; moved files change only their package line. gateway/ec2.go keeps the dispatch map unchanged as the transitional registration point. Callers are the gateway dispatch and account teardown's EC2 reapers. Adapter, gateway dispatch and account-teardown tests, the integration and E2E builds, and full preflight passed.
c38bf99e4, 2ee60b20f, eaa5c971e, f6d8060f2, f50687210, 817e19bf2, 67992c8f5	gateway/ec2/{zone,vpc,eigw,eip,igw,natgw,routetable}	spinifex/domains/ec2/awsapi/<same>	The VPC-networking action adapters follow the same per-resource pattern; zone moves first because the instance adapter depends on it. Moved files change only their package line (vpc_test for its external tests). Callers are the gateway dispatch, account teardown's EC2 reapers, the quota live counters and the not-yet-moved instance adapter. Adapter, gateway and account-teardown tests, the integration and E2E builds, and full preflight passed.
4b315469f, 8b106e796, 7ee808d2d, 0485c77e6	gateway/ec2/{image,snapshot,volume,tags}	spinifex/domains/ec2/awsapi/<same>	Image, snapshot, volume and tag action adapters follow the same per-resource pattern; moved files change only their package line. Callers are the gateway dispatch, account teardown's EC2 reapers and the quota storage counter. The volume adapter still imports the instance adapter, which moves next. Adapter, gateway, account-teardown and quota tests, the integration and E2E builds, and full preflight passed.
b9a5eaf19, d4c68007e, 534c5b49d, 931af0ea5	gateway/ec2 (root), gateway/ec2/{idem,instance,spotinstance}	spinifex/domains/ec2/awsapi, spinifex/domains/ec2/awsapi/<same>	The root package holds EC2 resource-ARN resolution for authorization and becomes package awsapi (imported as ec2awsapi); the completeness test's failure messages now name its new path. The idempotency, instance and spot-instance adapters follow the per-resource pattern, instance and spot instance last because they carry cross-domain and runtime dependencies (see dependency-rule debt). Moved files change only their package line; docs/DESIGN.md examples use the new alias. gateway/ec2 no longer exists and gateway/ec2.go remains the transitional dispatch point. E2E suite selection is unchanged: neither the old nor the new path is in the manifest. EC2 domain, gateway, account-teardown, quota, daemon and awsgw tests, the integration and E2E builds, and full preflight passed.
cd9266176	gateway/restrouter.go	spinifex/ingress/aws/rest	The REST-JSON router maps method and path to an AWS action and percent-decodes path parameters because ARNs appear in paths, so it is AWS protocol mechanics rather than protocol-neutral HTTP and sits beside ingress/aws/query. The exported surface is Route[H], NewRouter and (*Router).Lookup; pattern parsing stays package-private and tested in place. The Bedrock and EKS route tables and their duplicate-route and completeness assertions stay in gateway, which computes the two former helper values inline rather than widening the API. Ingress and gateway tests, the integration and E2E builds, and full preflight passed.
ba2d59b29	gateway/ratelimit.go	spinifex/ingress/aws/ratelimit	Per-IP lockout after repeated failed SigV4 authentication returns AWS RequestLimitExceeded, so it is AWS ingress protection. Moved code changes only its package line and the four exports the gateway needs: MaxFailures, Fingerprint, TokenDigest and Anonymous; limiter behaviour is unchanged. gateway imports it as authlimit because it already imports Bluebottle's ratelimit throttler. The 14 implementation tests move with the package; the end-to-end gateway tests stay. The session-principal verdict and success-reset tests now read the record table through the lockout boundary instead of the limiter's private fields, and three mutations (success not clearing, double counting, legacy verdict recording) each fail them. Ingress and gateway tests, the integration and E2E builds, and full preflight passed.
—	cmd/dhcptest, cmd/spx-loadgen	unchanged	Both already conform to ADR-0001's tooling row: the load engine is internal/testkit/loadgen and the DHCP probe's shared pieces come from the network domain's dhcp package. What remains in each main is its own flag parsing and one-off orchestration that nothing else imports, so extracting it would create a package solely to satisfy the directory map. No source change.
7047f6b36	—	—	ADR-0002 phase 0: characterization tests pin the ECR control plane as it behaves today before dispatch moves. Full-pipeline tests fix the 400/501 error envelopes, JSON 1.1 content type and X-Amzn-Errortype, 413 before dispatch for an oversized body, 503 for stub and composed actions when NATS is down, and authorization before a composed action. Unit tests fix target parsing (dispatch and telemetry agree on every malformed form), the stub and inventory sets, GetAuthorizationToken ignoring body-supplied identity, and the action reaching the throttle key, trace span and audit record. Mutation of the target parser, the authorization gate and the audit action each failed the new tests. Test-only; full preflight passed.
