spinifex/docs/COMMANDS.md

AWS Command Implementation Matrix

EC2 - Instance Management

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
run-instances	--image-id, --instance-type, --count (Min/MaxCount), --key-name, --user-data, --subnet-id (auto-creates ENI, assigns private IP), --block-device-mappings (DeviceName, VolumeSize, VolumeType, Iops, DeleteOnTermination)	--security-group-ids, --placement, --tag-specifications, --dry-run, --client-token, --disable-api-termination, --ebs-optimized, --iam-instance-profile, --network-interfaces, --private-ip-address, --monitoring, --credit-specification, --cpu-options, --metadata-options, --launch-template, --hibernate-options	describe-images (AMI must exist), create-key-pair (optional), VPC/SG (optional)	Gateway parses AWS query → NATS ec2.runinstances → daemon creates QEMU/KVM VM with viperblock-backed root volume via NBD → if SubnetId provided, auto-creates ENI with private IP → cloud-init injects user-data/keys → returns reservation with instance ID	1. Launch with valid AMI and key pair 2. Launch with invalid AMI ID (error) 3. Launch with block device mappings (custom volume size) 4. Launch multiple instances (MinCount/MaxCount) 5. Launch with subnet-id (auto-creates ENI) 6. Invalid instance type returns error	DONE
describe-instances	--instance-ids	--filters, --max-results, --next-token, --dry-run	None	Gateway fans out NATS ec2.DescribeInstances to all nodes (no queue group) → each daemon returns local instances → gateway aggregates and returns combined list	1. Describe all instances (no filter) 2. Describe by instance ID 3. Describe with filters (e.g. instance-state-name) 4. Instance not found returns empty set 5. Multi-node aggregation returns instances from all nodes	DONE
start-instances	--instance-ids	--dry-run, --force	run-instances (instance must exist in stopped state)	Gateway sends NATS ec2.cmd.{instance-id} → daemon restarts stopped QEMU process with same config → state transitions stopped→pending→running	1. Start a stopped instance 2. Start already-running instance (error: IncorrectInstanceState) 3. Start with invalid instance ID 4. Verify volumes re-mount on start	DONE
stop-instances	--instance-ids	--force, --hibernate, --dry-run	run-instances (instance must be running)	Gateway sends NATS to target node → daemon issues QMP system_powerdown for graceful shutdown → monitors heartbeat until QEMU exits → state transitions running→stopping→stopped	1. Graceful stop of running instance 2. Force stop (kills QEMU process) 3. Stop already-stopped instance (error) 4. Verify ~30s heartbeat detection	DONE
terminate-instances	--instance-ids, DeleteOnTermination (per-volume flag, default true)	--dry-run	run-instances (instance must exist)	Gateway sends NATS to target node → daemon kills QEMU process → cleans up NBD mounts → deletes volumes with DeleteOnTermination=true via volumeService.DeleteVolume() (S3 cleanup of vol/, vol-efi/, vol-cloudinit/) → internal volumes (EFI, cloud-init) always cleaned up via ebs.delete NATS → volumes with DeleteOnTermination=false left in available state → state→terminated	1. Terminate running instance 2. Terminate stopped instance 3. Terminate with DeleteOnTermination=true deletes volumes 4. Terminate with DeleteOnTermination=false preserves volumes 5. Terminate already-terminated (idempotent) 6. Internal volumes (EFI, cloud-init) always cleaned up 7. Invalid instance ID	DONE
reboot-instances	—	--instance-ids, --dry-run	run-instances (instance must be running)	Gateway sends NATS to target node → daemon issues QMP system_reset → instance reboots without stopping	1. Reboot running instance 2. Reboot stopped instance (error) 3. Verify instance stays in running state after reboot	NOT STARTED (parser test exists)
describe-instance-types	--filters (capacity filter only)	--instance-types, --max-results, --next-token, --dry-run, all other filters	None	Gateway fans out NATS ec2.DescribeInstanceTypes to all nodes → each daemon reports supported types (t3.micro/small/medium/large) with vCPU/memory specs → gateway deduplicates and returns	1. List all instance types 2. Filter by specific type 3. Filter with capacity=true shows available slots 4. Verify vCPU/memory specs match hardware	DONE
modify-instance-attribute	--instance-id, --instance-type, --user-data	--disable-api-termination, --ebs-optimized, --source-dest-check, --instance-initiated-shutdown-behavior, --block-device-mappings, --groups, --ena-support, --sriov-net-support	Instance must be stopped (in NATS KV)	Gateway validates input (exactly one attribute per call, instance ID format) → NATS ec2.ModifyInstanceAttribute with hive-workers queue group → daemon loads stopped instance from JetStream KV → applies attribute change → writes back to KV → returns {} on success. InstanceType: updates vm.InstanceType, Config, and Instance fields; clears StateReason (enables recovery from instance-type-missing bug). UserData: stores decoded content in vm.UserData and re-encodes to base64 for RunInstancesInput (cloud-init on next start). No instance type pre-validation (matches AWS — invalid types accepted, fail at StartInstances time).	1. Change instance type while stopped 2. Change user data while stopped 3. Modify running instance (error: NotFound — running instances not in KV) 4. Instance not found (error: InvalidInstanceID.NotFound) 5. Instance not stopped (error: IncorrectInstanceState) 6. Invalid instance type accepted (fails on start with InsufficientInstanceCapacity) 7. StateReason cleared on type change (recovery from capacity-unavailable) 8. Missing/malformed instance ID (error: InvalidInstanceID.Malformed) 9. No attribute set (error: InvalidParameterValue) 10. Multiple attributes in one call (error: InvalidParameterValue)	DONE
get-console-output	--instance-id	--latest (always returns latest), --dry-run	Instance must be running on a node	Gateway sends NATS ec2.{instanceId}.GetConsoleOutput (per-instance topic, routed to owning node) → daemon reads console log file from disk → returns last 64KB base64-encoded with timestamp. Always available regardless of serial console access setting (matches AWS behavior).	1. Get output from running instance 2. Empty log file returns empty output 3. Instance not found (error: InvalidInstanceID.NotFound)	DONE
monitor-instances	—	--instance-ids	Instance must exist	Enable basic monitoring (CPU, disk, network) → store metrics in NATS KV → return monitoring state	1. Enable monitoring 2. Verify monitoring state in describe-instances	NOT STARTED
unmonitor-instances	—	--instance-ids	Instance must exist	Disable detailed monitoring → revert to basic monitoring → return monitoring state	1. Disable monitoring 2. Verify monitoring state reverts in describe-instances	NOT STARTED

EC2 - Key Pair Management

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
create-key-pair	--key-name, --key-type (rsa/ed25519)	--key-format (pem/ppk), --tag-specifications, --dry-run	None	NATS ec2.CreateKeyPair → daemon generates SSH keypair → stores public key in Predastore S3 (/bucket/ec2/{name}.pub) → returns private key material (one-time)	1. Create RSA key pair 2. Create ED25519 key pair 3. Duplicate key name (error: InvalidKeyPair.Duplicate) 4. Verify key material returned only on creation	DONE
describe-key-pairs	--key-names, --key-pair-ids	--filters, --max-results, --dry-run	None	NATS ec2.DescribeKeyPairs → daemon lists public keys from Predastore S3 → returns key names and fingerprints	1. List all key pairs 2. Filter by key name 3. Filter by key pair ID 4. Non-existent key returns empty	DONE
delete-key-pair	--key-name, --key-pair-id	--dry-run	Key must exist	NATS ec2.DeleteKeyPair → daemon deletes public key from Predastore S3 → returns success	1. Delete existing key pair 2. Delete non-existent key (idempotent, no error) 3. Verify key no longer in describe-key-pairs	DONE
import-key-pair	--key-name, --public-key-material	--tag-specifications, --dry-run	None	NATS ec2.ImportKeyPair → daemon stores provided public key in Predastore S3 → returns key name and fingerprint	1. Import valid SSH public key 2. Import invalid key material (error) 3. Import duplicate name (error) 4. Verify imported key usable with run-instances	DONE

