rcf-lite 0.23.0 → 0.25.0

package/rcf/test-suites/ts-150.json

@@ -0,0 +1,86 @@
+{
+  "createdAt": "2026-09-08T01:44:51.205Z",
+  "updatedAt": "2026-09-08T01:45:31.442Z",
+  "purpose": "Cover the T-2 chain ACs via the shipped anatomy test at test/blueprint/platform-docker-compose-host-anatomy.test.js and via the five blueprint probes driven from the shared throwaway-server fixture (which T-2 extends with a compose stack, Caddyfile, secret file mount and healthchecked service)",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-12001-1",
+    "AC-12101-1",
+    "AC-12102-1",
+    "AC-12201-1",
+    "AC-12202-1",
+    "AC-12301-1",
+    "AC-12401-1",
+    "AC-12402-1",
+    "AC-12501-1"
+  ],
+  "id": "TS-150",
+  "usId": "US-12001",
+  "title": "T-2 platform-docker-compose-host anatomy proof: probe modules and compose-stack fixture assertions",
+  "testCases": [
+    {
+      "id": "TC-150-compose-layout-shape-valid",
+      "acId": "AC-12001-1",
+      "description": "Cover AC-12001-1 via anatomy test: fixture compose.yaml declares service-per-container, named networks and volumes, and a .env for non-secret config",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12001-1 compose layout shape valid (TC-150-compose-layout-shape-valid)"
+    },
+    {
+      "id": "TC-150-secrets-file-mount-shape",
+      "acId": "AC-12101-1",
+      "description": "Cover AC-12101-1 via anatomy test: compose.yaml declares secrets under top-level secrets with a file source and mounts them into the web service; the mounted file is 0o400",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12101-1 secrets file mount shape (TC-150-secrets-file-mount-shape)"
+    },
+    {
+      "id": "TC-150-secrets-scan-fails-on-plaintext",
+      "acId": "AC-12102-1",
+      "description": "Cover AC-12102-1 via anatomy test: secrets-as-files-scan probe passes on the canonical fixture and fails under SIMULATE_PLAINTEXT_SECRET naming the literal",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12102-1 secrets-as-files scan fails on plaintext (TC-150-secrets-scan-fails-on-plaintext)"
+    },
+    {
+      "id": "TC-150-compose-config-lint-refuses-missing-healthcheck",
+      "acId": "AC-12201-1",
+      "description": "Cover AC-12201-1 via anatomy test: compose-config-lint probe passes on canonical fixture and fails under SIMULATE_MISSING_HEALTHCHECK naming the service",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12201-1 compose-config-lint refuses missing healthcheck (TC-150-compose-config-lint-refuses-missing-healthcheck)"
+    },
+    {
+      "id": "TC-150-real-account-minimal-stack-up-declared-and-skipped-shape",
+      "acId": "AC-12202-1",
+      "description": "Cover AC-12202-1 via anatomy test: real-account-minimal-stack-up probe declares accountBound true and records accountBoundSkipped when the env var is unset",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12202-1 real-account-minimal-stack-up declared and skipped shape (TC-150-real-account-minimal-stack-up-declared-and-skipped-shape)"
+    },
+    {
+      "id": "TC-150-restart-discipline-lint-refuses-unclassified",
+      "acId": "AC-12301-1",
+      "description": "Cover AC-12301-1 via anatomy test: compose-config-lint enforces restart policy classification and fails under SIMULATE_UNCLASSIFIED_RESTART naming the service",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12301-1 restart discipline lint refuses unclassified (TC-150-restart-discipline-lint-refuses-unclassified)"
+    },
+    {
+      "id": "TC-150-caddyfile-validate-refuses-invalid-directive",
+      "acId": "AC-12401-1",
+      "description": "Cover AC-12401-1 via anatomy test: caddyfile-validate probe passes on canonical Caddyfile and fails under SIMULATE_INVALID_CADDYFILE naming the line",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12401-1 caddyfile-validate refuses invalid directive (TC-150-caddyfile-validate-refuses-invalid-directive)"
+    },
+    {
+      "id": "TC-150-real-account-reload-burst-declared-and-skipped-shape",
+      "acId": "AC-12402-1",
+      "description": "Cover AC-12402-1 via anatomy test: real-account-reload-burst probe declares accountBound true and records accountBoundSkipped when the env var is unset",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12402-1 real-account-reload-burst declared and skipped shape (TC-150-real-account-reload-burst-declared-and-skipped-shape)"
+    },
+    {
+      "id": "TC-150-log-driver-classification",
+      "acId": "AC-12501-1",
+      "description": "Cover AC-12501-1 via anatomy test: compose-config-lint asserts every service declares a logging driver and fails under SIMULATE_UNCLASSIFIED_LOG_DRIVER naming the service",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12501-1 log driver classification (TC-150-log-driver-classification)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-160.json

