rcf-lite 0.24.0 → 0.25.0

package/CHANGELOG.md

@@ -6,6 +6,17 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.25.0] - 2026-09-08
+
+rcf-lite 0.25.0 opens the Hetzner line with three blueprints in one round: a Hetzner Cloud server as the shipped Linux VM shape with the estate hardening baseline and a snapshot cadence, a docker-compose platform on top with healthchecks, secrets as file mounts and a first-class reverse-proxy artefact, and a Cloudflare Tunnel bridge that composes with Access when Zero Trust is applied and drops to public-hostname mode when it is not. Every real-account probe across the round ships accountBoundSkipped pending the Hetzner and Cloudflare token vault ruling; the local probes carry the ship-time verdicts. The follow-up Hetzner Object Storage adapter ships as a sequential PR under `object-storage-s3` v1.1.0 after this release; the rcf-lite package version does not bump for it.
+
+### Added
+
+- **Round 7 T-1: `deploy-hetzner-server` v1.0.0 on the shelf (PR #173).** Hetzner Cloud server provisioner with an `hcloud`-shaped adapter as the sole reader of the Hetzner API token through the applied `security-secrets-management` facade, a canonical server manifest under `hetzner/servers/name.json`, a cloud-init template landing the estate hardening baseline (SSH key-only, root disabled, UFW default-deny incoming, DOCKER-USER iptables chain, fail2ban SSH jail, unattended-upgrades, a `/live` probe on a private interface), a Hetzner Cloud Firewall contract, and a snapshots-and-backups posture (weekly snapshot default, daily and off alternatives, Hetzner-managed backups as the elicited paid option). Local probes cover cloud-init render, manifest schema and an hcloud dry-run; the three throwaway-server real-account probes (provision, cloud-init hardened, snapshot on demand) ship accountBoundSkipped pending the Hetzner token vault ruling. Ships the shared throwaway-server CI fixture reused by T-2 and T-3 (label-scoped provision, destroy and orphan sweep; hcloud pulled into a checksummed scratchpad, no system install). Declares `capabilities: ["cloudHost"]`. Mints the new global topics `linuxCloudHostContract` and `snapshotAndBackupCadence`.
+- **Round 7 T-2: `platform-docker-compose-host` v1.0.0 on the shelf (PR #174).** Docker engine and compose plugin install invoked from the T-1 cloud-init playbook, a canonical compose layout (`compose.yaml` at repo root, service-per-container, named networks and volumes), a healthcheck-required contract, a restart discipline (`restart: unless-stopped` for long-running services, `on-failure` for jobs), a zero-downtime reload shape for the reverse proxy, secrets as compose file mounts referencing the applied secrets facade at 0o400, and log shipping to the elicited `observability-logging` sink (default `journald`, opt-in `loki`). Caddy is the shipped default reverse proxy with Traefik as the elicited alternative; Coolify is rejected. The reverse-proxy config is a first-class versioned artefact under `caddy/Caddyfile` or `traefik/traefik.yaml` with a smoke curl after every apply. Local probes drive real docker 29.6.2 and the `caddy:2` image (`docker compose config` lint, secrets-as-files scan, Caddyfile validate); the two real-account probes (minimal-stack-up, reload-burst) ship accountBoundSkipped. Extends the T-1 throwaway-server fixture in place with a two-service compose stack. Declares `capabilities: ["containerHost"]`. Mints the new global topic `containerHostContract`.
+- **Round 7 T-3: `edge-cloudflare-tunnel` v1.0.0 on the shelf (PR #175).** `cloudflared` as a compose service (default when `containerHost` is applied) or a systemd unit (alternative for bare `cloudHost` per the vendor cloudflared as-a-service documentation), a tunnel manifest under `cloudflare/tunnels/<name>.yaml` (tunnel id, credentials reference into the applied secrets facade, ingress rules mapping public hostname to internal service URL with a mandatory catch-all `http_status:404`), and a hostname-management contract that creates the DNS route via the Cloudflare API. Composes with `edge-cloudflare-access` via `zeroTrustGate`: when Access is applied, the ingress rule attaches the Access AUD in `originRequest.access` and the connector-side JWT check refuses requests without a valid Access assertion; when Access is not applied, the tunnel ships in public-hostname mode. Local probes cover manifest schema, `cloudflared tunnel ingress validate` and an AUD-presence sidecar-read check; the two real-account probes (connector-healthy, tunnel-hostname-routes) ship accountBoundSkipped pending the Cloudflare token vault ruling. Declares `capabilities: ["tunnelBridge"]`. Mints the new global topic `edgeIngressBridge`.
+- **Authoring standard capability table extended.** `packages/rcf-lite/docs/blueprint-authoring.md` section 6a gains three new rows: `cloudHost`, `containerHost`, `tunnelBridge`. Chunk-zero-style append, loader unchanged.
+
 ## [0.24.0] - 2026-09-08
 
