rcf-lite 0.23.0 → 0.25.0

package/blueprints/deploy-hetzner-server/contributions/adrs/adr-3803-deploy-hetzner-server-provisioning-tool.json

@@ -0,0 +1,20 @@
+{
+  "adrId": "ADR-3803-deploy-hetzner-server-provisioning-tool",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Provisioning tool: hcloud CLI default, raw Hetzner Cloud API alternative, Terraform rejected",
+  "context": "An applying project needs a documented answer to how the provisioner shells out to Hetzner Cloud. Options considered: hcloud CLI (small, self-documenting, JSON output on --output json, per https://github.com/hetznercloud/cli); the raw Hetzner Cloud REST API (no CLI dependency, useful when the target host cannot install a binary, per https://docs.hetzner.cloud/); Terraform (declarative, adds a second toolchain and a state file). Baz ruling 2026-09-07 09:50Z on decision 18 of the round-7 summary: hcloud not Terraform. Terraform adds a second toolchain and a state file that nobody in the estate needs.",
+  "decision": "The shipped v1.0.0 default is the hcloud CLI as the provisioning tool. Alternative elicited: raw-api (the provisioner fetches the Hetzner Cloud REST API directly). Terraform is a rejected alternative recorded in the blueprint README section 9 rejected-alternatives. elicited: true. recommendedDefault: hcloud. Standards trace clause: Hetzner Cloud CLI documented resource verbs per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "The applying project installs the hcloud binary on the operator laptop and every CI runner that provisions. The raw-api fork sits behind the same provisioner facade so no consumer code diverges. The provisioner-facade sole-reader guarantee holds on both paths.",
+  "alternativesConsidered": [
+    {
+      "id": "terraform",
+      "summary": "Terraform declaring the Hetzner resources with the hetznercloud provider.",
+      "rejectedBecause": "Adds a second toolchain and a state file. The state file becomes a new source of truth to reconcile with git and with the live account. Baz ruling 2026-09-07 09:50Z."
+    }
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/adrs/adr-3804-deploy-hetzner-server-hardening-baseline.json

@@ -0,0 +1,14 @@
+{
+  "adrId": "ADR-3804-deploy-hetzner-server-hardening-baseline",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Hardening baseline: SSH key-only, root disabled, UFW default-deny, DOCKER-USER chain, fail2ban, unattended-upgrades",
+  "context": "Every Hetzner server exposed to the public internet needs a minimum hardening set. Cloud-init landing the set at first boot is the operator-friendly shape: declarative, reproducible, kept in git per https://cloudinit.readthedocs.io/en/latest/. The Debian unattended-upgrades wiki (https://wiki.debian.org/UnattendedUpgrades) documents the auto-update mechanism the baseline turns on; the estate baseline at operator/knowledge/systems/environments/hetzner-cloud/overview.md Security posture baseline names the exact block set. The Hetzner community basic-cloud-config tutorial (https://community.hetzner.com/tutorials/basic-cloud-config) shows the vendor-recommended shape.",
+  "decision": "The shipped v1.0.0 hardening baseline is the six blocks: SSH key-only (PasswordAuthentication no), root disabled (PermitRootLogin no), UFW default-deny incoming with 22, 80 and 443 permitted per the manifest firewall shape, DOCKER-USER iptables chain wired to drop non-conforming egress, fail2ban SSH jail, unattended-upgrades on for security updates. The render-lint probe (cloud-init-render-lint.mjs) asserts every block appears in the rendered cloud-init YAML; the SIMULATE_HARDENING_DRIFT mutation removes a block and the probe FAILS naming the missing line. recommendedDefault: true. Standards trace clause: Debian unattended-upgrades wiki AND the estate baseline at operator/knowledge/systems/environments/hetzner-cloud/overview.md Security posture baseline per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "The applying project inherits the six-block baseline on every provisioned server. Deviation costs a fresh ADR at the applying project level. The baseline is text plus a rendered template; extension (extra ssh key, extra fail2ban jail) sits on top without rewriting.",
+  "alternativesConsidered": [],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/probes/cloud-init-render-lint.mjs