@@ -0,0 +1,78 @@
+{
+  "createdAt": "2026-09-08T03:24:23.156Z",
+  "updatedAt": "2026-09-08T03:24:51.162Z",
+  "purpose": "Cover the T-3 chain ACs via the shipped anatomy test at test/blueprint/edge-cloudflare-tunnel-anatomy.test.js and via the three local probe modules driven from the shared throwaway-server fixture (which T-3 extends with cloudflared/compose-service and cloudflared/systemd-unit variants, each in both public-hostname and access-gated sidecar modes).",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-13001-1",
+    "AC-13002-1",
+    "AC-13101-1",
+    "AC-13102-1",
+    "AC-13201-1",
+    "AC-13301-1",
+    "AC-13302-1",
+    "AC-13401-1"
+  ],
+  "id": "TS-160",
+  "usId": "US-13001",
+  "title": "T-3 edge-cloudflare-tunnel anatomy proof: probe modules and cloudflared connector fixture assertions",
+  "testCases": [
+    {
+      "id": "TC-160-connector-shape-variants-shipped",
+      "acId": "AC-13001-1",
+      "description": "Cover AC-13001-1 via anatomy test: the shared fixture ships both cloudflared/compose-service/ and cloudflared/systemd-unit/ variants and the compose-service variant defines a cloudflared service alongside T-2 web and caddy on the same web-net network with no host ports; the systemd-unit variant ships a cloudflared.service unit file per the vendor local-configuration-file docs.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::T-3 edge-cloudflare-tunnel AC-13001-1 connector shape variants shipped (TC-160-connector-shape-variants-shipped)"
+    },
+    {
+      "id": "TC-160-real-account-connector-healthy-declared-and-skipped-shape",
+      "acId": "AC-13002-1",
+      "description": "Cover AC-13002-1 via anatomy test: real-account-connector-healthy probe declares accountBound true and records accountBoundSkipped when CI_HAS_CLOUDFLARE_ACCOUNT or CI_HAS_HETZNER_ACCOUNT is unset.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::T-3 edge-cloudflare-tunnel AC-13002-1 real-account-connector-healthy declared and skipped shape (TC-160-real-account-connector-healthy-declared-and-skipped-shape)"
+    },
+    {
+      "id": "TC-160-manifest-schema-validate-refuses-invalid",
+      "acId": "AC-13101-1",
+      "description": "Cover AC-13101-1 via anatomy test: manifest-schema-validate probe passes on the canonical fixture manifests and fails under the three fixture-side mutations SIMULATE_MANIFEST_INVALID_TUNNEL_ID, SIMULATE_MANIFEST_CREDENTIALS_INLINE and SIMULATE_MANIFEST_MISSING_CATCHALL naming the offending field.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::T-3 edge-cloudflare-tunnel AC-13101-1 manifest schema validate refuses invalid (TC-160-manifest-schema-validate-refuses-invalid)"
+    },
+    {
+      "id": "TC-160-cloudflared-config-lint-passes-and-refuses-invalid-ingress",
+      "acId": "AC-13102-1",
+      "description": "Cover AC-13102-1 via anatomy test: cloudflared-config-lint probe runs cloudflared tunnel ingress validate through the cloudflare/cloudflared container image and exits 0 on the canonical fixture; fails under SIMULATE_INGRESS_INVALID naming the offending line.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::T-3 edge-cloudflare-tunnel AC-13102-1 cloudflared-config-lint passes and refuses invalid ingress (TC-160-cloudflared-config-lint-passes-and-refuses-invalid-ingress)"
+    },
+    {
+      "id": "TC-160-no-public-origin-port-refused",
+      "acId": "AC-13201-1",
