rcf-lite 0.23.0 → 0.25.0

package/blueprints/application-notifications-in-app/docs/topics.md

@@ -21,7 +21,7 @@ The `application-notifications-` prefix is reserved for the sibling channel blue
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -31,6 +31,15 @@ The `application-notifications-` prefix is reserved for the sibling channel blue
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 | application-notifications-email (reserved) | to be claimed at ship | to be claimed at ship | name-only doc reservation (not shipped) | tba |
 | application-notifications-push (reserved) | to be claimed at ship | to be claimed at ship | name-only doc reservation (not shipped) | tba |
 | application-notifications-webhook (reserved) | to be claimed at ship | to be claimed at ship | name-only doc reservation (not shipped) | tba |

package/blueprints/application-onboarding-tour/docs/topics.md

@@ -17,7 +17,7 @@ The blueprint claims no new global topics at v1.0.0. Onboarding-tour is a consum
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -27,6 +27,15 @@ The blueprint claims no new global topics at v1.0.0. Onboarding-tour is a consum
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-spa/docs/topics.md

@@ -47,7 +47,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -57,6 +57,15 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 SPA v1.1.0 stays on the LOW end of its band: v1.0.0 occupied US-1101 through US-1128; v1.1.0 adds US-1129 and US-1130, leaving headroom above 1130 for future minor bumps and for project-side stories that mechanically derive to the 11xx numeric range.
 

package/blueprints/delivery-ci-workflows/docs/topics.md

@@ -53,7 +53,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -63,6 +63,15 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 US 6101-6110 sit at the LOW end of the 6101-6899 band on purpose. A project-side story that mechanically derives from `delivery-ci-workflows-REQ-011` into the number `6111` would collide against delivery-ci-workflows-US-6111 in this package; the band leaves headroom at the HIGH end (US 6181-6899) so a project's own stories anchored to delivery-ci-workflows REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/deploy-cloudflare-workers/docs/topics.md

@@ -39,7 +39,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -49,6 +49,15 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 US 12101-12112 sit at the LOW end of the 12101-12899 band on purpose. A project-side story that mechanically derives from a deploy-cloudflare-workers REQ id into the number `12112` would collide against deploy-cloudflare-workers-US-12112 in this package; the band leaves headroom at the HIGH end (US 12181-12899) so a project's own stories anchored to deploy-cloudflare-workers REQs can allocate without conflict. The watchpost run4 lesson applies here too. Band spacing between the last shipped block (security-secrets-management, 8101-8899, 9xx) and this one (12101-12899, 13xx) leaves the 9xxx-11xxx US bands and the 10xx-12xx suffix blocks open for concurrent-lane authoring so a peer authoring another blueprint in the same PR window does not collide with this one.
 

package/blueprints/deploy-hetzner-server/CHANGELOG.md

@@ -0,0 +1,34 @@
+# deploy-hetzner-server changelog
+
+## 1.0.0
+
+Initial shelf release. Ships an hcloud-shaped provisioner facade
+(with a raw-api elicited alternative) as the sole reader of the
+Hetzner API token; a manifest schema at `hetzner/servers/*.json`; a
+cloud-init template landing the six-block hardening baseline (SSH
+key-only, root disabled, UFW default-deny incoming, DOCKER-USER
+iptables chain, fail2ban SSH jail, unattended-upgrades); a firewall
+rule shape (22 from operator-nominated prefixes, 80/443 open, deny
+all else); a snapshot cadence elicit (weekly default, daily and off
+alternatives) plus a snapshot-on-demand verb; four metadata-only
+lifecycle events (`provisionerReady`, `hetznerServerProvisioned`,
+`hetznerSnapshotTaken`, `hetznerServerDestroyed`). Provides the
+`cloudHost` capability. Mints two new global topics:
+`linuxCloudHostContract` and `snapshotAndBackupCadence`. Suggests
+companions `logging` and `errorHandling`.
+
+Ships six Node-only probes: `cloud-init-render-lint`,
+`manifest-schema-validate`, `hcloud-dry-run-mock` (three mocked; each
+paired with a mutation switch that flips the probe to FAIL), plus
+`real-account-throwaway-server-provision`,
+`real-account-cloud-init-hardened`,
+`real-account-snapshot-on-demand` (three account-bound; skipped
+without `CI_HAS_HETZNER_ACCOUNT`).
+
+Mints the shared `hetzner-throwaway-server` fixture under
+`packages/rcf-lite/test/fixtures/` (round-7 T-2 and T-3 EXTEND it,
+they do not ship a second copy).
+
+Trace: hetzner-round-7-spec-2026-09-07.md section 5.1;
+Baz ruling 2026-09-07 09:50Z (decisions 18 through 24 approved as
+recommended, "round 7 - agreee to all").