EC2 - AMI Image Management

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
describe-images	--image-ids (format validation only), --owners (self, account ID, alias)	--executable-users, --filters, --include-deprecated, --include-disabled, --max-results, --next-token, --dry-run	None	NATS ec2.DescribeImages → daemon reads AMI metadata from Predastore S3 buckets (ami-*) → filters by ImageIds and Owners → returns image list with state, architecture, block device mappings	1. List all images 2. Filter by image ID 3. Filter by owner (self/amazon) 4. Non-existent AMI returns empty 5. Verify metadata fields (architecture, state, rootDeviceName)	DONE
create-image	--instance-id, --name, --description, --tag-specifications	--no-reboot, --block-device-mappings, --dry-run	Instance must exist (running or stopped)	Gateway validates input → NATS ec2.{instanceId}.CreateImage (per-instance topic) → daemon extracts root volume → snapshots via ebs.snapshot NATS (running) or offline S3 copy (stopped) → creates AMI metadata in S3 ({amiId}/config.json) → stores tags → returns ami-ID. Duplicate AMI name validation enforced.	1. Create image from running instance 2. Create image from stopped instance 3. Invalid instance ID (error) 4. Duplicate AMI name (error) 5. Verify new AMI appears in describe-images 6. Launch new instance from created AMI	DONE
register-image	—	--name, --description, --architecture, --root-device-name, --virtualization-type, --block-device-mappings, --boot-mode, --ena-support, --sriov-net-support, --tpm-support, --imds-support	Image data must exist in S3	Create AMI metadata entry in Predastore → assign ami-ID → set state to available → return ami-ID	1. Register with valid metadata 2. Missing required name (error) 3. Verify registered image in describe-images	NOT STARTED
deregister-image	—	--image-id, --dry-run	AMI must exist, no instances using it	Mark AMI metadata as deregistered in S3 → AMI no longer available for new launches → existing instances unaffected	1. Deregister existing AMI 2. Deregister non-existent AMI (error) 3. Verify deregistered AMI not in describe-images 4. Existing instances from AMI still run	NOT STARTED
copy-image	—	--source-image-id, --source-region, --name, --description, --encrypted, --kms-key-id, --client-token, --copy-image-tags, --tag-specifications	Source AMI must exist	Copy AMI data between regions/nodes in Predastore → create new AMI metadata with new ami-ID → return new ami-ID	1. Copy image within same region 2. Copy non-existent image (error) 3. Verify copied image independent of source	NOT STARTED
import-image	—	--disk-containers (Format, Url/S3Bucket+S3Key), --description, --architecture, --platform	S3 bucket with disk image	Download disk image from S3 → convert format (VMDK/VHD/RAW→QCOW2) → create viperblock volume → register as AMI	1. Import QCOW2 image 2. Import RAW image 3. Invalid format (error) 4. Verify imported image launchable	NOT STARTED
describe-image-attribute	—	--image-id, --attribute, --dry-run	AMI must exist	Read specific attribute from AMI metadata in S3 → return attribute value	1. Get description attribute 2. Get launch permission 3. Invalid attribute name (error)	NOT STARTED
modify-image-attribute	—	--image-id, --launch-permission, --description, --operation-type, --user-ids, --user-groups, --organization-arns, --dry-run	AMI must exist	Update specific attribute in AMI metadata → persist to S3	1. Add launch permission 2. Modify description 3. Invalid AMI (error)	NOT STARTED
reset-image-attribute	—	--image-id, --attribute, --dry-run	AMI must exist	Reset attribute to default value in AMI metadata	1. Reset launch permission to owner-only 2. Invalid AMI (error)	NOT STARTED

EC2 - Volume (EBS) Management

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
describe-volumes	--volume-ids (fast-path lookup), DeleteOnTermination (from persisted VolumeMetadata)	--filters, --max-results, --next-token, --dry-run	None	NATS ec2.DescribeVolumes → daemon queries viperblock for volume metadata → returns volume list with state, size, attachments, type, DeleteOnTermination flag	1. List all volumes 2. Filter by volume ID 3. Filter by attachment state 4. Non-existent volume returns empty 5. DeleteOnTermination reflects persisted value	DONE
modify-volume	--volume-id, --size, --volume-type, --iops	--throughput, --dry-run, --multi-attach-enabled	Volume must exist	NATS ec2.ModifyVolume → daemon sends resize request to viperblock → NBD does not support live resize, instance must be stopped → returns modification state	1. Increase volume size 2. Modify volume type 3. Decrease size (error - not supported) 4. Modify attached volume (requires stop/start)	DONE
create-volume	--size, --availability-zone, --volume-type (gp3 only), --snapshot-id (creates volume from snapshot)	--iops (hardcoded 3000), --encrypted (hardcoded false), --throughput, --tag-specifications	Valid AZ configured via hive init	Gateway validates input → NATS ec2.CreateVolume → daemon generates vol-ID via viperblock → creates volume (empty or from snapshot) of specified size → persists config.json to Predastore S3 → returns vol-ID with state=available	1. Create 80GB gp3 volume 2. Boundary sizes (1 GiB min, 16384 GiB max) 3. Invalid AZ (error) 4. Verify volume in describe-volumes 5. Unsupported volume type (error - only gp3) 6. Size out of range (error) 7. Create from snapshot	DONE
delete-volume	--volume-id	--dry-run	Volume must exist and be detached (state=available)	Gateway validates vol- prefix → NATS ec2.DeleteVolume → daemon confirms state=available and no AttachedInstance → NATS ebs.delete to viperblockd (stops nbdkit/WAL) → deletes S3 objects under vol-id/, vol-id-efi/, vol-id-cloudinit/ → returns success	1. Delete detached volume 2. Delete attached volume (error: VolumeInUse) 3. Delete non-existent volume (error: InvalidVolume.NotFound) 4. Verify volume gone from describe-volumes 5. Malformed volume ID (error: InvalidVolumeID.Malformed) 6. Double delete (idempotent NotFound)	DONE
attach-volume	--volume-id, --instance-id, --device (optional, auto-assigns /dev/sd[f-p])	--dry-run	Volume must exist (available), instance must exist (running)	Gateway sends to ec2.cmd.{instanceId} → daemon validates volume (Predastore) → ebs.mount via NATS (viperblock starts NBD server) → QMP blockdev-add (nbd-{volId}) → QMP device_add (virtio-blk-pci, vdisk-{volId}) → three-phase rollback on failure → update EBSRequests + BlockDeviceMappings → persist to JetStream + Predastore → respond with VolumeAttachment	1. Attach volume to running instance 2. Auto-assign device name 3. Attach already-attached volume (VolumeInUse) 4. Attach to non-existent instance (InvalidInstanceID.NotFound) 5. Attach to stopped instance (IncorrectInstanceState) 6. Volume not found (InvalidVolume.NotFound) 7. All device slots full (AttachmentLimitExceeded) 8. Volume persists across stop/start	DONE
detach-volume	--volume-id, --instance-id (optional, resolved via DescribeVolumes), --device (optional cross-check), --force	--dry-run	Volume must be attached, instance must be running	Gateway resolves InstanceId if omitted (via DescribeVolumes) → sends to ec2.cmd.{instanceId} → daemon validates (running, attached, not boot/EFI/CloudInit, device match) → three-phase hot-unplug: QMP device_del (force continues on failure) → QMP blockdev-del (abort if fails, preserves state to prevent double-attach) → ebs.unmount via NATS (best-effort) → remove from EBSRequests + BlockDeviceMappings → update volume metadata to available → persist state → respond with VolumeAttachment (state=detaching)	1. Detach with explicit InstanceId 2. Detach without InstanceId (gateway resolution) 3. Detach with correct --device cross-check 4. Missing VolumeId (InvalidParameterValue) 5. Volume not attached (IncorrectState) 6. Nonexistent volume (InvalidVolume.NotFound) 7. Nonexistent instance (InvalidInstanceID.NotFound) 8. Instance not running (IncorrectInstanceState) 9. Device mismatch (InvalidParameterValue) 10. Boot volume protection (OperationNotPermitted) 11. Force flag (continues past device_del failure) 12. Volume reusability (re-attach after detach)	DONE
describe-volume-status	--volume-ids	--filters, --max-results, --next-token, --dry-run	None	Gateway validates vol- prefix → NATS ec2.DescribeVolumeStatus → daemon fetches VolumeConfig from Predastore S3 (parallel for specific IDs, sequential list-all for no IDs) → builds VolumeStatusItem per volume (status=ok, io-enabled=passed, io-performance=not-applicable) → returns InvalidVolume.NotFound for missing explicit IDs → skips internal sub-volumes (-efi, -cloudinit)	1. List all volume statuses 2. Filter by specific volume IDs (fast path) 3. Non-existent volume ID returns InvalidVolume.NotFound 4. Invalid volume ID format (InvalidVolume.Malformed) 5. Internal sub-volumes excluded from listing 6. Nil/empty input defaults to all volumes	DONE
describe-volumes-modifications	—	--volume-ids, --filters, --max-results	None	Query pending/completed volume modifications → return modification state, progress, original/target size	1. Check in-progress modification 2. Check completed modification 3. No modifications returns empty	NOT STARTED

