mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-15 17:11:30 +00:00
joshsiv-mulga
8db9771fbf
The codec defines how the canonical persisted instance record evolves, with its assignment and observation sections, which is EC2 instance ownership rather than node-local VM supervision. It moves unchanged into its own package and keeps wrapping the legacy vm.InstanceRecord alias and its spec and status types, which stay in runtime/compute/vm for now. The domain-to-runtime import is recorded as new dependency-rule debt with its removal condition and allow-listed against that entry. The instance-state ratchet now names the new file as an owner file; its allowlist is unchanged.
157 KiB
157 KiB
Package-boundary migration record
Status: Active implementation record. Decision: Mulga ADR-0001 — Spinifex Package Boundary and Layout. Scope: Spinifex source layout only. This record does not establish a new architecture decision, expand a customer-facing interface, or claim that the current implementation conforms to the target layout.
Purpose
This document records the implementation sequence for ADR-0001 in this repository. The ADR owns the target layout and dependency rules; this record captures the source-level entry-point inventory and the evidence needed for each narrow structural slice.
The migration proceeds on one long-lived refactor branch. Each commit remains small, independently buildable and reviewable; that does not require one pull request per package move.
Baseline
The inventory below was taken from Spinifex commit
ecef5e4d2f793b4cf2c96d0a43d0a1ab37be3eed, the revision pinned by Mulga when
ADR-0001 was accepted. It records ownership standing, not a promise that a
binary or script is AWS-compatible or supported beyond its documented scope.
Entry-point and automation inventory
Product operator and delivery entry points
| Current path | Standing | Target ownership | Migration rule |
|---|---|---|---|
cmd/spinifex (spx) |
Supported operator process | Thin main; command assembly in spinifex/operator/cli and individual supported use cases in spinifex/operator/* |
Preserve binary and supported command compatibility. The CLI must reach a domain through an explicit capability, never its private state. |
cmd/installer |
Delivery executable | Thin main; interactive, unattended and host-installation work in spinifex/operator/installer |
Preserve installation behaviour while separating executable startup from delivery logic. It is not, merely by existing, the permanent administration interface. |
cmd/spinifex/cmd and cmd/installer/* have since moved: commits 05f390e61
and 918150758 below separate each executable's startup from its command and
installation logic, landing them in spinifex/operator/cli and
spinifex/operator/installer/<same>.
Guest and named-role entry points
| Current path | Standing | Target ownership | Evidence of role boundary |
|---|---|---|---|
cmd/ecs-agent |
ECS guest agent | Thin main; spinifex/agents/ecs/agent |
Baked into ECS node images; communicates with the control plane through the AWS gateway, not NATS. |
cmd/rds-agent |
RDS guest agent | Thin main; spinifex/agents/rds/agent |
Runs in an RDS guest, handles bootstrap and engine directives through the gateway. |
cmd/lb-agent |
ELBv2 guest agent | Thin main; spinifex/agents/elbv2 |
Included in the load-balancer microVM and controls its local data plane. |
cmd/eks-token-webhook |
EKS control-plane guest role | Thin main; spinifex/agents/eks/tokenwebhook |
Baked into the EKS node image as the Kubernetes TokenReview webhook. |
cmd/eks-gateway-fetch |
EKS control-plane guest helper | Thin main; spinifex/agents/eks/gatewayfetch |
Fetches recovery and addon state through the AWS gateway. |
cmd/eks-gateway-publish |
EKS control-plane guest helper | Thin main; spinifex/agents/eks/gatewaypublish |
Relays bootstrap and state reports through the AWS gateway. |
cmd/eks-webhook-cert |
EKS image-resident certificate helper | Thin main; spinifex/agents/eks/webhookcert |
Invoked by EKS image scripts to create/reuse webhook serving certificates. |
cmd/eks-konnectivity-cert |
EKS image-resident certificate helper | Thin main; spinifex/agents/eks/konnectivitycert |
Invoked by EKS image scripts to create/reuse Konnectivity serving certificates. |
cmd/ecr-credential-provider |
EKS node integration | Thin main; spinifex/agents/eks/credentialprovider |
Kubelet exec credential provider baked into EKS images; it is not ECR control-plane ownership. |
No common agent package is introduced by this inventory. Shared mechanisms are considered only when the existing role and least-privilege boundaries remain intact; ADR-0001 explicitly defers that design.
Development and qualification entry points
| Current path | Standing | Target ownership | Rule |
|---|---|---|---|
cmd/aws-model-coverage |
Qualification generator | Thin main; reusable code in internal/tooling |
Produces the dispatch-versus-model inventory; never imported by product packages. |
cmd/dhcptest |
Development diagnostic | Thin main; reusable code in internal/tooling if extraction is useful |
It is a DHCP probe, not a supported spx admin command. |
cmd/spx-loadgen |
Qualification/load tool | Thin main; reusable code in internal/testkit |
It drives test load and is not shipped to nodes. |
tests/e2e/*/cmd/*, tests/bench/*/cmd/* |
Test and benchmark-private tools | Remain test-private | They are invoked by a test or benchmark harness, not a product process. |
docs/terraform-workbooks/demo-app/main.go |
Demonstration workload | Remain with the workbook | It is neither a Spinifex executable nor a product package. |
Automation standing
| Path class | Standing | Rule during migration |
|---|---|---|
.github/scripts/ |
CI-private qualification automation | Keep at the module root; the invoking workflow owns the evidence scope. |
build/, images/, scripts/images/, image build and publish scripts |
Delivery and guest-image inputs | Keep at the module root. In-guest helpers stay with their image; do not relocate shell sources into Go packages. |
scripts/setup.sh, setup-ovn.sh, install-node.sh, node-reset.sh, uninstall-spx.sh |
Transitional delivery and documented host-operation mechanics | Keep at the module root. They may implement a published procedure but are not an enduring public administration API solely because they are installed on a node. |
scripts/dev-env/, scripts/demo/, benchmarks, diagnostics and Terraform experiments |
Development or exploratory automation | Keep at the module root; they are not customer-facing contracts. |
scripts/check-coverage.sh, diff-coverage.sh, run-gate.sh, sync-aws-models.sh and test harness scripts |
Repository and qualification automation | Keep at the module root; their caller defines the contract and evidence. |
First source move — ARN
The first source move is the cohesive ARN leaf package:
- old import path:
github.com/mulgadc/spinifex/spinifex/arn - target import path:
github.com/mulgadc/spinifex/spinifex/foundation/aws/arn
Source commit 91ac70e29 moves the ten package files and updates all forty-four
Go importers. It changes no behaviour and leaves no forwarding package.
Verification passed with an isolated Go module/build cache:
go test ./spinifex/foundation/aws/arngo testfor the fourteen packages directly importing ARN- a Go-source search for the old import path returned no matches
git diff --check
The inventory was intentionally committed before this move so a later thin-main refactor cannot silently choose an owner by convenience.
Second source move — AWS filters
The second source move removes the generic filterutil location and name:
- old import path:
github.com/mulgadc/spinifex/spinifex/filterutil - target import path:
github.com/mulgadc/spinifex/spinifex/foundation/aws/filters
Source commit e707be942 moves the two package files, renames the Go package
to filters, and updates twenty-eight importing files. Callers use the
explicit import alias awsfilters: many filter implementations already hold
a local filters value, and the alias prevents a package-name collision
without changing that local state or any filter behaviour.
Verification passed with an isolated Go module/build cache:
go test ./spinifex/foundation/aws/filtersgo testfor the seventeen direct caller packages- a Go-source search for the old import path returned no matches
git diff --check
Third source move — AWS Query parser
The third source move names the protocol concern rather than the first service that happened to use it:
- old import path:
github.com/mulgadc/spinifex/spinifex/awsec2query - target import path:
github.com/mulgadc/spinifex/spinifex/ingress/aws/query
Source commit caaf98d9e moves the two parser files, renames the Go package to
query, and updates thirteen importing files. The parser is used across EC2,
IAM, STS, ECS, ECR, ELBv2 and RDS, but owns only AWS Query wire decoding and no
service action or resource semantics.
Verification passed with an isolated Go module/build cache:
go test ./spinifex/ingress/aws/querygo test -run '^$'for six direct caller packages- a Go-source search for the old import path returned no matches
git diff --check
A broad go test run over those caller packages was stopped after two minutes
without output. It is not recorded as a passing test; the normal full suite
remains CI evidence for the branch.
Subsequent source moves
The following slices follow the same rule as the first three: each is a
structural move with import rewrites, no compatibility shim, focused package
and direct-caller validation, and git diff --check. They are recorded here
while the branch is in flight; they do not describe the umbrella repository's
main until its Spinifex gitlink is updated.
| Source commit | Old path | New path | Finding or boundary recorded |
|---|---|---|---|
04b41a62c |
spinifex/idempotency |
spinifex/foundation/lifecycle/idempotency |
Generic request coalescing is lifecycle infrastructure, not a domain owner. |
25fa01a3d |
spinifex/preflight |
spinifex/bootstrap/preflight |
Startup validation is bootstrap input, not a generic service. |
681fccc61 |
spinifex/systemd |
spinifex/operator/host/systemd |
Host unit generation and reconciliation are operator-host work. |
23ca5d8aa |
spinifex/resource |
spinifex/foundation/lifecycle/resource |
Resource metadata is a generic lifecycle primitive. |
7a3c8de07 |
spinifex/nbd |
spinifex/runtime/compute/nbd |
NBD process control is node-local compute runtime. |
ea65616be |
spinifex/hostdns |
spinifex/runtime/host/dns |
Host resolver integration is runtime host work. |
d80803807 |
spinifex/qmp |
spinifex/runtime/compute/qmp |
QMP is local VM runtime control. |
41e2c1f10 |
spinifex/gpu |
spinifex/runtime/compute/gpu |
GPU discovery and attachment are local compute runtime work. |
d78246d05 |
spinifex/instancetypes |
spinifex/domains/ec2/instancetypes |
AWS-visible instance-type semantics belong to EC2. |
b2ce46124 |
spinifex/service |
spinifex/runtime/service |
The named-role catalogue is runtime composition. |
573ee6761 |
spinifex/loadgen |
internal/testkit/loadgen |
Load generation is qualification support, not product code. |
afdb6618c |
spinifex/otelsetup |
spinifex/foundation/telemetry |
Spinifex instrumentation primitives are shared telemetry foundation. |
956fe1490 |
spinifex/awserrors |
spinifex/foundation/aws/errors |
AWS error vocabulary is shared AWS foundation. |
cbbf252e6 |
spinifex/testutil |
internal/testkit |
Test doubles remain compiler-private and cannot become application dependencies. |
0c2d64413 |
spinifex/vm |
spinifex/runtime/compute/vm |
VM lifecycle is node-local compute runtime, not EC2 API ownership. |
a74adc48b |
spinifex/ebsmetadata |
spinifex/domains/ec2/ebs/metadata |
EBS API metadata remains EC2-domain state. |
94ddc91a1 |
spinifex/ebsprovider |
spinifex/providers/ebs |
The provider contract and conformance suite are replaceable storage adapters. |
3c1bce1eb |
spinifex/cloud/oci |
spinifex/providers/cloud/oci |
OCI access is a replaceable cloud-provider adapter. |
56970d079 |
spinifex/services/nats |
spinifex/runtime/roles/nats |
NATS process startup is a named runtime role. |
d87326f64 |
spinifex/network/listenerinventory |
internal/testkit/listenerinventory |
Listener inventory is test-only qualification support. |
4d4875b13 |
spinifex/services/spinifexui |
spinifex/runtime/roles/spinifexui |
The web UI is a named runtime role, not a logical AWS domain. |
f39bc64c9 |
spinifex/admin listener helpers |
spinifex/foundation/netaddr |
Listener-address parsing is a small shared network primitive. |
9e8e889fb |
spinifex/services/qemunbdd |
spinifex/runtime/roles/qemunbdd |
QEMU-NBD provider process startup is a runtime role. |
3494ae131 |
spinifex/services/qmpcollector |
spinifex/runtime/roles/qmpcollector |
QMP collection is a named runtime role. |
f64931546 |
spinifex/services/spinifex |
spinifex/runtime/roles/spinifex |
The core daemon executable role is runtime composition. |
57f238a0c |
spinifex/tags |
spinifex/foundation/aws/tags |
System-tag vocabulary is shared AWS foundation. |
7a6b00728, 186ef7ebc |
spinifex/kvutil |
spinifex/foundation/state/kvutil |
Replica policy was made explicit before moving generic KV utilities to state foundation. |
57f9d2ccc |
spinifex/kvstore |
spinifex/foundation/state/kvstore |
Generic KV storage mechanics are state foundation. |
247e52ba3 |
spinifex/reconciler |
spinifex/foundation/lifecycle/reconciler |
Generic reconciliation mechanics are lifecycle foundation. |
b1d0eba89 |
inline KV migration mechanics | spinifex/foundation/state/migrate |
KV migration is a reusable state concern. |
967f6904a |
spinifex/kvlease |
spinifex/foundation/state/kvlease |
Leases are state foundation, not a resource-domain owner. |
248f0e005, 8c4af3030 |
spinifex/formation |
spinifex/runtime/formation |
Formation owns its protocol payloads and remains runtime membership/bootstrap work. |
b8b97279c, c0c64cd53 |
spinifex/instancecache |
spinifex/runtime/compute/cache |
Cache policy is decoupled from callers before becoming node-local compute runtime. |
aa0c36ff4 |
spinifex/types/ec2.go |
contracts/ec2/v1 |
The EC2 instance-command subject and JSON payload are an explicit versioned cross-process contract; commands_test.go is its compatibility evidence. |
60c9ed47d |
spinifex/types/types.go (IGWEvent) |
contracts/ec2/v1/igw.go (InternetGatewayEvent, InternetGatewayAttachSubject, InternetGatewayDetachSubject) |
The EC2-to-network internet-gateway attach/detach projection on vpc.igw-attach/vpc.igw-detach is an explicit versioned cross-process contract; igw_test.go pins its subject and JSON shape. |
c239fd897 |
spinifex/types/eni.go |
spinifex/runtime/compute/vm/eni_requests.go |
PCIe hot-plug slot allocation is mutex-bearing, per-VM runtime state rather than a shared type or wire contract; record_test.go preserves its restart semantics. |
b49e55a58 |
spinifex/types/node.go (NodeDiscoverResponse) |
contracts/cluster/v1/discovery.go (NodeDiscoverResponse, NodesDiscoverSubject) |
Fan-out node-membership discovery on spinifex.nodes.discover is a versioned cluster control-plane contract; discovery_test.go pins its subject and JSON shape. |
6d6275e78 |
spinifex/types/cluster.go (NodeHealthResponse) |
contracts/cluster/v1/health.go |
Node health is a versioned cluster control-plane representation shared by the per-node NATS route and daemon HTTPS /health; health_test.go pins both wire forms. |
53a614717 |
spinifex/types/cluster.go (SharedClusterData) |
spinifex/daemon/config_hash.go |
Shared-config hash input is daemon-local implementation data; focused config-hash tests preserve deterministic, shared-only semantics. |
5d88a3399 |
spinifex/types/storage.go |
contracts/operator/v1/storage.go (StorageConfigResponse, StorageEncoding, StorageMetaNode, StorageBlobNode, StorageBucket) |
The spinifex.storage.config operator-plane response describing Predastore topology is a deployment-administration contract, not an AWS tenant-facing API; storage_test.go pins its subject and JSON shape. |
78fd017e0 |
spinifex/types/telemetry.go (GuestTelemetryMeta) |
contracts/telemetry/v1/guest_meta.go |
QMP collector sidecar JSON is a versioned file contract between VM runtime and telemetry role; guest_meta_test.go pins its filename and payload. |
4b35a2a33 |
spinifex/types/node.go (NodeVMsResponse, VMInfo, VMGPUInfo) |
contracts/cluster/v1/node_vms.go |
VM inventory is a versioned cluster fan-out payload used by SPX CLI and EKS host lookup; node_vms_test.go pins its subject and JSON shape. |
08bd335f0 |
spinifex/types/node.go (NodeStatusResponse, capacity and GPU inventory) |
contracts/cluster/v1/status.go |
Node status is a versioned fan-out observation contract for operator inspection and EC2/EKS scheduling consumers; status_test.go pins its subject and JSON shape. |
f4cb550c9 |
spinifex/types/ebs.go (GP3 policy constants) |
spinifex/domains/ec2/ebs/policy/gp3.go |
The supported GP3 product envelope is EC2 EBS domain policy, not generic runtime or Viperblockd wire state; gp3_test.go pins the deployed values. |
adb55de33 |
spinifex/types/ebs.go (NBDTransport) |
spinifex/services/viperblockd/nbd_transport.go |
NBD endpoint transport selection is Viperblockd-local delivery configuration, not generic EBS state or a provider contract; nbd_transport_test.go pins the socket and TCP forms. |
94a6e7af2 |
spinifex/types/ebs.go (EBSConfigUpdateRequest, EBSConfigUpdateResponse) |
contracts/viperblockd/legacy/v1/config_update.go |
Legacy configuration updates have deployed queue and volume-addressed NATS routes; the versioned compatibility contract is expressly transitional and separate from providers/ebs. |
0b82e1404 |
spinifex/types/ebs.go (EBSSyncRequest, EBSSyncResponse) |
contracts/viperblockd/legacy/v1/sync.go |
The ebs.sync queue-group route that reloads a mounted volume's state from its backend is deployed Viperblockd legacy compatibility, not generic EBS state; sync_test.go pins its subject and JSON shape. |
b975f1ba9 |
Remaining spinifex/types/ebs.go payloads |
runtime/compute/vm/ebs_requests.go and contracts/viperblockd/legacy/v1/volume.go |
The mutex-bearing attachment collection is VM-owned; deployed mount, unmount and delete routes plus their JSON payloads are versioned Viperblockd legacy compatibility. Contract tests pin every route and JSON shape. |
08d950770 |
spinifex/types/telemetry.go (MetricsEC2SubjectPrefix, TelemetrySeries) |
spinifex/runtime/roles/qmpcollector/metrics.go |
The guest-metrics subject prefix has no versioned contract yet: its eventual consumer is Goanna, so it stays collector-local runtime data pending a cross-repository contract decision rather than being promoted to contracts/. This empties and removes spinifex/types; the package no longer exists in this repository. |
61cf833aa |
spinifex/cloud/exoscale |
spinifex/providers/cloud/exoscale |
Exoscale CLI access is a replaceable external-cloud adapter. The source move rewrites its four Exonet callers and preserves its adapter tests and CLI boundary. |
dbc62562c |
spinifex/objectstore |
spinifex/providers/objectstore |
The generic S3-compatible client is a replaceable object-storage adapter, not S3 resource authority. The mechanical move rewrites all direct callers; its focused suite and caller compilation passed. |
f11922986 |
spinifex/config |
spinifex/bootstrap/config |
Root configuration parsing belongs to bootstrap. Its package API is unchanged; package tests and regular, integration, E2E and benchmark caller compilation passed. |
aa4b0b1bb |
spinifex/paging |
spinifex/foundation/aws/paging |
Opaque listing tokens, deterministic slicing and EC2 pagination validation are shared AWS protocol infrastructure rather than EC2 resource authority. The move rewrites all five EC2 callers; focused package tests, direct caller compilation and tagged integration compilation passed. |
6ac02a886 |
spinifex/clustersize |