89364c100	—	spinifex/ingress/aws/dispatch, spinifex/ingress/aws/invariants	ADR-0002 phase 1: the registration contract. A startup Builder validates and seals registrations into an immutable Registry keyed by credential-scope service, with aliases, an inventory name, an advisory action resolver, the dispatcher, the error envelope and the operation inventory; Invocation carries the bounded request, account, Region, an AuthorizeFunc and a lazy ActorFunc. It imports only foundation/aws/errors and Bluebottle's iampolicy condition-key vocabulary, and no domain moved. TestS4_IngressAWSImportsNoDomainOrRuntimeImplementation binds ADR-0002 S4 for all of ingress/aws and failed on an injected domain import. Contract tests at 100% statement coverage under -race; full preflight passed.
86a2de3ff	spinifex/gateway (dispatch switch)	spinifex/gateway consuming spinifex/ingress/aws/dispatch	ADR-0002 phase 2: the gateway consumes the registry with no service registered. A registered service passes the auth gate, resolves its own action label, renders errors in its declared envelope through one gw.jsonErrorService method, and is dispatched with an Invocation whose Authorize calls the existing policy check and whose lazy Actor reuses buildCallerARN. The NATS-unavailable guard still runs ahead of both paths; every existing service takes the unchanged switch, now named the legacy path that must only shrink. The awsgw role wires an empty registry and fails startup on any overlap with the legacy table. Fake JSON, XML and resolver-less registrations prove dispatch, telemetry labels, authorisation deny/allow, the verified actor, both envelopes, the 503 and unknown-service paths and the overlap guard through the full pipeline; four production mutations were each caught. Phase 0 ECR characterisation and the unserved-service tests passed unchanged; full preflight passed.
6c48ab6b7	spinifex/gateway (ECR_Request, ecrActionFromTarget, ecrAuthorizationPrincipal, the four ECR* GatewayConfig fields, the ecr legacy table/switch entries)	spinifex/domains/ecr/awsapi (NewRegistration, OperationInventory), wired by spinifex/runtime/roles/awsgw	ADR-0002 phase 3: ECR's AWS JSON 1.1 control plane registers from its domain. The dispatcher reproduces the removed gateway path step for step (error codes and order, one bounded body read feeding scope and invocation, Authorize before every use case, nil capability as ServerInternal, the token principal from the verified Actor, the JSON writer). The gateway no longer imports domains/ecr/awsapi; the OCI /v2 route is unchanged. Operation coverage reads the pure OperationInventory() that the registration uses verbatim, proved equal by TestRegistrationInventoryIsTheDeclaredInventory; coverage.json and every coverage page were byte-identical. TestS4_OnlyAWSGWRoleImportsDispatchAndECRAWSAPI binds acceptance item 3, with cmd/aws-model-coverage as the only named, non-serving tool exception. Five mutations (authorise after use, prefix-strict resolver, inventory drop, body-derived token principal, probe import) were each caught; Phase 0 characterisation kept every assertion except one rebound from the deleted parser to the registration's resolver; full preflight passed. Remaining temporary edge: Deps.NATS is a raw *nats.Conn.
5f66bd2a3	spinifex/gateway (GenerateEC2ErrorResponse, GenerateIAMErrorResponse, GenerateS3ErrorResponse, requestSignalsJSONProtocol, jsonErrorType, error content types), spinifex/gateway/eks (GenerateEKSErrorResponse)	spinifex/ingress/aws/envelope	ADR-0002 phase 4, error rendering: pure EC2, IAM-style and S3 XML builders, the AWS JSON 1.1 body and error type, the header-only JSON-protocol detector and content types, importing only the standard library. ErrorHandler, the cluster-unavailable, throttle and SigV4 writers and the legacy service-to-envelope selection stay in gateway. A 140-case golden of status, headers and body across 14 service cases and every error writer was identical before and after; two mutations were caught; the S4 ingress import invariant scans the new package; full preflight passed.
b81ae4eb4	spinifex/gateway (service served/action/error-protocol selection, overlap check)	spinifex/ingress/aws/dispatch (Selector, Legacy)	ADR-0002 phase 4 slice 2: one selector decides whether a service is served, its throttle/trace/audit action, its error protocol, its registered entry and the startup overlap; a registered service always wins and a resolver-less registration does not fall back to legacy action resolution. The gateway supplies its legacy tables through the three-method dispatch.Legacy interface, so ingress imports nothing from gateway; legacy dispatch, the Bedrock sub-service mapping and invocation building (which read gateway request-context keys) stay in gateway. A 160-case golden capture through the real SigV4, trace and Request chain with live test NATS and the ECR registration was identical before and after; mutating Served, ResolveAction and Validate each failed tests. Only startup-visible change: the overlap error now begins dispatch: and names the first overlap in sorted order. Full preflight passed.