EC2 - Snapshot Management

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
create-snapshot	--volume-id, --description, --tag-specifications	--dry-run	Volume must exist in Predastore	Gateway validates vol- prefix → NATS ec2.CreateSnapshot → daemon reads VolumeConfig from Predastore → generates snap-ID via viperblock → stores SnapshotConfig (metadata-only, points to source volume) as completed → returns Snapshot with state=completed, progress=100%	1. Snapshot from valid volume 2. Missing volume ID (InvalidParameterValue) 3. Volume not found (InvalidVolume.NotFound) 4. Invalid volume ID format (InvalidVolume.Malformed) 5. Snapshot with description 6. Snapshot with tag specifications	DONE
create-snapshots	—	--instance-specification, --description, --tag-specifications	Instance must exist, instance-volume attachment tracking	Create snapshots of all volumes attached to instance → return list of snapshot IDs. Blocked: requires instance-volume attachment tracking to discover which volumes to snapshot.	1. Snapshot all volumes on instance 2. Instance with no volumes	NOT STARTED
delete-snapshot	--snapshot-id	--dry-run	Snapshot must exist	Gateway validates snap- prefix → NATS ec2.DeleteSnapshot → daemon verifies snapshot exists in Predastore → lists and deletes all objects under snapshot prefix → returns success	1. Delete existing snapshot 2. Delete non-existent snapshot (InvalidSnapshot.NotFound) 3. Missing snapshot ID (InvalidParameterValue) 4. Invalid snapshot ID format (InvalidSnapshot.Malformed)	DONE
describe-snapshots	--snapshot-ids	--owner-ids, --filters, --max-results, --dry-run	None	Gateway validates snap- prefix on IDs → NATS ec2.DescribeSnapshots → daemon lists snap- prefixed objects in Predastore → reads SnapshotConfig for each → filters by snapshot ID if specified → returns snapshot list	1. List all snapshots 2. Filter by snapshot ID 3. Empty snapshot list 4. Invalid snapshot ID format (InvalidSnapshot.Malformed)	DONE
copy-snapshot	--source-snapshot-id, --source-region, --description	--encrypted, --dry-run	Source snapshot must exist	Gateway validates snap- prefix + source region → NATS ec2.CopySnapshot → daemon reads source SnapshotConfig → generates new snap-ID → copies metadata (preserves tags, description override) → stores as completed → returns new snapshot ID	1. Copy within same region 2. Copy non-existent snapshot (InvalidSnapshot.NotFound) 3. Missing source ID (InvalidParameterValue) 4. Missing source region (MissingParameter) 5. Copy preserves tags 6. Copy with description override	DONE

EC2 - Tags

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
create-tags	--resources, --tags (Key=,Value=)	--dry-run	None	Gateway validates input (resources non-empty, tags non-empty, keys non-empty) → NATS ec2.CreateTags → daemon merges tags into per-resource JSON in Predastore S3 (tags/{resourceId}.json) → return success	1. Tag an instance 2. Tag multiple resources at once 3. Overwrite existing tag value 4. Empty resources list (error: MissingParameter) 5. Empty tags list (error: MissingParameter) 6. Empty tag key (error: InvalidParameterValue)	DONE
delete-tags	--resources, --tags	--dry-run	None	Gateway validates input (resources non-empty) → NATS ec2.DeleteTags → daemon removes specified tag keys from resource JSON, or all tags if no keys specified → return success	1. Delete specific tag by key 2. Delete all tags (no tags specified) 3. Empty resources list (error: MissingParameter)	DONE
describe-tags	--filters (resource-id, resource-type, key, value)	--max-results, --next-token, --dry-run	None	NATS ec2.DescribeTags → daemon lists all tags/*.json from Predastore S3 → applies filters (resource-id, resource-type, key, value) → returns tag list with resource type auto-detected from ID prefix	1. List all tags 2. Filter by resource-id 3. Filter by resource-type (instance, volume, image, snapshot, vpc, subnet, security-group, route-table, internet-gateway, egress-only-internet-gateway) 4. Filter by key 5. Filter by value 6. Empty result when no tags exist	DONE

EC2 - Regions & Availability Zones

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
describe-regions	(returns configured region, endpoint, opt-in status from config — input params ignored)	--region-names, --filters, --all-regions, --dry-run	None	Return configured region from hive init config with Endpoint and OptInStatus → local-only response, no NATS	1. List all regions 2. Filter by region name 3. Verify endpoint URL returned 4. Verify OptInStatus returned	DONE
describe-availability-zones	(returns configured AZ, region, zone ID, state, opt-in status from config — input params ignored)	--zone-names, --filters, --all-availability-zones	None	Return configured AZ from hive init config with zone ID, state, group name, network border group → local-only response, no NATS	1. List all AZs 2. Filter by zone name 3. Verify zone state is available 4. Verify region name matches config	DONE

EC2 - Account Attributes

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
describe-account-attributes	--attribute-names	--dry-run	None	Gateway parses input → returns static account attributes: supported-platforms=VPC, default-vpc=none, max-instances=100, vpc-max-security-groups-per-interface=5, max-elastic-ips=5, vpc-max-elastic-ips=20 → local-only response, no NATS	1. List all account attributes 2. Filter by attribute name 3. Verify all 6 attributes returned with correct values	DONE

EC2 - Account Settings (Deferred)

Persistence layer works (NATS JetStream KV), but stored values are not yet enforced by downstream services. Will be completed post-merge.

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
enable-ebs-encryption-by-default	(no flags needed)	--dry-run	None	Gateway validates input → NATS ec2.EnableEbsEncryptionByDefault with hive-workers queue group → daemon stores EbsEncryptionByDefault=true in JetStream KV (hive-ec2-account-settings bucket) → return EbsEncryptionByDefault=true. Enforcement deferred: stored value not yet checked by CreateVolume/CreateSnapshot.	1. Enable encryption 2. Verify via get	STARTED (enforcement pending)
disable-ebs-encryption-by-default	(no flags needed)	--dry-run	None	Gateway validates input → NATS ec2.DisableEbsEncryptionByDefault with hive-workers queue group → daemon stores EbsEncryptionByDefault=false in JetStream KV → return EbsEncryptionByDefault=false.	1. Disable encryption 2. Verify via get	STARTED (enforcement pending)
get-ebs-encryption-by-default	(no flags needed)	--dry-run	None	Gateway validates input → NATS ec2.GetEbsEncryptionByDefault with hive-workers queue group → daemon reads EbsEncryptionByDefault from JetStream KV → return current state.	1. Get default state 2. Verify matches last enable/disable	STARTED (enforcement pending)
enable-serial-console-access	(no flags needed)	--dry-run	None	Gateway validates input → NATS ec2.EnableSerialConsoleAccess with hive-workers queue group → daemon stores SerialConsoleAccessEnabled=true in JetStream KV (hive-ec2-account-settings bucket) → return enabled=true. Stored for future interactive serial console support (not currently enforced by any operation).	1. Enable access 2. Verify via get	STARTED (enforcement pending)
disable-serial-console-access	(no flags needed)	--dry-run	None	Gateway validates input → NATS ec2.DisableSerialConsoleAccess with hive-workers queue group → daemon stores SerialConsoleAccessEnabled=false in JetStream KV → return enabled=false. Stored for future interactive serial console support (not currently enforced by any operation).	1. Disable access 2. Verify via get	STARTED (enforcement pending)
get-serial-console-access-status	(no flags needed)	--dry-run	None	Gateway validates input → NATS ec2.GetSerialConsoleAccessStatus with hive-workers queue group → daemon reads SerialConsoleAccessEnabled from JetStream KV → return current state.	1. Get current status 2. Verify matches last enable/disable	DONE
enable-snapshot-block-public-access	—	--state	None	Store snapshot block public access state in JetStream KV	1. Enable with block-all-sharing 2. Enable with block-new-sharing	NOT STARTED (enforcement pending)
disable-snapshot-block-public-access	—	--dry-run	None	Clear snapshot block public access state in JetStream KV	1. Disable access	NOT STARTED (enforcement pending)
get-snapshot-block-public-access-state	—	--dry-run	None	Read snapshot block public access state from JetStream KV	1. Get current state	NOT STARTED (enforcement pending)
enable-image-block-public-access	—	--image-block-public-access-state	None	Store image block public access state in JetStream KV	1. Enable with block-new-sharing	NOT STARTED (enforcement pending)
disable-image-block-public-access	—	--dry-run	None	Clear image block public access state in JetStream KV	1. Disable access	NOT STARTED (enforcement pending)
get-image-block-public-access-state	—	--dry-run	None	Read image block public access state from JetStream KV	1. Get current state	NOT STARTED (enforcement pending)
modify-instance-metadata-defaults	—	--http-tokens, --http-put-response-hop-limit, --http-endpoint, --instance-metadata-tags	None	Store instance metadata defaults in JetStream KV	1. Set httpTokens=required 2. Set hop limit	NOT STARTED (enforcement pending)
get-instance-metadata-defaults	—	--dry-run	None	Read instance metadata defaults from JetStream KV	1. Get current defaults	NOT STARTED (enforcement pending)