@@ -0,0 +1,64 @@
+// Probe: cloud-init render lint.
+//
+// anchorAcId: AC-37104-1. accountBound: false.
+//
+// Renders the shipped cloud-init template against the fixture manifest at
+// packages/rcf-lite/test/fixtures/hetzner-throwaway-server/hetzner/servers/ci-throwaway.json
+// via the fixture's src/cloud-init-renderer.mjs. Asserts the six hardening
+// baseline blocks appear in the rendered YAML.
+//
+// SIMULATE_HARDENING_DRIFT=true removes the unattended-upgrades write-file
+// block from the rendered YAML; the probe FAILS naming the missing line
+// per hetzner-round-7-spec-2026-09-07.md section 3.4 lesson 4.
+
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { FIXTURE_DIR } from './probe-utils.mjs';
+
+export const anchorAcId = 'AC-37104-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const rendererPath = resolve(FIXTURE_DIR, 'src/cloud-init-renderer.mjs');
+  const manifestPath = resolve(FIXTURE_DIR, 'hetzner/servers/ci-throwaway.json');
+  const { renderCloudInit, BASELINE_BLOCKS } = await import(rendererPath);
+  const manifest = JSON.parse(await readFile(manifestPath, 'utf8'));
+  const rendered = await renderCloudInit(manifest);
+  const missing = [];
+  const present = [];
+  for (const block of BASELINE_BLOCKS) {
+    const ok = block.markers.every((m) => rendered.includes(m));
+    if (ok) {
+      present.push(block.id);
+    } else {
+      const missingMarkers = block.markers.filter((m) => !rendered.includes(m));
+      missing.push({ id: block.id, label: block.label, missingMarkers });
+    }
+  }
+  const results = [];
+  if (missing.length > 0) {
+    for (const m of missing) {
+      results.push({
+        anchorAcId,
+        verdict: 'fail',
+        detail: `cloud-init hardening baseline block "${m.label}" is missing from the rendered YAML (missing markers: ${m.missingMarkers.join(', ')}).`,
+      });
+    }
+  } else {
+    results.push({
+      anchorAcId,
+      verdict: 'pass',
+      detail: `all ${BASELINE_BLOCKS.length} baseline blocks present in the rendered YAML: ${present.join(', ')}.`,
+    });
+  }
+  return {
+    results,
+    extra: {
+      manifestName: manifest.name,
+      renderedByteLength: rendered.length,
+      presentBlocks: present,
+      missingBlocks: missing.map((m) => m.id),
+      mutationActive: process.env.SIMULATE_HARDENING_DRIFT === 'true',
+    },
+  };
+}

package/blueprints/deploy-hetzner-server/contributions/probes/hcloud-dry-run-mock.mjs