+      "description": "Cover AC-13201-1 via anatomy test: manifest-schema-validate refuses under SIMULATE_ORIGIN_PORT_OPEN when an ingress rule service URL binds to a host public interface; the T-1 firewall on the ci-throwaway manifest stays 22 open plus 80/443 open only when a reverse proxy is applied.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::T-3 edge-cloudflare-tunnel AC-13201-1 no public origin port refused (TC-160-no-public-origin-port-refused)"
+    },
+    {
+      "id": "TC-160-aud-presence-flip-on-both-fixture-variants",
+      "acId": "AC-13301-1",
+      "description": "Cover AC-13301-1 via anatomy test: aud-presence-check reads each variant sidecar and asserts the ingress rules attach originRequest.access.aud on the access-gated variant and omit the block on the public-hostname variant.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::T-3 edge-cloudflare-tunnel AC-13301-1 aud-presence-check flips on both fixture variants (TC-160-aud-presence-flip-on-both-fixture-variants)"
+    },
+    {
+      "id": "TC-160-aud-presence-check-refuses-on-drift",
+      "acId": "AC-13302-1",
+      "description": "Cover AC-13302-1 via anatomy test: aud-presence-check FAILS under SIMULATE_AUD_DROP when the gated fixture ingress drifts to omit the originRequest.access block; the finding names the affected rule.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::T-3 edge-cloudflare-tunnel AC-13302-1 aud-presence-check refuses on drift (TC-160-aud-presence-check-refuses-on-drift)"
+    },
+    {
+      "id": "TC-160-credentials-discipline-and-event-secrecy",
+      "acId": "AC-13401-1",
+      "description": "Cover AC-13401-1 via anatomy test: the fixture credentials placeholder documents the 0o400 host mode and secretRef discipline; the event-secrecy scan across lifecycle event bodies passes on canonical fixture and FAILS under SIMULATE_EVENT_SECRECY_LEAK naming the leaked field.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::T-3 edge-cloudflare-tunnel AC-13401-1 credentials discipline and event-secrecy scan (TC-160-credentials-discipline-and-event-secrecy)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/user-stories/us-10001.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T21:41:02.422Z",
+  "updatedAt": "2026-09-07T21:41:02.422Z",
+  "asA": "shelf consumer applying the edge-cloudflare-rate-limiting v1.0.0 blueprint on a Workers project using the cf-edge fixture",
+  "iWant": "the elicited manifest directory to hold at least one committed JSON file per rate-limit rule, each carrying the seven documented fields and no plaintext secret",
+  "soThat": "the rules are source-controlled and reviewable and the operator has a stable source of truth to apply to the live zone",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-10001-1",
+      "description": "The cf-edge fixture's cloudflare/rate-limits/ directory holds at least one JSON file per rule; every file parses; every file carries id, expression, threshold, period, characteristics, action, duration; no file body carries a plaintext bearer token, private key or inline CF_API_TOKEN reference.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema"
+  ],
+  "usId": "US-10001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-100",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-6 rate-limit manifest present in cf-edge cloudflare/rate-limits/ carrying seven required fields without plaintext secrets"
+}