package/blueprints/deploy-hetzner-server/README.md

@@ -0,0 +1,202 @@
+# deploy-hetzner-server v1.0.0
+
+Ship a Hetzner Cloud Linux VM as the project's `cloudHost`. A facade
+over `hcloud` (or the raw Hetzner Cloud REST API) that provisions a
+server from a git-managed manifest, lands a six-block hardening
+baseline via cloud-init, applies a documented firewall shape, and
+emits four metadata-only lifecycle events on the injected sink.
+
+- Category: `deploy` (sibling of `deploy-cloudflare-workers`; the deploy
+  family enforces one target per project at apply time).
+- Capabilities provided: `cloudHost`.
+- Suggested companions: `logging`, `errorHandling`.
+- New global topics minted: `linuxCloudHostContract`,
+  `snapshotAndBackupCadence`.
+
+## What the blueprint contracts
+
+Six REQs realise the shape:
+
+| REQ | What it commits |
+|---|---|
+| REQ-001 | The provisioner facade is the sole reader of `HETZNER_ACCOUNT_API_KEY` and emits `provisionerReady` with `{tool, apiHost}` on boot. |
+| REQ-002 | Server declarations live at `hetzner/servers/<name>.json` and validate against the shipped JSON Schema (nine required fields). |
+| REQ-003 | The cloud-init template renders YAML that lands the six hardening baseline blocks on every provisioned server. |
+| REQ-004 | Firewall rule shape: 22 from operator-nominated prefixes, 80 and 443 open, all other inbound denied. Applied at provision time. |
+| REQ-005 | Snapshot cadence elicited (weekly default, daily and off alternatives). A snapshot-on-demand verb fires a tagged snapshot. |
+| REQ-006 | Four lifecycle events fire with metadata-only payloads; no event body carries the token, an ssh private key, or the user-data body. |
+
+Nine USs (37101 through 37109) split those REQs into one user story
+per shape plus three cross-cutting cases: manifest-applies,
+cloud-init-hardened, snapshot-on-demand.
+
+Four TACs anchor the mechanism: `TAC-3801` provisioner, `TAC-3802`
+manifest schema, `TAC-3803` cloud-init template, `TAC-3804` firewall
+shape.
+
+Four ADRs record the load-bearing decisions:
+
+- `ADR-3801` cloud host contract (scope global, new topic
+  `linuxCloudHostContract`).
+- `ADR-3802` snapshot cadence (scope global, new topic
+  `snapshotAndBackupCadence`); weekly default; Hetzner-managed backups
+  are an elicited paid opt-in at approximately 20 percent of monthly
+  server price per
+  https://docs.hetzner.com/cloud/servers/backups-snapshots/overview.
+- `ADR-3803` provisioning tool: `hcloud` default, `raw-api`
+  alternative, Terraform rejected on second toolchain and state file
+  grounds per Baz ruling 2026-09-07.
+- `ADR-3804` hardening baseline: the six blocks named below.
+
+## Two provisioner paths: hcloud and raw-api
+
+The `provisioningTool` elicit takes `hcloud` (default) or `raw-api`.
+Both paths sit behind the same facade so consumer code never diverges.
+
+- `hcloud` shells to the Hetzner Cloud CLI with `--output json` for
+  every verb. Small, self-documenting, dependency-free (the operator
+  installs the binary once). Vendor doc:
+  https://github.com/hetznercloud/cli.
+- `raw-api` fetches the Hetzner Cloud REST API directly. Useful when
+  the target host or CI runner cannot install a binary. Vendor doc:
+  https://docs.hetzner.cloud/.
+
+## Hardening baseline (per ADR-3804)
+