@@ -0,0 +1,116 @@
+// Probe: hcloud dry-run mock.
+//
+// anchorAcId: AC-37101-1 (provisioner facade sole reader + provisionerReady
+// on boot; also covers AC-37109-1 event-secrecy across the lifecycle).
+// accountBound: false.
+//
+// Drives the provisioner facade with the fixture's ci-throwaway manifest
+// against the mocked hcloud shim (src/hcloud-mock.mjs). Asserts:
+//   - the facade opens on ready() and fires provisionerReady with a
+//     metadata-only payload {tool, apiHost}.
+//   - createServer parses the mocked JSON stdout and emits
+//     hetznerServerProvisioned with id, primaryIpv4, location=fsn1,
+//     serverType=cx23.
+//   - takeSnapshot fires hetznerSnapshotTaken with snapshot id and time.
+//   - destroyServer fires hetznerServerDestroyed with the id.
+//   - no event body across the run carries the token, an ssh private-key
+//     marker, or the rendered user-data bytes (event-secrecy check).
+//
+// Mutations:
+//   SIMULATE_JSON_PARSE_STRIP=true has hcloud-mock.mjs return non-JSON
+//   stdout so JSON.parse throws and the probe FAILS.
+//   SIMULATE_EVENT_SECRECY_LEAK=true has provisioner-facade.mjs inject
+//   the token into the hetznerServerProvisioned payload; the event-
+//   secrecy scan FAILS with a defensive-fake finding.
+
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { FIXTURE_DIR } from './probe-utils.mjs';
+
+export const anchorAcId = 'AC-37101-1';
+export const accountBound = false;
+
+const TOKEN = 'test-fixture-token-000000000000000000000000000000000000000000';
+const USER_DATA_MARKER = 'unattended-upgrades on for security updates';
+const PRIVATE_KEY_MARKER = 'BEGIN OPENSSH PRIVATE KEY';
+
+export default async function runProbe() {
+  const facadePath = resolve(FIXTURE_DIR, 'src/provisioner-facade.mjs');
+  const manifestPath = resolve(FIXTURE_DIR, 'hetzner/servers/ci-throwaway.json');
+  const { createProvisionerFacade, createEventLog } = await import(facadePath);
+  const manifest = JSON.parse(await readFile(manifestPath, 'utf8'));
+  const { events, eventSink } = createEventLog();
+  const facade = createProvisionerFacade({
+    token: TOKEN,
+    tool: 'hcloud',
+    apiHost: 'https://api.hetzner.cloud/v1',
+    eventSink,
+  });
+  const results = [];
+  try {
+    await facade.ready();
+    const server = await facade.createServer(manifest);
+    const snapshot = await facade.takeSnapshot({ id: server.id, name: manifest.name }, `${manifest.name}-${new Date().toISOString()}`);
+    await facade.destroyServer(server);
+    const provisionerReady = events.find((e) => e.event === 'provisionerReady');
+    const provisioned = events.find((e) => e.event === 'hetznerServerProvisioned');
+    const snapped = events.find((e) => e.event === 'hetznerSnapshotTaken');
+    const destroyed = events.find((e) => e.event === 'hetznerServerDestroyed');
+    if (!provisionerReady) {
+      results.push({ anchorAcId: 'AC-37101-1', verdict: 'fail', detail: 'provisionerReady event did not fire on ready().' });
+    } else if (provisionerReady.tool !== 'hcloud' || provisionerReady.apiHost !== 'https://api.hetzner.cloud/v1') {
+      results.push({ anchorAcId: 'AC-37101-1', verdict: 'fail', detail: `provisionerReady payload shape wrong: ${JSON.stringify(provisionerReady)}` });
+    } else {
+      results.push({ anchorAcId: 'AC-37101-1', verdict: 'pass', detail: 'provisionerReady fired with metadata-only {tool, apiHost} payload.' });
+    }
+    if (!provisioned || !provisioned.id || !provisioned.primaryIpv4 || provisioned.location !== 'fsn1' || provisioned.serverType !== 'cx23') {
+      results.push({ anchorAcId: 'AC-37101-1', verdict: 'fail', detail: `hetznerServerProvisioned event missing or malformed: ${JSON.stringify(provisioned)}` });
+    } else {
+      results.push({ anchorAcId: 'AC-37101-1', verdict: 'pass', detail: `hetznerServerProvisioned fired with id=${provisioned.id} primaryIpv4=${provisioned.primaryIpv4} location=fsn1 serverType=cx23.` });
+    }
+    if (!snapped || !snapped.snapshotId || !snapped.wallClockTime) {
+      results.push({ anchorAcId: 'AC-37101-1', verdict: 'fail', detail: `hetznerSnapshotTaken event missing or malformed: ${JSON.stringify(snapped)}` });
+    }
+    if (!destroyed || !destroyed.id) {
+      results.push({ anchorAcId: 'AC-37101-1', verdict: 'fail', detail: `hetznerServerDestroyed event missing or malformed: ${JSON.stringify(destroyed)}` });
+    }
+    // Event-secrecy scan across every event body.
+    const leaks = [];
+    for (const e of events) {
+      const body = JSON.stringify(e);
+      if (body.includes(TOKEN)) leaks.push({ event: e.event, marker: 'HETZNER_ACCOUNT_API_KEY value' });
+      if (body.includes(PRIVATE_KEY_MARKER)) leaks.push({ event: e.event, marker: 'ssh private key' });
+      if (body.includes(USER_DATA_MARKER)) leaks.push({ event: e.event, marker: 'rendered user-data bytes' });
+    }
+    if (leaks.length > 0) {
+      results.push({
+        anchorAcId: 'AC-37109-1',
+        verdict: 'fail',
+        detail: `event-secrecy leak: ${leaks.map((l) => `${l.event} carries ${l.marker}`).join('; ')} (defensive-fake finding; check for a SIMULATE_EVENT_SECRECY_LEAK mutation).`,
+      });
+    } else {
+      results.push({
+        anchorAcId: 'AC-37109-1',
+        verdict: 'pass',
+        detail: `event-secrecy scan across ${events.length} event bodies found no leak of the token, ssh private key, or user-data content.`,
+      });
+    }
+  } catch (err) {
+    results.push({
+      anchorAcId: 'AC-37101-1',
+      verdict: 'fail',
+      detail: `provisioner facade lifecycle threw: ${err.message} (probable cause: mocked hcloud stdout is not JSON; check for a SIMULATE_JSON_PARSE_STRIP mutation).`,
+    });
+  }
+  return {
+    results,
+    extra: {
+      eventCount: events.length,
+      events: events.map((e) => ({ event: e.event, keys: Object.keys(e).sort() })),
+      mutations: {
+        jsonParseStrip: process.env.SIMULATE_JSON_PARSE_STRIP === 'true',
+        eventSecrecyLeak: process.env.SIMULATE_EVENT_SECRECY_LEAK === 'true',
+      },
+    },
+  };
+}