spinifex/foundation/state/clustersize |
The declared cluster size and its fail-closed JetStream/KV replica policy are shared state-tier infrastructure, not a resource-domain owner. Focused package tests, all direct caller compilation, integration and E2E-tagged harness compilation passed. |
93084043a |
spinifex/handlers/ecr |
spinifex/domains/ecr |
ECR repository metadata, blob semantics and lifecycle rules are ECR domain ownership. The full domain suite, direct callers and tagged integration callers passed. |
51b5c55b9 |
spinifex/gateway/ecrapi |
spinifex/domains/ecr/awsapi |
AWS JSON 1.1 action inventory, validation, resource-scope derivation and NATS-backed action handlers are ECR action-adapter ownership. Focused, gateway and tagged integration validation passed. |
5e7311eb2 |
spinifex/gateway/ecr |
spinifex/domains/ecr/registry |
The OCI Distribution v2 protocol adapter is ECR data-plane ownership. Focused registry, gateway/AWS-gateway and tagged integration validation passed. |
474c07316 |
spinifex/gateway/ecrauth |
spinifex/domains/ecr/auth |
ECR token claims, issuer/verifier, encrypted signing-key persistence and rotation are ECR credential ownership. Focused, gateway/AWS-gateway and tagged integration validation passed. |
5ff0fa452 |
Gateway buildRepository, ecrRepositoryArn, ecrRegistryHost, ecrRepositoryUri (GatewayConfig methods) |
spinifex/domains/ecr/awsapi.RepositoryEndpoint (RepositoryARN, RegistryURIHost, RepositoryURI, RepositoryFromMeta) |
ECR repository ARN, registry URI and AWS response projection are ECR-domain composition state; the endpoint profile is supplied by the composition root rather than read from GatewayConfig fields. |
f59b40ad1 |
Gateway DescribeRepositories action semantics |
spinifex/domains/ecr/awsapi.DescribeRepositories |
Request validation, account scope, repository metadata lookup and AWS response projection are ECR AWS-action ownership. Gateway retains authenticated HTTP adaptation and response writing. Focused domain, gateway dispatch and tagged integration compilation passed. |
c558872e8 |
Gateway CreateRepository action semantics |
spinifex/domains/ecr/awsapi.CreateRepository |
Request decoding, input defaults and validation, duplicate detection, account-scoped metadata persistence and AWS response projection are ECR AWS-action ownership. Gateway retains authenticated HTTP adaptation and response writing. Focused domain, gateway lifecycle and tagged integration validation passed. |
a6b209b7b |
Gateway DeleteRepository action semantics |
spinifex/domains/ecr/awsapi.DeleteRepository |
Request validation, account scope, non-empty protection, forced deletion, metadata cascade and AWS response projection are ECR AWS-action ownership. Blob reclamation remains the separately documented GC concern. Focused domain, gateway lifecycle and tagged integration validation passed. |
7a5159366 |
Gateway PutImageTagMutability action |
spinifex/domains/ecr/awsapi.PutImageTagMutability |
This endpoint-free action is registered directly in the ECR action table rather than retained as a gateway wrapper. Request validation, account-scoped metadata update and AWS response construction are domain-adapter ownership; generic gateway auth and policy gating remain before dispatch. Focused domain, gateway and tagged integration validation passed. |
a2f6005d2 |
Gateway GetAuthorizationToken action response |
spinifex/domains/ecr/awsapi.GetAuthorizationToken |
Gateway retains canonical IAM/STS principal construction from authenticated context. The ECR adapter consumes a narrow token-issuer capability and owns mint-result handling, Docker AWS:<jwt> encoding and AWS response projection. Focused domain, real issuer/verifier gateway round-trip and tagged integration validation passed. |
ee4610a75 |
Gateway ListImages action semantics |
spinifex/domains/ecr/awsapi.ListImages |
The ECR AWS adapter consumes a narrow OCI image-catalog capability and owns request validation, account scope, tag-status projection and AWS response/error mapping. Gateway retains authenticated HTTP adaptation and supplies the configured registry. Focused domain, registry-backed gateway and tagged integration validation passed. |
b22b723a4 |
Gateway DescribeImages action semantics |
spinifex/domains/ecr/awsapi.DescribeImages |
The ECR AWS adapter now shares the image-catalog capability and catalog error mapping with ListImages, and owns image selection/detail projection. The accepted-but-unapplied filter field is explicitly retained as an unchanged compatibility gap. Focused domain, registry-backed gateway and tagged integration validation passed. |
deabaa300 |
Gateway BatchGetImage action semantics |
spinifex/domains/ecr/awsapi.BatchGetImage |
The ECR AWS adapter consumes a narrow manifest-reader capability and owns request validation, the 100-image cap, digest-over-tag selection and partial-failure response projection. Repository/account scope validation is now shared with ListImages and DescribeImages. Focused domain, registry-backed gateway and tagged integration validation passed. |
2542ce98e |
Gateway PutImage action semantics |
spinifex/domains/ecr/awsapi.PutImage |
The ECR AWS adapter consumes a narrow manifest-writer capability and owns request validation, tag/digest selection, AWS response projection and OCI manifest-store error translation. Gateway retains authenticated HTTP adaptation and supplies the configured registry. Focused domain, registry-backed gateway and tagged integration validation passed. |
7666ed208 |
Gateway BatchDeleteImage action semantics and residual ECR helpers |
spinifex/domains/ecr/awsapi.BatchDeleteImage, awsapi.ValidateRepositoryScope, gateway ecr_request.go |
The ECR adapter consumes a narrow image-deleter capability and owns batch deletion/partial-failure projection. Completion exposed scope validation still needed by lifecycle-preview adapters, which now calls the exported ECR adapter utility; generic HTTP JSON decoding moved to a gateway ECR adapter helper. Focused domain, image/lifecycle gateway and tagged integration validation passed. |
72c20bf78 |
Gateway lifecycle-preview evaluation and StartLifecyclePolicyPreview |
spinifex/domains/ecr/awsapi.EvaluateLifecyclePreview, StartLifecyclePolicyPreview |
Shared preview evaluation now consumes explicit policy-store and image-catalog capabilities, owns request/stored-policy resolution and lifecycle evaluation, and returns a reusable expiry set. Start preview is fully domain-owned; Get preview consumes the evaluator and retains only its response projection pending the next slice. Focused domain, lifecycle gateway and tagged integration validation passed. |
68945bbb1 |
Gateway GetLifecyclePolicyPreview response projection |
spinifex/domains/ecr/awsapi.GetLifecyclePolicyPreview |
Get preview now joins Start preview in the ECR adapter, sharing the synchronous evaluator and explicit policy-store/image-catalog capabilities. Gateway retains only authenticated HTTP/body adaptation and capability supply. Focused domain, lifecycle gateway and tagged integration validation passed. |
4c9f3d681 |
Gateway ECR image-action wrappers and residual JSON adapter | spinifex/domains/ecr/awsapi.RegistryActionService |
ListImages, DescribeImages, BatchGetImage, PutImage and BatchDeleteImage now dispatch through one composed registry-action capability after the generic gateway's authentication and policy gate. The composition root supplies narrow OCI capabilities; the operation inventory derives their implemented status from that capability. The obsolete gateway wrappers and JSON helper are removed. Focused domain, gateway, AWS-gateway and tagged integration validation passed. |
40e7b14ad |
Gateway lifecycle-preview wrappers | spinifex/domains/ecr/awsapi.LifecyclePreviewActionService |
StartLifecyclePolicyPreview and GetLifecyclePolicyPreview now dispatch through one composed policy-store-plus-image-catalog capability after generic authorization. Production reuses the registry's NATS metadata client; focused tests compose an in-memory metadata store. The obsolete wrappers are removed, and a missing composition fails closed rather than falling through to the raw action table. Focused domain, gateway, AWS-gateway and tagged integration validation passed. |
54f96ad78 |
Gateway CreateRepository, DescribeRepositories and DeleteRepository wrappers | spinifex/domains/ecr/awsapi.RepositoryActionService |
Repository actions now dispatch through one composed metadata-store-plus-endpoint-profile capability after generic authorization. The individual action adapters depend on a narrow repository metadata contract rather than constructing NATS clients themselves. The three obsolete wrappers are removed, and a missing composition fails closed. Focused domain, gateway, AWS-gateway and tagged integration validation passed. |
5ebbdcb53 |
Gateway GetAuthorizationToken wrapper and endpoint adapter | spinifex/domains/ecr/awsapi.AuthorizationTokenActionService |
GetAuthorizationToken now dispatches through a composed issuer-plus-endpoint capability after gateway constructs the canonical IAM/STS principal. The token subject remains gateway identity work; ECR retains credential response projection. The obsolete wrapper and endpoint adapter are removed, a missing action service fails closed, and an unavailable issuer retains the declared NotImplemented response. Focused domain, gateway, AWS-gateway and tagged integration validation passed. |
2b945ad88 |
spinifex/handlers/acm, spinifex/gateway/acm |
spinifex/domains/acm, spinifex/domains/acm/awsapi |
ACM certificate state, issuance and renewal are ACM-domain ownership; its AWS JSON/NATS request adapters live beside them. All nine adapters, including the previously inlined RequestCertificate path, now use domains/acm/awsapi; generic gateway retains only routing, request context, policy gating and response writing. Focused domain, adapter and gateway request tests plus direct-caller and tagged integration compilation passed. |
47c6b2fcf |
spinifex/gateway/bodyscope |
spinifex/ingress/aws/bodyscope |
Case-aware, ambiguity-safe extraction of AWS JSON request identifiers is ingress policy machinery, not generic gateway ownership. Focused parser tests and compilation of all six direct service-policy consumers passed. |
d3cd6d520 |
spinifex/gateway/policy |
spinifex/foundation/aws/policy |
AWS wire-service to IAM action-name mapping is protocol-neutral AWS vocabulary. Its focused suite and direct gateway/RDS/integration caller compilation passed. |
be7f0b1d0 |
spinifex/utils/platform |
spinifex/domains/ec2/platform |
EC2 Platform and UsageOperation derivation is EC2 compatibility vocabulary, not a generic helper. Focused package and metadata-default tests, plus direct daemon/image/instance caller compilation, passed. |
e2ac3dbed |
spinifex/utils/command |
spinifex/runtime/host/command |
Bounded host-command execution is node-local runtime machinery. Focused command and host-DNS tests plus the direct SPX CLI caller compilation passed. |
3360382f5 |
spinifex/utils/idempotency |
spinifex/foundation/lifecycle/idempotency |
Retry-token HTTP/NATS vocabulary now lives beside the idempotency store. Focused propagation and EIP retry behavior tests, affected package compilation and tagged integration compilation passed. |
b5bc8cd7d |
spinifex/utils/images (SelectNewestImage) |
spinifex/foundation/aws/ami |
Selecting the newest EC2 image from AWS SDK models is shared AWS-model logic used by EKS, ECS, RDS and Bedrock, not operator catalogue ownership. Focused selector and remaining catalogue tests plus all four direct caller compilations passed. |
9f83f899a |
spinifex/utils (ClientIP, RequestClientIP) |
spinifex/ingress/http |
HTTP remote-address parsing and loopback-trusted X-Real-IP handling are generic ingress policy shared by the AWS gateway and UI proxy. The moved test suite and all direct caller compilations passed. |
693109950 |
spinifex/utils (HashMAC) |
spinifex/network/identifiers |
Deterministic locally-administered MAC derivation is network infrastructure shared by ENIs, DHCP, OVN topology, IMDS and VM tap setup. Focused MAC tests and every direct caller compilation passed. |
79cf93996 |
spinifex/utils (DistinctIDs) |
spinifex/foundation/aws/identifiers |
Request-order-preserving normalization of AWS resource-ID lists is shared API-model handling used by image and snapshot enumeration. Focused tests and both direct caller compilations passed. |
7e29f2640 |
spinifex/utils (download and terminal-progress helpers) |
spinifex/operator/progress |
Operator-facing downloads, terminal progress rendering and byte display are CLI presentation concerns. Focused tests and the spx admin compilation passed. |
56471479f |
spinifex/utils (ValidateKeyPairName) |
spinifex/handlers/ec2/key |
EC2 key-pair-name validation has one production owner and is now private to it. Its moved unit matrix and full key-handler suite passed. |
cf531cd73 |
spinifex/utils (QMP telemetry filename convention) |
contracts/telemetry/v1 |
The telemetry QMP prefix and metadata path are part of the existing VM-runtime-to-collector file contract. The contract test, focused VM telemetry tests, collector suite and caller compilations passed; the broader VM suite is sandbox-blocked by unrelated socket setup. |
83615f1f4 |
spinifex/utils (AWS XML response helpers) |
spinifex/foundation/aws/xml |
EC2 XML response normalization/enveloping and IAM-style Query envelopes are shared AWS protocol mechanics. Focused XML tests and all direct caller compilations passed; the RDS-agent package was compile-checked without execution because its FIPS bootstrap requires a FIPS-enabled runtime. |
9896834b2 |
spinifex/utils (ExtractTags, MapToEC2Tags) |
spinifex/foundation/aws/tags |
Generic EC2 tag-specification extraction and API-model projection join the AWS tag foundation; KV tag mirroring remains separate state-layer work. Focused tag tests and direct caller compilations passed; the volume package was compile-checked without execution because its test main opens a sandbox-blocked TCP listener. |
d8985c287 |
spinifex/utils (AccountKey) |
spinifex/foundation/state/kvutil |
Account-scoped durable-key construction belongs to the state foundation; its {accountID}.{resourceID} layout is unchanged. AWS account policy (GlobalAccountID, IsAccountID) remains separate legacy utility work. Focused key and tag-mirror tests plus every direct resource-caller compilation passed. |
e6794d87d |
spinifex/utils (SudoCommand, NeedsPrivilege, EndpointSysctlHelper) |
spinifex/runtime/host/command |
Host-command privilege escalation is node-local runtime machinery and now sits beside bounded command execution. The RG-10 invariant restricting direct sudo construction to this package and network/host/run.go moves with it. Focused privilege, preflight, network-host, host-DNS and vpcd tests, every direct caller compilation and tagged integration/E2E compilation passed. |
fd6c12f14 |
spinifex/utils (PID files, runtime directory, socket waits, process signalling and OOM score) |
spinifex/runtime/host/process |
Node-local process supervision shared by the daemon, VM runtime, Viperblockd and every named role is runtime host machinery. The remaining NBD endpoint helpers temporarily import it until they move to compute runtime. The shipped Viperblock unit comment still names utils.KillProcess; it is left unchanged so a structural move does not alter a delivered unit. Full preflight (excluding the pre-existing containerd advisory), focused caller suites and tagged integration/E2E compilation passed. |
e712c6a7f |
spinifex/utils (NBD socket paths, URI format/parse, readiness wait) |
spinifex/runtime/compute/nbd |
NBD endpoint naming and readiness join the node-local NBD runtime, removing the interim utils to runtime-host edge. The EBS provider conformance suite now imports compute runtime for the URI format; if a versioned EBS wire contract is introduced, that format is a candidate for contracts/ebs/v1. Full preflight (excluding the pre-existing containerd advisory), focused NBD, VM, Viperblockd, QEMU-NBD, EBS-provider and admin suites, and tagged integration/E2E compilation passed. |
366e2c2e4 |
spinifex/utils (image catalogue, checksum verification, disk-image extraction) |
spinifex/operator/imagecatalog |
The published image catalogue and its download verification serve only spx admin image import, an operator use case. The package is named imagecatalog because the command tree already uses images as a local identifier. Moved tests reach repository fixtures one directory deeper; script and documentation pointers to the catalogue file were updated. Full preflight (excluding the pre-existing containerd advisory), focused catalogue and CLI suites, and tagged integration/E2E (including GPU) compilation passed. |
53f13f213 |
spinifex/utils (GenerateResourceID) |
spinifex/foundation/aws/identifiers |
AWS-style {prefix}-{17 hex} resource-ID generation joins the AWS identifier foundation beside request-ID normalisation; callers use the established awsidentifiers alias, which also avoids the network-identifier package name. Format and CSPRNG failure handling are unchanged. Full preflight (excluding the pre-existing containerd advisory), focused tests and tagged integration/E2E compilation passed. |
eab631b42 |
spinifex/services/predastore |
spinifex/runtime/roles/predastore |
Predastore process configuration and startup are a named runtime role; the package holds no S3 resource semantics. The service manifest path moved with it. Full preflight (excluding the pre-existing containerd advisory), focused role, role-catalogue and CLI suites, and tagged integration/E2E compilation passed. Commit 796fb52d4 separately corrects the manifest's stale handlers/acm path left by the ACM relocation; manifest-check now passes. |
ad6a158f8 |
spinifex/services/northstar |
spinifex/runtime/roles/northstar |
Northstar process startup and reload are a named runtime role. BootstrapBaseZone moved with it unchanged but is DNS control-plane work (it imports handlers/dns); it belongs to domains/dns when that domain moves, so the role is not yet thin. Full preflight (excluding the pre-existing containerd advisory), focused role, role-catalogue and CLI suites, manifest-check and tagged integration/E2E compilation passed. |
931d86d5c |
spinifex/services/awsgw |
spinifex/runtime/roles/awsgw |
The AWS gateway process is a named runtime role and its composition root wires every domain, which runtime may do. The quota reconcile loop (runQuotaReconcile, quotaKeyFor) moved with it unchanged but belongs to domains/admission/quota, and the EKS token-verify responder belongs with STS or EKS identity; both are recorded residuals, so the role is not yet thin. Service-interface manifest, design doc and architecture diagram paths were updated. Full preflight (excluding the pre-existing containerd advisory), focused role, role-catalogue and CLI suites, manifest-check and tagged integration/E2E compilation passed. |
745338563 |
spinifex/utils (GenerateErrorPayload, GenerateErrorPayloadWithMessage, ValidateErrorPayload, UnmarshalJsonPayload) |
spinifex/foundation/aws/errors |
The JSON error envelope every domain exchanges over NATS carries the shared AWS error vocabulary, so it sits beside the codes it encodes rather than in a per-domain contract. Behaviour is unchanged. Full preflight (excluding the pre-existing containerd advisory), focused error and caller suites and tagged integration/E2E compilation passed. |
02e0dd0dc |
spinifex/utils (GlobalAccountID, IsAccountID) |
spinifex/foundation/aws/identifiers |
The 12-digit account ID check and the system account ID constant are AWS identifier vocabulary and sit beside resource ID generation; no account policy changed. Full preflight (excluding the pre-existing containerd advisory), focused identifier and caller suites and tagged integration/E2E compilation passed. |