+Every rendered cloud-init lands these six blocks. The render-lint
+probe asserts each block appears in the YAML; the
+`SIMULATE_HARDENING_DRIFT` mutation removes a block and the probe
+FAILS naming the missing line.
+
+1. SSH key-only. `PasswordAuthentication no` via
+   `/etc/ssh/sshd_config.d/hardening.conf`.
+2. Root disabled. `PermitRootLogin no` in the same file.
+3. UFW default-deny incoming with 22, 80, 443 permitted per the
+   manifest firewall shape.
+4. DOCKER-USER iptables chain wired to drop non-conforming egress
+   (loaded on boot via `iptables-persistent`).
+5. fail2ban SSH jail on port 22.
+6. `unattended-upgrades` on for security updates per
+   https://wiki.debian.org/UnattendedUpgrades.
+
+## Elicited parameters
+
+| Elicit | Choices | Default |
+|---|---|---|
+| `provisioning-tool` | `hcloud`, `raw-api` | `hcloud` (ADR-3803) |
+| `server-type` | `cx23`, `cx33`, `cx43`, `cpx11`..`cpx41`, `cax11`..`cax31` | `cx23` |
+| `location` | `fsn1`, `nbg1`, `hel1`, `ash`, `hil` | `fsn1` (Baz ruling 2026-09-07 09:50Z) |
+| `image` | any Hetzner image slug | `ubuntu-24.04` |
+| `ssh-source-prefixes` | CSV of CIDR ranges | `203.0.113.0/24` (example only; supply the real prefix set) |
+| `firewall-id` | existing firewall id or empty | empty (create from `firewallRules`) |
+| `snapshot-cadence` | `weekly`, `daily`, `off` | `weekly` (ADR-3802) |
+| `hetzner-managed-backups` | `true`, `false` | `false` (ADR-3802) |
+
+ssh-key ids are delegated to `security-secrets-management`; the
+manifest carries a nonempty array of key references (names) and the
+facade never sees the private material.
+
+## Companions
+
+- `logging` supplies the sink factory for the four lifecycle events.
+- `errorHandling` supplies the internal-error record factory and the
+  facade boundary that turns hcloud non-zero exits, rate-limited API
+  calls, firewall-apply failures and cloud-init timeouts into typed
+  records.
+
+## The six probes and how to run them
+
+Every probe lives at `contributions/probes/<name>.mjs` with a
+`run-<name>.mjs` shim, and is exercised through a fixture-side
+`run-<name>.mjs` under
+`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/`.
+
+- Three mocked probes run in-process without an API call:
+  - `cloud-init-render-lint` (AC-37104-1): renders the template
+    against the fixture manifest and asserts the six baseline blocks
+    appear. Mutation switch: `SIMULATE_HARDENING_DRIFT=true`.
+  - `manifest-schema-validate` (AC-37102-1, also AC-37106-1 and
+    AC-37107-1): validates every fixture manifest. Mutation switch:
+    `SIMULATE_MANIFEST_INVALID=true`.
+  - `hcloud-dry-run-mock` (AC-37101-1 and AC-37109-1): drives the
+    facade lifecycle against a mocked hcloud shim and asserts every
+    lifecycle event fires with a metadata-only payload; runs an
+    event-secrecy scan across every event body. Mutation switches:
+    `SIMULATE_JSON_PARSE_STRIP=true` (parser failure) and
+    `SIMULATE_EVENT_SECRECY_LEAK=true` (defensive-fake token leak).
+- Three account-bound probes gate on `CI_HAS_HETZNER_ACCOUNT`:
+  - `real-account-throwaway-server-provision` (AC-37103-1): applies
+    the ci-throwaway manifest, asserts the server appears in
+    `hcloud server list`, tears down in `always()`.
+  - `real-account-cloud-init-hardened` (AC-37105-1): waits for