package/blueprints/deploy-hetzner-server/contributions/probes/manifest-schema-validate.mjs

@@ -0,0 +1,180 @@
+// Probe: manifest schema validate.
+//
+// anchorAcId: AC-37102-1 (also covers AC-37106-1 firewall shape and
+// AC-37107-1 snapshot cadence enum via the same schema). accountBound: false.
+//
+// Validates every hetzner/servers/*.json under the shared throwaway-server
+// fixture against blueprints/deploy-hetzner-server/contributions/schemas/
+// hetzner-server.schema.json. A lightweight in-process draft-07 subset
+// validator ships with the probe so the shelf gains no runtime dependency
+// on ajv or similar. See validate() at the bottom.
+//
+// SIMULATE_MANIFEST_INVALID=true replaces the manifest's location with an
+// unknown token and the probe FAILS naming the offending field per
+// hetzner-round-7-spec-2026-09-07.md section 3.4 lesson 4.
+
+import { readFile } from 'node:fs/promises';
+import { readManifestFiles, SCHEMA_PATH } from './probe-utils.mjs';
+
+export const anchorAcId = 'AC-37102-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const schema = JSON.parse(await readFile(SCHEMA_PATH, 'utf8'));
+  const { present, files } = await readManifestFiles();
+  if (!present) {
+    return {
+      results: [{
+        anchorAcId,
+        verdict: 'fail',
+        detail: 'fixture hetzner/servers/ holds zero JSON files; ship at least ci-throwaway.json.',
+      }],
+    };
+  }
+  const results = [];
+  const mutationActive = process.env.SIMULATE_MANIFEST_INVALID === 'true';
+  for (const f of files) {
+    let doc;
+    try {
+      doc = JSON.parse(f.text);
+    } catch (err) {
+      results.push({
+        anchorAcId,
+        verdict: 'fail',
+        detail: `manifest ${f.name} does not parse: ${err.message}`,
+      });
+      continue;
+    }
+    if (mutationActive) doc = { ...doc, location: 'mars1' };
+    const errors = validate(schema, doc, `#/${f.name}`);
+    if (errors.length > 0) {
+      for (const e of errors) {
+        const anchor = anchorForError(e);
+        results.push({
+          anchorAcId: anchor,
+          verdict: 'fail',
+          detail: `manifest ${f.name} schema violation at ${e.path}: ${e.message}`,
+        });
+      }
+    } else {
+      results.push({
+        anchorAcId,
+        verdict: 'pass',
+        detail: `manifest ${f.name} validates against hetzner-server.schema.json (nine required fields, firewall rule shape, snapshotCadence enum all satisfied).`,
+      });
+    }
+  }
+  return {
+    results,
+    extra: {
+      manifestCount: files.length,
+      manifestNames: files.map((f) => f.name),
+      mutationActive,
+    },
+  };
+}
+
+function anchorForError(err) {
+  if (err.field === 'firewallRules' || (err.path || '').includes('firewallRules')) {
+    return 'AC-37106-1';
+  }
+  if (err.field === 'snapshotCadence' || (err.path || '').includes('snapshotCadence')) {
+    return 'AC-37107-1';
+  }
+  return 'AC-37102-1';
+}
+
+// Draft-07 subset validator: required, type, enum, minLength, minItems,
+// additionalProperties, items, properties, required-on-array-items.
+// Extra rule: on firewallRules the ssh rule sourceIps must NOT include
+// 0.0.0.0/0 (per TAC-3804); handled after schema validation.
+export function validate(schema, doc, pathPrefix = '#') {
+  const errors = [];
+  walk(schema, doc, pathPrefix, errors);
+  if (Array.isArray(doc.firewallRules)) {
+    const ssh = doc.firewallRules.find((r) => r && r.name === 'ssh');