b5806ce63 |
spinifex/utils (NATS connect/retry, request/serve, gather, headers, PublishEvent, trace propagation) |
spinifex/foundation/messaging/nats (package natsmsg) |
Generic NATS transport primitives are shared machinery with no resource owner; the package name avoids colliding with nats.go at every caller. The OTel instrumentation scope keeps its spinifex/utils value so existing APM queries still match. vpcd's request/ack protocol (RequestEvent, AddNAT, PublishNATEvent) stays in utils/vpcd_event.go for a future network contract, and SubjectEnsureDefaultVpc stays in utils/ec2_subject.go for an EC2 contract; both were split out byte-identical. Full preflight (excluding the pre-existing containerd advisory), focused transport and caller suites and tagged integration/E2E compilation passed. |
cabe0e99b |
spinifex/handlers/sysinstance |
spinifex/domains/ec2/systeminstance |
System-instance launch is compute ownership; managed services (ELBv2, EKS, RDS, Bedrock) consume the launcher contract. The package was renamed to its directory; runtime sysinstance: error strings are unchanged. Managed-service parent metadata is still only the ManagedBy tag value, short of the explicit parent metadata the ADR names. Full preflight (excluding the pre-existing containerd advisory), focused daemon and managed-service suites and tagged integration/E2E compilation passed. |
4d86296eb |
spinifex/handlers/systemvpc |
spinifex/domains/network/systemvpc |
Managed system-VPC realisation is network ownership; ELBv2, EKS, RDS and Bedrock consume its builder. The package was renamed from handlers_systemvpc to its directory and callers dropped the alias; it depends only on foundation packages. Full preflight (excluding the pre-existing containerd advisory), focused system-VPC, daemon and managed-service suites and tagged integration/E2E compilation passed. |
09de514ef |
spinifex/handlers/imds |
spinifex/domains/ec2/guestmetadata |
Guest metadata is a compute-domain interface served to guests on each node. The package was renamed from handlers_imds to its directory and its vpcd and E2E callers dropped the alias; five path comments were updated. The move exposes dependency-rule breaks it does not repair: imports of the DNS, EC2 instance, EC2 key, IAM and STS implementations, and the first domain-to-runtime edge (runtime/compute/vm); see Guest metadata relocation residuals. Full preflight (excluding the pre-existing containerd advisory), focused guest-metadata, vpcd and DNS suites and tagged integration/E2E compilation passed. |
99278d5ff |
spinifex/handlers/dns |
spinifex/domains/dns |
DNS control semantics (zone records, resolver and name policy) are DNS-domain ownership, distinct from OVN and host-network realisation. The package name was already dns, so callers dropped the handlers_dns alias; the multinode E2E test that also imports miekg/dns uses dnsdomain. Six path comments were updated. The move exposes imports of runtime/compute/vm, network/reconcile and bootstrap/config, recorded in the dependency-rule debt. The integration,segscanoracle build fails identically on origin/dev (predastoreS3Client is in package integration but called from integration_test) and was not touched. Full preflight (excluding the pre-existing containerd advisory), focused DNS, ACM, guest-metadata, daemon, northstar, admin and CLI suites, manifest-check and tagged integration, E2E and E2E bench compilation passed. |
06b1eefd9 |
spinifex/runtime/roles/northstar (BootstrapBaseZone) |
spinifex/domains/dns |
Seeding the base zone and its NS topology is DNS control-plane work, so it joins the DNS domain and the northstar role is left with process startup and reload only. Its tests moved with it and reuse the DNS package's identical fakeS3 helper. The daemon flakes seen during verification (TestRestoreInstances_ClusterRecordWinsForSharedInstance under load; TestKVIPSecBarrier_* and TestDrainVolumeRecordsItsPointAfterTheWork under -count=3) reproduce identically on origin/dev. Full preflight (excluding the pre-existing containerd advisory), focused DNS, northstar and CLI suites and tagged integration/E2E compilation passed. |
8ca318070 |
spinifex/admin (SystemAccountID) |
spinifex/foundation/aws/identifiers (GlobalAccountID) |
SystemAccountID() duplicated the existing GlobalAccountID constant (000000000000), so its callers now use the constant and the function and its test are deleted rather than moved. DefaultAccountID and DefaultAccountName are Mulga bootstrap identity policy, not AWS identifier syntax, and stay in admin for a later IAM/account bootstrap slice. Full preflight (excluding the pre-existing containerd advisory), focused admin, account-teardown, EKS, CLI and identifier suites and tagged integration/E2E compilation passed. |
930040875 |
spinifex/admin (LoadCAKeyPair) |
spinifex/foundation/pki |
Loading a PEM certificate and PKCS8 RSA key is a generic primitive; the new package imports no Spinifex package and holds no certificate identity or file layout. GenerateCACert and GenerateSignedCert stay in admin because they embed Spinifex certificate identity and validity policy. Full preflight (excluding the pre-existing containerd advisory), focused admin and RDS suites and tagged integration/E2E compilation passed. |
001aa2d42 |
spinifex/admin (TenantCACertPath, TenantCAKeyPath) |
spinifex/domains/acm |
The tenant private CA's on-disk layout belongs to ACM, beside LoadTenantCA and LoadOrCreateTenantCA, which consume it; the daemon and the spx admin acm command now call the ACM domain. Full preflight (excluding the pre-existing containerd advisory), focused ACM, admin, daemon and CLI suites and tagged integration/E2E compilation passed. |
454defb00 |
spinifex/admin (IPsec certificate paths, peer issuance, strongSwan CA install and reread) |
spinifex/network/host |
IPsec peer credentials belong with the host IPsec owner that consumes them; network/host no longer imports admin. Peer keys use their own ipsecCertKeyBits seam (4096, lowered in tests) instead of admin's certKeyBits, a deliberate duplicate of the key-size policy. The moved test now builds its throwaway CA locally instead of calling admin's GenerateCACert. Full preflight (excluding the pre-existing containerd advisory), the four moved tests, focused network-host, admin and CLI suites and tagged integration/E2E compilation passed. |
2c467988d |
spinifex/handlers/bedrock |
spinifex/domains/ochre |
Ochre is the platform service and owns model serving placement, launch, readiness, capacity and reaping; the Bedrock name now marks only the AWS API surface, per the amended ADR-0001 map row. Package renamed from handlers_bedrock to ochre, callers drop the alias, and KV bucket names, NATS subjects, metric names and error strings keep their bedrock names. The comment in the shipped bedrock-serve image script still names the old path because editing it changes image build input. Full preflight apart from the known govulncheck finding, focused Ochre, vector, Bedrock gateway, daemon, account teardown, awsgw, config and CLI tests, and tagged integration/E2E compilation passed. |
93f101c0f |
spinifex/handlers/ochrevector |
spinifex/domains/ochre/vector |
The tenant vector store (pgvector backend, KV index registry, ingest, jobs, backup and appliance orchestration) is Ochre domain state and now sits under the Ochre domain as the ADR-0001 map requires. Package renamed from handlers_ochrevector to vector with its existing package comment; callers use the ochrevector alias because vector is a common local identifier in the gateway, daemon and CLI. Error strings keep their ochrevector: prefix. The service-interface manifest names the new path. Full preflight apart from the known vulnerability-scan finding, focused Ochre, gateway, daemon, awsgw and CLI tests, tagged integration/E2E compilation and the manifest check passed. |
2b6131e21 |
spinifex/gateway/bedrock/hfhub |
spinifex/domains/ochre/hfhub |
The Hugging Face Hub client resolves and streams model weights for Ochre and has no dependency on the rest of gateway/bedrock; its only caller is spx admin ochre weights pull. Package name unchanged. The rest of gateway/bedrock is not moved: it holds Ochre domain state, stores and the inference engine alongside the Bedrock action layer, and domains/ochre imports it, so moving it to domains/ochre/awsapi would invert the domain-to-adapter direction. It is recorded as dependency-rule debt. Full preflight apart from the known vulnerability-scan finding, focused hfhub and CLI tests, and tagged integration/E2E compilation passed. |
40964815b |
spinifex/utils (MergeTagsMut, ApplyTagRemovals, RemoveTagsMut, UpdateKVRecordTags, MirrorKVRecordTags) |
spinifex/domains/ec2/tagmirror |
EC2-wide AWS tag mutation over resource KV records is EC2 domain behaviour and imports only foundation packages. The EC2 tags resource package was not used because it imports the instance, key and VPC resources that call these helpers, which would create a resource-to-resource cycle. Twelve EC2 resource packages now call tagmirror; a stale utils.ParseNBDURI comment in the VM device code now names nbd.ParseNBDURI. Full preflight apart from the known vulnerability-scan finding, focused EC2, utils and VM tests, and tagged integration/E2E compilation passed. |
7003168bc |
spinifex/network/* (all 15 packages) |
spinifex/domains/network/* |
Network control, policy, topology, OVN, external and host realisation are network-domain ownership. The packages move as one enclosing move because the L0–L5 invariants classify layers by trimming a single networkRoot prefix; a partial move would silently drop moved packages out of S1. Package names, layer assignments, reconciliation authority and the vpcd boundary are unchanged. Invariant scan roots, the RG-10 sudo allow-list path, .github/CODEOWNERS and the IMDS netns unit test's repo-root walk follow the new path. Injected host→topology and L3 CreateLogicalSwitch violations failed S1 and S5 at the new paths, confirming the invariants still scan the moved packages; domains/network/systemvpc now also falls inside the host-containment and NAT-mode scans and passes them. Full preflight apart from the known vulnerability-scan finding, focused network, invariant, host-command and vpcd suites, setup-ovn_test.sh, manifest-check and tagged integration/E2E compilation passed. |
d8ab4017a |
spinifex/handlers/ec2/{account,key,launchtemplate,placementgroup,spotinstance,volumestate} |
spinifex/domains/ec2/<resource> |
These EC2 resources import no other EC2 handler package, so they move first as EC2 domain resources with their responsibilities unchanged. Each package is named after its directory and callers import it as ec2<resource>, because the bare names collide with common local identifiers; volumestate already carried its directory name. No package name appears in error text, KV keys or metrics. Path comments were updated. Full preflight apart from the known vulnerability-scan finding, focused EC2 domain, EC2 gateway, account-teardown and remaining EC2 handler suites, and tagged integration/E2E compilation passed. |
20b5deb5c |
spinifex/handlers/ec2/{vpc,eigw,eip,igw,natgw,routetable} |
spinifex/domains/ec2/<resource> |
VPC, egress-only and internet gateways, Elastic IPs, NAT gateways and route tables are EC2 API resources and keep their responsibilities. vpc moves whole; splitting it along VPC, subnet, ENI and security-group boundaries remains EC2 decomposition work. Packages are named after their directories and imported as ec2<resource>; one test's local vpc alias was kept. The reconcile drift-watch test located bucket constants by matching the handlers_ec2_ qualifier text, so its pattern now matches ec2<resource>; removing ec2eip.KVBucketEIPs from the watched list made it fail as intended. domains/network's imports of these packages are now visible domain-to-domain edges, already listed in the dependency-rule debt. Full preflight apart from the known vulnerability-scan finding, focused EC2 and network domain, EC2 gateway, handler, daemon and CLI suites, and tagged integration/E2E compilation passed. |
5d60184e8 |
spinifex/handlers/ec2/{instance,volume,snapshot,image,tags} |
spinifex/domains/ec2/<resource> |
Instances, volumes, snapshots, images and tags are EC2 API resources and keep their responsibilities; handlers/ec2 is now empty. Packages are named after their directories and imported as ec2<resource>; one test's local instance alias was kept. docs/service-interfaces.yaml mapped spinifex/handlers/ec2 to the daemon for e2e suite selection, so since the first EC2 slice an EC2-only change fell back to the default suites; a throwaway commit changing only a domains/ec2/key file selected e2e-cert e2e-lb with the old manifest and the daemon suites with the new one, which lists the 17 moved resource paths rather than all of domains/ec2 so selection is unchanged. The move exposes domains/ec2/instance's runtime and DNS imports, recorded in the dependency-rule debt. Full preflight apart from the known vulnerability-scan finding, focused domain, EC2 gateway, handler, daemon, account-teardown, CLI and selector suites, manifest-check and tagged integration/E2E compilation passed. |
4501dbf69 |
cmd/ecr-credential-provider (implementation) |
spinifex/agents/eks/credentialprovider |
The kubelet exec credential provider is EKS-node integration and moves under the agent tree as ADR-0001 maps it; it depends only on internal/{ecrauth,guestenv,imdscreds}, so no ECR domain code gains a guest-environment dependency. main() became Main(in, out) int with the same body writing to out and returning the exit code; the thin cmd/ecr-credential-provider main keeps the binary name and the fipsboot import. .golangci.yml excludes gosec for cmd/, so the move brings this code under gosec for the first time; its one G101 false positive is annotated. The moved test, full preflight apart from the known vulnerability-scan finding, a bad-CA smoke run (empty-auth response, exit 1) and a dependency check that fipsboot still links into the binary passed. |
fecf0b28a |
cmd/eks-gateway-publish (implementation) |
spinifex/agents/eks/gatewaypublish |
The control-plane VM's gateway publication relay is EKS in-guest behaviour. cmd/eks-gateway-publish keeps flag definitions, EKS_* environment defaults, parsing, the fipsboot import, the eks-gateway-publish: log prefix and exit code 1; the agent exposes only Config and Run(ctx, Config) error and imports no flag, os.Args, os.Stdin or os.Exit. The 11 former fatal sites had no defers or cleanup and return errors with identical text. retryDelay became a variable for tests and the retry wait honours context cancellation, which the binary's background context never triggers. New focused Run tests cover every validation and payload error, a wrapped publish, the 30-attempt budget and cancellation. Old and new binaries gave identical stderr and exit codes for nine command-path cases apart from the binary path in flag usage output. Full preflight apart from the known vulnerability-scan finding passed. |
8929ee47b |
cmd/eks-gateway-fetch (implementation) |
spinifex/agents/eks/gatewayfetch |
The control-plane VM's add-on and recovery fetch is EKS in-guest behaviour. cmd/eks-gateway-fetch keeps its nine flags in their original order with EKS_* environment defaults, parsing, the fipsboot import, the eks-gateway-fetch: log prefix and exit code 1; the agent exposes only Config (with Out supplied by the binary) and Run(ctx, Config) error. The 8 former fatal sites had no defers or cleanup and return errors with identical text; a render failure is still not retried. As with publish, retryDelay is a test variable and the retry wait honours a cancellation the binary never triggers. The TSV emitters and their tests moved unchanged; new Run tests cover the five startup errors, addons and recovery rendering at their gateway paths, an unretried render failure, the attempt budget and cancellation. Old and new binaries gave byte-identical stdout, stderr and exit codes for 11 cases against a local TLS gateway, including both TSV outputs and flags overriding environment. Full preflight apart from the known vulnerability-scan finding passed. |
d064924e6 |
cmd/eks-webhook-cert (implementation) |
spinifex/agents/eks/webhookcert |
Minting and caching the in-cluster admission webhook's self-signed serving certificate is EKS in-guest behaviour. cmd/eks-webhook-cert keeps the -dir, -cn and -dns flags, parsing, the usage text, the fipsboot import, the eks-webhook-cert: log prefix and exit code 1; the agent exposes only Config (with Out supplied by the binary) and Run(ctx, Config) error and depends only on the standard library. The 3 former fatal sites had no defers or cleanup; a key-write failure still leaves tls.crt on disk, and a stdout write error is still ignored. Moving out of cmd/ brought the file under gosec, whose G306 finding on the public certificate's 0644 mode is annotated with its reason. Existing tests moved unchanged; new Run tests cover the required-flag and blank-SAN errors, the cache-directory failure and the one-line CA/leaf/key output. Old and new binaries gave identical stdout, stderr, exit codes, file modes and output shape for 7 cases, and a second run reused the cached pair. Full preflight apart from the known vulnerability-scan finding passed. |
fba330b86 |
cmd/eks-konnectivity-cert (implementation) |
spinifex/agents/eks/konnectivitycert |
Issuing and caching the on-node konnectivity-server certificate from the K3s cluster CA is EKS in-guest behaviour. cmd/eks-konnectivity-cert keeps its five flags and defaults (including -cn konnectivity-server), parsing, the usage text, the fipsboot import, the eks-konnectivity-cert: log prefix and exit code 1; the agent exposes only Config (with Out supplied by the binary) and Run(ctx, Config) error and depends only on the standard library. The 3 former fatal sites had no defers or cleanup; a key-write failure still leaves tls.crt on disk, and a stdout write error is still ignored. The gosec G306 finding on the public certificate's 0644 mode is annotated with its reason. Existing signing, reuse/reissue and SAN-splitting tests moved unchanged; new Run tests cover the required-flag and blank-SAN errors, an unreadable CA and the path output with IP and DNS SANs. Old and new binaries gave identical stdout, stderr, exit codes, file modes, CA verification, SANs and subject for 10 cases including SEC1 and PKCS8 CA keys, and the new binary reused the cached certificate and reissued it on a SAN change. Full preflight apart from the known vulnerability-scan finding passed. |
ac069d8f3 |
cmd/eks-token-webhook (implementation) |
spinifex/agents/eks/tokenwebhook |
The control-plane VM's TokenReview webhook is EKS in-guest behaviour. cmd/eks-token-webhook keeps the -addr flag and loopback default, the environment-derived configuration (loadConfig, envOr, all eleven EKS_* variables, their default paths and the three required-variable errors, with its test), the slog text handler, both log lines and exit code 1; the agent exposes only Config and Run(ctx, Config) error and imports neither flag nor os.Getenv. The binary already returned errors from run, so no exit sites changed, and the certificate, kubeconfig, gateway-client and serve order is unchanged. Cancelling ctx now closes the server, which the binary never triggers. The relay, handler, certificate, kubeconfig and wire types moved unchanged with their tests; the public certificate's gosec G306 finding is annotated. New Run tests cover serving-cert, kubeconfig, gateway-client and listen failures and serving until cancelled. Old and new binaries matched for 12 cases including a live server's /healthz and /authenticate 405, 400 and 503 responses, file modes, kubeconfig body and log messages. Full preflight apart from the known vulnerability-scan finding passed. |