4b0a4dd6b	—	—	ACM characterization before registration: full-pipeline 400 MissingAction/InvalidAction envelopes, a 200 ListCertificates against a live NATS responder, dispatch and telemetry target-parser agreement, authorization before the NATS call (subject counter stays zero), 413 before dispatch, 503 when NATS is down (ACM's own nil-connection check is unreachable over HTTP), the action reaching throttle, trace and audit, and the nine-action inventory. Mutating the parser, the authorization call and the action table each failed tests. Test-only; full preflight passed.
fdaf589ca	spinifex/gateway (ACM_Request, acmActions, acmActionFromTarget, legacy acm entries)	spinifex/domains/acm/awsapi (NewRegistration, OperationInventory)	ACM registers its AWS JSON 1.1 control plane from its domain, wired only by the awsgw role; the dispatcher reproduces the old order (missing/unknown action, InternalError without an account, bounded body, resource ARNs, authorization, then nil-NATS and the action). The S4 composition invariant now covers every registered domain awsapi with the same named coverage-tool exception. Coverage output was byte-identical and the ACM integration conformance summary was identical at the parent and after. Mutating authorization order, the target parser, the inventory and gateway imports each failed tests. Temporary edge: Deps.NATS is a raw *nats.Conn because every ACM action function takes one. Full preflight passed.
01276bf29	—	—	RDS DB subnet group characterization before extraction (ADR-0003 S1, ADR-0004): repeat delete reports not found, name scoped to the account, modify never moves a placed instance, snapshots do not block delete, restore rejects an unknown group, tags reached through the ARN and gone with the group, persisted record field names. Present contract and gaps in docs/package-boundary/rds-db-subnet-group-lifecycle.md; no conformance claimed.
17dc29251	spinifex/handlers/rds (DBSubnetGroupRecord, DBSubnetGroupSubnet, DBSubnetGroupKey, DBSubnetGroupsPrefix, getDBSubnetGroup, resolveGroupSubnets and the create/modify/delete bodies)	spinifex/domains/rds/subnetgroup (Owner, Record, Subnet, Key, Prefix)	First ADR-0004 resource owner. The handler keeps AWS validation, projection and paging; delete reaches instances through the owner-declared Dependants, and instance placement reaches the group through the instance-declared subnetGroupPlacement. Stored shape unchanged; docs/service-interfaces.yaml lists the package with the RDS daemon. No conformance claimed; gaps in the lifecycle contract.
1cb868e68	—	—	ECS task definition characterization before extraction (ADR-0003 S1, ADR-0004): stored keys and field names, every reference form and its not-found fault, repeatable deregister, an inactive revision still launching, bare-family launch resolution, a service pinning its resolved revision. Present contract and gaps, including the bare-family iam:PassRole re-resolution security gap, in docs/package-boundary/ecs-task-definition-lifecycle.md; no conformance claimed.
544b0c6a0	spinifex/handlers/ecs (TaskDefRecord, ContainerDef, TaskDefRevKey, TaskDefLatestRevKey, ParseTaskDefRef, TaskDefARN, TaskDefRefARN, revision register/deregister/resolve/list)	spinifex/domains/ecs/taskdefinition (Owner, Record, Container, PortMapping, SystemControl, ParseRef, ARN, RefARN, keys)	ADR-0004 owner extraction (ADR-0003 S1 contract in docs/package-boundary/ecs-task-definition-lifecycle.md). Stored keys and JSON field names unchanged; the owner declares its own persisted PortMapping/SystemControl so it does not import handlers/ecs/bus. Launches use the launch-side taskDefinitionResolver; gateway authz and all iam:PassRole checks unchanged. docs/service-interfaces.yaml now lists spinifex/handlers/ecs and the new package under spinifex_daemon. Proves ownership and dependency direction only; no conformance claimed.
b36d70b22	—	—	EKS access entry characterization before extraction (ADR-0003 S1, ADR-0004): persisted and nested field names, pre-existing JSON decodes, actions ignore cluster status, associate without an entry is not found, disassociating an unbound policy is a no-op, an empty update keeps username and groups, cluster delete sweeps only that cluster's entries, token review needs no cluster record. Present contract and gaps in docs/package-boundary/eks-access-entry-lifecycle.md; no conformance claimed.
68ee6f620	spinifex/handlers/eks (AccessEntryRecord, AssociatedAccessPolicy, AccessScope, AccessEntriesPrefix, AccessEntryKey, PrincipalARNHash, access-entry KV helpers, policy catalogue, effectiveGroups, the access mutation logic)	spinifex/domains/eks/access (Owner, Record, AssociatedPolicy, Scope, Spec, Get, List, Key, Prefix, PrincipalARNHash, SupportedPolicies, EffectiveGroups)	ADR-0004 owner extraction (ADR-0003 S1 contract in docs/package-boundary/eks-access-entry-lifecycle.md). Stored keys and JSON field names unchanged; writes go only through Owner, including the creator-admin seed at cluster launch. The handler keeps AWS validation, the cluster existence check, error mapping and projection; gateway authz switches only its hash import. docs/service-interfaces.yaml now lists spinifex/handlers/eks and the new package under spinifex_daemon. Proves ownership and dependency direction only; no conformance claimed.