+    if (ssh && Array.isArray(ssh.sourceIps) && ssh.sourceIps.some((s) => s === '0.0.0.0/0' || s === '::/0')) {
+      errors.push({
+        path: `${pathPrefix}/firewallRules/ssh/sourceIps`,
+        field: 'firewallRules',
+        message: 'ssh rule sourceIps must not include 0.0.0.0/0 or ::/0; use an operator-nominated set per TAC-3804.',
+      });
+    }
+    const need = ['ssh', 'http', 'https'];
+    for (const n of need) {
+      if (!doc.firewallRules.some((r) => r && r.name === n)) {
+        errors.push({
+          path: `${pathPrefix}/firewallRules`,
+          field: 'firewallRules',
+          message: `firewallRules is missing the required ${n} rule per TAC-3804.`,
+        });
+      }
+    }
+  }
+  return errors;
+}
+
+function walk(schema, value, path, errors) {
+  if (!schema || typeof schema !== 'object') return;
+  if (Array.isArray(schema.required) && typeof value === 'object' && value !== null && !Array.isArray(value)) {
+    for (const k of schema.required) {
+      if (!(k in value)) {
+        errors.push({ path: `${path}/${k}`, field: k, message: `missing required field ${k}` });
+      }
+    }
+  }
+  if (schema.type) {
+    const typeOk = checkType(schema.type, value);
+    if (!typeOk) {
+      errors.push({ path, message: `expected type ${JSON.stringify(schema.type)}, got ${jsType(value)}` });
+      return;
+    }
+  }
+  if (Array.isArray(schema.enum) && !schema.enum.includes(value)) {
+    errors.push({ path, message: `value ${JSON.stringify(value)} is not in enum ${JSON.stringify(schema.enum)}` });
+  }
+  if (typeof schema.minLength === 'number' && typeof value === 'string' && value.length < schema.minLength) {
+    errors.push({ path, message: `string shorter than minLength ${schema.minLength}` });
+  }
+  if (typeof schema.minItems === 'number' && Array.isArray(value) && value.length < schema.minItems) {
+    errors.push({ path, message: `array shorter than minItems ${schema.minItems}` });
+  }
+  if (schema.type === 'object' && schema.additionalProperties === false && value && typeof value === 'object') {
+    const known = new Set(Object.keys(schema.properties || {}));
+    for (const k of Object.keys(value)) {
+      if (!known.has(k)) {
+        errors.push({ path: `${path}/${k}`, field: k, message: `unknown field ${k} (additionalProperties false)` });
+      }
+    }
+  }
+  if (schema.properties && value && typeof value === 'object' && !Array.isArray(value)) {
+    for (const [k, sub] of Object.entries(schema.properties)) {
+      if (k in value) walk(sub, value[k], `${path}/${k}`, errors);
+    }
+  }
+  if (schema.items && Array.isArray(value)) {
+    value.forEach((v, i) => walk(schema.items, v, `${path}/${i}`, errors));
+  }
+}
+
+function checkType(type, value) {
+  const types = Array.isArray(type) ? type : [type];
+  return types.some((t) => matchType(t, value));
+}
+
+function matchType(t, value) {
+  if (t === 'null') return value === null;
+  if (t === 'array') return Array.isArray(value);
+  if (t === 'object') return typeof value === 'object' && value !== null && !Array.isArray(value);
+  if (t === 'integer') return Number.isInteger(value);
+  if (t === 'number') return typeof value === 'number';
+  if (t === 'string') return typeof value === 'string';
+  if (t === 'boolean') return typeof value === 'boolean';
+  return false;
+}
+
+function jsType(v) {
+  if (v === null) return 'null';
+  if (Array.isArray(v)) return 'array';
+  return typeof v;
+}