3c82c69ad |
cmd/ecs-agent/{runtime,credentials} |
spinifex/agents/ecs/{runtime,credentials} |
The containerd runtime adapter and the instance-role credential provider are ECS-agent-private mechanism and move under the ECS agent tree unchanged, keeping their package names. cmd/ecs-agent is their only importer; its import paths and one comment changed. Both packages now fall under gosec, which reported nothing. ECS agent and subpackage tests passed 10 times under the race detector and in full preflight apart from the known vulnerability-scan finding. |
59decbc25 |
cmd/ecs-agent (implementation) |
spinifex/agents/ecs/agent |
The ECS container-instance agent is ECS in-guest behaviour; package agent, imported by the binary as ecsagent. cmd/ecs-agent keeps process lifecycle only: the signal context, the separate New(cfg) and Run(ctx) calls, the ecs-agent: startup failed and ecs-agent: run failed log lines and exit code 1. Config, LoadConfig(envFile) and DefaultEnvFile stay in the agent as the guest-agent/AMI contract. The ldflags-set var version stays in the binary's main package so -X main.version keeps working, and reaches the register message through a new Config.AgentVersion field that LoadConfig never sets; a new test pins that New carries it into the identity. runtime and credentials remain ECS-agent-private subpackages. Moving out of cmd/ brought the code under gosec; its one finding, G101 on the mulga.ecs.credID container label key, is annotated as a key name. Old and new binaries built with the same -X main.version sent identical register bodies (including the injected version) to a fake TLS gateway with a fake IMDS, logged the same messages, exited the same on SIGTERM and failed identically with IMDS unreachable. Full preflight apart from the known vulnerability-scan finding passed. |
55e858788 |
cmd/rds-agent (implementation) |
spinifex/agents/rds/agent |
The RDS guest agent is RDS in-guest behaviour and moves as one slice: its engines, commander, bootstrap handoff, quiesce, storage and parameter recovery share unexported types, so a finer split would need new exports. Package agent, imported by the binary as rdsagent. cmd/rds-agent keeps process lifecycle only: the signal context, Start(ctx, cfg) then Run(ctx), cancellation as a clean stop, the rds-agent: startup failed and rds-agent: run failed messages and exit code 1. The agent owns Config, DefaultEnvFile, LoadConfig with the engine-layout derivation, New, Start and Run; Start is the existing startup retry around New, kept as guest-agent readiness policy, and no generic retry helper is exported. The ldflags-set var version stays in the binary's main package and reaches the agent through Config.AgentVersion. Three image fixture paths gained one directory level and their regeneration hints name the new package; the fixture tests were confirmed to fail on the old paths. Moving out of cmd/ brought the code under errcheck and gosec, which reported no findings. Old and new binaries built with the same -X main.version produced the same startup retry messages, retry cadence, error text, stdout and SIGTERM exit status with no gateway URL and with a missing gateway CA; the post-registration path is covered by the moved unit tests. Full preflight apart from the known vulnerability-scan finding passed. |
918150758 |
cmd/installer/{autoinstall,branding,firstboot,install,netprobe,systemd,ui} |
spinifex/operator/installer/<same> |
Installation, UI and autoinstall logic is operator delivery behaviour; the seven packages were already libraries and keep their names, and cmd/installer/main.go stays the thin executable with its TTY detection, messages and exit codes unchanged. The installer's systemd package writes the installed system's bridge, firstboot, banner and getty units, which is distinct from operator/host/systemd's Spinifex unit reconciliation, so the two are not merged. scripts/diff-coverage.sh's UI exclusion and a scripts/setup.sh comment follow the new path; the Makefile still builds cmd/installer/main.go. Moving out of cmd/ brought the code under gosec and errcheck for the first time. All 47 gosec findings are annotated per line with the artifact and why its mode is required: 0755 directories, executables and mount points, 0644 OS configuration, units, networkd files, fstab, GRUB assets and the public CA certificate, and 0444 machine-id, each stating that it contains no secret material; spinifex-firstboot.sh is annotated as never permitted to contain credentials or tokenised callback URLs, and the two G115 conversions are annotated as bounded Linux statfs and sysinfo values. The PSK-bearing WPA configuration was already written 0600 and the root password goes through chpasswd. The one errcheck finding, an unchecked *syscall.Stat_t assertion in the ownership check, is now a checked assertion returning a verify error instead of panicking. Installer tests and full preflight apart from the known vulnerability-scan finding passed. |
05f390e61 |
cmd/spinifex/cmd |
spinifex/operator/cli |
The spx command tree is operator CLI assembly; package cmd becomes cli and cmd/spinifex/main.go stays the thin entry point calling cli.Execute(). The -X version and commit ldflags in the Makefile and build/Dockerfile.distro follow the new import path, and a build using the Makefile LDFLAGS printed the injected version rather than dev. Template paths in scripts/reset-dev-env.sh, migrate/VERSIONS.md and the NATS role test follow the move. The listener-bind invariant globbed the old template path, found nothing and passed without examining any template; it now uses the new path and fails when the glob is empty, confirmed against the old path. Moving out of cmd/ brought the tree under errcheck and gosec (105 findings uncapped). Config and flag wiring now goes through unexported mustBindEnv, mustBindPFlag and mustMarkFlagRequired helpers that panic with the config key, flag and command at startup instead of silently dropping a binding; all 110 sites are covered by the package's init and existing bind-function tests. Listing tables are written with Srender and a checked write because pterm's Render discards write errors; output is byte-identical and writing to a full device now exits 1. The formation-server shutdown discards are explicit, the http.DefaultTransport assertion is checked, twelve permission findings are annotated per line, and the formation join's InsecureSkipVerify is annotated as a known security gap (see dependency-rule debt). Full preflight apart from the known vulnerability-scan finding passed. |
5032e24a7, d500e3802, e630703d7, eb68ec460, ebcafa01f |
gateway/ec2/{account,capacityreservation,key,launchtemplate,placementgroup} |
spinifex/domains/ec2/awsapi/<same> |
EC2 action adapters are domain-owned AWS API surface, so they move under the EC2 domain's awsapi, one commit per resource. Each package takes its directory name and callers use ec2<resource>api; moved files change only their package line. gateway/ec2.go keeps the dispatch map unchanged as the transitional registration point. Callers are the gateway dispatch and account teardown's EC2 reapers. Adapter, gateway dispatch and account-teardown tests, the integration and E2E builds, and full preflight passed. |
c38bf99e4, 2ee60b20f, eaa5c971e, f6d8060f2, f50687210, 817e19bf2, 67992c8f5 |
gateway/ec2/{zone,vpc,eigw,eip,igw,natgw,routetable} |
spinifex/domains/ec2/awsapi/<same> |
The VPC-networking action adapters follow the same per-resource pattern; zone moves first because the instance adapter depends on it. Moved files change only their package line (vpc_test for its external tests). Callers are the gateway dispatch, account teardown's EC2 reapers, the quota live counters and the not-yet-moved instance adapter. Adapter, gateway and account-teardown tests, the integration and E2E builds, and full preflight passed. |
4b315469f, 8b106e796, 7ee808d2d, 0485c77e6 |
gateway/ec2/{image,snapshot,volume,tags} |
spinifex/domains/ec2/awsapi/<same> |
Image, snapshot, volume and tag action adapters follow the same per-resource pattern; moved files change only their package line. Callers are the gateway dispatch, account teardown's EC2 reapers and the quota storage counter. The volume adapter still imports the instance adapter, which moves next. Adapter, gateway, account-teardown and quota tests, the integration and E2E builds, and full preflight passed. |
b9a5eaf19, d4c68007e, 534c5b49d, 931af0ea5 |
gateway/ec2 (root), gateway/ec2/{idem,instance,spotinstance} |
spinifex/domains/ec2/awsapi, spinifex/domains/ec2/awsapi/<same> |
The root package holds EC2 resource-ARN resolution for authorization and becomes package awsapi (imported as ec2awsapi); the completeness test's failure messages now name its new path. The idempotency, instance and spot-instance adapters follow the per-resource pattern, instance and spot instance last because they carry cross-domain and runtime dependencies (see dependency-rule debt). Moved files change only their package line; docs/DESIGN.md examples use the new alias. gateway/ec2 no longer exists and gateway/ec2.go remains the transitional dispatch point. E2E suite selection is unchanged: neither the old nor the new path is in the manifest. EC2 domain, gateway, account-teardown, quota, daemon and awsgw tests, the integration and E2E builds, and full preflight passed. |
cd9266176 |
gateway/restrouter.go |
spinifex/ingress/aws/rest |
The REST-JSON router maps method and path to an AWS action and percent-decodes path parameters because ARNs appear in paths, so it is AWS protocol mechanics rather than protocol-neutral HTTP and sits beside ingress/aws/query. The exported surface is Route[H], NewRouter and (*Router).Lookup; pattern parsing stays package-private and tested in place. The Bedrock and EKS route tables and their duplicate-route and completeness assertions stay in gateway, which computes the two former helper values inline rather than widening the API. Ingress and gateway tests, the integration and E2E builds, and full preflight passed. |
ba2d59b29 |
gateway/ratelimit.go |
spinifex/ingress/aws/ratelimit |
Per-IP lockout after repeated failed SigV4 authentication returns AWS RequestLimitExceeded, so it is AWS ingress protection. Moved code changes only its package line and the four exports the gateway needs: MaxFailures, Fingerprint, TokenDigest and Anonymous; limiter behaviour is unchanged. gateway imports it as authlimit because it already imports Bluebottle's ratelimit throttler. The 14 implementation tests move with the package; the end-to-end gateway tests stay. The session-principal verdict and success-reset tests now read the record table through the lockout boundary instead of the limiter's private fields, and three mutations (success not clearing, double counting, legacy verdict recording) each fail them. Ingress and gateway tests, the integration and E2E builds, and full preflight passed. |
| — | cmd/dhcptest, cmd/spx-loadgen |
unchanged | Both already conform to ADR-0001's tooling row: the load engine is internal/testkit/loadgen and the DHCP probe's shared pieces come from the network domain's dhcp package. What remains in each main is its own flag parsing and one-off orchestration that nothing else imports, so extracting it would create a package solely to satisfy the directory map. No source change. |
7047f6b36 |
— | — | ADR-0002 phase 0: characterization tests pin the ECR control plane as it behaves today before dispatch moves. Full-pipeline tests fix the 400/501 error envelopes, JSON 1.1 content type and X-Amzn-Errortype, 413 before dispatch for an oversized body, 503 for stub and composed actions when NATS is down, and authorization before a composed action. Unit tests fix target parsing (dispatch and telemetry agree on every malformed form), the stub and inventory sets, GetAuthorizationToken ignoring body-supplied identity, and the action reaching the throttle key, trace span and audit record. Mutation of the target parser, the authorization gate and the audit action each failed the new tests. Test-only; full preflight passed. |
89364c100 |
— | spinifex/ingress/aws/dispatch, spinifex/ingress/aws/invariants |
ADR-0002 phase 1: the registration contract. A startup Builder validates and seals registrations into an immutable Registry keyed by credential-scope service, with aliases, an inventory name, an advisory action resolver, the dispatcher, the error envelope and the operation inventory; Invocation carries the bounded request, account, Region, an AuthorizeFunc and a lazy ActorFunc. It imports only foundation/aws/errors and Bluebottle's iampolicy condition-key vocabulary, and no domain moved. TestS4_IngressAWSImportsNoDomainOrRuntimeImplementation binds ADR-0002 S4 for all of ingress/aws and failed on an injected domain import. Contract tests at 100% statement coverage under -race; full preflight passed. |
86a2de3ff |
spinifex/gateway (dispatch switch) |
spinifex/gateway consuming spinifex/ingress/aws/dispatch |
ADR-0002 phase 2: the gateway consumes the registry with no service registered. A registered service passes the auth gate, resolves its own action label, renders errors in its declared envelope through one gw.jsonErrorService method, and is dispatched with an Invocation whose Authorize calls the existing policy check and whose lazy Actor reuses buildCallerARN. The NATS-unavailable guard still runs ahead of both paths; every existing service takes the unchanged switch, now named the legacy path that must only shrink. The awsgw role wires an empty registry and fails startup on any overlap with the legacy table. Fake JSON, XML and resolver-less registrations prove dispatch, telemetry labels, authorisation deny/allow, the verified actor, both envelopes, the 503 and unknown-service paths and the overlap guard through the full pipeline; four production mutations were each caught. Phase 0 ECR characterisation and the unserved-service tests passed unchanged; full preflight passed. |
6c48ab6b7 |
spinifex/gateway (ECR_Request, ecrActionFromTarget, ecrAuthorizationPrincipal, the four ECR* GatewayConfig fields, the ecr legacy table/switch entries) |
spinifex/domains/ecr/awsapi (NewRegistration, OperationInventory), wired by spinifex/runtime/roles/awsgw |
ADR-0002 phase 3: ECR's AWS JSON 1.1 control plane registers from its domain. The dispatcher reproduces the removed gateway path step for step (error codes and order, one bounded body read feeding scope and invocation, Authorize before every use case, nil capability as ServerInternal, the token principal from the verified Actor, the JSON writer). The gateway no longer imports domains/ecr/awsapi; the OCI /v2 route is unchanged. Operation coverage reads the pure OperationInventory() that the registration uses verbatim, proved equal by TestRegistrationInventoryIsTheDeclaredInventory; coverage.json and every coverage page were byte-identical. TestS4_OnlyAWSGWRoleImportsDispatchAndECRAWSAPI binds acceptance item 3, with cmd/aws-model-coverage as the only named, non-serving tool exception. Five mutations (authorise after use, prefix-strict resolver, inventory drop, body-derived token principal, probe import) were each caught; Phase 0 characterisation kept every assertion except one rebound from the deleted parser to the registration's resolver; full preflight passed. Remaining temporary edge: Deps.NATS is a raw *nats.Conn. |
5f66bd2a3 |
spinifex/gateway (GenerateEC2ErrorResponse, GenerateIAMErrorResponse, GenerateS3ErrorResponse, requestSignalsJSONProtocol, jsonErrorType, error content types), spinifex/gateway/eks (GenerateEKSErrorResponse) |
spinifex/ingress/aws/envelope |
ADR-0002 phase 4, error rendering: pure EC2, IAM-style and S3 XML builders, the AWS JSON 1.1 body and error type, the header-only JSON-protocol detector and content types, importing only the standard library. ErrorHandler, the cluster-unavailable, throttle and SigV4 writers and the legacy service-to-envelope selection stay in gateway. A 140-case golden of status, headers and body across 14 service cases and every error writer was identical before and after; two mutations were caught; the S4 ingress import invariant scans the new package; full preflight passed. |
b81ae4eb4 |
spinifex/gateway (service served/action/error-protocol selection, overlap check) |
spinifex/ingress/aws/dispatch (Selector, Legacy) |
ADR-0002 phase 4 slice 2: one selector decides whether a service is served, its throttle/trace/audit action, its error protocol, its registered entry and the startup overlap; a registered service always wins and a resolver-less registration does not fall back to legacy action resolution. The gateway supplies its legacy tables through the three-method dispatch.Legacy interface, so ingress imports nothing from gateway; legacy dispatch, the Bedrock sub-service mapping and invocation building (which read gateway request-context keys) stay in gateway. A 160-case golden capture through the real SigV4, trace and Request chain with live test NATS and the ECR registration was identical before and after; mutating Served, ResolveAction and Validate each failed tests. Only startup-visible change: the overlap error now begins dispatch: and names the first overlap in sorted order. Full preflight passed. |
4b0a4dd6b |
— | — | ACM characterization before registration: full-pipeline 400 MissingAction/InvalidAction envelopes, a 200 ListCertificates against a live NATS responder, dispatch and telemetry target-parser agreement, authorization before the NATS call (subject counter stays zero), 413 before dispatch, 503 when NATS is down (ACM's own nil-connection check is unreachable over HTTP), the action reaching throttle, trace and audit, and the nine-action inventory. Mutating the parser, the authorization call and the action table each failed tests. Test-only; full preflight passed. |
fdaf589ca |
spinifex/gateway (ACM_Request, acmActions, acmActionFromTarget, legacy acm entries) |
spinifex/domains/acm/awsapi (NewRegistration, OperationInventory) |
ACM registers its AWS JSON 1.1 control plane from its domain, wired only by the awsgw role; the dispatcher reproduces the old order (missing/unknown action, InternalError without an account, bounded body, resource ARNs, authorization, then nil-NATS and the action). The S4 composition invariant now covers every registered domain awsapi with the same named coverage-tool exception. Coverage output was byte-identical and the ACM integration conformance summary was identical at the parent and after. Mutating authorization order, the target parser, the inventory and gateway imports each failed tests. Temporary edge: Deps.NATS is a raw *nats.Conn because every ACM action function takes one. Full preflight passed. |
01276bf29 |
— | — | RDS DB subnet group characterization before extraction (ADR-0003 S1, ADR-0004): repeat delete reports not found, name scoped to the account, modify never moves a placed instance, snapshots do not block delete, restore rejects an unknown group, tags reached through the ARN and gone with the group, persisted record field names. Present contract and gaps in docs/package-boundary/rds-db-subnet-group-lifecycle.md; no conformance claimed. |
17dc29251 |
spinifex/handlers/rds (DBSubnetGroupRecord, DBSubnetGroupSubnet, DBSubnetGroupKey, DBSubnetGroupsPrefix, getDBSubnetGroup, resolveGroupSubnets and the create/modify/delete bodies) |
spinifex/domains/rds/subnetgroup (Owner, Record, Subnet, Key, Prefix) |
First ADR-0004 resource owner. The handler keeps AWS validation, projection and paging; delete reaches instances through the owner-declared Dependants, and instance placement reaches the group through the instance-declared subnetGroupPlacement. Stored shape unchanged; docs/service-interfaces.yaml lists the package with the RDS daemon. No conformance claimed; gaps in the lifecycle contract. |