The EC2 contract row is intentionally different from the directory moves: it creates a compatibility boundary. ec2.cmd.* retains its deployed one-token NATS subscription and permission shape, while callers use InstanceCommandSubject rather than reconstructing the subject. The contract's README states the route, scope and change rule.

ECR composition boundary remaining

The ECR AWS JSON dispatcher and /v2/* route assembly remain methods on the generic GatewayConfig. They establish the generic HTTP route, authenticated request context, bounded-body read and policy gate, then invoke the ECR domain packages above. They are not moved merely to remove the last ECR-named files from gateway: doing so first would make the ECR domain own generic gateway state and policy mechanics.

Registry-backed image actions have now crossed this boundary through awsapi.RegistryActionService: the composition root supplies the OCI capabilities, and the generic gateway dispatches through it after authorization.

Lifecycle-preview actions have likewise crossed it through awsapi.LifecyclePreviewActionService, whose policy-store-plus-image-catalog dependencies remain explicit and separate from the registry image-action service.

Repository metadata actions have crossed it through awsapi.RepositoryActionService, which makes both their narrow metadata-store dependency and advertised endpoint profile composition explicit.

Authorization-token issuance has crossed it through awsapi.AuthorizationTokenActionService. Gateway intentionally still builds the canonical IAM/STS principal before dispatch, because ECR must not depend on gateway identity context or ARN construction.