package/blueprints/deploy-hetzner-server/contributions/probes/probe-utils.mjs

@@ -0,0 +1,106 @@
+// Shared helpers for deploy-hetzner-server probes.
+//
+// Runtime-dependency posture:
+// - cloud-init-render-lint, manifest-schema-validate and
+//   hcloud-dry-run-mock run in-process against the shared throwaway-
+//   server fixture at packages/rcf-lite/test/fixtures/hetzner-throwaway-
+//   server/. No real API call fires; hcloud is mocked via
+//   src/hcloud-mock.mjs so the shim never crosses the process boundary.
+// - real-account-* probes call the fixture's provision.mjs / destroy.mjs
+//   / snapshot verbs. Without CI_HAS_HETZNER_ACCOUNT they record
+//   accountBoundSkipped: true and the aggregate flips to pass per
+//   hetzner-round-7-spec-2026-09-07.md section 3.5.
+
+import { mkdir, writeFile, readFile, readdir } from 'node:fs/promises';
+import { dirname, resolve, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(
+  PROJECT_ROOT,
+  'packages/rcf-lite/test/fixtures/hetzner-throwaway-server',
+);
+export const MANIFEST_DIR = resolve(FIXTURE_DIR, 'hetzner/servers');
+export const SCHEMA_PATH = resolve(HERE, '..', 'schemas', 'hetzner-server.schema.json');
+export const REPORT_DIR = resolve(
+  PROJECT_ROOT,
+  '.rcf/reports/blueprints/deploy-hetzner-server',
+);
+
+export function aggregate(results) {
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+
+export function isSkipped(results) {
+  return results.length > 0 && results.every((r) => r.accountBoundSkipped === true);
+}
+
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const rawVerdict = aggregate(results);
+  const aggregateVerdict = isSkipped(results) ? 'pass' : rawVerdict;
+  const report = {
+    slug: 'deploy-hetzner-server',
+    probeName,
+    runAt: new Date().toISOString(),
+    engine,
+    results,
+    aggregateVerdict,
+    ...(extra ?? {}),
+  };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = (await mainFn()) ?? { results: [] };
+    const { results, extra } = outcome;
+    const { report, path } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    const results = [{
+      anchorAcId: 'unknown',
+      verdict: 'fail',
+      detail: `probe threw: ${err && err.message ? err.message : String(err)}`,
+    }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err && err.stack ? err.stack : String(err)}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}
+
+export async function readManifestFiles(dir = MANIFEST_DIR) {
+  let entries;
+  try {
+    entries = (await readdir(dir))
+      .filter((f) => f.endsWith('.json'))
+      .sort();
+  } catch (err) {
+    return { present: false, entries: [], files: [], error: err.message };
+  }
+  const files = [];
+  for (const name of entries) {
+    const p = join(dir, name);
+    const text = await readFile(p, 'utf8');
+    files.push({ name, path: p, text });
+  }
+  return { present: entries.length > 0, entries, files };
+}
+
+export function accountBoundSkippedResult(anchorAcId, note) {
+  return {
+    anchorAcId,
+    verdict: 'skipped',
+    accountBoundSkipped: true,
+    detail: `accountBound: CI_HAS_HETZNER_ACCOUNT unset; ${note}`,
+  };
+}

package/blueprints/deploy-hetzner-server/contributions/probes/real-account-cloud-init-hardened.mjs

@@ -0,0 +1,63 @@
+// Probe: real-account cloud-init hardened.
+//
+// anchorAcId: AC-37105-1. accountBound: true.
+//
+// Without CI_HAS_HETZNER_ACCOUNT the probe records
+// accountBoundSkipped: true and the aggregate flips to pass.
+//
+// With the env var set the probe:
+//   - provisions the throwaway server via the fixture provision.mjs;
+//   - shells cloud-init status --wait over ssh to the throwaway server;
+//   - runs the six baseline checks over ssh (grep for the marker per
+//     baseline block); FAILS naming the first missing block on any
+//     defect.
+//   - always() calls destroy.mjs regardless of verdict.
+
+import { accountBoundSkippedResult, FIXTURE_DIR } from './probe-utils.mjs';
+import { resolve } from 'node:path';
+
+export const anchorAcId = 'AC-37105-1';
+export const accountBound = true;
+
+export default async function runProbe() {
+  if (process.env.CI_HAS_HETZNER_ACCOUNT !== 'true') {
+    return {
+      results: [accountBoundSkippedResult(anchorAcId, 'real-account cloud-init hardened check skipped; run with CI_HAS_HETZNER_ACCOUNT=true to exercise the six ssh baseline checks against a throwaway cx23.')],
+    };
+  }
+  const provisionPath = resolve(FIXTURE_DIR, 'provision.mjs');
+  const destroyPath = resolve(FIXTURE_DIR, 'destroy.mjs');
+  const sshCheckPath = resolve(FIXTURE_DIR, 'src/ssh-baseline-check.mjs');
+  const { provisionThrowawayServer } = await import(provisionPath);
+  const { destroyThrowawayServer } = await import(destroyPath);
+  const { runSshBaselineChecks } = await import(sshCheckPath);
+  let provisioned;
+  try {
+    provisioned = await provisionThrowawayServer({ runId: process.env.GITHUB_RUN_ID ?? 'local' });
+    const report = await runSshBaselineChecks(provisioned);
+    const failed = report.checks.filter((c) => c.verdict === 'fail');
+    if (failed.length > 0) {
+      return {
+        results: failed.map((c) => ({
+          anchorAcId,
+          verdict: 'fail',
+          detail: `cloud-init baseline block "${c.label}" failed on server ${provisioned.id}: ${c.detail}`,
+        })),
+      };
+    }
+    return {
+      results: [{
+        anchorAcId,
+        verdict: 'pass',
+        detail: `cloud-init status --wait completed on server ${provisioned.id}; all six ssh baseline checks passed.`,
+      }],
+      extra: report,
+    };
+  } catch (err) {
+    return { results: [{ anchorAcId, verdict: 'fail', detail: `check failed: ${err.message}` }] };
+  } finally {
+    if (provisioned && provisioned.id) {
+      try { await destroyThrowawayServer(provisioned); } catch (_) { /* swept by orphan cron */ }
+    }
+  }
+}