1cb868e68 |
— | — | ECS task definition characterization before extraction (ADR-0003 S1, ADR-0004): stored keys and field names, every reference form and its not-found fault, repeatable deregister, an inactive revision still launching, bare-family launch resolution, a service pinning its resolved revision. Present contract and gaps, including the bare-family iam:PassRole re-resolution security gap, in docs/package-boundary/ecs-task-definition-lifecycle.md; no conformance claimed. |
544b0c6a0 |
spinifex/handlers/ecs (TaskDefRecord, ContainerDef, TaskDefRevKey, TaskDefLatestRevKey, ParseTaskDefRef, TaskDefARN, TaskDefRefARN, revision register/deregister/resolve/list) |
spinifex/domains/ecs/taskdefinition (Owner, Record, Container, PortMapping, SystemControl, ParseRef, ARN, RefARN, keys) |
ADR-0004 owner extraction (ADR-0003 S1 contract in docs/package-boundary/ecs-task-definition-lifecycle.md). Stored keys and JSON field names unchanged; the owner declares its own persisted PortMapping/SystemControl so it does not import handlers/ecs/bus. Launches use the launch-side taskDefinitionResolver; gateway authz and all iam:PassRole checks unchanged. docs/service-interfaces.yaml now lists spinifex/handlers/ecs and the new package under spinifex_daemon. Proves ownership and dependency direction only; no conformance claimed. |
b36d70b22 |
— | — | EKS access entry characterization before extraction (ADR-0003 S1, ADR-0004): persisted and nested field names, pre-existing JSON decodes, actions ignore cluster status, associate without an entry is not found, disassociating an unbound policy is a no-op, an empty update keeps username and groups, cluster delete sweeps only that cluster's entries, token review needs no cluster record. Present contract and gaps in docs/package-boundary/eks-access-entry-lifecycle.md; no conformance claimed. |
68ee6f620 |
spinifex/handlers/eks (AccessEntryRecord, AssociatedAccessPolicy, AccessScope, AccessEntriesPrefix, AccessEntryKey, PrincipalARNHash, access-entry KV helpers, policy catalogue, effectiveGroups, the access mutation logic) |
spinifex/domains/eks/access (Owner, Record, AssociatedPolicy, Scope, Spec, Get, List, Key, Prefix, PrincipalARNHash, SupportedPolicies, EffectiveGroups) |
ADR-0004 owner extraction (ADR-0003 S1 contract in docs/package-boundary/eks-access-entry-lifecycle.md). Stored keys and JSON field names unchanged; writes go only through Owner, including the creator-admin seed at cluster launch. The handler keeps AWS validation, the cluster existence check, error mapping and projection; gateway authz switches only its hash import. docs/service-interfaces.yaml now lists spinifex/handlers/eks and the new package under spinifex_daemon. Proves ownership and dependency direction only; no conformance claimed. |
955486421 |
— | — | RDS engine catalogue characterization before extraction (ADR-0004): family normalisation, exact error codes, per-parameter agent metadata, internal-fault outcomes, recovery text, reference class. Static metadata, so no ADR-0003 lifecycle contract; boundary and evidence note in docs/package-boundary/rds-engine-catalogue-boundary.md. |
f1f194b16 |
— | — | Discovered and corrected during the catalogue characterization: a missing MasterUserPassword on CreateDBInstance returned HTTP 500 ServerInternal; it now returns 400 InvalidParameterValue, covered through the gateway by gateway/rds_test.go TestRDSRequest_CreateDBInstance_EmptyMasterUserPasswordReturns400. |
4b5524781 |
spinifex/handlers/rds (Engine, engine registry and lookup, family mapping, version/username/DB-name validation, postgres/mariadb catalogues, ParameterSpec, ApplyType*, ParamType*, ResolveEffectiveParameters, db.* classes, engine-version and orderable selection) |
spinifex/domains/rds/engine (Engine, LookupEngine, EngineForFamily, ParameterSpec, Setting, InstanceTypes, Sizing, NewSizing, EngineVersions, OrderableOptions) |
ADR-0004 owner move of static metadata; boundary note in docs/package-boundary/rds-engine-catalogue-boundary.md. Two deliberate boundaries: EC2 instance-type memory is consumed only through Sizing, never by a direct RDS to EC2 package dependency; agent engine metadata is consumed only through the agent-declared EngineCatalog contract composed in cmd/rds-agent, never by importing the catalogue. Effective parameters cross as engine-owned Setting, converted to Parameter in handlers/rds. AWS output, paging, apply-method mapping, storage limits and the runnable check stay in the adapter path. |
ca1dd9aa9 |
— | — | RDS DB parameter group characterization before extraction (ADR-0003 S1, ADR-0004): persisted meta and override field names, pre-existing JSON decodes, default groups synthesised and never stored, repeated delete is not found, a pending attachment blocks delete, a dynamic pending-reboot override is still applied live, propagation reaches a stopped instance. Present contract and gaps in docs/package-boundary/rds-db-parameter-group-lifecycle.md; propagation to instances is recorded as instance-side realization outside the group, and no conformance is claimed. |
d9c3f3ca6 |
spinifex/handlers/rds (DBParameterGroupRecord, DBParameterRecord, the parameter-group key helpers, ListDBParameterGroupNames, ListDBParameterOverrides, getDBParameterGroup and the create/modify/delete writes) |
spinifex/domains/rds/parametergroup (Owner, Record, Override, MetaKey, ParamsPrefix, ParamKey, Prefix) |
ADR-0004 owner extraction (contract in docs/package-boundary/rds-db-parameter-group-lifecycle.md). Stored keys and JSON field names unchanged. Delete reaches instances through the owner-declared Dependants; instance-side resolution reads through the instance-declared parameterGroupValues. SetOverrides refuses an unknown group. The handler keeps AWS validation (it refuses every default.* name; the owner refuses only a real engine default), projection, paging and propagation. Proves ownership and dependency direction only; no conformance claimed. |
52de5e517 |
— | — | EKS add-on characterization before extraction (ADR-0003 S1, ADR-0004): persisted record and manifest keys and field names, durable CREATING and staged descriptor, installer failure as CREATE_FAILED (update too), update returning Successful while UPDATING, mismatched-version reports accepted, delete erasing both keys while answering DELETING, the ignored client token, no PassRole check on serviceAccountRoleArn, and the exact internal add-ons body (Go field names, not the declared json tags) and agent TSV. Present contract and gaps in docs/package-boundary/eks-addon-lifecycle.md; no conformance claimed. |
d89963054 |
spinifex/handlers/eks (addon_catalog.go, addon_state.go, addon_installer.go, the add-on key helpers, the create/update/delete transitions, markAddonFailed, nextAddonStatus and report application) |
spinifex/domains/eks/addon (Owner, Record, Manifest, Status, Spec, Installer, StagingInstaller, Report, Key, ManifestKey, Prefix) |
ADR-0004 owner extraction (contract in docs/package-boundary/eks-addon-lifecycle.md). The owner is the sole writer; stored keys and JSON fields unchanged. The handler checks cluster existence (acctKVForCluster) and keeps AWS validation, error mapping and projection. ClusterReconciler remains the subscriber host and delegates through the reconciler-declared addonReports; node groups call EnsureGPUDevicePlugin. Guest wire types stay in handlers/eks. Behaviour preserving: proves ownership and dependency direction only; every lifecycle gap remains. |
692d929b4 |
spinifex/handlers/eks (AddonStatusSubject, AddonDeliveryPhase, AddonStatusReport, StagedAddonManifest), gateway/eks (internalAddonsOutput), agents/eks/gatewayfetch (stagedAddon, internalAddonsResponse) |
contracts/eks/v1 |
The add-on guest/controller wire is an explicit versioned contract; v1 is the deployed form and a generation-aware protocol needs a successor version. Bytes unchanged: the internal add-ons body is rendered by jsonutil.BuildJSON with Go field names, which the contract documents and pins. Compatibility tests cover the status report, the guest printf form, the manifest, both body forms and the TSV. The guest script still builds report JSON by hand without escaping. |
4e822fa34 |
— | — | EKS add-on v1 compatibility characterization: pins which owner (domains/eks/addon) writes drop unknown record and manifest fields, that reads and deletes ignore or erase them, that one undecodable stored entry fails a listing rather than the whole set, and that contracts/eks/v1 and agents/eks/gatewayfetch wire consumers ignore extra fields. Test-only; no conformance claimed. |
7e504c1dd |
— | — | Stale paths left by the moves: .gitignore un-ignores the moved runtime/roles/spinifexui/frontend/dist/, UI CI and the Dependabot npm job point at the moved frontend, the depguard ec2-control-plane rule covers domains/** as well as handlers/**, and CODEOWNERS names the network-layer proposal rather than an accepted ADR. |
d5849c6b3 |
spinifex/handlers/quota |
spinifex/domains/admission/quota |
ADR-0001's handlers/quota current-to-target map row. Package renamed to quota (imported as admissionquota where a local quota identifier exists); KV buckets, subjects and error codes unchanged. Its existing debt edges moved with it and are recorded below; runQuotaReconcile stays in runtime/roles/awsgw. Full preflight passed apart from the recorded Go 1.27.0 advisory exception. |
8cd9cff75 |
spinifex/migrate/migrate_test.go (the Registry/RunKV tests and their NATS helpers) |
spinifex/foundation/state/migrate/kv_test.go |
The KV migration engine's only tests lived in the operator upgrade package's test file. They move to the package that owns the engine before the workflow moves, so operator/upgrade does not hold another package's test suite. No test name, assertion or behaviour changed. |
919d5bfa6 |
spinifex/migrate |
spinifex/operator/upgrade |
Owner decision: the operator-driven config-file and object-store upgrade workflow behind spx admin upgrade belongs to operator/upgrade, distinct from foundation/state/migrate. Package renamed to upgrade; no registry types, migration names, versions, file formats or command names changed. It imports only foundation/state/{kvutil,migrate}, providers/objectstore and jetstream, so it carries no layering debt. scripts/diff-coverage.sh and VERSIONS.md point at the new path. Full preflight passed apart from the recorded Go 1.27.0 advisory exception. |
5292bd22c |
— | — | ADR-0001 layering ratchet added, with the nine import edges it found missing from this record recorded below; it lives at architecture/layering beside tests/, outside the product tree. |
8bf162fb7 |
spinifex/utils/ec2_subject.go (SubjectEnsureDefaultVpc) |
contracts/ec2/v1 (EnsureDefaultVpcSubject) |
The default-VPC request/reply subject crosses the gateway–daemon process boundary, so its home is the EC2 contract. Only the subject moved; the request and reply bodies remain anonymous structs on each side, as the contract README states. |
6b01f39e7 |
spinifex/admin (config generation, certificate issuance, host discovery, telemetry, email validation, image import/removal, orphan volumes) |
spinifex/operator/admin |
These are operator use cases consumed only by operator/cli and operator/installer/ui. Certificate issuance moves as an operator use case; foundation/pki keeps generic CA-key loading and the tenant ACM CA stays in domains/acm. Legacy admin keeps DefaultAccountID/DefaultAccountName, GenerateAWSAccessKey/GenerateAWSSecretKey and images_promote.go; the private readAMI helper and the removal test fixtures are duplicated there rather than shared. No forwarding shim; operator/cli imports the legacy package as legacyadmin. Full preflight (excluding the recorded Go 1.27.0 advisories) passed. |
29f9ad07f |
(characterisation only) | — | Pins the ebs.<node>.fenced and ebs.<node>.abandon subjects (named and single-node forms), the exact JSON of VolumeFencedEvent, VolumeAbandonRequest/Response and DirtyRecord, the VIPERBLOCK_VOLUME_DIRTY bucket name and the volume key rule against golden literals before anything moved. |
53697bc76 |
spinifex/services/viperblockd/vbwire (fence and abandon subjects and payloads, DirtyBucket, key rule, DirtyRecord) |
contracts/viperblockd/legacy/v1 (fence.go, abandon.go, dirty_marker.go) |
These routes and the dirty marker cross the daemon–viperblockd process boundary and, for the marker, persist across nodes, so they are deployed legacy contract vocabulary. The characterisation tests moved with them, literals unchanged. The README records the approved dirty-marker boundary: the adapter owns it, only the adapter writes, recovery on any node and spx admin (read-only) consume it, no TTL, N/N-1, no renames or reinterpretation, and a breaking change needs a successor contract. docs/service-interfaces.yaml now lists both routes for the daemon and viperblockd. |
f17e93aed |
spinifex/services/viperblockd (lease, fence, dirty-marker writes, nbdkit recovery, provider handlers, Config) and vbwire I/O helpers |
spinifex/providers/ebs/viperblock and spinifex/providers/ebs/viperblock/dirty |
The Viperblock EBS adapter is a provider; it and internal/testkit/vbscan are the only importers of the Viperblock library. dirty exposes only ListUnsealedVolumes; it never creates the bucket (unchanged behaviour), and write, clear and purge stay unexported in the adapter. operator/cli uses the reader, so it is not a raw KV client. vbwire is deleted and its frozen-list and allowlist entries removed. The adapter loads its key through bluebottle/pkg/masterkey, so utils/encryption.go was not needed. |
7e70222f1 |
spinifex/services/viperblockd (role supervision, opt-in live data-path tests) |
spinifex/runtime/roles/viperblockd |
ADR-0001 maps services/* to runtime/roles/*; what remained is an 82-line role. It was the last package under services/, which now holds nothing. Full preflight (excluding the recorded Go 1.27.0 advisories) and manifest-check passed for each of the four commits. |
7a45e7a3e |
(characterisation only) | — | Pins the subject, JSON, reply envelope, delivery mode and queue group of all 22 inbound vpc.* network-realisation routes where they lived. docs/service-interfaces.yaml gains six live routes it was missing (IGW routes, subnet egress gating, system egress). |
77ac0f0f7 |
(new contract) | contracts/network/v1 |
Versioned vocabulary for the vpc.* control-plane-to-network-realisation boundary: one file per route family, the {success,error} acknowledgement envelope and the vpcd-workers queue group. Network owns the meaning and wire contract because it owns OVN and host realisation; EC2 and managed-service domains own their AWS-visible transitions and decide when to project them. The README states it does not move vpcd and changes no lifecycle or reliability semantics. |
105048594 |
Subjects and payload types in domains/network/subscribers, domains/ec2/{vpc,eip,natgw}, handlers/eks and contracts/ec2/v1/igw.go |
contracts/network/v1 |
Producers and the subscribers use one vocabulary; the duplicates are deleted, including the IGW attach/detach declarations in contracts/ec2/v1 (network is the sole owner). Wire bytes are unchanged: networkv1.SecurityGroupRule carries the publisher's nine fields with its tags (the subscriber-side golden now pins the "rule_id" the publisher always sent), and both NAT-gateway publisher shapes marshal as before. domains/ec2/vpc.SGRule stays because it is EC2's persisted rule record, converted at the publish boundary. |
3aa82953e, 46f448963 |
spinifex/utils/vpcd_event.go and the raw vpc.* publishes in EC2, ELBv2, EKS, the daemon and domains/network/systemvpc |
spinifex/domains/network/projection |
A typed projection client with one method per operation and delivery mode; callers pass no subject strings. Timeouts (5s, 45s NAT add, 15s NAT delete), the NAT add barrier, the ErrNoResponders retry (3 attempts, 500ms) and non-fatal teardown are unchanged, and the inconsistent NAT paths keep their current mode under honest names (recorded below). The IGW, NAT-gateway, IGW-route and egress-gate publishes previously logged their own WarnContext messages with subnetId; they now log the shared publish warning without request context or subnet, a diagnostic loss only. |
fd88e8ceb |
spinifex/utils/encryption.go (LoadViperblockMasterKey) |
spinifex/domains/ec2/ebs/encryption (Enabled) |
EC2's AWS-visible EBS encryption posture, a temporary reading of the provider's key-file setting rather than an encryption implementation. Cache, error text and each caller's handling are unchanged (image reports unencrypted on a load failure; instance and volume return InternalError). utils/ is deleted; the layering test retires utils and services and fails if either regains files. The S7 subject-prefix scan now walks contracts/network, where the vpc.* literals live; after the projection move it had silently stopped listing them. Full preflight (excluding the recorded Go 1.27.0 advisories) and manifest-check passed for each commit. |
38fbd1499 |
(characterisation only) | — | ADR-0007 slice 0: pins the local file's exact bytes and schema failure modes, the instance bucket configuration, the i.<id> key and wire form, the bucket version gate, generation preservation across every KV writer and the VM conversion, and what a returning node does with a missing, foreign, terminal or unreadable canonical record. Current behaviour, not the ADR target; see the slice 0 section below. |
6fa09d336 |
(governance only) | — | ADR-0007 slice 0 ratchet at architecture/instancestate: freezes the 73 direct production uses of raw instance state found by the inventory below. |
2a196f9ba |
(governance only) | — | ADR-0007 slice 0 ratchet narrowed to instance-state access: the JetStreamManager type and constructor are no longer matched, the cluster-state consumers INV-09 and INV-19 leave the allowlist, and 67 entries remain. |
e9e11d531 |
(design only) | — | ADR-0007 slice 1a: docs/package-boundary/instance-state-transition-record-design.md designs the transitional i.<id> record (per-record format marker, assignment with generation, epoch and token, fenced observation, legacy mirror), the writer authority table, top-level unknown-member preservation, the activation gate (per-slot capability proof over the daemon and vpcd, narrowed by the recorded user decisions D1 to D5; Inactive, PREPARED, ACTIVE, DEACTIVATING, FINALISED; stamp raise against R0 restarts; fail closed when unreadable), the journal v2 rules and the slice 1b order. No code, schema, writer or test changed; no conformance claimed. |
e62f921d2 |
(new owner code only) | spinifex/runtime/compute/vm/record_codec.go |
ADR-0007 slice 1b step 1: the instance transition-record codec (DecodeTransitionRecord, TransitionRecord.Encode) with the per-record format marker, the format-2 assignment and observation types, preservation of unknown members at every object level, and typed rejection of malformed, duplicate-key, case-alias, trailing-data and invalid-marker input. vm.InstanceRecord and every existing writer are unchanged, so wire bytes are unchanged (TestCurrentBehaviour_RecordKeyAndWireForm passes with its literal unchanged). No production reader or writer uses the codec yet and nothing conforms yet. The ratchet gains the codec as an owner file; the allowlist is unchanged. Full preflight passed except the recorded Go 1.27.0 advisories. |
The EC2 contract row is intentionally different from the directory moves: it creates
a compatibility boundary. ec2.cmd.* retains its deployed one-token NATS
subscription and permission shape, while callers use
InstanceCommandSubject rather than reconstructing the subject. The
contract's README states the route, scope and change rule.