All implemented ECR control-plane actions now dispatch through explicit ECR capabilities. The remaining ECR-named gateway code is generic /v2/* route assembly, SigV4/registry authentication and policy enforcement; it remains in gateway rather than inverting those dependencies into the ECR domain.

ACM relocation residuals

The ACM move leaves two pre-existing dependency seams visible rather than changing their behaviour in a structural slice:

• domains/acm.Store still imports IAM's AES-GCM helper functions. It does not read IAM records, but the crypto mechanism must move behind a shared crypto boundary before the final domain-dependency lint can prohibit that implementation import.
• GatewayConfig still owns the ACM action-name dispatch map. ACM owns the action adapters and resource-scope derivation, while generic gateway owns route handling, request context, policy gating and response writing. Moving service registration itself needs the later ingress registration contract; it is not hidden by a compatibility shim in this move.

Guest metadata relocation residuals

The guest-metadata move keeps every existing import unchanged, so the domain package now shows these breaks of the target dependency rules. Each needs a consumer-owned capability, projection or versioned contract before the dependency lint (ADR step 8) can be enabled.

• domains/ec2/guestmetadata imports the DNS, IAM and STS implementations, which breaks rule 3 (no domain reads another domain's implementation). Its EC2 key and instance imports are same-domain once those resources sit under domains/ec2; they remain resource-to-resource implementation imports for the EC2 decomposition to review.
• domains/ec2/guestmetadata imports runtime/compute/vm for instance records and VM reconstruction, the first domain-to-runtime edge; runtime is meant to compose domains, not be imported by them.

Dependency-rule debt to clear after the moves

These residuals were recorded by individual slices and must be resolved once the structural moves are complete, before the dependency lint is enabled.