EC2 - Egress-Only Internet Gateway

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
create-egress-only-internet-gateway	—	--vpc-id, --client-token, --tag-specifications, --dry-run	VPC must exist	NATS ec2.CreateEgressOnlyInternetGateway → daemon generates eigw-ID → creates record in NATS JetStream KV with state=attached → returns EgressOnlyInternetGateway with attachment	1. Create with valid VpcId 2. Missing VpcId (error: MissingParameter) 3. Create with inline tags 4. Verify ID format eigw-{16hex}	NOT STARTED
delete-egress-only-internet-gateway	—	--egress-only-internet-gateway-id, --dry-run	EIGW must exist	NATS ec2.DeleteEgressOnlyInternetGateway → daemon verifies EIGW exists in KV → deletes from KV → returns ReturnCode=true	1. Delete existing EIGW 2. Delete non-existent EIGW (error) 3. Missing ID (error: MissingParameter)	NOT STARTED
describe-egress-only-internet-gateways	—	--egress-only-internet-gateway-ids, --filters, --max-results, --next-token, --dry-run	None	NATS ec2.DescribeEgressOnlyInternetGateways → daemon lists all keys from KV bucket → filters by ID if specified → returns list	1. Describe all EIGWs 2. Filter by specific ID 3. Non-existent ID returns empty list	NOT STARTED

EC2 - Placement Groups

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
create-placement-group	—	--group-name, --strategy (cluster/spread/partition), --partition-count, --spread-level, --tag-specifications	None	NATS ec2.CreatePlacementGroup → daemon stores placement group in JetStream KV with strategy, state=available → return group metadata	1. Create with cluster strategy 2. Create with spread strategy 3. Create with partition strategy + partition count 4. Duplicate name (error) 5. Invalid strategy (error)	NOT STARTED
delete-placement-group	—	--group-name, --dry-run	Group must exist, no instances in group	NATS ec2.DeletePlacementGroup → daemon verifies group exists and is empty → delete from KV → return success	1. Delete empty group 2. Delete group with instances (error) 3. Delete non-existent group (error)	NOT STARTED
describe-placement-groups	—	--group-names, --group-ids, --filters	None	NATS ec2.DescribePlacementGroups → daemon lists groups from KV → return list with strategy and state	1. List all groups 2. Filter by name 3. Filter by strategy	NOT STARTED

EC2 - Dedicated Hosts

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
allocate-hosts	—	--availability-zone, --instance-type, --quantity, --auto-placement, --tag-specifications	None	NATS ec2.AllocateHosts → daemon allocates host resources → stores in JetStream KV with h-ID → return host ID list	1. Allocate single host 2. Allocate multiple hosts 3. Missing AZ or instance type (error)	NOT STARTED
describe-hosts	—	--host-ids, --filters, --max-results	None	NATS ec2.DescribeHosts → daemon lists hosts from KV → return host list with capacity and instance info	1. List all hosts 2. Filter by host ID 3. Filter by instance type	NOT STARTED
release-hosts	—	--host-ids	Host must exist, no running instances	NATS ec2.ReleaseHosts → daemon verifies no instances on host → delete from KV → return success/failure per host	1. Release empty host 2. Release host with instances (error) 3. Release non-existent host (error)	NOT STARTED

EC2 - IPv4 Pools

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
create-public-ipv4-pool	—	--tag-specifications, --dry-run	None	NATS ec2.CreatePublicIpv4Pool → daemon creates pool in JetStream KV with ipv4pool-ID → return pool ID	1. Create pool 2. Verify in describe	NOT STARTED
delete-public-ipv4-pool	—	--pool-id, --dry-run	Pool must exist and be empty	NATS ec2.DeletePublicIpv4Pool → daemon verifies pool empty → delete from KV → return success	1. Delete empty pool 2. Delete pool with addresses (error)	NOT STARTED
describe-public-ipv4-pools	—	--pool-ids, --filters, --max-results	None	NATS ec2.DescribePublicIpv4Pools → daemon lists pools from KV → return pool list with address counts	1. List all pools 2. Filter by pool ID	NOT STARTED

EC2 - DHCP Options

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
create-dhcp-options	—	--dhcp-configurations (domain-name, domain-name-servers, ntp-servers, netbios-name-servers, netbios-node-type), --tag-specifications	None	NATS ec2.CreateDhcpOptions → daemon stores DHCP option set in JetStream KV with dopt-ID → return DHCP options with configurations	1. Create with domain-name + DNS servers 2. Create with NTP servers 3. Verify in describe	NOT STARTED
delete-dhcp-options	—	--dhcp-options-id, --dry-run	DHCP options must exist and not be associated with a VPC	NATS ec2.DeleteDhcpOptions → daemon verifies not associated → delete from KV → return success	1. Delete unassociated options 2. Delete associated options (error) 3. Delete non-existent (error)	NOT STARTED
describe-dhcp-options	—	--dhcp-options-ids, --filters, --max-results	None	NATS ec2.DescribeDhcpOptions → daemon lists DHCP options from KV → return list with configurations	1. List all DHCP options 2. Filter by ID	NOT STARTED
associate-dhcp-options	—	--dhcp-options-id, --vpc-id, --dry-run	DHCP options and VPC must exist	NATS ec2.AssociateDhcpOptions → daemon links DHCP options to VPC → update VPC metadata → return success	1. Associate with VPC 2. Missing DHCP options ID (error) 3. Missing VPC ID (error)	NOT STARTED

EC2 - Capacity Reservations

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
create-capacity-reservation	—	--instance-type, --instance-platform, --availability-zone, --instance-count, --end-date, --end-date-type, --instance-match-criteria, --tag-specifications	None	NATS ec2.CreateCapacityReservation → daemon stores reservation in JetStream KV with cr-ID → return reservation with state=active	1. Create with required fields 2. Missing instance type (error) 3. Verify in describe	NOT STARTED
cancel-capacity-reservation	—	--capacity-reservation-id, --dry-run	Reservation must exist	NATS ec2.CancelCapacityReservation → daemon marks reservation as cancelled in KV → return success	1. Cancel active reservation 2. Cancel non-existent (error)	NOT STARTED
describe-capacity-reservations	—	--capacity-reservation-ids, --filters, --max-results	None	NATS ec2.DescribeCapacityReservations → daemon lists reservations from KV → return list with state and counts	1. List all reservations 2. Filter by ID 3. Filter by instance type	NOT STARTED
modify-capacity-reservation	—	--capacity-reservation-id, --instance-count, --end-date, --end-date-type	Reservation must exist	NATS ec2.ModifyCapacityReservation → daemon updates reservation in KV → return success	1. Modify instance count 2. Modify end date 3. Missing reservation ID (error)	NOT STARTED