ECR composition boundary remaining
The ECR AWS JSON dispatcher and /v2/* route assembly remain methods on the
generic GatewayConfig. They establish the generic HTTP route, authenticated
request context, bounded-body read and policy gate, then invoke the ECR domain
packages above. They are not moved merely to remove the last ECR-named files
from gateway: doing so first would make the ECR domain own generic gateway
state and policy mechanics.
Registry-backed image actions have now crossed this boundary through
awsapi.RegistryActionService: the composition root supplies the OCI
capabilities, and the generic gateway dispatches through it after authorization.
Lifecycle-preview actions have likewise crossed it through
awsapi.LifecyclePreviewActionService, whose policy-store-plus-image-catalog
dependencies remain explicit and separate from the registry image-action
service.
Repository metadata actions have crossed it through
awsapi.RepositoryActionService, which makes both their narrow metadata-store
dependency and advertised endpoint profile composition explicit.
Authorization-token issuance has crossed it through
awsapi.AuthorizationTokenActionService. Gateway intentionally still builds
the canonical IAM/STS principal before dispatch, because ECR must not depend on
gateway identity context or ARN construction.
All implemented ECR control-plane actions now dispatch through explicit ECR
capabilities. The remaining ECR-named gateway code is generic /v2/* route
assembly, SigV4/registry authentication and policy enforcement; it remains in
gateway rather than inverting those dependencies into the ECR domain.
ACM relocation residuals
The ACM move leaves two pre-existing dependency seams visible rather than changing their behaviour in a structural slice:
domains/acm.Storestill imports IAM's AES-GCM helper functions. It does not read IAM records, but the crypto mechanism must move behind a shared crypto boundary before the final domain-dependency lint can prohibit that implementation import.
The ACM action-name dispatch map has since cleared: fdaf589ca below registers
ACM's AWS JSON 1.1 control plane from domains/acm/awsapi, wired only by
runtime/roles/awsgw, and no ACM_Request or acmActions/acmActionFromTarget
dispatch remains in gateway.
Guest metadata relocation residuals
The guest-metadata move keeps every existing import unchanged, so the domain package now shows these breaks of the target dependency rules. Each needs a consumer-owned capability, projection or versioned contract before the dependency lint (ADR step 8) can be enabled.
domains/ec2/guestmetadataimports the DNS, IAM and STS implementations, which breaks rule 3 (no domain reads another domain's implementation). Its EC2 key and instance imports are same-domain once those resources sit underdomains/ec2; they remain resource-to-resource implementation imports for the EC2 decomposition to review.domains/ec2/guestmetadataimportsruntime/compute/vmfor instance records and VM reconstruction, the first domain-to-runtime edge; runtime is meant to compose domains, not be imported by them.
Dependency-rule debt to clear after the moves
These residuals were recorded by individual slices and must be resolved once the structural moves are complete, before the dependency lint is enabled.
- Guest metadata: the cross-domain and runtime imports above.
- EC2 → network implementation:
domains/ec2/vpc/eni.go:18andeni_lease_rebind.go:11importdomains/network/topology,eni.go:17also importsdomains/network/identifiers,external_ipam.go:10-11importsdomains/network/externalanddomains/network/external/dhcp,domains/ec2/eip/service_impl.go:17andlease_rebind.go:11importdomains/network/topology, anddomains/ec2/instance/service_impl.go:31importsdomains/network/topology. EC2 reads network's implementation directly rather than through a capability or projection; this clears when EC2's network-facing reads and writes go through the EC2-owned projection recorded above (step 7). - Cross-domain:
domains/ecr/auth/signingkey.go:24anddomains/ochre/vector/appliance.go:15importhandlers/iam; this needs an IAM capability rather than the IAM implementation package.domains/ochre/launch.go:17-18anddomains/ochre/vpc.go:9importdomains/ec2/systeminstanceanddomains/network/systemvpc; Ochre consumes managed-service launch and system-VPC realisation as domain implementations rather than capabilities. - Domain → runtime:
domains/ochre/capacity.go:9importsruntime/compute/gpu;domains/ec2/volume/service_impl.go:30andvolume_leak_reaper.go:8importruntime/compute/vm;domains/ec2/instance/status_selection.go:9also importsruntime/compute/vm. Each reads VM or GPU runtime state directly instead of through a domain-owned projection. handlers/sts/oidc_jwks.go:14importshandlers/eksforAccountBucketName(line 101) andOIDCJWKSKey(line 110), the Q-22 STS-to-EKS dependency ADR-0001 prohibits in its present form. Removal condition: an EKS-owned OIDC projection or an identity-owned contract that STS consumes instead of the EKS implementation package.handlers/elbv2/{agent_types,haproxy,health_checker,nginx}.goimportlbagent(HealthReport,ServerStatus,CertDir,NginxPIDPath,NginxCertDir), a domain reading an agent's implementation package rather than a declared wire contract. Removal condition: the health-report and cert/PID-path vocabulary moves behind a guest/controller contract the domain and the agent both consume.handlers/iam/service_impl.go:30importsadminforGenerateAWSSecretKey(line 641) only, a domain-to-operator edge; theadmin.AccountID,admin.AccountNameandadmin.EncryptedSecretuses are fields of a local*AdminBootstrapDataparameter, not the package. It clears with the remainingadminentry, once the key generators have an IAM-credentials owner.vpcd/imds_instance_state.go:10importsdaemonforLocalState,ReadLocalState,LocalStatePath,NewJetStreamManagerandInstanceStateBucket, a guest-facing daemon component reading the daemon's own implementation rather than a declared local-state contract. Removal condition: a daemon-owned local-state capability or contract that vpcd consumes instead of thedaemonpackage directly.- Advisory: 27 production files across
domains/{acm,dns,ec2/*,network/host,network/ovn,ochre}importbootstrap/configdirectly rather than through typed constructor inputs, which ADR-0001'sconfigrow expects.bootstrap/preflight/preflight.go:15importsruntime/host/commandandservices.go:13importsoperator/host/systemd; both are expected bootstrap-to-runtime/operator edges for startup validation and are not domain-rule violations. admin(remaining): the operator-only code moved tooperator/admin. What remains has non-operator consumers and awaits owners:DefaultAccountID/DefaultAccountName(IAM/account bootstrap),GenerateAWSAccessKey/GenerateAWSSecretKey(IAM credentials) andPromoteSystemImage(the existingdomains/ec2/image).domains/dns: importsruntime/compute/vm(domain-to-runtime),domains/network/reconcilefor the reconcile lock andbootstrap/configfor node configuration.- ACM: the IAM AES-GCM helper import (ACM relocation residual).
runtime/roles/awsgw: the quota reconcile loop belongs todomains/admission/quota, and the EKS token-verify responder belongs with STS or EKS identity.- ECR control-plane registration:
awsapi.Deps.NATSis a raw*nats.Conn, not a narrow capability. Every NATS-backedHandlerpasses it todomains/ecr.NewNATSMetaStore, which callsnatsmsg.NATSRequest, so narrowing it means changing the exportedHandlertype, every handler and the meta store; it must not be broadened further meanwhile. - ACM control-plane registration:
domains/acm/awsapi.Deps.NATS(registration.go) is likewise a raw*nats.Conncarried by everyHandler, for the same reason; it must not be broadened further meanwhile. cmd/aws-model-coverageimportsingress/aws/dispatch,domains/ecr/awsapi,domains/acm/awsapiandgatewayto read ECR's and ACM's declared inventories. It is a non-serving tool and the only named exception to the ADR-0002 composition invariant; it must not construct a registration.- Ingress pipeline (ADR-0002 phase 4): the request-audit record, the trace action enricher, the throttle key functions and the gateway request-context keys stay in
gatewayuntil the auth/IAM and request-context boundary is designed. SigV4 authentication writes the audit record and context keys from four places, so moving them now would export exactly the setters ADR-0002 says must not be exported solely to make a directory move possible. - NAT projection delivery is inconsistent and is preserved as found: EIP
AssociateAddresssendsvpc.add-natunacknowledged (AnnounceNATAdd), skipping the 45s OVN barrier every other add path waits on, andDeleteNetworkInterfacesendsvpc.delete-natunacknowledged (AnnounceNATDelete), skipping the ack and the ErrNoResponders retry. The reconciler's orphan sweep is the only backstop for both. Clears when those call sites useAddNAT/AddNATBestEffortandRemoveNAT, a reliability change of its own. vpc.add-system-egresshas avpcdsubscriber and a contract entry but no producer (its formerdomains/ec2/eippublisher is gone);handlers/eksstill publishes the delete. Either a producer is missing or the add route is dead; it needs an owner decision.- EBS encryption posture:
domains/ec2/ebs/encryptionreads the Viperblock key-file setting to decide what EC2 reports. Clears whenproviders/ebsreports each volume's encryption posture and EC2 stops reading key files. foundation/messaging/nats/nats_trace.gostill names its OpenTelemetry tracergithub.com/mulgadc/spinifex/spinifex/utils. It is an emitted instrumentation-scope name that dashboards may filter on, so renaming it is a telemetry change, not a path fix.runtime/compute/cache.New: two construction-time panics carry a lint exemption pending a constructor that returns an error.domains/ec2/systeminstance: managed-service parent metadata is only theManagedBytag value.gateway/bedrock: holds the Ochre domain core (model catalogue, provisioned throughput, guardrail, access, credential, usage, price, logging and weights stores), the inference engine (provider, vLLM, Anthropic, embeddings, reranker, admission) and the Bedrock action layer in one package with internal cycles.domains/ochreimports it, which is the ADR step 7 Ochre gateway import. Splitting it needs a plan: domain core and stores todomains/ochre/<resource>, inference to an Ochre-owned package, and only the action layer todomains/ochre/awsapi. The top-levelgateway/bedrock*.goHTTP handlers additionally wait for the ingress registration seam.domains/network:reconcile/intent.gobuilds desired network state by reading EC2's KV buckets and decoding EC2's private VPC, subnet, ENI, route-table, gateway, EIP, NAT and security-group records, andreconcile/drift.gowatches those buckets. ADR-0001 names this pair explicitly: EC2 and network communicate through a capability/projection or versioned contract, never by one being the other's KV reader. Step 7 fix: an EC2-owneddomains/ec2/projectionexposing network intent with list and watch (it may stay KV-backed, so no data moves); a narrow intent interface declared byreconcile; wiring at the composition root; and the duplicatedPurposeEIP/PurposeIGWLRPconstants and mirroredSGRule/SGEventfolded into the projection orcontracts/ec2/v1. The drift-watch coverage test and reconcile scenario tests are the evidence the projection must keep.domains/networkalso importsruntime/compute/vmandruntime/host/command(domain-to-runtime).domains/ec2/instance: importsruntime/compute/vmandruntime/compute/gpu(domain-to-runtime) anddomains/dns(cross-domain implementation import).domains/ec2/instance/state(dependency): the instance transition-record codec importsruntime/compute/vmbecause it wraps the legacyvm.InstanceRecordalias and itsInstanceSpecandInstanceStatustypes. Removal condition: the spec and status types and the record alias move intodomains/ec2/instance/state, andruntime/compute/vmconsumes them from there (runtime to domain is allowed).agents/eks/tokenwebhook: importshandlers/eksforWebhookTokenReviewResult, an agent depending on a domain implementation. Temporary: the eventual EKS contract or projection for the token-review reply needs its own design, and no contract is invented to complete the move.agents/ecs/agent: importshandlers/ecs/busfor the assignment and state wire types (Assign,TaskState,StopDirective,Heartbeat,InstanceCapacity,SystemControl, container and task statuses) andhandlers/ecsfor the poll-assignment and GPU-report inputs and outputs and the instance-type and availability-zone attribute names. Temporary agent-to-domain debt; no contract is created during the relocation.agents/rds/agent(wire contract): importshandlers/rdsfor the command, reply, parameter, health and bootstrap types exchanged with the control plane. Temporary agent-to-domain debt; no contract is created during the relocation. The earlierLookupEnginedependency on the RDS domain's engine registry has since cleared:controlPlaneRulesFromand both engine constructors now take the agent-declaredEngineCatalog(see the narrowed entry below), with zero production uses ofLookupEngineremaining inagents/rds/agent.operator/installer/firstboot(security):Config.InstallCallbackis rendered intospinifex-firstboot.sh, which is world-readable (0755). The field is currently unused (fireInstallCallbackreadsSPINIFEX_INSTALL_CALLBACKfrom the environment instead), but any future wiring must not place secrets or tokenised callback URLs in the generated script; sensitive callback credentials should reach first boot through a protected channel such as a 0600 file or a credential store.operator/cli(known security risk):spx admin joincontacts the formation server withInsecureSkipVerify, sends the join token as a bearer credential and receives the cluster CA certificate and key, master key, Viperblock key and shared credentials, so an on-path attacker during formation can capture the token and the cluster root secrets or substitute a CA. This predates the move; lint surfaced it when the tree leftcmd/. It is accepted for now and carries a line-level gosec annotation stating it is not a false positive. Removal condition: authenticate formation TLS with a pinned key or certificate delivered with the join material, or an out-of-band CA, with tests proving a mismatched server certificate fails before credentials are sent.handlers/eks(potential security risk):ClusterMeta.ControlPlaneTemplate(handlers/eks/service_impl.go) clears the template's credentials but keepsOIDCPrivateKeyPEMand the k3sJoinToken, so both are persisted in theeks-account-{acct}cluster record, which the gateway also reads. Whether that record is encrypted at rest is unconfirmed; if it is not, a reader of the bucket can forge service-account tokens for the cluster's OIDC issuer and join nodes to it. This predates the refactor and is not fixed in it. Removal condition: the key and token are held by a dedicated secret store (a future KMS or Secrets Manager capability is the likely owner) and the cluster record keeps only a reference, with a test proving the persisted record contains neither secret.operator/cli(dependency): the command tree still imports domain and service implementations directly (handlers/{iam,eks},domains/admission/quota,gateway,gateway/bedrock,daemon,vpcd,admin,accountteardown, the Viperblock adapter and runtime roles). The ADR'scmd/spinifexcurrent-to-target map row requires command packages to reach domains through public capabilities; splitting supported use cases intooperator/*packages is later work.providers/ebs/viperblock→runtime/compute/nbdandruntime/host/process(dependency, moved unchanged fromservices/viperblockd): the adapter formats NBD endpoints and manages nbdkit processes through runtime packages. ADR-0001 does not list providers → runtime as forbidden and the layering test does not enforce it (same category asproviders/ebs/conformance→runtime/compute/nbd), but a provider should not depend on node runtime. Clears when NBD endpoint naming has a provider-facing home (a candidate forcontracts/ebs/v1) and process supervision is injected by the role. The adapter also importsproviders/objectstore, a provider-to-provider edge that is allowed.gateway/ec2.go(registration): the EC2 dispatch map stays aGatewayConfigmethod ingatewayand imports everydomains/ec2/awsapi/*package;gateway/ec2_idempotency.goalso importsdomains/ec2/awsapi/idem(KVBucket,TTL,TokenAndParams) for the dispatch-time idempotency wrapper. ADR-0001 makes the domain own its action registration; moving the map waits on the generic ingress registration seam and must not be done as a package move.gateway/requestaudit.go: the outermost request-audit middleware records AWS fields and is updated from four places in the gateway's authentication flow through the gateway's own context key. Moving it would export about seven names used only by that flow, so it stays ingatewayuntil the generic ingress registration seam defines how ingress middleware receives authentication results.accountteardown(dependency): its EC2 reapers calldomains/ec2/awsapi/*action adapters directly, as they did undergateway/ec2. The ADR'saccountteardowncurrent-to-target map row replaces this with domain-owned cleanup capabilities before the package moves.domains/admission/quota(dependency, moved fromhandlers/quotaunchanged):live.goimportsgateway/elbv2andhandlers/rdsfor its live ELBv2 and RDS counters;records.goimportsruntime/compute/vmfor the instance-record vCPU sweep;live.go,vcpu.goandstorage.gocalldomains/ec2/awsapi/{vpc,eip,volume}describe adapters to count VPCs, subnets, addresses and volumes, as they did undergateway/ec2. The ADR'shandlers/quotacurrent-to-target map row replaces these with reader capabilities once their final locations exist.domains/ec2/awsapi/instance(dependency): importshandlers/iam(IAMServiceinDescribeInstances.go,RunInstances.goandIamInstanceProfileAssociation.go;InstanceProfilein the latter two),runtime/compute/cache(NodeState,NodeUnknown,NodeLive) andruntime/compute/vm(VM), both instatus_synthesis.go. The IAM edge needs an IAM capability; the runtime edges are domain-to-runtime and need the instance record and node liveness exposed through an EC2-owned projection.domains/ec2/awsapi/spotinstance(dependency): importshandlers/iam.IAMServiceanddomains/admission/quota.ServiceinRequestSpotInstances.go.- Instance adapter consumers outside EC2:
gateway/rds/enginecatalog.go,daemon/eks_cp_control.go,daemon/rds_deps.go,domains/admission/quota'svcpu.goandgateway/iam.go(CountInstanceProfileAssociations) calldomains/ec2/awsapi/instancedirectly; each needs an EC2 capability rather than the AWS action adapter.