+    `cloud-init status --wait`, runs six ssh baseline checks.
+  - `real-account-snapshot-on-demand` (AC-37108-1): fires the snapshot
+    verb, asserts a tagged snapshot appears in `hcloud image list`.
+
+Without `CI_HAS_HETZNER_ACCOUNT=true` the three account-bound probes
+record `accountBoundSkipped: true` and the aggregate flips to pass per
+hetzner-round-7-spec-2026-09-07.md section 3.5.
+
+Reviewer boot from the fixture directory (mocked path, no account):
+
+```
+cd packages/rcf-lite/test/fixtures/hetzner-throwaway-server
+node ./run-cloud-init-render-lint.mjs && node ./run-manifest-schema-validate.mjs && node ./run-hcloud-dry-run-mock.mjs
+```
+
+Every probe writes its report envelope to
+`.rcf/reports/blueprints/deploy-hetzner-server/<probe-name>.json`.
+
+## Shared throwaway-server fixture
+
+The one new pattern this round. Lives at
+`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/`; ships
+`provision.mjs`, `destroy.mjs`, `sweep-orphans.mjs`, the mocked hcloud
+shim and the manifest at `hetzner/servers/ci-throwaway.json`. T-2
+(`platform-docker-compose-host`) and T-3 (`edge-cloudflare-tunnel`)
+EXTEND the fixture rather than shipping a second copy. Cost ceiling:
+one `cx23` at approximately EUR 0.006/hour per run; destroy runs in
+`always()`; the nightly `sweep-orphans` cron collects any leak with a
+60-minute label-age cutoff and emits a `throwawayServerSweptCount`
+metric.
+
+## When to reach for this blueprint
+
+Reach for `deploy-hetzner-server` when the project needs a persistent
+Linux runtime: something a Cloudflare Worker cannot host (a
+long-running process, a container runtime, an outbound network
+adapter that needs a stable egress). Sibling `deploy-cloudflare-workers`
+still ships every V8-isolate workload the Workers runtime accepts;
+this blueprint is the Hetzner-line answer for the workloads Workers
+cannot host.
+
+## Consumers
+
+- ops-01 is the first HQ consumer (`w-2026-09-07-dave-004` migration).
+- Round-7 T-2 `platform-docker-compose-host` composes on
+  `capabilities: [cloudHost]`.
+- Round-7 T-3 `edge-cloudflare-tunnel` composes on `cloudHost` (via
+  the systemd unit shape) or on `containerHost` (via T-2).
+
+Blueprint acceptance never depends on the ops-01 migration.
+
+## Standards trace
+
+- Hetzner Cloud API: https://docs.hetzner.cloud/
+- Hetzner Cloud CLI: https://github.com/hetznercloud/cli
+- Hetzner Cloud servers overview: https://docs.hetzner.com/cloud/servers/overview
+- Hetzner Cloud firewalls overview: https://docs.hetzner.com/cloud/firewalls/overview/
+- Hetzner Cloud backups-and-snapshots overview:
+  https://docs.hetzner.com/cloud/servers/backups-snapshots/overview
+- Hetzner Cloud networks overview: https://docs.hetzner.com/cloud/networks/overview/
+- Hetzner community basic cloud-config tutorial:
+  https://community.hetzner.com/tutorials/basic-cloud-config
+- cloud-init documentation: https://cloudinit.readthedocs.io/en/latest/
+- Debian unattended-upgrades wiki: https://wiki.debian.org/UnattendedUpgrades
+
+## Rejected alternatives
+
+- Terraform. Adds a second toolchain and a state file that nobody in
+  the estate needs. Baz ruling 2026-09-07 09:50Z on decision 18.
+- A Load Balancer blueprint. Out of scope for round-7 T-1; may ship as
+  a follow-up if a second Hetzner consumer needs it.