EC2 - Elastic IP

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
allocate-address	—	--domain (vpc), --tag-specifications, --dry-run	None	NATS ec2.AllocateAddress → daemon allocates IP from pool → stores in JetStream KV with eipalloc-ID → return AllocationId, PublicIp, Domain	1. Allocate EIP 2. Verify in describe-addresses 3. Allocate without --domain uses default	NOT STARTED
release-address	—	--allocation-id, --dry-run	EIP must exist and be disassociated	NATS ec2.ReleaseAddress → daemon verifies not associated → release IP back to pool → delete from KV → return success	1. Release disassociated EIP 2. Release associated EIP (error) 3. Release non-existent (error)	NOT STARTED
associate-address	—	--allocation-id, --instance-id or --network-interface-id, --dry-run	EIP and target must exist	NATS ec2.AssociateAddress → daemon links EIP to instance/ENI → configure OVS DNAT/SNAT rules → return eipassoc-ID	1. Associate with instance 2. Re-associate (moves EIP) 3. Associate non-existent EIP (error)	NOT STARTED
disassociate-address	—	--association-id, --dry-run	Association must exist	NATS ec2.DisassociateAddress → daemon unlinks EIP from instance/ENI → remove OVS DNAT/SNAT rules → return success	1. Disassociate existing 2. Disassociate non-existent (error)	NOT STARTED
describe-addresses	—	--allocation-ids, --filters, --public-ips	None	NATS ec2.DescribeAddresses → daemon lists EIPs from KV → return list with association info	1. List all EIPs 2. Filter by allocation ID 3. Filter by public IP	NOT STARTED

EC2 - NAT Gateway

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
create-nat-gateway	—	--subnet-id, --allocation-id, --connectivity-type, --tag-specifications	Subnet must exist, EIP must be allocated (for public type)	NATS ec2.CreateNatGateway → daemon creates NAT gateway in JetStream KV with nat-ID → configure OVS SNAT rules → state=pending→available → return NatGateway	1. Create public NAT gateway 2. Create private NAT gateway (no allocation-id) 3. Invalid subnet (error)	NOT STARTED
delete-nat-gateway	—	--nat-gateway-id, --dry-run	NAT gateway must exist	NATS ec2.DeleteNatGateway → daemon marks as deleting → remove OVS SNAT rules → delete from KV → return NatGatewayId	1. Delete existing NAT gateway 2. Delete non-existent (error)	NOT STARTED
describe-nat-gateways	—	--nat-gateway-ids, --filters, --max-results	None	NATS ec2.DescribeNatGateways → daemon lists NAT gateways from KV → return list with state, subnet, addresses	1. List all NAT gateways 2. Filter by ID 3. Filter by VPC ID	NOT STARTED
assign-private-nat-gateway-address	—	--nat-gateway-id, --private-ip-addresses	NAT gateway must exist (private type)	NATS ec2.AssignPrivateNatGatewayAddress → daemon assigns private IPs to NAT gateway → return assigned addresses	1. Assign address 2. Missing NAT gateway ID (error)	NOT STARTED
associate-nat-gateway-address	—	--nat-gateway-id, --allocation-ids	NAT gateway and EIPs must exist	NATS ec2.AssociateNatGatewayAddress → daemon associates EIPs with NAT gateway → return association info	1. Associate EIP 2. Missing NAT gateway ID (error)	NOT STARTED

EC2 - VPC Networking (Core)

Requires Open vSwitch (apt install openvswitch-switch openvswitch-common). Single AZ for Hive v1.

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
create-vpc	—	--cidr-block, --tag-specifications, --instance-tenancy	None	Create OVS bridge for VPC → assign vpc-ID → store VPC metadata in NATS KV → configure CIDR range → return VPC with state=available	1. Create VPC with /16 CIDR 2. Overlapping CIDR (error) 3. Invalid CIDR format (error) 4. Verify in describe-vpcs	NOT STARTED
delete-vpc	—	--vpc-id	VPC must be empty (no subnets, gateways, instances)	Verify no dependent resources → delete OVS bridge → remove metadata → return success	1. Delete empty VPC 2. Delete VPC with subnets (error: DependencyViolation) 3. Delete non-existent VPC (error)	NOT STARTED
describe-vpcs	—	--vpc-ids, --filters, --max-results	None	Query NATS KV for VPC metadata → return VPC list with CIDR, state, tags	1. List all VPCs 2. Filter by VPC ID 3. Filter by CIDR block	NOT STARTED
modify-vpc-attribute	—	--vpc-id, --enable-dns-support, --enable-dns-hostnames	VPC must exist	NATS ec2.ModifyVpcAttribute → daemon updates VPC attribute in KV → return success	1. Enable DNS support 2. Enable DNS hostnames 3. Missing VPC ID (error)	NOT STARTED
associate-vpc-cidr-block	—	--vpc-id, --cidr-block	VPC must exist	NATS ec2.AssociateVpcCidrBlock → daemon adds secondary CIDR to VPC metadata → return association	1. Add secondary CIDR 2. Overlapping CIDR (error) 3. Max CIDR blocks exceeded (error)	NOT STARTED
disassociate-vpc-cidr-block	—	--association-id	Association must exist	NATS ec2.DisassociateVpcCidrBlock → daemon removes secondary CIDR from VPC → return success	1. Remove secondary CIDR 2. Remove primary CIDR (error)	NOT STARTED
create-subnet	—	--vpc-id, --cidr-block, --availability-zone, --tag-specifications	VPC must exist	Validate CIDR within VPC range → create OVS port group with VLAN tag → assign subnet-ID → store metadata	1. Create subnet within VPC CIDR 2. Subnet CIDR outside VPC range (error) 3. Overlapping subnet CIDRs (error)	NOT STARTED
delete-subnet	—	--subnet-id	Subnet must be empty (no instances)	Verify no instances in subnet → remove OVS port group → delete metadata	1. Delete empty subnet 2. Delete subnet with instances (error)	NOT STARTED
describe-subnets	—	--subnet-ids, --filters, --max-results	None	Query NATS KV for subnet metadata → return subnet list	1. List all subnets 2. Filter by VPC ID 3. Filter by AZ	NOT STARTED
modify-subnet-attribute	—	--subnet-id, --map-public-ip-on-launch, --assign-ipv6-address-on-creation	Subnet must exist	NATS ec2.ModifySubnetAttribute → daemon updates subnet attribute in KV → return success	1. Enable auto-assign public IP 2. Missing subnet ID (error)	NOT STARTED
associate-subnet-cidr-block	—	--subnet-id, --ipv6-cidr-block	Subnet must exist	NATS ec2.AssociateSubnetCidrBlock → daemon adds IPv6 CIDR to subnet → return association	1. Add IPv6 CIDR 2. Missing subnet ID (error)	NOT STARTED
disassociate-subnet-cidr-block	—	--association-id	Association must exist	NATS ec2.DisassociateSubnetCidrBlock → daemon removes IPv6 CIDR from subnet → return success	1. Remove IPv6 CIDR 2. Invalid association (error)	NOT STARTED
create-security-group	—	--group-name, --description, --vpc-id, --tag-specifications	VPC must exist	Create security group metadata → create default OVS flow rules (deny all inbound, allow all outbound) → assign sg-ID	1. Create SG in VPC 2. Duplicate name in same VPC (error) 3. Verify default rules	NOT STARTED
delete-security-group	—	--group-id	SG must not be in use by instances	Verify no instances reference SG → remove OVS flow rules → delete metadata	1. Delete unused SG 2. Delete SG in use (error)	NOT STARTED
describe-security-groups	—	--group-ids, --group-names, --filters, --max-results	None	Query NATS KV for SG metadata → return SG list with rules	1. List all SGs 2. Filter by VPC ID 3. Filter by group name	NOT STARTED
authorize-security-group-ingress	—	--group-id, --protocol, --port, --cidr, --source-group	SG must exist	Add inbound rule → create OVS OpenFlow rule → persist to metadata	1. Allow SSH (port 22) from 0.0.0.0/0 2. Allow from specific CIDR 3. Duplicate rule (idempotent)	NOT STARTED
authorize-security-group-egress	—	--group-id, --protocol, --port, --cidr	SG must exist	Add outbound rule → create OVS OpenFlow rule → persist to metadata	1. Allow HTTPS outbound 2. Restrict to specific CIDR	NOT STARTED
revoke-security-group-ingress	—	--group-id, --protocol, --port, --cidr	SG must exist, rule must exist	Remove inbound rule → delete OVS OpenFlow rule → update metadata	1. Revoke existing rule 2. Revoke non-existent rule (error)	NOT STARTED
revoke-security-group-egress	—	--group-id, --protocol, --port, --cidr	SG must exist, rule must exist	Remove outbound rule → delete OVS OpenFlow rule → update metadata	1. Revoke existing rule 2. Revoke non-existent rule (error)	NOT STARTED
create-internet-gateway	—	--tag-specifications	None	Create IGW metadata → assign igw-ID → configure OVS NAT bridge for external access	1. Create IGW 2. Verify in describe-internet-gateways	NOT STARTED
attach-internet-gateway	—	--internet-gateway-id, --vpc-id	IGW and VPC must exist	Link IGW to VPC → configure OVS flows for internet routing → update metadata	1. Attach IGW to VPC 2. Attach already-attached IGW (error) 3. Attach to non-existent VPC (error)	NOT STARTED
detach-internet-gateway	—	--internet-gateway-id, --vpc-id	IGW must be attached to VPC	Unlink IGW from VPC → remove OVS internet routing flows	1. Detach attached IGW 2. Detach unattached IGW (error)	NOT STARTED
delete-internet-gateway	—	--internet-gateway-id	IGW must be detached	Verify IGW detached → remove OVS NAT bridge → delete metadata	1. Delete detached IGW 2. Delete attached IGW (error)	NOT STARTED
describe-internet-gateways	—	--internet-gateway-ids, --filters, --max-results	None	Query NATS KV for IGW metadata → return list with attachment info	1. List all IGWs 2. Filter by attachment VPC	NOT STARTED