package/blueprints/deploy-hetzner-server/contributions/probes/real-account-snapshot-on-demand.mjs

@@ -0,0 +1,60 @@
+// Probe: real-account snapshot on demand.
+//
+// anchorAcId: AC-37108-1. accountBound: true.
+//
+// Without CI_HAS_HETZNER_ACCOUNT the probe records
+// accountBoundSkipped: true and the aggregate flips to pass.
+//
+// With the env var set the probe:
+//   - provisions the throwaway server via provision.mjs;
+//   - fires the snapshot verb on the provisioner facade;
+//   - asserts hcloud image list --type=snapshot --output json shows a
+//     snapshot with the server name and current wall-clock time in the
+//     labels;
+//   - always() calls destroy.mjs regardless of verdict; the snapshot is
+//     deleted as part of destroy.mjs so the run leaves no orphaned
+//     image behind.
+
+import { accountBoundSkippedResult, FIXTURE_DIR } from './probe-utils.mjs';
+import { resolve } from 'node:path';
+
+export const anchorAcId = 'AC-37108-1';
+export const accountBound = true;
+
+export default async function runProbe() {
+  if (process.env.CI_HAS_HETZNER_ACCOUNT !== 'true') {
+    return {
+      results: [accountBoundSkippedResult(anchorAcId, 'real-account snapshot on-demand skipped; run with CI_HAS_HETZNER_ACCOUNT=true to exercise the hcloud image create-image path.')],
+    };
+  }
+  const provisionPath = resolve(FIXTURE_DIR, 'provision.mjs');
+  const destroyPath = resolve(FIXTURE_DIR, 'destroy.mjs');
+  const snapshotPath = resolve(FIXTURE_DIR, 'src/snapshot-verb.mjs');
+  const { provisionThrowawayServer } = await import(provisionPath);
+  const { destroyThrowawayServer } = await import(destroyPath);
+  const { takeAndVerifySnapshot } = await import(snapshotPath);
+  let provisioned;
+  try {
+    provisioned = await provisionThrowawayServer({ runId: process.env.GITHUB_RUN_ID ?? 'local' });
+    const outcome = await takeAndVerifySnapshot(provisioned);
+    if (!outcome.snapshotId) {
+      return {
+        results: [{ anchorAcId, verdict: 'fail', detail: `snapshot verb ran but no matching snapshot appeared in hcloud image list.` }],
+      };
+    }
+    return {
+      results: [{
+        anchorAcId,
+        verdict: 'pass',
+        detail: `snapshot ${outcome.snapshotId} tagged with server name ${provisioned.name} and time ${outcome.wallClockTime} on server ${provisioned.id}.`,
+      }],
+      extra: outcome,
+    };
+  } catch (err) {
+    return { results: [{ anchorAcId, verdict: 'fail', detail: `snapshot verb threw: ${err.message}` }] };
+  } finally {
+    if (provisioned && provisioned.id) {
+      try { await destroyThrowawayServer(provisioned); } catch (_) { /* swept by orphan cron */ }
+    }
+  }
+}