• Guest metadata: the cross-domain and runtime imports above.
• admin → operator/admin is blocked until its shared pieces have owners: DefaultAccountID/DefaultAccountName (IAM/account bootstrap), GenerateAWSAccessKey/GenerateAWSSecretKey (IAM credentials), PromoteSystemImage (EC2 image domain), and GenerateCACert/GenerateSignedCert (Spinifex certificate issuance, used by the NATS role and RDS).
• domains/dns: imports runtime/compute/vm (domain-to-runtime), domains/network/reconcile for the reconcile lock and bootstrap/config for node configuration.
• ACM: the IAM AES-GCM helper import and gateway-owned action dispatch (ACM relocation residuals).
• runtime/roles/awsgw: the quota reconcile loop belongs to domains/admission/quota, and the EKS token-verify responder belongs with STS or EKS identity.
• ECR control-plane registration: awsapi.Deps.NATS is a raw *nats.Conn, not a narrow capability. Every NATS-backed Handler passes it to handlers_ecr.NewNATSMetaStore, which calls natsmsg.NATSRequest, so narrowing it means changing the exported Handler type, every handler and the meta store; it must not be broadened further meanwhile.
• cmd/aws-model-coverage imports both ingress/aws/dispatch and domains/ecr/awsapi to read ECR's declared inventory. It is a non-serving tool and the only named exception to the ADR-0002 composition invariant; it must not construct a registration.
• Ingress pipeline (ADR-0002 phase 4): the request-audit record, the trace action enricher, the throttle key functions and the gateway request-context keys stay in gateway until the auth/IAM and request-context boundary is designed. SigV4 authentication writes the audit record and context keys from four places, so moving them now would export exactly the setters ADR-0002 says must not be exported solely to make a directory move possible.
• utils: vpcd_event.go (vpcd request/ack protocol and NAT helpers) awaits a network contract, ec2_subject.go awaits an EC2 contract, and encryption.go (the Viperblock master-key loader) awaits a Viperblock adapter owner, since providers/ebs is provider-neutral.
• runtime/compute/cache.New: two construction-time panics carry a lint exemption pending a constructor that returns an error.
• domains/ec2/systeminstance: managed-service parent metadata is only the ManagedBy tag value.
• gateway/bedrock: holds the Ochre domain core (model catalogue, provisioned throughput, guardrail, access, credential, usage, price, logging and weights stores), the inference engine (provider, vLLM, Anthropic, embeddings, reranker, admission) and the Bedrock action layer in one package with internal cycles. domains/ochre imports it, which is the ADR step 7 Ochre gateway import. Splitting it needs a plan: domain core and stores to domains/ochre/<resource>, inference to an Ochre-owned package, and only the action layer to domains/ochre/awsapi. The top-level gateway/bedrock*.go HTTP handlers additionally wait for the ingress registration seam.
• spinifex/migrate: the KV engine already lives in foundation/state/migrate, but the remaining config-file and object-store migration engine is not a move into it. It is an operator upgrade concern used only by spx admin upgrade, both packages define Registry, NewRegistry and DefaultRegistry with distinct registry models, and its object migrations would give foundation a dependency on providers/objectstore. Its eventual owner is deferred; no subpackage is created to satisfy the directory map.
• domains/network: reconcile/intent.go builds desired network state by reading EC2's KV buckets and decoding EC2's private VPC, subnet, ENI, route-table, gateway, EIP, NAT and security-group records, and reconcile/drift.go watches those buckets. ADR-0001 names this pair explicitly: EC2 and network communicate through a capability/projection or versioned contract, never by one being the other's KV reader. Step 7 fix: an EC2-owned domains/ec2/projection exposing network intent with list and watch (it may stay KV-backed, so no data moves); a narrow intent interface declared by reconcile; wiring at the composition root; and the duplicated PurposeEIP/PurposeIGWLRP constants and mirrored SGRule/SGEvent folded into the projection or contracts/ec2/v1. The drift-watch coverage test and reconcile scenario tests are the evidence the projection must keep. domains/network also imports runtime/compute/vm and runtime/host/command (domain-to-runtime).
• domains/ec2/instance: imports runtime/compute/vm and runtime/compute/gpu (domain-to-runtime) and domains/dns (cross-domain implementation import).
• agents/eks/tokenwebhook: imports handlers/eks for WebhookTokenReviewResult, an agent depending on a domain implementation. Temporary: the eventual EKS contract or projection for the token-review reply needs its own design, and no contract is invented to complete the move.
• agents/ecs/agent: imports handlers/ecs/bus for the assignment and state wire types (Assign, TaskState, StopDirective, Heartbeat, InstanceCapacity, SystemControl, container and task statuses) and handlers/ecs for the poll-assignment and GPU-report inputs and outputs and the instance-type and availability-zone attribute names. Temporary agent-to-domain debt; no contract is created during the relocation.
• agents/rds/agent (domain capability): imports handlers/rds for LookupEngine, used in bootstrap parameter rendering and both engine constructors, and for the Engine metadata that controlPlaneRulesFrom reads. This is a dependency on the RDS domain's engine registry, not a wire type; it stays explicit debt until an RDS engine capability or projection is designed.
• agents/rds/agent (wire contract): imports handlers/rds for the command, reply, parameter, health and bootstrap types exchanged with the control plane. Temporary agent-to-domain debt; no contract is created during the relocation.
• operator/installer/firstboot (security): Config.InstallCallback is rendered into spinifex-firstboot.sh, which is world-readable (0755). The field is currently unused (fireInstallCallback reads SPINIFEX_INSTALL_CALLBACK from the environment instead), but any future wiring must not place secrets or tokenised callback URLs in the generated script; sensitive callback credentials should reach first boot through a protected channel such as a 0600 file or a credential store.