EC2 - Route Tables

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
create-route-table	—	--vpc-id, --tag-specifications	VPC must exist	NATS ec2.CreateRouteTable → daemon creates route table in KV with rtb-ID → add default local route for VPC CIDR → return route table	1. Create route table 2. Verify default local route 3. Missing VPC ID (error)	NOT STARTED
delete-route-table	—	--route-table-id, --dry-run	Route table must exist and not be main route table	NATS ec2.DeleteRouteTable → daemon verifies not main table → delete from KV → return success	1. Delete non-main route table 2. Delete main route table (error) 3. Delete non-existent (error)	NOT STARTED
describe-route-tables	—	--route-table-ids, --filters, --max-results	None	NATS ec2.DescribeRouteTables → daemon lists route tables from KV → return tables with routes	1. List all route tables 2. Filter by VPC	NOT STARTED
create-route	—	--route-table-id, --destination-cidr-block, --gateway-id or --nat-gateway-id or --egress-only-internet-gateway-id	Route table and target must exist	NATS ec2.CreateRoute → daemon adds route entry → configure OVS flow for destination CIDR → update metadata	1. Add internet route via IGW 2. Add route to NAT gateway 3. Add route to EIGW 4. Conflicting route (error)	NOT STARTED
delete-route	—	--route-table-id, --destination-cidr-block	Route must exist	NATS ec2.DeleteRoute → daemon removes route entry → remove OVS flow → update metadata	1. Delete existing route 2. Delete non-existent route (error) 3. Delete local route (error)	NOT STARTED
replace-route	—	--route-table-id, --destination-cidr-block, --gateway-id or --nat-gateway-id	Route must exist	NATS ec2.ReplaceRoute → daemon replaces route target → update OVS flow → update metadata	1. Replace IGW route with NAT 2. Replace non-existent route (error)	NOT STARTED
associate-route-table	—	--route-table-id, --subnet-id or --gateway-id	Route table and target must exist	NATS ec2.AssociateRouteTable → daemon links route table to subnet/gateway → return rtbassoc-ID	1. Associate with subnet 2. Missing route table ID (error)	NOT STARTED
disassociate-route-table	—	--association-id	Association must exist, not main table association	NATS ec2.DisassociateRouteTable → daemon unlinks route table → return success	1. Disassociate existing 2. Disassociate main table (error)	NOT STARTED

EC2 - VPC Peering

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
create-vpc-peering-connection	—	--vpc-id, --peer-vpc-id, --peer-owner-id, --peer-region, --tag-specifications	Both VPCs must exist	NATS ec2.CreateVpcPeeringConnection → daemon creates peering in KV with pcx-ID → state=pending-acceptance → return peering connection	1. Create peering between two VPCs 2. Missing VPC ID (error) 3. Overlapping CIDRs (error)	NOT STARTED
accept-vpc-peering-connection	—	--vpc-peering-connection-id, --dry-run	Peering must exist in pending-acceptance state	NATS ec2.AcceptVpcPeeringConnection → daemon updates state to active → configure OVS cross-VPC flows → return peering	1. Accept pending peering 2. Accept already active (error)	NOT STARTED
reject-vpc-peering-connection	—	--vpc-peering-connection-id, --dry-run	Peering must exist in pending-acceptance state	NATS ec2.RejectVpcPeeringConnection → daemon updates state to rejected → return peering	1. Reject pending peering 2. Reject already active (error)	NOT STARTED
delete-vpc-peering-connection	—	--vpc-peering-connection-id, --dry-run	Peering must exist	NATS ec2.DeleteVpcPeeringConnection → daemon removes OVS cross-VPC flows → delete from KV → return success	1. Delete active peering 2. Delete non-existent (error)	NOT STARTED
describe-vpc-peering-connections	—	--vpc-peering-connection-ids, --filters, --max-results	None	NATS ec2.DescribeVpcPeeringConnections → daemon lists peerings from KV → return list with state	1. List all peerings 2. Filter by ID 3. Filter by VPC	NOT STARTED
modify-vpc-peering-connection-options	—	--vpc-peering-connection-id, --requester-peering-connection-options, --accepter-peering-connection-options	Peering must be active	NATS ec2.ModifyVpcPeeringConnectionOptions → daemon updates peering options in KV → return modified options	1. Enable DNS resolution 2. Missing peering ID (error)	NOT STARTED

EC2 - VPC Endpoints

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
create-vpc-endpoint	—	--vpc-id, --service-name, --vpc-endpoint-type (Gateway/Interface), --route-table-ids, --subnet-ids, --tag-specifications	VPC must exist	NATS ec2.CreateVpcEndpoint → daemon creates endpoint in KV with vpce-ID → return endpoint	1. Create Gateway endpoint for S3 2. Create Interface endpoint 3. Missing VPC ID (error)	NOT STARTED
delete-vpc-endpoints	—	--vpc-endpoint-ids, --dry-run	Endpoints must exist	NATS ec2.DeleteVpcEndpoints → daemon deletes endpoints from KV → return success/failure per endpoint	1. Delete existing endpoint 2. Delete non-existent (error)	NOT STARTED
describe-vpc-endpoints	—	--vpc-endpoint-ids, --filters, --max-results	None	NATS ec2.DescribeVpcEndpoints → daemon lists endpoints from KV → return list with state and type	1. List all endpoints 2. Filter by VPC 3. Filter by service name	NOT STARTED
describe-vpc-endpoint-services	—	--service-names, --filters, --max-results	None	NATS ec2.DescribeVpcEndpointServices → daemon returns available services (S3, DynamoDB equivalents) → return service list	1. List available services 2. Filter by service name	NOT STARTED
modify-vpc-endpoint	—	--vpc-endpoint-id, --add-route-table-ids, --remove-route-table-ids, --add-subnet-ids, --remove-subnet-ids	Endpoint must exist	NATS ec2.ModifyVpcEndpoint → daemon updates endpoint route tables/subnets in KV → return success	1. Add route table 2. Remove subnet 3. Missing endpoint ID (error)	NOT STARTED

EC2 - VPN Gateway & Customer Gateway

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
create-customer-gateway	—	--type (ipsec.1), --bgp-asn, --ip-address, --tag-specifications	None	NATS ec2.CreateCustomerGateway → daemon stores in JetStream KV with cgw-ID → return customer gateway	1. Create with BGP ASN and IP 2. Missing required fields (error)	NOT STARTED
delete-customer-gateway	—	--customer-gateway-id, --dry-run	Must exist, no VPN connections	NATS ec2.DeleteCustomerGateway → daemon verifies no active connections → delete from KV → return success	1. Delete existing 2. Delete with active VPN (error)	NOT STARTED
describe-customer-gateways	—	--customer-gateway-ids, --filters	None	NATS ec2.DescribeCustomerGateways → daemon lists from KV → return list with BGP/IP info	1. List all 2. Filter by ID	NOT STARTED
create-vpn-gateway	—	--type (ipsec.1), --amazon-side-asn, --tag-specifications	None	NATS ec2.CreateVpnGateway → daemon stores in JetStream KV with vgw-ID → return VPN gateway	1. Create VPN gateway 2. Verify in describe	NOT STARTED
delete-vpn-gateway	—	--vpn-gateway-id, --dry-run	Must be detached	NATS ec2.DeleteVpnGateway → daemon verifies detached → delete from KV → return success	1. Delete detached gateway 2. Delete attached (error)	NOT STARTED
attach-vpn-gateway	—	--vpn-gateway-id, --vpc-id	Both must exist	NATS ec2.AttachVpnGateway → daemon links VPN gateway to VPC → return attachment	1. Attach to VPC 2. Already attached (error)	NOT STARTED
detach-vpn-gateway	—	--vpn-gateway-id, --vpc-id	Must be attached	NATS ec2.DetachVpnGateway → daemon unlinks VPN gateway from VPC → return success	1. Detach from VPC 2. Not attached (error)	NOT STARTED
describe-vpn-gateways	—	--vpn-gateway-ids, --filters	None	NATS ec2.DescribeVpnGateways → daemon lists from KV → return list with attachment info	1. List all 2. Filter by VPC attachment	NOT STARTED