package/rcf/user-stories/us-10101.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T21:41:02.760Z",
+  "updatedAt": "2026-09-07T21:41:02.760Z",
+  "asA": "operator on the applying project preparing to push rate-limit rules from the local manifest to the live Cloudflare zone",
+  "iWant": "a documented flow with both wrangler command steps and a Cloudflare dashboard walkthrough",
+  "soThat": "I can pick the flow that suits my operating discipline and reproduce the apply from the manifest",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-10101-1",
+      "description": "The blueprint guide documents an operator-facing management surface with a wrangler command flow and a Cloudflare dashboard flow; the guide references https://developers.cloudflare.com/waf/rate-limiting-rules/.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3702-edge-cloudflare-rate-limiting-management-surface-doc"
+  ],
+  "usId": "US-10101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-101",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-6 operator-facing management surface: wrangler command flow and Cloudflare dashboard flow documented in the guide"
+}

package/rcf/user-stories/us-10201.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T21:41:03.086Z",
+  "updatedAt": "2026-09-07T21:41:03.086Z",
+  "asA": "operator running the real-account burst probe against a scheduled HQ-owned URL",
+  "iWant": "the probe to fire an undici burst above the rule threshold and observe the (N+1)th and subsequent requests return HTTP 429 with Retry-After and Cf-Ray, or record accountBoundSkipped in CI",
+  "soThat": "the over-threshold behaviour is verified against a real Cloudflare account when the account is available, and CI without an account records the honest verdict per ruling 6",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-10201-1",
+      "description": "With CI_HAS_CLOUDFLARE_ACCOUNT=true and CF_RATE_LIMIT_URL set, the burst probe returns 429 with Retry-After and Cf-Ray on over-threshold requests; without either env var it records accountBoundSkipped: true and aggregates to pass per spec section 3.5 and ruling 6.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema"
+  ],
+  "usId": "US-10201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-102",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-6 real-account burst returns 429 with Retry-After and Cf-Ray on over-threshold requests, or accountBoundSkipped in CI per ruling 6"
+}

package/rcf/user-stories/us-10301.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T21:41:03.411Z",
+  "updatedAt": "2026-09-07T21:41:03.411Z",
+  "asA": "operator on the applying project running the scheduled drift-audit runner behind the elicited cadence",
+  "iWant": "the runner to fetch the live rules via the Cloudflare API and diff each against the local manifest, constructing metadata-only drift records",
+  "soThat": "manifest drift is surfaced through the logging companion rather than lingering unnoticed",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-10301-1",
+      "description": "Given a fixture manifest with threshold 60 and a fake live-zone response with threshold 90 on the same rule id, the runner constructs one drift record with {ruleId, clientIpHash, outcome, timestamp, diff:[{field:threshold, manifestValue:60, liveValue:90}]}; no full IP, body or user-agent field is present.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner"
+  ],
+  "usId": "US-10301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-103",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-6 drift-audit runner reads live rules and diffs against manifest, constructing metadata-only drift records"
+}

package/rcf/user-stories/us-10401.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T21:41:03.736Z",
+  "updatedAt": "2026-09-07T21:41:03.736Z",
+  "asA": "operator applying both edge-cloudflare-rate-limiting and security-auth-magic-link on the same project",
+  "iWant": "the guide to name the ADR-3702 layering explicitly with a copy-paste example",
+  "soThat": "I understand the two-rule shape at apply time rather than by trial and error",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-10401-1",
+      "description": "The guide contains a Composition with security-auth-magic-link section referencing ADR-3702, naming the two characteristic sets (IP-per-URL and per-email per-minute) verbatim, and showing a copy-paste example of both blueprints applied.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3702-edge-cloudflare-rate-limiting-management-surface-doc"
+  ],
+  "usId": "US-10401",
+  "prdId": "PRD-001",
+  "reqId": "REQ-104",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-6 composition with security-auth-magic-link: zone rule layers over the per-email application rule per ADR-3702, documented in the guide"
+}

package/rcf/user-stories/us-10601.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T21:41:04.062Z",
+  "updatedAt": "2026-09-07T21:41:04.062Z",
+  "asA": "operator committing new rate-limit rule files under the elicited manifest directory",
+  "iWant": "the shipped JSON Schema to validate every rule file and the manifest-schema-validate probe to surface any file that violates the shape",
+  "soThat": "invalid manifest changes are caught in the fixture probe rather than at operator apply time",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-10601-1",
+      "description": "The manifest-schema-validate probe validates every manifest file against the shipped rate-limit-rule.schema.json (draft-07); valid files pass; a manifest file missing threshold (SIMULATE_SCHEMA_INVALID=true) fails validation with the offending field named in the detail.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema"
+  ],
+  "usId": "US-10601",
+  "prdId": "PRD-001",
+  "reqId": "REQ-100",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-6 manifest schema validates every rule file against the shipped draft-07 schema and refuses invalid shapes"
+}