• operator/cli (known security risk): spx admin join contacts the formation server with InsecureSkipVerify, sends the join token as a bearer credential and receives the cluster CA certificate and key, master key, Viperblock key and shared credentials, so an on-path attacker during formation can capture the token and the cluster root secrets or substitute a CA. This predates the move; lint surfaced it when the tree left cmd/. It is accepted for now and carries a line-level gosec annotation stating it is not a false positive. Removal condition: authenticate formation TLS with a pinned key or certificate delivered with the join material, or an out-of-band CA, with tests proving a mismatched server certificate fails before credentials are sent.
• handlers/eks (potential security risk): ClusterMeta.ControlPlaneTemplate (handlers/eks/service_impl.go) clears the template's credentials but keeps OIDCPrivateKeyPEM and the k3s JoinToken, so both are persisted in the eks-account-{acct} cluster record, which the gateway also reads. Whether that record is encrypted at rest is unconfirmed; if it is not, a reader of the bucket can forge service-account tokens for the cluster's OIDC issuer and join nodes to it. This predates the refactor and is not fixed in it. Removal condition: the key and token are held by a dedicated secret store (a future KMS or Secrets Manager capability is the likely owner) and the cluster record keeps only a reference, with a test proving the persisted record contains neither secret.
• operator/cli (dependency): the command tree still imports domain and service implementations directly (handlers/{iam,eks,quota}, gateway, gateway/bedrock, daemon, vpcd, admin, accountteardown, migrate, services/viperblockd and runtime roles). ADR row 231 requires command packages to reach domains through public capabilities; splitting supported use cases into operator/* packages is later work.
• gateway/ec2.go (registration): the EC2 dispatch map stays a GatewayConfig method in gateway and imports every domains/ec2/awsapi/* package. ADR-0001 makes the domain own its action registration; moving the map waits on the generic ingress registration seam and must not be done as a package move.
• gateway/requestaudit.go: the outermost request-audit middleware records AWS fields and is updated from four places in the gateway's authentication flow through the gateway's own context key. Moving it would export about seven names used only by that flow, so it stays in gateway until the generic ingress registration seam defines how ingress middleware receives authentication results.
• accountteardown (dependency): its EC2 reapers call domains/ec2/awsapi/* action adapters directly, as they did under gateway/ec2. ADR row 225 replaces this with domain-owned cleanup capabilities before the package moves.
• handlers/quota (dependency): the live quota counters call domains/ec2/awsapi/{vpc,eip,volume} describe adapters to count VPCs, subnets, addresses and volumes, as they did under gateway/ec2. ADR row 254 replaces these with reader capabilities once their final locations exist.
• domains/ec2/awsapi/instance (dependency): imports handlers/iam (IAMService in DescribeInstances.go, RunInstances.go and IamInstanceProfileAssociation.go; InstanceProfile in the latter two), runtime/compute/cache (NodeState, NodeUnknown, NodeLive) and runtime/compute/vm (VM), both in status_synthesis.go. The IAM edge needs an IAM capability; the runtime edges are domain-to-runtime and need the instance record and node liveness exposed through an EC2-owned projection.
• domains/ec2/awsapi/spotinstance (dependency): imports handlers/iam.IAMService and handlers/quota.Service in RequestSpotInstances.go.
• Instance adapter consumers outside EC2: gateway/rds/enginecatalog.go, daemon/eks_cp_control.go, daemon/rds_deps.go and handlers/quota/vcpu.go call domains/ec2/awsapi/instance directly; each needs an EC2 capability rather than the AWS action adapter.
• handlers/rds → domains/rds/subnetgroup (legacy edges): instanceReferences binds Dependants by scanning instance records, and tags.go writes the group record through its generic tag registry. The first clears when the RDS instance gains its own owner and answers Dependants from it. The second clears when tagging invokes a subnet-group-owned tag/untag capability rather than writing the record; moving the tagging adapter to domains/rds/awsapi alone does not clear it.
• handlers/ecs → domains/ecs/taskdefinition (legacy edges): tags.go reads and writes the revision record through its generic tag registry; this clears when ECS tagging invokes an owner-provided tag mutation capability, and moving tags.go to domains/ecs/awsapi alone does not clear it. taskDefinitionResolver returns the persisted Record to task and service launch code; when the task and service owners are extracted, replace the record crossing that boundary with a consumer-owned resolved task-definition (launch-spec) projection. Moving packages has not made the record private.
• domains/ecs/taskdefinition (deliberate duplication, not debt): private getJSON, putJSON and keysWithPrefix copy the raw-KV helpers in handlers/ecs so the extraction keeps ECS's get/put/list error and recovery semantics. Revisit only if a later, tested state abstraction proves it preserves those semantics; do not migrate ECS to kvstore merely to remove them.
• handlers/eks → domains/eks/access (legacy edges): ResolveTokenReview opens the EKS bucket in the gateway process and reads records through the exported access.Get; this clears when token review asks the owner across a contract rather than opening the bucket itself. DeleteClusterPrefix erases access-entry keys as part of its blanket cluster sweep; this clears when cluster delete invokes an owner-provided removal of the cluster's entries. The owner returns the persisted Record to the AWS adapter and token review; replace it with consumer-owned projections when those consumers are extracted.
• docs/service-interfaces.yaml (coverage gap): no ecs.* subjects are listed and the manifest lint does not cover them, so ECS publisher/subscriber edges play no part in suite selection. Add them only after tracing the actual publishers and subscribers.
• Merge-time follow-up in the umbrella repository: the Makefile invariants-check target, the docs-pr.yml clause cross-check, .claude/hooks/architecture-traps.sh and a check-invariants.sh comment hard-code spinifex/spinifex/network/invariants. They must change with the pointer bump that brings in this branch, or the docs-pr cross-check silently skips. Live specs and proposals citing spinifex/network/ will report unresolved citations until updated.