EC2 - VPN Connections

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
create-vpn-connection	—	--type (ipsec.1), --customer-gateway-id, --vpn-gateway-id, --options, --tag-specifications	Customer gateway and VPN gateway must exist	NATS ec2.CreateVpnConnection → daemon stores connection in JetStream KV with vpn-ID → return connection with tunnel info	1. Create IPsec connection 2. Missing customer gateway (error) 3. Missing VPN gateway (error)	NOT STARTED
delete-vpn-connection	—	--vpn-connection-id, --dry-run	Connection must exist	NATS ec2.DeleteVpnConnection → daemon deletes from KV → return success	1. Delete existing connection 2. Delete non-existent (error)	NOT STARTED
describe-vpn-connections	—	--vpn-connection-ids, --filters	None	NATS ec2.DescribeVpnConnections → daemon lists from KV → return list with state and tunnel info	1. List all connections 2. Filter by ID 3. Filter by VPN gateway	NOT STARTED
modify-vpn-connection	—	--vpn-connection-id, --vpn-gateway-id, --customer-gateway-id	Connection must exist	NATS ec2.ModifyVpnConnection → daemon updates connection target in KV → return modified connection	1. Change VPN gateway 2. Missing connection ID (error)	NOT STARTED
modify-vpn-connection-options	—	--vpn-connection-id, --local-ipv4-network-cidr, --remote-ipv4-network-cidr	Connection must exist	NATS ec2.ModifyVpnConnectionOptions → daemon updates tunnel options in KV → return modified connection	1. Modify CIDR ranges 2. Missing connection ID (error)	NOT STARTED

EC2 - Network ACLs

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
create-network-acl	—	--vpc-id, --tag-specifications	VPC must exist	NATS ec2.CreateNetworkAcl → daemon creates NACL in KV with acl-ID → add default deny-all rules → return NACL	1. Create NACL in VPC 2. Missing VPC ID (error) 3. Verify default deny rules	NOT STARTED
delete-network-acl	—	--network-acl-id, --dry-run	Must not be default NACL	NATS ec2.DeleteNetworkAcl → daemon verifies not default → delete from KV → return success	1. Delete non-default NACL 2. Delete default NACL (error)	NOT STARTED
describe-network-acls	—	--network-acl-ids, --filters, --max-results	None	NATS ec2.DescribeNetworkAcls → daemon lists NACLs from KV → return list with entries	1. List all NACLs 2. Filter by VPC	NOT STARTED
create-network-acl-entry	—	--network-acl-id, --rule-number, --protocol, --rule-action (allow/deny), --cidr-block, --ingress/--egress, --port-range	NACL must exist	NATS ec2.CreateNetworkAclEntry → daemon adds rule entry to NACL in KV → configure OVS flow → return success	1. Add ingress allow rule 2. Add egress deny rule 3. ICMP type/code parsing 4. Missing NACL ID (error)	NOT STARTED
delete-network-acl-entry	—	--network-acl-id, --rule-number, --ingress/--egress	Entry must exist	NATS ec2.DeleteNetworkAclEntry → daemon removes rule from NACL → remove OVS flow → return success	1. Delete existing entry 2. Delete non-existent entry (error)	NOT STARTED
replace-network-acl-association	—	--association-id, --network-acl-id	Both must exist	NATS ec2.ReplaceNetworkAclAssociation → daemon swaps NACL for subnet → return new association ID	1. Replace association 2. Missing association ID (error)	NOT STARTED
replace-network-acl-entry	—	--network-acl-id, --rule-number, --protocol, --rule-action, --cidr-block, --ingress/--egress, --port-range	Entry must exist	NATS ec2.ReplaceNetworkAclEntry → daemon replaces rule in KV → update OVS flow → return success	1. Replace existing entry 2. Replace non-existent entry (error)	NOT STARTED

EC2 - Prefix Lists

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
create-managed-prefix-list	—	--prefix-list-name, --address-family (IPv4/IPv6), --max-entries, --entries, --tag-specifications	None	NATS ec2.CreateManagedPrefixList → daemon stores prefix list in JetStream KV with pl-ID → return prefix list with version	1. Create with IPv4 entries 2. Name, address family, max entries required 3. Verify in describe	NOT STARTED
delete-managed-prefix-list	—	--prefix-list-id, --dry-run	Must exist, not referenced by security groups/route tables	NATS ec2.DeleteManagedPrefixList → daemon verifies not referenced → delete from KV → return success	1. Delete unreferenced list 2. Delete referenced list (error)	NOT STARTED
describe-managed-prefix-lists	—	--prefix-list-ids, --filters, --max-results	None	NATS ec2.DescribeManagedPrefixLists → daemon lists from KV → return list with state and version	1. List all prefix lists 2. Filter by ID	NOT STARTED
modify-managed-prefix-list	—	--prefix-list-id, --current-version, --add-entries, --remove-entries, --prefix-list-name	Must exist, current version must match	NATS ec2.ModifyManagedPrefixList → daemon validates version → apply changes → increment version → return updated list	1. Add entries 2. Remove entries 3. Version mismatch (error)	NOT STARTED
get-managed-prefix-list-entries	—	--prefix-list-id, --target-version, --max-results	Prefix list must exist	NATS ec2.GetManagedPrefixListEntries → daemon reads entries from KV → return entry list	1. List entries 2. List entries at specific version	NOT STARTED
get-managed-prefix-list-associations	—	--prefix-list-id, --max-results	Prefix list must exist	NATS ec2.GetManagedPrefixListAssociations → daemon finds references in SGs/route tables → return association list	1. List associations 2. No associations returns empty	NOT STARTED

EC2 - Network Interfaces

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
create-network-interface	—	--subnet-id, --description, --private-ip-address, --groups, --tag-specifications	Subnet must exist	NATS ec2.CreateNetworkInterface → daemon creates ENI in KV with eni-ID → assign private IP from subnet pool → return ENI	1. Create in subnet 2. Create with specific private IP 3. Missing subnet ID (error)	NOT STARTED
delete-network-interface	—	--network-interface-id, --dry-run	Must not be attached	NATS ec2.DeleteNetworkInterface → daemon verifies detached → release IP → delete from KV → return success	1. Delete detached ENI 2. Delete attached ENI (error)	NOT STARTED
describe-network-interfaces	—	--network-interface-ids, --filters, --max-results	None	NATS ec2.DescribeNetworkInterfaces → daemon lists ENIs from KV → return list with IP/attachment info	1. List all ENIs 2. Filter by subnet 3. Filter by attachment	NOT STARTED
attach-network-interface	—	--network-interface-id, --instance-id, --device-index	ENI and instance must exist	NATS ec2.AttachNetworkInterface → daemon attaches OVS port to instance QEMU process → configure MAC/IP → return eni-attach-ID	1. Attach ENI to instance 2. Already attached (error) 3. Missing device index (error)	NOT STARTED
detach-network-interface	—	--attachment-id, --force	ENI must be attached	NATS ec2.DetachNetworkInterface → daemon detaches OVS port from instance → return success	1. Detach ENI 2. Force detach 3. Not attached (error)	NOT STARTED
modify-network-interface-attribute	—	--network-interface-id, --description, --source-dest-check, --groups	ENI must exist	NATS ec2.ModifyNetworkInterfaceAttribute → daemon updates ENI attributes in KV → return success	1. Modify description 2. Toggle source/dest check 3. Update security groups	NOT STARTED
assign-private-ip-addresses	—	--network-interface-id, --private-ip-addresses or --secondary-private-ip-address-count	ENI must exist	NATS ec2.AssignPrivateIpAddresses → daemon allocates IPs from subnet pool → assign to ENI → return assigned IPs	1. Assign specific IPs 2. Assign by count 3. Cannot specify both (error)	NOT STARTED
unassign-private-ip-addresses	—	--network-interface-id, --private-ip-addresses	IPs must be assigned to ENI	NATS ec2.UnassignPrivateIpAddresses → daemon releases IPs → return success	1. Unassign secondary IP 2. Unassign primary IP (error)	NOT STARTED