Enforcement: the owner decided the layering test is blocking now, with a ratchet. Its allowlist mirrors this debt list exactly, each edge carrying its owner and removal condition; any new unrecorded forbidden edge fails local preflight and CI, and an allowlisted edge that no longer exists must be removed from the list.
handlers/rds→domains/rds/subnetgroup(legacy edges):instanceReferencesbindsDependantsby scanning instance records, andtags.gowrites the group record through its generic tag registry. The first clears when the RDS instance gains its own owner and answersDependantsfrom it. The second clears when tagging invokes a subnet-group-owned tag/untag capability rather than writing the record; moving the tagging adapter todomains/rds/awsapialone does not clear it.handlers/rds→domains/rds/parametergroup(legacy edges):parameterGroupReferencesbindsDependantsby scanning instance records; this clears when the RDS instance gains its own owner and answersDependantsfrom it.tags.gowrites the meta record through its generic tag registry; this clears when tagging invokes a parameter-group-owned tag mutation capability, and moving the tagging adapter todomains/rds/awsapialone does not clear it. The Modify handler still callspropagateParameterGroupafter the owner's write; propagation is instance-side realization and stays legacy until it is designed as asynchronous realization (group generation, instance staleness, retry).parameterGroupValuesreturns the persistedRecordand overrides to instance code; when the instance owner is extracted, replace them with a consumer-owned resolved-parameters projection.handlers/ecs→domains/ecs/taskdefinition(legacy edges):tags.goreads and writes the revision record through its generic tag registry; this clears when ECS tagging invokes an owner-provided tag mutation capability, and movingtags.gotodomains/ecs/awsapialone does not clear it.taskDefinitionResolverreturns the persistedRecordto task and service launch code; when the task and service owners are extracted, replace the record crossing that boundary with a consumer-owned resolved task-definition (launch-spec) projection. Moving packages has not made the record private.domains/ecs/taskdefinition(deliberate duplication, not debt): privategetJSON,putJSONandkeysWithPrefixcopy the raw-KV helpers inhandlers/ecsso the extraction keeps ECS's get/put/list error and recovery semantics. Revisit only if a later, tested state abstraction proves it preserves those semantics; do not migrate ECS tokvstoremerely to remove them.handlers/eks→domains/eks/access(legacy edges):ResolveTokenReviewopens the EKS bucket in the gateway process and reads records through the exportedaccess.Get; this clears when token review asks the owner across a contract rather than opening the bucket itself.DeleteClusterPrefixerases access-entry keys as part of its blanket cluster sweep; this clears when cluster delete invokes an owner-provided removal of the cluster's entries. The owner returns the persistedRecordto the AWS adapter and token review; replace it with consumer-owned projections when those consumers are extracted.handlers/eks→domains/eks/addon(legacy edges):DeleteClusterPrefixerases add-on records and manifests in its blanket cluster sweep; this clears when cluster delete invokes an add-on-owned teardown capability.stageGPUDeviceAddonis a temporary node-group-to-add-on orchestration edge: best-effort, errors logged and swallowed, never undone on node-group delete; it clears when the node-group owner is extracted and the dependency is designed.ClusterReconcilerhosts the add-on status subscription; it clears when add-on delivery observation has its own host under the lifecycle correction. Cluster existence is checked in the handler, not through an owner-declared capability; it moves into the owner when cluster admission is defined (today status is ignored). Guest wire types (AddonStatusReport,AddonDeliveryPhase,AddonStatusSubject,StagedAddonManifest,InternalAddonsResponse) are owned bycontracts/eks/v1, whichhandlers/eks,gateway/eksandagents/eks/gatewayfetchimport directly.handlers/eksandgateway/eks→domains/eks/addon(further edges): the AWS adapter reads the persistedRecordthroughaddon.Get/addon.List; this clears when the owner returns a view and the add-on adapter moves todomains/eks/awsapi. The guest route reaches the owner through thehandlers_eksNATS RPC (ListStagedAddonManifests); this clears with per-resource commands behind EKS registration. The add-on ARN is derived in both the owner andgateway/eks/authz.go; this clears when authorization obtains the ARN from the owner, which an incarnation suffix would require. The owner'sManifest/Reportbeside thecontracts/eks/v1types is deliberate duplication, not debt.agents/rds/agent(dependency, narrowed): engine metadata now arrives through the agent-declaredEngineCatalog, but the agent still importshandlers/rdsfor the command protocol, wire and record types (Command*,Parameter,EngineHealth*,BootstrapMode*) and API output types. This clears when those move behind a guest/controller wire contract.gateway/rds→handlers/rds(InstanceSizing): the gateway obtains itsSizingthrough the RDS handler package's adapter rather than its own composition root. This clears when the gateway's RDS composition moves toruntime/roles/awsgwand buildsSizingthere.domains/admission/quota→domains/ec2/instancetypes:reconcile.go,records.goandvcpu.goreadDefaultVCPUsto size instances without a recorded vCPU count. This clears when quota receives vCPU sizing through a consumer-owned capability or an EC2 projection.- IAM implementation consumers in STS, Ochre and ELBv2:
handlers/stsimportshandlers/iamacross five files (IAMService,SessionRevoker,EncryptSecret/DecryptSecret,AccessKeyStatusActive,ValidateTrustPolicyDocument,PolicyEffectAllow/PolicyEffectDeny,IAMAccountBucketName,OIDCProviderARN,OIDCProviderKey), not onlyoidc_jwks.go;gateway/sts/GetCallerIdentity.gotakesIAMService;gateway/bedrock/credentials.gousesEncryptSecret/DecryptSecret; andhandlers/elbv2/{lb_role,service_impl}.gouseEnsureSystemInstanceProfileandSystemInstanceRoleEnsurer. Each clears when its consumer receives a narrow IAM capability, or a shared crypto boundary for the secret helpers, rather than importing the IAM implementation. handlers/elbv2(cross-domain):service_impl.goimportsdomains/acm(Store,NewStore),domains/dns(ELBChanges,ELBName,Change,ActionUpsert,ResolveBaseDomain),domains/ec2/vpc(VPCServiceImpl) anddomains/network/topology(Port), andlauncher.gore-exportsdomains/ec2/systeminstancelaunch types as aliases. These clear when ELBv2 is extracted and each edge becomes a consumer-owned capability, which ADR-0001 sequences after the ELBv2 data-plane boundary is settled.docs/service-interfaces.yaml(coverage gap): noecs.*subjects are listed and the manifest lint does not cover them, so ECS publisher/subscriber edges play no part in suite selection. Add them only after tracing the actual publishers and subscribers.
The layering test enforcing these rules (architecture/layering, a module-root repository governance test, not Spinifex product code; run by make test, test-cover and test-race) is blocking, with a ratchet: the debt recorded in this section is narrowly allow-listed by owner and removal condition, and any new, unrecorded forbidden edge fails local preflight and CI. The allow-list mirrors the edges in this section that break an import rule; same-domain legacy edges, placement residuals and security notes are not import-rule violations and have no allow-list entry.
- Merge-time follow-up in the umbrella repository: the
Makefileinvariants-checktarget, thedocs-pr.ymlclause cross-check,.claude/hooks/architecture-traps.shand acheck-invariants.shcomment hard-codespinifex/spinifex/network/invariants. They must change with the pointer bump that brings in this branch, or the docs-pr cross-check silently skips. Live specs and proposals citingspinifex/network/will report unresolved citations until updated. A read-only mulga-repository count (excluding submodules,docs/development/archive/and agent worktrees) confirms four items still open:spinifex/network/appears in 49 mulga files;services/awsgwappears in 19 (.claude/rules/spinifex.mdplus 18 docs; the umbrella.claude/CLAUDE.mddoes not contain it but cites the oldnetwork/policy/policy.go:28); andservices/spinifexui(including its/frontendsubpath) appears in 20 mulga files, includingansible/roles/build/tasks/main.yml, the.claude/settings.jsonformatting hook, the.claude/rules/frontend-standards.mdglob,.claude/skills/run-spinifex/SKILL.mdandui-dev.sh,.vscode/settings.jsonandREADME.md. The sameSKILL.mdalso namescmd/spinifex/cmd, the obs-agent Ansible role'sotelsetuppath mirrors the pre-move name, anddocs/specs/guides/dependency-enforcement.md's "Known open edges" section carries the same pre-move paths; all four are mulga-repository updates, out of scope for a Spinifex-only commit.
Security corrections and branch preflight exception
These are security corrections found during discovery, not lifecycle work.
ee13be950:PublishInternalrequired only the IAM policy, built from the body account and URL cluster, and the control-plane role grants it on*. Any control-plane VM session, any tenant holdingeks:*, or static system credentials could publish cluster state, bootstrap and add-on reports for another cluster or account. It now passes the internal-route membership gate, with one body decoder shared by the gate and the handler. Evidence:gateway/eks_authz_test.goTestEKSRequest_PublishInternal*.a23e1ccf5:WebhookTokenReviewhad the same flaw and could reveal another cluster's Kubernetes group mappings. It now passes the same gate, and every unauthorised target returns the sameAccessDeniedwithout reaching STS. Evidence:TestEKSRequest_WebhookTokenReview*,gateway/eks/internal_authz_test.goTestInternalBodyAccounts_CoverEveryBodyScopedRoute.642cb4889:serviceAccountRoleArnon CreateAddon and UpdateAddon must be syntactically an IAM role ARN (foundation/aws/arn.ValidateRoleARN), returningInvalidParameterException;iam:PassRoleremains the permission and existence check. Evidence:handlers/eks/addons_test.goTestCreateAddon_RejectsMalformedServiceAccountRoleArn,TestUpdateAddon_*ServiceAccountRoleArn*.097e19109:CreateAddonandUpdateAddonacceptedserviceAccountRoleArnwith noiam:PassRolecheck, the gap the52de5e517characterization recorded ("no PassRole check on serviceAccountRoleArn").PassedRoleARNsnow resolves the field for both actions, so the caller needsiam:PassRoleon the role foreks.amazonaws.com, matchingCreateClusterandCreateNodegroup. Evidence:spinifex/gateway/eks_passrole_test.go.- Remaining render gap: IAM's path grammar permits
",&,\and|, which the guest'ssedreplacement and double-quoted YAML value inmulga-eks-addon-sync.shdo not escape. A role whose path contains them must also exist and passiam:PassRole. Removal condition: the guest renders the role ARN with escaping for bothsedand YAML (or a structured renderer), with a test rendering such a path verbatim. - Static-credential control-plane VMs (IAM wiring failed) are now denied every internal route and cannot bootstrap; that fallback is unsupported.
Preflight exception (branch only): from ee13be950, full make preflight on this branch is red solely because the vulnerability gate reports GO-2026-6599 to GO-2026-6617 against the pinned Go 1.27.0 toolchain. Every other gate passes. This branch is not production. No advisory is accepted or suppressed, and the accepted-advisory list, go.mod and the toolchain pins are unchanged; the toolchain is updated through Dependabot. Normal full-preflight enforcement resumes when the toolchain baseline is updated.
Gates outside preflight and CI (follow-up, not merge-blocking): make test-package-check, which the Makefile keeps out of preflight, reports 87 test files added on this branch in their own package rather than <pkg>_test; they include the contract, agent, new-domain, ingress, layering and split-out ECR tests. Converting each to an external test package, or marking it //test:in-package with a reason, is follow-up work before that gate returns to preflight. make nilaway was killed by the host on both local attempts (15 GB, including GOGC=25 GOMAXPROCS=2) before it reported anything, so this branch has no nilaway evidence.
ADR-0004 source inventory and first-resource ranking
The per-file inventories for ECS, EKS and RDS are in docs/package-boundary/adr-0004-inventory-{ecs,eks,rds}.md.
Each classifies every production file as resource owner, cross-resource orchestration, AWS protocol adapter, guest/controller wire contract, or temporary residue, and maps actions, durable records, identity and scope, lifecycle paths, NATS subjects and boundary-crossing imports.
They were produced by reading the code at 6c50349bd and are not verified against a live system.
Observed gaps common to all three: no resource carries a desired generation, all resources of a service share one per-account KV bucket, and deletes remove records before dependent cleanup is confirmed.
First-resource ranking:
- RDS DB subnet group: about 340 lines with its own
db-subnet-groups/{name}keys, synchronous AWS semantics, and no quota, expected-node, IAM, Bluebottle or agent dependency. It has a real deletion graph, because delete refuses while an instance references the group, so it exercises a consumer-owned capability in both directions: an instance-owned "instances referencing this group" query for delete, and a subnet-group-owned placement query for instance create. - ECS task definition: own keys and good tests, but
RegisterTaskDefinitionallocates revisions non-atomically and the gateway adapter carries theiam:PassRolechecks, so it sits closer to a blocked boundary. - EKS access entry: own keys, but entries are read during token review, which places it next to EKS identity.
Blocked dependencies recorded, not designed around:
- RDS instance: quota admission, the duplicated expected-node fan-out (
gateway/rds/enginecatalog.go,daemon/rds_deps.go), IAM ensurer and Bluebottle master key. - RDS
DescribeOrderableDBInstanceOptions: the EC2 instance-type-availability projection. - ECS task, service and capacity:
iam:PassRolein the gateway adapter, IAMecsInstanceRole, and EC2/ELBv2/EIP adapters called as internal APIs. - EKS nodegroup and cluster: IAM role and instance-profile creation, Bluebottle
auth, the NATS CA, and EKS identity (token review, OIDC). - Guest agents:
agents/ecs,agents/rdsandagents/eks/tokenwebhookimport the service implementation packages, which ADR-0004 S5 forbids; they need wire contracts.
Findings to resolve before extraction:
devis merged in (9e77181f2), includingModifyDBSubnetGroup(#1152); the subnet-group inventory is superseded by its lifecycle contract,docs/package-boundary/rds-db-subnet-group-lifecycle.md.- The EKS control-plane template persists the OIDC signing key and k3s join token; see the
handlers/ekspotential security risk in the dependency-rule debt.
ADR-0007 instance-state inventory (slice 0)
This is the baseline for ADR-0007 (instance state authority and partition recovery), produced by reading the code at cf9e8ce0d and pinned by tests in 38fbd1499 and 6fa09d336.
Nothing here conforms to ADR-0007 yet.
Every behaviour below is current behaviour, recorded so later slices can show what they change; none of it is a target.
vpcd stays blocked: it still reads the daemon's local file and opens the instance bucket through the daemon's manager (INV-13), and no slice has given it a narrower capability.
Shared KV is primary for accepted lifecycle intent and assignment. The local file is a durable execution journal for an already-assigned local guest and is not authority to create or reassign resources. The characterisation below shows several places where today's code treats it as more than that.
Persisted state
| Item | Location | Shape |
|---|---|---|
| Local file | daemon/local_state.go |
<DataDir>/state/instance-state.json (default DataDir /var/lib/spinifex), mode 0640, parent 0750, written to a temp file then renamed. Body is {"schema_version":1,"vms":{<id>: vm.VM}}, compact JSON, no trailing newline, the whole vm.VM per instance, no generation of any kind. |
| Live bucket | daemon/jetstream.go:130 |
spinifex-instance-state, history 1, no TTL, RecreateIfMissing, version stamp 5 via kvutil on open through migrate.DefaultRegistry.RunKV. Created at one replica and raised to cluster size by kvutil.RaiseAllBucketReplicas (daemon/daemon.go:2536). |
| Terminated bucket | daemon/jetstream.go:146 |
spinifex-terminated-instances, history 1, TTL 1 hour, version stamp 3, same open hook. |
| Record keys | daemon/instance_records.go |
i.<id> holds a vm.InstanceRecord (metadata, spec, status) in both buckets; the live bucket also holds node presence and ownership keys and the legacy per-node and stopped prefixes. Records carry no per-record schema version. |
| KV migrations | daemon/instance_records_migrate.go |
Live 1→2 stopped instances to per-resource keys, 2→3 running sets to per-resource keys, 3→4 i/<id> to i.<id>, 4→5 node presence and ownership out of the running-set blob; terminated 1→2 per-resource keys, 2→3 re-key. operator/upgrade touches no instance state; its VERSIONS.md points KV migrations at the owning package. |
| Record type | runtime/compute/vm/record.go |
vm.InstanceRecord with resource.Metadata (Generation, ObservedGeneration, UID, Region, OwnerRefs, Finalizers, Tags, DeletionTimestamp); VM.Record() and VMFromRecord convert to and from vm.VM. |
Consumer inventory
The owner files (daemon/{instance_membership,instance_records,instance_records_migrate,instance_running_set,jetstream,local_state}.go and runtime/compute/vm/record.go) define the state and are not listed as consumers.