ADR-0004 source inventory and first-resource ranking

The per-file inventories for ECS, EKS and RDS are in docs/package-boundary/adr-0004-inventory-{ecs,eks,rds}.md. Each classifies every production file as resource owner, cross-resource orchestration, AWS protocol adapter, guest/controller wire contract, or temporary residue, and maps actions, durable records, identity and scope, lifecycle paths, NATS subjects and boundary-crossing imports. They were produced by reading the code at 6c50349bd and are not verified against a live system.

Observed gaps common to all three: no resource carries a desired generation, all resources of a service share one per-account KV bucket, and deletes remove records before dependent cleanup is confirmed.

First-resource ranking:

1. RDS DB subnet group: about 340 lines with its own db-subnet-groups/{name} keys, synchronous AWS semantics, and no quota, expected-node, IAM, Bluebottle or agent dependency. It has a real deletion graph, because delete refuses while an instance references the group, so it exercises a consumer-owned capability in both directions: an instance-owned "instances referencing this group" query for delete, and a subnet-group-owned placement query for instance create.
2. ECS task definition: own keys and good tests, but RegisterTaskDefinition allocates revisions non-atomically and the gateway adapter carries the iam:PassRole checks, so it sits closer to a blocked boundary.
3. EKS access entry: own keys, but entries are read during token review, which places it next to EKS identity.

Blocked dependencies recorded, not designed around:

• RDS instance: quota admission, the duplicated expected-node fan-out (gateway/rds/enginecatalog.go, daemon/rds_deps.go), IAM ensurer and Bluebottle master key.
• RDS DescribeOrderableDBInstanceOptions: the EC2 instance-type-availability projection.
• ECS task, service and capacity: iam:PassRole in the gateway adapter, IAM ecsInstanceRole, and EC2/ELBv2/EIP adapters called as internal APIs.
• EKS nodegroup and cluster: IAM role and instance-profile creation, Bluebottle auth, the NATS CA, and EKS identity (token review, OIDC).
• Guest agents: agents/ecs, agents/rds and agents/eks/tokenwebhook import the service implementation packages, which ADR-0004 S5 forbids; they need wire contracts.

Findings to resolve before extraction:

• dev is merged in (9e77181f2), including ModifyDBSubnetGroup (#1152); the subnet-group inventory is superseded by its lifecycle contract, docs/package-boundary/rds-db-subnet-group-lifecycle.md.
• The EKS control-plane template persists the OIDC signing key and k3s join token; see the handlers/eks potential security risk in the dependency-rule debt.

Recording rule

For every later slice, add the old and new path, source commit, focused verification, and any finding exposed by the move. Record a conflict rather than folding a behavioural repair into a structural commit. When this branch is merged, the umbrella repository's execution plan records the resulting Spinifex commit.