package/rcf/user-stories/us-10701.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T21:41:04.389Z",
+  "updatedAt": "2026-09-07T21:41:04.389Z",
+  "asA": "operator reading drift-audit reports and rate-limit event records through the applied logging companion",
+  "iWant": "every drift-audit record to carry only metadata-safe fields, never a full IP, request body or user agent string",
+  "soThat": "the audit trail is safe to store, forward and read without additional PII scrubbing",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-10701-1",
+      "description": "The event-secrecy probe drives the drift-audit runner with a synthetic input pair; every record carries only {ruleId, clientIpHash, outcome, timestamp, diff}; SIMULATE_EVENT_LEAK_IP=true injects a full IP into the outcome so the probe surfaces the leak.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner"
+  ],
+  "usId": "US-10701",
+  "prdId": "PRD-001",
+  "reqId": "REQ-103",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-6 drift-audit event records carry ruleId, clientIpHash, outcome, timestamp, diff only; no full IP, body or user-agent"
+}

package/rcf/user-stories/us-10801.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T21:41:04.712Z",
+  "updatedAt": "2026-09-07T21:41:04.712Z",
+  "asA": "operator that accidentally deletes or moves a manifest file",
+  "iWant": "the manifest-presence probe to surface the missing file at fixture probe time",
+  "soThat": "a manifest under-population defect is caught in CI rather than at operator apply time",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-10801-1",
+      "description": "With SIMULATE_MANIFEST_MISSING=true the manifest-presence probe returns aggregateVerdict: fail and names the missing file basename in the detail; without the switch the probe passes.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema"
+  ],
+  "usId": "US-10801",
+  "prdId": "PRD-001",
+  "reqId": "REQ-100",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-6 manifest-presence probe refuses a missing manifest file and names the basename in the detail"
+}

package/rcf/user-stories/us-11001.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T23:55:32.229Z",
+  "updatedAt": "2026-09-07T23:55:46.775Z",
+  "usId": "US-11001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-110",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 provisioner opens on boot with sole HETZNER_ACCOUNT_API_KEY reader and emits provisionerReady with metadata-only payload",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint on a Node project that provisions a Hetzner Cloud VM",
+  "iWant": "the provisioner facade to be the sole reader of the Hetzner API token (via security-secrets-management) and to fire provisionerReady with a metadata-only payload when it opens on boot",
+  "soThat": "the applying project has one auditable seam for the token and the observability sink surfaces the ready event without a secret",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11001-1",
+      "description": "On boot of the shared throwaway-Hetzner-server fixture the provisioner facade opens, and (a) only the provisioner module reads HETZNER_ACCOUNT_API_KEY (grep across the fixture source refuses any other reader), (b) the facade emits a provisionerReady event whose payload carries tool and apiHost only (no token, no ssh key, no user data body).",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3801-deploy-hetzner-server-provisioner"
+  ]
+}

package/rcf/user-stories/us-11101.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T23:56:32.763Z",
+  "updatedAt": "2026-09-07T23:56:33.164Z",
+  "usId": "US-11101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-111",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 server manifest schema at hetzner/servers/name.json validates and names type location image ssh-key ids firewall id network id cloud-init path labels",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint",
+  "iWant": "the applying project's hetzner/servers/name.json manifests to validate against a shipped JSON Schema naming type, location, image, sshKeyIds, firewallId, networkId, cloudInitPath, labels, snapshotCadence",
+  "soThat": "the operator has a stable declarative source of truth for every server",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11101-1",
+      "description": "Every hetzner/servers/*.json under the shared throwaway-Hetzner-server fixture parses, validates against blueprints/deploy-hetzner-server/contributions/schemas/hetzner-server.schema.json, and carries the nine named fields with correct types; an induced defect (SIMULATE_MANIFEST_INVALID=true replaces location with an unknown token) fails schema validation naming the offending field.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3802-deploy-hetzner-server-manifest-schema"
+  ]
+}