EC2 - Launch Templates

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
create-launch-template	—	--launch-template-name, --launch-template-data (ImageId, InstanceType, etc.), --tag-specifications	None	NATS ec2.CreateLaunchTemplate → daemon stores template in JetStream KV with lt-ID → version 1 → return template metadata	1. Create template with full config 2. Duplicate name (error) 3. Verify in describe output	NOT STARTED
create-launch-template-version	—	--launch-template-id or --launch-template-name, --launch-template-data, --source-version	Template must exist	NATS ec2.CreateLaunchTemplateVersion → daemon creates new version in KV → return version details	1. Create version from scratch 2. Create version from source version 3. Template not found (error)	NOT STARTED
delete-launch-template	—	--launch-template-id or --launch-template-name, --dry-run	Template must exist	NATS ec2.DeleteLaunchTemplate → daemon deletes template and all versions from KV → return deleted template info	1. Delete by ID 2. Delete by name 3. Non-existent template (error)	NOT STARTED
describe-launch-templates	—	--launch-template-ids, --launch-template-names, --filters	None	NATS ec2.DescribeLaunchTemplates → daemon lists templates from KV → return list	1. List all templates 2. Filter by name 3. Filter by ID	NOT STARTED
describe-launch-template-versions	—	--launch-template-id or --launch-template-name, --versions, --min-version, --max-version	Template must exist	NATS ec2.DescribeLaunchTemplateVersions → daemon lists versions from KV → return version list with data	1. List all versions 2. List specific version 3. Template not found (error)	NOT STARTED

EC2 - Misc Operations

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
delete-network-interface-permission	—	--network-interface-permission-id, --force	Permission must exist	NATS ec2.DeleteNetworkInterfacePermission → daemon deletes permission from KV → return success	1. Delete existing permission 2. Force delete	NOT STARTED
enable-address-transfer	—	--allocation-id, --transfer-account-id	EIP must exist	NATS ec2.EnableAddressTransfer → daemon stores transfer in JetStream KV with 7-day expiration → return AllocationId and TransferAccountId	1. Enable transfer 2. Verify transfer stored with expiration	NOT STARTED
disable-address-transfer	—	--allocation-id	Transfer must exist	NATS ec2.DisableAddressTransfer → daemon updates transfer status to disabled in KV → return status	1. Disable active transfer 2. Disable non-existent transfer (error)	NOT STARTED

EBS Direct API

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
start-snapshot	—	--volume-size, --parent-snapshot-id, --description, --encrypted	None	Initialize snapshot in viperblock → return snap-ID for block-level writes	1. Start new snapshot 2. Start incremental from parent	NOT STARTED
put-snapshot-block	—	--snapshot-id, --block-index, --block-data, --checksum	start-snapshot	Write block data to snapshot at specified index in viperblock → verify checksum	1. Write single block 2. Write with bad checksum (error)	NOT STARTED
get-snapshot-block	—	--snapshot-id, --block-index	Snapshot must exist	Read block data from snapshot at specified index → return data with checksum	1. Read existing block 2. Read sparse block (zeros)	NOT STARTED
complete-snapshot	—	--snapshot-id, --changed-blocks-count	start-snapshot, put-snapshot-block	Finalize snapshot → mark as completed → sync to Predastore	1. Complete valid snapshot 2. Complete with wrong block count (error)	NOT STARTED
list-snapshot-blocks	—	--snapshot-id, --max-results, --next-token	Snapshot must exist	List all non-empty blocks in snapshot with tokens and sizes	1. List blocks of populated snapshot 2. List blocks of empty snapshot	NOT STARTED
list-changed-blocks	—	--second-snapshot-id, --first-snapshot-id, --max-results	Snapshots must exist	Compare two snapshots → return list of differing block indexes	1. Compare parent and child snapshots 2. Compare unrelated snapshots	NOT STARTED

S3 (via Predastore)

Currently S3 operations are handled directly by Predastore. Consider moving control/data plane to Hive format for AWS gateway integration.

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
s3 mb (CreateBucket)	—	s3://bucket-name	None	NATS s3.createbucket → Predastore creates bucket → return success	1. Create valid bucket 2. Duplicate bucket name (error) 3. Invalid bucket name (error)	NOT STARTED (Predastore handles directly)
s3 rb (DeleteBucket)	—	s3://bucket-name, --force	Bucket must exist	NATS s3.deletebucket → verify bucket empty (or force) → Predastore deletes bucket	1. Delete empty bucket 2. Delete non-empty bucket (error) 3. Force delete non-empty bucket	NOT STARTED
s3 ls (ListBuckets/Objects)	—	s3://bucket/prefix, --recursive	None	NATS s3.listobjects → Predastore lists objects with prefix → return list	1. List all buckets 2. List objects in bucket 3. List with prefix filter	NOT STARTED
s3 cp (PutObject/GetObject)	—	source dest, --recursive, --acl	Bucket must exist	NATS s3.putobject/s3.getobject → Predastore stores/retrieves with Reed-Solomon encoding	1. Upload single file 2. Download single file 3. Recursive upload/download 4. Large file (multipart)	NOT STARTED
s3 rm (DeleteObject)	—	s3://bucket/key, --recursive	Object must exist	NATS s3.deleteobject → Predastore deletes object shards	1. Delete single object 2. Recursive delete 3. Delete non-existent (idempotent)	NOT STARTED
s3 sync	—	source dest, --delete, --exclude, --include	Bucket must exist	Compare source and dest → upload changed/new files → optionally delete removed files	1. Sync local dir to S3 2. Sync with --delete 3. Sync with exclude filter	NOT STARTED

IAM

Command	Implemented Flags	Missing Flags	Prerequisites	Basic Logic	Test Cases	Status
create-user	—	--user-name, --path, --tags	None	Store user in JetStream KV → generate AIDA-prefixed UserId → return User with ARN	1. Create user 2. Duplicate name (EntityAlreadyExists) 3. Missing username (error)	NOT STARTED
get-user	—	--user-name	User must exist	Read user from JetStream KV → return User details	1. Get existing user 2. Get non-existent user (NoSuchEntity)	NOT STARTED
list-users	—	--path-prefix, --max-items, --marker	None	List users from JetStream KV → return user list	1. List all users 2. List with path prefix 3. Empty list	NOT STARTED
delete-user	—	--user-name	User must exist, no access keys/policies	Remove user from JetStream KV → return success	1. Delete user with no keys 2. Delete user with keys (error) 3. Delete non-existent (NoSuchEntity)	NOT STARTED
create-access-key	—	--user-name	User must exist	Generate access key ID (AKIA prefix) and secret → store in JetStream KV → return credentials	1. Create key for user 2. Max keys exceeded (error)	NOT STARTED (gateway stub exists)
delete-access-key	—	--access-key-id, --user-name	Key must exist	Remove access key from JetStream KV → return success	1. Delete existing key 2. Delete non-existent key (error)	NOT STARTED
list-access-keys	—	--user-name, --max-items	None	Query JetStream KV for user's access keys → return list	1. List keys for user 2. No keys returns empty	NOT STARTED
create-policy	—	--policy-name, --policy-document, --path, --description, --tags	None	Validate JSON policy document → store in JetStream KV → generate policy ARN → return Policy	1. Create with valid document 2. Invalid JSON (error) 3. Duplicate name (EntityAlreadyExists)	NOT STARTED
delete-policy	—	--policy-arn	Policy must exist, not attached to any user	Remove policy from JetStream KV → return success	1. Delete unattached policy 2. Delete attached policy (error)	NOT STARTED
attach-user-policy	—	--user-name, --policy-arn	User and policy must exist	Link policy to user in JetStream KV → return success	1. Attach policy 2. Already attached (idempotent) 3. Non-existent user (NoSuchEntity)	NOT STARTED
detach-user-policy	—	--user-name, --policy-arn	User and policy must exist, policy attached	Unlink policy from user in JetStream KV → return success	1. Detach attached policy 2. Not attached (error)	NOT STARTED
list-attached-user-policies	—	--user-name, --path-prefix, --max-items	User must exist	List policies attached to user from JetStream KV → return policy list	1. List attached policies 2. No policies returns empty	NOT STARTED