package/blueprints/deploy-hetzner-server/blueprint.json

@@ -0,0 +1,233 @@
+{
+  "slug": "deploy-hetzner-server",
+  "version": "1.0.0",
+  "category": "deploy",
+  "capabilities": [
+    "cloudHost"
+  ],
+  "suggestedCompanions": [
+    {
+      "role": "logging",
+      "reason": "Every provisioner lifecycle event (provisionerReady, hetznerServerProvisioned, hetznerSnapshotTaken, hetznerServerDestroyed) writes through the applied logger; a logging companion supplies the factory."
+    },
+    {
+      "role": "errorHandling",
+      "reason": "An hcloud CLI non-zero exit, a rate-limited API call, a firewall-apply failure, a cloud-init timeout constructs an internal error record; an error-handling companion supplies the record factory and the boundary."
+    }
+  ],
+  "elicits": [
+    {
+      "id": "provisioning-tool",
+      "prompt": "Provisioning tool for Hetzner Cloud verbs: hcloud (default per ADR-3803, small self-documenting CLI with --output json) or raw-api (the provisioner fetches the Hetzner Cloud REST API directly, useful when the CI runner cannot install the binary).",
+      "kind": "enum",
+      "options": [
+        "hcloud",
+        "raw-api"
+      ],
+      "default": "hcloud"
+    },
+    {
+      "id": "server-type",
+      "prompt": "Hetzner Cloud shared-vCPU server type. cx23 is the cheapest shipped default; cx33 has more RAM and vCPU for a small compose stack.",
+      "kind": "enum",
+      "options": [
+        "cx23",
+        "cx33",
+        "cx43",
+        "cpx11",
+        "cpx21",
+        "cpx31",
+        "cpx41",
+        "cax11",
+        "cax21",
+        "cax31"
+      ],
+      "default": "cx23"
+    },
+    {
+      "id": "location",
+      "prompt": "Hetzner data centre. fsn1 (Falkenstein) is the shipped default per Baz ruling 2026-09-07 09:50Z on the Q2 ratification.",
+      "kind": "enum",
+      "options": [
+        "fsn1",
+        "nbg1",
+        "hel1",
+        "ash",
+        "hil"
+      ],
+      "default": "fsn1"
+    },
+    {
+      "id": "image",
+      "prompt": "Base image. ubuntu-24.04 is the shipped default; the six-block hardening baseline in the cloud-init template targets Debian and Ubuntu shapes.",
+      "kind": "string",
+      "default": "ubuntu-24.04"
+    },
+    {
+      "id": "ssh-source-prefixes",
+      "prompt": "Comma-separated CIDR list permitted on port 22 (operator-nominated set; the manifest schema refuses on 0.0.0.0/0). Populates firewallRules[ssh].sourceIps per TAC-3804.",
+      "kind": "string",
+      "default": "203.0.113.0/24"
+    },
+    {
+      "id": "firewall-id",
+      "prompt": "Reuse an existing Hetzner Cloud firewall id, or leave empty to have the provisioner create one from firewallRules.",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "snapshot-cadence",
+      "prompt": "Snapshot cadence per ADR-3802. weekly is the recommended default; daily has higher recovery-point objective and cost; off skips the scheduled snapshot runner.",
+      "kind": "enum",
+      "options": [
+        "weekly",
+        "daily",
+        "off"
+      ],
+      "default": "weekly"
+    },
+    {
+      "id": "hetzner-managed-backups",
+      "prompt": "Opt-in to Hetzner-managed backups (paid, approximately 20 percent of monthly server price per ADR-3802).",
+      "kind": "enum",
+      "options": [
+        "true",
+        "false"
+      ],
+      "default": "false"
+    }
+  ],
+  "contributions": [
+    {
+      "id": "deploy-hetzner-server-REQ-001",
+      "kind": "req",
+      "path": "requirements/deploy-hetzner-server-req-001.json"
+    },
+    {
+      "id": "deploy-hetzner-server-REQ-002",
+      "kind": "req",
+      "path": "requirements/deploy-hetzner-server-req-002.json"
+    },
+    {
+      "id": "deploy-hetzner-server-REQ-003",
+      "kind": "req",
+      "path": "requirements/deploy-hetzner-server-req-003.json"
+    },
+    {
+      "id": "deploy-hetzner-server-REQ-004",
+      "kind": "req",
+      "path": "requirements/deploy-hetzner-server-req-004.json"