package/rcf/user-stories/us-11102.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T23:56:33.351Z",
+  "updatedAt": "2026-09-07T23:56:33.765Z",
+  "usId": "US-11102",
+  "prdId": "PRD-001",
+  "reqId": "REQ-111",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 applying the provisioner reads each manifest and creates a matching live server, hetznerServerProvisioned event carries id primary IPv4 location server-type",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint against a Hetzner project",
+  "iWant": "applying the provisioner to read each manifest under hetzner/servers/, create a matching live Hetzner Cloud server, and emit hetznerServerProvisioned with id, primaryIpv4, location, serverType",
+  "soThat": "the manifest is the source of truth for what actually exists in the project",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11102-1",
+      "description": "The real-account-throwaway-server-provision probe (accountBound: true, skipped without CI_HAS_HETZNER_ACCOUNT) applies the ci-throwaway.json manifest via provision.mjs, asserts (a) hcloud server list --output json shows the new server whose id is written to the fixture scratch file, (b) hetznerServerProvisioned fired with id, primaryIpv4, location=fsn1, serverType=cx23; teardown via destroy.mjs runs regardless of probe verdict.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3801-deploy-hetzner-server-provisioner",
+    "TAC-3802-deploy-hetzner-server-manifest-schema"
+  ]
+}

package/rcf/user-stories/us-11201.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T23:56:33.951Z",
+  "updatedAt": "2026-09-07T23:57:58.302Z",
+  "usId": "US-11201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-112",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 cloud-init template lands the six hardening baseline blocks in the rendered YAML for every provisioned server",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint",
+  "iWant": "the shipped cloud-init template to render YAML that lands SSH key-only, root disabled, UFW default-deny incoming, DOCKER-USER iptables chain, fail2ban SSH jail and unattended-upgrades on every server",
+  "soThat": "the operator inherits the six-block hardening baseline without hand-authoring per host",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11201-1",
+      "description": "cloud-init-render-lint.mjs renders the template with the fixture manifest and asserts each of the six baseline blocks (SSH key-only, root disabled, UFW default-deny incoming, DOCKER-USER iptables chain, fail2ban SSH jail, unattended-upgrades) appears in the rendered YAML by grep; a mutation SIMULATE_HARDENING_DRIFT=true removes the unattended-upgrades block and the probe FAILS with a message naming the missing line.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3803-deploy-hetzner-server-cloud-init-template"
+  ]
+}

package/rcf/user-stories/us-11202.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T23:56:34.564Z",
+  "updatedAt": "2026-09-07T23:57:58.489Z",
+  "usId": "US-11202",
+  "prdId": "PRD-001",
+  "reqId": "REQ-112",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 provisioned server is hardened at runtime: root ssh refused, password auth refused, UFW active default-deny, DOCKER-USER present, unattended-upgrades service active",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint on a real Hetzner account",
+  "iWant": "the provisioned server to be hardened at runtime as the rendered cloud-init promised: root ssh refused, password auth refused, UFW active default-deny incoming, DOCKER-USER present, unattended-upgrades service active",
+  "soThat": "the operator can trust the cloud-init contract without ssh-in-and-check for every server",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11202-1",
+      "description": "real-account-cloud-init-hardened.mjs (accountBound: true, skipped without CI_HAS_HETZNER_ACCOUNT) waits for cloud-init status --wait on the throwaway server, then ssh-checks the six baseline blocks and asserts each check passes; failure names the missing block. Teardown via destroy.mjs runs regardless.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3803-deploy-hetzner-server-cloud-init-template"
+  ]
+}

package/rcf/user-stories/us-11301.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T23:56:35.165Z",
+  "updatedAt": "2026-09-07T23:56:35.601Z",
+  "usId": "US-11301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-113",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 firewall rule shape: 22 from operator-nominated prefixes, 80 and 443 open, all other inbound denied, applied at provision time",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint",
+  "iWant": "the firewall rule set carried in hetzner/servers/name.json to permit 22 only from an operator-nominated set of source-prefix ranges, permit 80 and 443 from 0.0.0.0/0 for the reverse proxy, and deny all other inbound; the provisioner applies the rules at provision time",
+  "soThat": "the operator inherits a documented least-privilege firewall shape on every server without opening ssh to the world",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11301-1",
+      "description": "manifest-schema-validate.mjs asserts every fixture manifest carries a firewall rule set matching the shape (22 permitted only from a nonempty list of source-prefix ranges; 80 and 443 permitted; no other inbound rule); an induced defect (a manifest that opens 22 to 0.0.0.0/0) fails schema validation with a message naming the offending rule.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3802-deploy-hetzner-server-manifest-schema",
+    "TAC-3804-deploy-hetzner-server-firewall-shape"
+  ]
+}