Line numbers are the first use in each file.
| Item | Location | Package | Process | Access |
|---|---|---|---|---|
| INV-01 | daemon/daemon.go:2686, :2889, :2912, :2922 |
daemon |
daemon | Reads the local file at boot (LoadState) and rewrites it whole in persistState, the single path every state change reaches, before the KV write and regardless of its outcome. |
| INV-02 | daemon/daemon.go:221, :2485–:2495 |
daemon |
daemon | Constructs the manager and opens both buckets, which runs the version gate and migrations. |
| INV-03 | daemon/daemon.go:2936–:2937, daemon/instance_record_repair.go:65 |
daemon |
daemon | Writes the node marker and projects the in-memory running set to i.<id> records (whole-record write from vm.VM). |
| INV-04 | daemon/daemon.go:2423 |
daemon |
daemon | Lists terminated instances (decodes to vm.VM). |
| INV-05 | daemon/vm_adapters.go:32–:91 |
daemon |
daemon | Adapts the manager into vm.StateStore: LoadState, stopped and terminated read, write, update, claim, list and delete, all through vm.VM. |
| INV-06 | runtime/compute/vm/{migrate,shutdown,orphan_qemu_reaper,teardown_reaper}.go |
vm |
daemon | Uses the StateStore port for stopped and terminated writes, terminated listing, update and delete. |
| INV-07 | domains/ec2/instance/service_impl.go:511–:2847 |
ec2/instance |
daemon | Stopped and terminated read, update, claim, write and delete through the StateStore-shaped port. |
| INV-08 | daemon/daemon_handlers_image.go:35, :89 |
daemon |
daemon | Loads and updates a stopped instance for image creation. |
| INV-09 | daemon/daemon_mgmt_ip.go:18 |
daemon |
daemon | Cluster-state consumer outside the ratchet: names JetStreamManager only for management-IP allocation in the cluster-state bucket and touches no instance key. |
| INV-10 | daemon/instance_recovery.go:85–:546 |
daemon |
daemon | Lists and decodes records, claims, releases and abandons recovery, reloads a record. Typed CAS writes. |
| INV-11 | daemon/dns_reconcile.go:38, :48, :179 |
daemon |
daemon | Constructs keys from the prefix, names the bucket, lists records for DNS. |
| INV-12 | daemon/eni_orphan_reaper.go:26–:27 |
daemon |
daemon | Lists live and terminated records to find orphaned ENIs. |
| INV-13 | vpcd/imds_instance_state.go:24–:94 |
vpcd |
vpcd | Reads and caches the daemon's local file by path and mtime; constructs a JetStreamManager and calls InitKVBucket, which runs the version gate and the instance migrations; decodes records. |
| INV-14 | domains/ec2/guestmetadata/instance_lookup.go:60, :120 |
guestmetadata |
vpcd (IMDS) | Loads a record through a LoadInstanceRecord interface satisfied by the manager and converts it to vm.VM. |
| INV-15 | domains/network/reconcile/intent.go:48, :444–:474 |
network/reconcile |
vpcd | Duplicates the bucket name and prefix as literals, opens the bucket by name with no gate, gets i.<id> and decodes vm.InstanceRecord. |
| INV-16 | runtime/roles/awsgw/awsgw.go:573–:633 |
awsgw |
gateway | Opens the bucket by name with no migration hook for the instance cache and the quota reconcile loop. |
| INV-17 | runtime/compute/cache/cache.go:97, :248 |
instancecache |
gateway | Watches i. records into a vm.VM map through kvstore.Store[vm.InstanceRecord]. |
| INV-18 | domains/admission/quota/records.go:33 |
quota |
gateway | Snapshots records to count vCPUs. |
| INV-19 | operator/cli/cluster.go:170 |
operator/cli |
operator CLI | Cluster-state consumer outside the ratchet: constructs a JetStreamManager only for the cluster-state shutdown marker and touches no instance key. |
Test packages are excluded; daemon/instance_records_vpcd_test.go pins INV-15's duplicated literals to the daemon constants.
Characterised behaviour
Local file (daemon/instance_state_baseline_test.go):
TestCurrentBehaviour_LocalStateFileExactBytespins the exact bytes.TestCurrentBehaviour_LocalStateSchemaVersionFailures: a missing or olderschema_versionreads asunknown schema_version 0 (expected 1), a newer one asunknown schema_version 2 (expected 1), a wrong type or truncated body asparse local state; every case returns no state.Daemon.LoadStateturns any of these into a boot failure (TestDaemonLoadState_CorruptFile).TestCurrentBehaviour_LocalStateUnknownFieldsAreDroppedOnRewrite: a file at the same version with fields this binary does not know is accepted, and those fields are gone after the next rewrite.- Already covered and relied on:
daemon/local_state_test.go(TestWriteLocalState_GroupReadable,_AtomicReplace,_NoTmpLeftBehind,_MkdirParent,_Failures,TestReadLocalState_Missing,_CorruptJSON,_UnknownSchema,_Unreadable) anddaemon/disconnect_test.go(TestDaemonWriteState_LocalFile,TestDaemonLoadState_*).
KV (daemon/instance_state_baseline_test.go):
TestCurrentBehaviour_InstanceBucketConfigurationpins names, history, TTL and version stamps.TestCurrentBehaviour_RecordKeyAndWireFormpins thei.<id>key and the exact record bytes; the running-set writer stamps the node and AZ it was given over whatever the instance carried.TestCurrentBehaviour_BucketVersionGate: a daemon-configured open of a bucket stamped ahead fails withmigrate.SchemaAheadError, a handle already open keeps writing, and a reader configured without the migration hook (the gateway's form) opens and decodes regardless.- Already covered and relied on:
daemon/instance_records_test.go(round trip, absent is nil, disjoint prefixes,TestWriteInstanceRecord_ReplacesWholesale,TestUpdateInstanceRecord_*),daemon/instance_claim_test.go(claim, release and abandon CAS),daemon/instance_running_set_test.go,daemon/instance_records_transition_test.go(every migration step),daemon/jetstream_test.go(TestJetStreamManager_InitBuckets_WritesVersion,_InstanceRecordKVErrors),foundation/state/kvutil/kvutil_test.goandfoundation/state/migrate/kv_test.go.
Recovery on return (daemon/instance_state_recovery_baseline_internal_test.go), with the local file reloaded and restoreInstances run:
| Case | Current outcome | Test |
|---|---|---|
| Canonical key missing | Local instance kept; the next state write recreates the record from the local file, owned by this node. | TestCurrentBehaviour_RestoreMissingCanonicalKeyRepublishesFromLocal |
| Live key missing, terminated record present | Terminated bucket not consulted; the instance is revived from the local file and republished as live and non-terminal. | TestCurrentBehaviour_RestoreIgnoresTerminatedBucket |
| Record owned by another node | Local copy dropped and removed from the rewritten file; the other node's record is left untouched. | TestCurrentBehaviour_RestoreRecordOwnedElsewhereDropsLocal |
| Terminal record owned by this node | The canonical record wins the merge and the instance is migrated to the terminated bucket, not restarted. | TestCurrentBehaviour_RestoreTerminalCanonicalRecordRetiresLocal |
| KV unavailable | Restore stops after the failed cluster read; local instances stay as the file left them, are not reset or relaunched, and the file is rewritten unchanged. | TestCurrentBehaviour_RestoreWithKVUnavailableLeavesLocalUnlaunched |
The first two cases are the ones ADR-0007 S5 rules out: a node republishes local state as authority without the canonical record.
Owner disposition of the KV-unavailable result:
- Correct: while canonical KV is unavailable, the daemon does not launch, recreate, migrate or report a healthy new realization.
- Permitted later: reattaching only to a demonstrably already-running local guest covered by a valid local journal assignment and fence.
- Not acceptable as the final model: keeping an in-memory record as
runningwhen no live process has been confirmed; the later recovery slice must make that an explicit unconfirmed or degraded state.
The safety goal is that a partition does not kill an existing workload, while a daemon restart plus a stale file cannot resurrect one.
TestCurrentBehaviour_RestoreWithKVUnavailableLeavesLocalUnlaunched stays as the current-behaviour pin until that slice changes it.
Generation preservation
Generation and ObservedGeneration are the only generation fields; KV entry revisions are used for CAS and never persisted in the record.
Unknown fields are a field a newer binary adds.
| Path | Generation and ObservedGeneration | Unknown fields | Test |
|---|---|---|---|
UpdateInstanceRecord |
Preserved | Lost | TestCurrentBehaviour_GenerationAcrossKVWriters |
LoadInstanceRecord then WriteInstanceRecord |
Preserved | Lost | same |
ClaimRecoverableInstance, AbandonRecovery |
Preserved | Lost | same |
ClaimStoppedInstance |
Preserved | Lost | same |
UpdateTerminatedInstanceRecord |
Preserved | Lost | same |
WriteRunningSet |
Lost | Lost | same |
UpdateStoppedInstance, WriteStoppedInstance |
Lost | Lost | same |
UpdateTerminatedInstance, WriteTerminatedInstance |
Lost | Lost | same |
KV → LoadState → running set → recovery merge |
Lost | Lost | TestCurrentBehaviour_LoadStateDropsGeneration |
Record → VMFromRecord → Record() |
Lost, with UID, Region, OwnerRefs, Finalizers and Metadata.Tags; Name, AccountID and DeletionTimestamp survive |
Lost | runtime/compute/vm/record_generation_test.go TestCurrentBehaviour_RecordThroughVMLosesGenerationAndBookkeeping |
vm.VM → Record() |
Never written | n/a | TestCurrentBehaviour_RecordFromVMHasNoGenerationKeys |
| Typed record decode then encode | Preserved | Lost at every level | TestCurrentBehaviour_TypedRecordRoundTripDropsUnknownFields |
vm.VM → local file → vm.VM |
Not represented | Lost | TestCurrentBehaviour_LocalStateFileExactBytes, TestCurrentBehaviour_LocalStateUnknownFieldsAreDroppedOnRewrite |
Regression ratchet
architecture/instancestate parses every non-test production file with go/parser and fails on any new use of the daemon's instance-state bucket, key and local-file identifiers, vm.InstanceRecord, InstanceSpec, InstanceStatus, VMFromRecord and VM.Record(), the JetStreamManager instance-state methods (instance and terminated record access, the running-set projection, LoadState, and InitKVBucket and InitTerminatedInstanceBucket, which open the instance buckets), or the bucket and file names as string literals.
The JetStreamManager type and NewJetStreamManager are not matched, because the manager also serves cluster state; a cluster-state-only consumer such as INV-09 or INV-19 is not instance-state debt and is not flagged.
TestADR0007_S6_NoNewRawInstanceStateConsumers holds 67 allow-listed file and symbol pairs, each citing an inventory item above; the list only shrinks, a stale entry fails, and a walk that finds too little fails rather than passing vacuously.
TestADR0007_S6_RatchetDetectsFaults and TestADR0007_S6_RatchetSeesBareIdentifiersInOwnerPackages inject synthetic sources to prove the matcher detects each kind of use, ignores declarations, and does not flag the manager type, its constructor or a cluster-state method.
Adding a daemon.LocalStatePath use to runtime/roles/awsgw and renaming one allowlist file were each confirmed to fail the gate.
After narrowing, a runtime/roles/awsgw file constructing a manager and calling InitClusterStateBucket passed, the same file calling WriteRunningSet failed NoUnrecordedConsumer, and restoring the removed INV-19 entry failed Allowlist_NoStaleEntries.
Slice 1b step 1: record codec
e62f921d2 adds the record codec in the owner package; the design records it as Section 10 (C1 to C7) of docs/package-boundary/instance-state-transition-record-design.md.
No production reader or writer uses it, so every row of the generation matrix above still reads as characterised, and no path conforms to ADR-0007 yet.
The codec protects capable writers only: a deployed binary still decodes into the typed record and drops unknown members, and excluding such writers remains the activation gate's job.
Within the codec, an unchanged array keeps unknown members inside its elements, and a changed array is replaced whole and loses them.
architecture/instancestate lists spinifex/runtime/compute/vm/record_codec.go as an owner file; no allowlist entry was added.
Operator-visible rollout qualification (design clause G19): old read-only gateway consumers remain safe, but DescribeInstanceStatus gains unconfirmed/degraded visibility only after awsgw upgrades.
Close-out status
The table records every legacy directory still standing, what remains in it and what blocks its move. "Deferred: " names a recorded blocked-work series above; "needs decision" is open.
| Legacy path | What remains | What blocks it |
|---|---|---|
handlers/iam |
Private identity state and credential issuance; consumed by the EC2 instance and spot-instance AWS adapters, handlers/sts, gateway/sts, gateway/bedrock, the ELBv2 system-instance role path, ECR/Ochre signing-key crypto and operator/cli. |
Deferred: the ADR's handlers/iam row states a shared IAM contract is not inferred from current KV readers; each cross-domain reader needs an IAM capability first. |
handlers/sts |
Everything; not yet touched. | Deferred: Q-22 forbids the STS-to-EKS dependency in its present form; oidc_jwks.go still imports handlers/eks for AccountBucketName/OIDCJWKSKey. |
handlers/ecs |
Task, service and capacity resources (taskdefinition already extracted to domains/ecs/taskdefinition). |
Deferred: ADR-0004 blocked-dependency list — iam:PassRole in the gateway adapter and EC2/ELBv2/EIP adapters called as internal APIs. |
handlers/eks |
Nodegroup and cluster resources (access and addon already extracted). |
Deferred: ADR-0004 blocked-dependency list — IAM role/instance-profile creation, Bluebottle auth, the NATS CA, and EKS identity (token review, OIDC). |
handlers/rds |
The RDS instance resource (subnet group, parameter group and engine catalogue already extracted). | Deferred: ADR-0004 blocked-dependency list — quota admission, the duplicated expected-node fan-out, the IAM ensurer and the Bluebottle master key. |
handlers/elbv2 |
Everything; not yet touched. | Deferred: ADR-0001 sequences this after the ELBv2 data-plane boundary is settled. Needs decision: what evidence establishes that boundary is settled. |
handlers/iam/mock |
A test double for handlers/iam. |
Moves with handlers/iam; it has no independent target. |
gateway (root) |
Generic HTTP route assembly, SigV4/registry authentication, the policy gate, request-audit middleware, request-context keys, and the legacy per-service dispatch switch for every service not yet registered. | Deferred: the ADR-0002 phases above (auth/IAM and request-context boundary design) gate moving the audit, context-key and legacy-dispatch mechanics. |
gateway/bedrock |
The Ochre domain core, its stores and the inference engine, together with the Bedrock action layer, in one package with internal cycles. | Deferred: needs the split plan recorded above — domain core and stores to domains/ochre/<resource>, inference to an Ochre-owned package, and only the action layer to domains/ochre/awsapi. |
gateway/{ecs,eks,rds,iam,sts,elbv2} |
Each service's AWS action adapters and dispatch, not yet registered through ADR-0002. | Deferred: the ADR-0002 registration contract has only reached ECR and ACM so far; each service needs its own registration slice. |
gateway/spx |
promote_image.go and spx.go dispatch (storage.go already consumes contracts/operator/v1). |
Needs decision: which package owns operator-plane action dispatch registration — an ingress/aws-style seam for the operator plane, or gateway stays its home. |
gateway/tagging |
The cross-service tagging API (GetResources) and its authorization. |
Decided: a new domains/tagging boundary owns the cross-resource tagging API and aggregation; individual resource domains keep ownership of their own tag storage and expose narrow tagging capabilities. Stays debt until those per-domain capabilities exist; clears when domains/tagging aggregates only through them. |
services/viperblockd |
— | Done. The adapter is providers/ebs/viperblock (with the read-only dirty reader), the shared vocabulary is contracts/viperblockd/legacy/v1, and the role is runtime/roles/viperblockd. services/ is empty. |
utils |
— | Done and deleted. ec2_subject.go went to contracts/ec2/v1, the vpcd protocol to contracts/network/v1 with the typed client in domains/network/projection, and the master-key loader to domains/ec2/ebs/encryption. |
vpcd |
imds_instance_state.go reads daemon.LocalState, ReadLocalState, LocalStatePath, NewJetStreamManager and InstanceStateBucket directly (recorded above). |
Its inter-process boundary now exists (contracts/network/v1, with domains/network/subscribers as the consumer and domains/network/projection as the producer client). Moving vpcd to runtime/roles/vpcd remains blocked on a separate design task: a daemon-owned local-state capability or contract vpcd can consume instead of the daemon package. |
daemon |
Reserved as runtime/daemon's home only; not split or moved. |
Deferred: Q-28's write-side consolidation is a prerequisite ADR-0001 names explicitly. |
admin |
DefaultAccountID/DefaultAccountName (consumed by daemon, gateway, runtime/roles/awsgw, operator/cli), GenerateAWSAccessKey/GenerateAWSSecretKey (handlers/iam, operator/cli) and images_promote.go (daemon, gateway/spx, operator/cli). The operator use cases moved to operator/admin. |
Deferred to their owners: IAM/account bootstrap, IAM credentials, and the existing domains/ec2/image. |
accountteardown |
Direct calls into domains/ec2/awsapi/* action adapters (recorded above). |
Deferred: the ADR's accountteardown row replaces this with domain-owned cleanup capabilities. |
lbagent |
The whole package; handlers/elbv2 imports it as a domain-to-agent implementation edge (recorded above). |
Deferred: Q-30 reserves agents/elbv2 as its destination but forbids moving it as an isolated rename ahead of the common-agent design. |
migrate |
Nothing at the old path. | Split, not an exact ADR row: ADR-0001 maps migrate to foundation/state/migrate, but the package held two responsibilities. The KV migration engine and its tests are in foundation/state/migrate (8cd9cff75); the config-file and object-store upgrade workflow moved to operator/upgrade (919d5bfa6) by owner decision. Needs an ADR-0001 map clarification before this row can be claimed as target conformance. |
runtime/roles/awsgw carries two recorded residuals from its own move (931d86d5c
above) that are not yet re-homed: runQuotaReconcile/quotaKeyFor belong to
domains/admission/quota, which would become a domain-to-daemon edge if the reconcile loop stays where it runs today; and the
EKS token-verify responder belongs with STS or EKS identity.
Deliberately kept on their old names for telemetry continuity, not debt:
providers/ebs/telemetry.go keeps package ebsprovider, its tracerName
(.../spinifex/ebsprovider) and ebs.-prefixed span/attribute names;
runtime/compute/cache/metrics.go keeps package instancecache and the
mulga.instancecache.* counter names; runtime/compute/vm/lifecycle.go keeps
vmTracerName as .../spinifex/vm; and runtime/roles/qmpcollector keeps its
qmp-collector: log prefix. Changing any of these is a telemetry and APM-query
change, not a package move.
Image inputs deliberately left on their pre-move paths, for the same reason a
structural move must not alter delivery material: images/mkosi.profiles/ecs/mkosi.conf
and scripts/images/ecs-agent/manifest.conf still comment-reference
cmd/ecs-agent/credendpoint.go (now agents/ecs/agent/credendpoint.go);
images/mkosi.profiles/vllm/bedrock-serve_test.sh and its sibling
bedrock-serve script keep their Bedrock-era names; and
build/systemd/spinifex-viperblock.service keeps a comment naming
utils.KillProcess, as already recorded above.
Recording rule
For every later slice, add the old and new path, source commit, focused verification, and any finding exposed by the move. Record a conflict rather than folding a behavioural repair into a structural commit. When this branch is merged, the umbrella repository's execution plan records the resulting Spinifex commit.