+    },
+    {
+      "id": "deploy-hetzner-server-REQ-005",
+      "kind": "req",
+      "path": "requirements/deploy-hetzner-server-req-005.json"
+    },
+    {
+      "id": "deploy-hetzner-server-REQ-006",
+      "kind": "req",
+      "path": "requirements/deploy-hetzner-server-req-006.json"
+    },
+    {
+      "id": "deploy-hetzner-server-US-37101",
+      "kind": "us",
+      "path": "user-stories/deploy-hetzner-server-us-37101.json"
+    },
+    {
+      "id": "deploy-hetzner-server-US-37102",
+      "kind": "us",
+      "path": "user-stories/deploy-hetzner-server-us-37102.json"
+    },
+    {
+      "id": "deploy-hetzner-server-US-37103",
+      "kind": "us",
+      "path": "user-stories/deploy-hetzner-server-us-37103.json"
+    },
+    {
+      "id": "deploy-hetzner-server-US-37104",
+      "kind": "us",
+      "path": "user-stories/deploy-hetzner-server-us-37104.json"
+    },
+    {
+      "id": "deploy-hetzner-server-US-37105",
+      "kind": "us",
+      "path": "user-stories/deploy-hetzner-server-us-37105.json"
+    },
+    {
+      "id": "deploy-hetzner-server-US-37106",
+      "kind": "us",
+      "path": "user-stories/deploy-hetzner-server-us-37106.json"
+    },
+    {
+      "id": "deploy-hetzner-server-US-37107",
+      "kind": "us",
+      "path": "user-stories/deploy-hetzner-server-us-37107.json"
+    },
+    {
+      "id": "deploy-hetzner-server-US-37108",
+      "kind": "us",
+      "path": "user-stories/deploy-hetzner-server-us-37108.json"
+    },
+    {
+      "id": "deploy-hetzner-server-US-37109",
+      "kind": "us",
+      "path": "user-stories/deploy-hetzner-server-us-37109.json"
+    },
+    {
+      "id": "TAC-3801-deploy-hetzner-server-provisioner",
+      "kind": "tac",
+      "path": "tacs/tac-3801-deploy-hetzner-server-provisioner.json"
+    },
+    {
+      "id": "TAC-3802-deploy-hetzner-server-manifest-schema",
+      "kind": "tac",
+      "path": "tacs/tac-3802-deploy-hetzner-server-manifest-schema.json"
+    },
+    {
+      "id": "TAC-3803-deploy-hetzner-server-cloud-init-template",
+      "kind": "tac",
+      "path": "tacs/tac-3803-deploy-hetzner-server-cloud-init-template.json"
+    },
+    {
+      "id": "TAC-3804-deploy-hetzner-server-firewall-shape",
+      "kind": "tac",
+      "path": "tacs/tac-3804-deploy-hetzner-server-firewall-shape.json"
+    },
+    {
+      "id": "ADR-3801-deploy-hetzner-server-cloud-host-contract",
+      "kind": "adr",
+      "path": "adrs/adr-3801-deploy-hetzner-server-cloud-host-contract.json",
+      "scope": "global",
+      "topic": "linuxCloudHostContract",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "Hetzner Cloud API server resource and cloud-init user-data contract per hetzner-round-7-spec-2026-09-07.md"
+    },
+    {
+      "id": "ADR-3802-deploy-hetzner-server-snapshot-cadence",
+      "kind": "adr",
+      "path": "adrs/adr-3802-deploy-hetzner-server-snapshot-cadence.json",
+      "scope": "global",
+      "topic": "snapshotAndBackupCadence",
+      "recommendedDefault": true,
+      "elicited": true,
+      "standardsTraceClause": "Hetzner Cloud backups-and-snapshots documented pricing and mechanism per hetzner-round-7-spec-2026-09-07.md"
+    },
+    {
+      "id": "ADR-3803-deploy-hetzner-server-provisioning-tool",
+      "kind": "adr",
+      "path": "adrs/adr-3803-deploy-hetzner-server-provisioning-tool.json",
+      "recommendedDefault": true,
+      "elicited": true,
+      "standardsTraceClause": "Hetzner Cloud CLI documented resource verbs per hetzner-round-7-spec-2026-09-07.md"
+    },
+    {
+      "id": "ADR-3804-deploy-hetzner-server-hardening-baseline",
+      "kind": "adr",
+      "path": "adrs/adr-3804-deploy-hetzner-server-hardening-baseline.json",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "Debian unattended-upgrades wiki AND the estate baseline at operator/knowledge/systems/environments/hetzner-cloud/overview.md Security posture baseline per hetzner-round-7-spec-2026-09-07.md"
+    }
+  ]
+}