package/rcf/user-stories/us-11401.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T23:56:35.790Z",
+  "updatedAt": "2026-09-07T23:56:36.205Z",
+  "usId": "US-11401",
+  "prdId": "PRD-001",
+  "reqId": "REQ-114",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 snapshot cadence file present under the manifest set, cadence value elicited (weekly default, daily and off alternatives) matches the schema",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint",
+  "iWant": "the elicited snapshot cadence value on hetzner/servers/name.json to match the shipped enum (weekly, daily, off), with weekly the recommended default per ADR-3802",
+  "soThat": "the operator has a single project-wide answer for how often each server snapshots",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11401-1",
+      "description": "manifest-schema-validate.mjs asserts every fixture manifest carries snapshotCadence with a value in the shipped enum {weekly, daily, off}; a manifest missing the field fails schema validation naming the missing field.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3802-deploy-hetzner-server-manifest-schema"
+  ]
+}

package/rcf/user-stories/us-11402.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T23:56:36.391Z",
+  "updatedAt": "2026-09-07T23:56:36.806Z",
+  "usId": "US-11402",
+  "prdId": "PRD-001",
+  "reqId": "REQ-114",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 snapshot-on-demand verb fires the hcloud snapshot verb, tags the snapshot with server name and wall-clock time, hetznerSnapshotTaken event fires with snapshot id",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint on a real Hetzner account",
+  "iWant": "the snapshot-on-demand verb on the provisioner to shell to hcloud image create-image (or the raw-api equivalent) and tag the snapshot with server name and wall-clock time; hetznerSnapshotTaken carries snapshot id and time",
+  "soThat": "the operator has a documented on-demand recovery point at any moment",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11402-1",
+      "description": "real-account-snapshot-on-demand.mjs (accountBound: true, skipped without CI_HAS_HETZNER_ACCOUNT) fires the snapshot verb on the throwaway server, then asserts hcloud image list --type=snapshot --output json shows a snapshot tagged with the server name and current wall-clock time; hetznerSnapshotTaken event carries snapshot id and time. Teardown via destroy.mjs.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3801-deploy-hetzner-server-provisioner"
+  ]
+}

package/rcf/user-stories/us-11501.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T23:56:36.993Z",
+  "updatedAt": "2026-09-07T23:56:37.410Z",
+  "usId": "US-11501",
+  "prdId": "PRD-001",
+  "reqId": "REQ-115",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 four lifecycle events fire with metadata-only payloads, no secret leaks through any event body",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint",
+  "iWant": "the provisioner facade to fire the four lifecycle events (provisionerReady, hetznerServerProvisioned, hetznerSnapshotTaken, hetznerServerDestroyed) with metadata-only payloads (id, primaryIpv4, location, serverType, snapshotId, wallClockTime) and no secret content",
+  "soThat": "the observability sink carries the operational trail without ever leaking a token or an ssh key",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11501-1",
+      "description": "hcloud-dry-run-mock.mjs drives every lifecycle event through the facade against a mocked hcloud shim; the accumulated event stream carries only the metadata fields named; a mutation (event-secrecy leak: inject the token into the hetznerServerProvisioned payload) FAILS the probe with a defensive-fake finding.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3801-deploy-hetzner-server-provisioner"
+  ]
+}

package/rcf/user-stories/us-12001.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T01:41:01.418Z",
+  "updatedAt": "2026-09-08T01:42:32.120Z",
+  "usId": "US-12001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-120",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 compose.yaml at repo root is the single-source runtime topology (service-per-container, named networks and volumes, .env for non-secret config)",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint on a project that runs its stack on a Hetzner cloudHost",
+  "iWant": "a single compose.yaml at the repo root to declare every service as one container with explicit named networks, named volumes, and non-secret config in a .env file",
+  "soThat": "the runtime topology has one auditable seam and the container host can bring the stack up from the file alone",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-12001-1",
+      "description": "The shared throwaway-server fixture ships compose.yaml at the fixture root with (a) every service running exactly one container image (service-per-container), (b) at least one named network under the top-level networks key, (c) at least one named volume under the top-level volumes key, and (d) non-secret config values are read via a colocated .env file rather than inlined into service environment entries.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3901-platform-docker-compose-host-compose-layout"
+  ]
+}