package/blueprints/deploy-hetzner-server/contributions/adrs/adr-3801-deploy-hetzner-server-cloud-host-contract.json

@@ -0,0 +1,14 @@
+{
+  "adrId": "ADR-3801-deploy-hetzner-server-cloud-host-contract",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Cloud host contract: Hetzner Cloud VM as the shipped cloudHost shape (scope global, new topic linuxCloudHostContract)",
+  "context": "An applying project needs a first-class Linux VM contract that container-orchestration and edge-ingress consumers (round-7 T-2 platform-docker-compose-host, T-3 edge-cloudflare-tunnel) can compose on. Hetzner Cloud servers plus cloud-init user-data provide the v1.0.0 shape per https://docs.hetzner.cloud/ and https://docs.hetzner.com/cloud/servers/overview. Every applied cloud host needs one project-wide answer to the linuxCloudHostContract topic; a future non-Hetzner sibling (Vultr, DigitalOcean, Fly.io) would contribute the same topic string with a different provider, forcing a DELIBERATE conflict the operator resolves per the round-2 conflict pattern.",
+  "decision": "The shipped v1.0.0 default is a Hetzner Cloud server as the linuxCloudHostContract provider. The provisioner reads its shape from the applying manifest at hetzner/servers/name.json (TAC-3802) and creates a matching live server via hcloud CLI verbs (ADR-3803) or the raw Hetzner Cloud API. The linuxCloudHostContract topic scope is global on this blueprint; the topic string is linuxCloudHostContract (lower camelCase, one concept per topic, no version suffix, per the round-2 rules-for-new-topics clause on the shelf registry). Standards trace clause: Hetzner Cloud API server resource and cloud-init user-data contract per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "Consumer blueprints that run on a Linux host declare capabilities: [cloudHost] on their applied contract; the round-7 T-2 platform-docker-compose-host reads this capability at apply-time. Rebuild-from-manifest is always possible: the manifest is the source of truth, the live server is derivative. Drift from the shipped manifest to the live server is out of scope for v1.0.0; a later minor may add a drift-audit runner.",
+  "alternativesConsidered": [],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/adrs/adr-3802-deploy-hetzner-server-snapshot-cadence.json

@@ -0,0 +1,14 @@
+{
+  "adrId": "ADR-3802-deploy-hetzner-server-snapshot-cadence",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Snapshot cadence: weekly default, daily and off alternatives, Hetzner-managed backups elicited (scope global, new topic snapshotAndBackupCadence)",
+  "context": "An applying project needs a discipline for how often the Hetzner Cloud server takes a snapshot and whether Hetzner-managed backups are enabled. Hetzner documents snapshots as manual on-demand actions kept on cloud storage, and Hetzner-managed backups as a paid subscription at approximately 20 percent of monthly server price per https://docs.hetzner.com/cloud/servers/backups-snapshots/overview. Every cloud host needs one project-wide answer to the snapshotAndBackupCadence topic; a future sibling snapshot mechanism would contribute the same topic string with a different answer and force a DELIBERATE conflict.",
+  "decision": "The shipped v1.0.0 default is weekly snapshot cadence fired by a scheduled snapshot runner in the applying project. Alternatives elicited: daily (higher recovery-point objective, higher storage cost) and off (no automatic snapshot). Hetzner-managed backups are an elicited paid opt-in (approximately 20 percent monthly per the vendor docs); when opted-in, the scheduled snapshot runner still fires so the two mechanisms compose. The snapshotAndBackupCadence topic scope is global on this blueprint. recommendedDefault: true. Standards trace clause: Hetzner Cloud backups-and-snapshots documented pricing and mechanism per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "Weekly snapshot on a cx23 costs approximately EUR 0.005 per month in extra storage; daily is approximately EUR 0.035; Hetzner-managed backups add approximately EUR 0.80 per month on a cx23. The scheduled snapshot runner emits hetznerSnapshotTaken with snapshot id and wall-clock time so the observability sink surfaces the cadence.",
+  "alternativesConsidered": [],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}