 rcf-lite 0.24.0 opens the Cloudflare line with six blueprints in one round: a Workers KV facade, cron triggers with an expression-router, durable objects covering strong-consistency and hibernatable WebSocket shapes, a Zero-Trust Access gate the admin console consumes, Turnstile with the pinned test keys running under a Playwright pack, and edge rate limiting with a committed manifest. Each blueprint verifies against the real Cloudflare engine through node-only probes, and the admin console reads the Access-gate capability to switch its sign-in surface.

package/blueprints/application-account-settings/docs/topics.md

@@ -35,6 +35,9 @@ The blueprint claims no new global topics at v1.0.0. Account-settings is a consu
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-admin-console/docs/topics.md

@@ -35,6 +35,9 @@ The blueprint claims no new global topics at v1.0.0. The console is a consumer o
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-api-rest/docs/topics.md

@@ -58,6 +58,9 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 Suffix-family ids (ADR, TAC): SPA numbers in the 2xx range, this package takes 3xx (ADR-301 to ADR-308, TAC-301 to TAC-306); the next blueprint should take 4xx.
 

package/blueprints/application-charts/docs/topics.md

@@ -34,6 +34,9 @@ The blueprint claims no new global topics at v1.0.0. The chart-component contrac
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-dashboard/docs/topics.md

@@ -34,6 +34,9 @@ The blueprint claims no new global topics at v1.0.0. The dashboard-shell contrac
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-datatable/docs/topics.md

@@ -33,6 +33,9 @@ The blueprint claims no new global topics at v1.0.0. The datatable shell is a ge
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-empty-error-states/docs/topics.md

@@ -34,6 +34,9 @@ The blueprint claims no new global topics at v1.0.0. Every ADR (HTTP status cont
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-error-handling/docs/topics.md

@@ -40,5 +40,8 @@
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.

package/blueprints/application-file-upload/docs/topics.md

@@ -35,6 +35,9 @@ The blueprint claims no new global topics at v1.0.0. Every ADR (transport branch
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-forms-wizard/docs/topics.md

@@ -34,6 +34,9 @@ The blueprint claims no new global topics at v1.0.0. Every ADR (navigation postu
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-notifications-in-app/docs/topics.md

@@ -37,6 +37,9 @@ The `application-notifications-` prefix is reserved for the sibling channel blue
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 | application-notifications-email (reserved) | to be claimed at ship | to be claimed at ship | name-only doc reservation (not shipped) | tba |
 | application-notifications-push (reserved) | to be claimed at ship | to be claimed at ship | name-only doc reservation (not shipped) | tba |
 | application-notifications-webhook (reserved) | to be claimed at ship | to be claimed at ship | name-only doc reservation (not shipped) | tba |

package/blueprints/application-onboarding-tour/docs/topics.md

@@ -33,6 +33,9 @@ The blueprint claims no new global topics at v1.0.0. Onboarding-tour is a consum
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-spa/docs/topics.md

@@ -63,6 +63,9 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 SPA v1.1.0 stays on the LOW end of its band: v1.0.0 occupied US-1101 through US-1128; v1.1.0 adds US-1129 and US-1130, leaving headroom above 1130 for future minor bumps and for project-side stories that mechanically derive to the 11xx numeric range.
 

package/blueprints/delivery-ci-workflows/docs/topics.md

@@ -69,6 +69,9 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 US 6101-6110 sit at the LOW end of the 6101-6899 band on purpose. A project-side story that mechanically derives from `delivery-ci-workflows-REQ-011` into the number `6111` would collide against delivery-ci-workflows-US-6111 in this package; the band leaves headroom at the HIGH end (US 6181-6899) so a project's own stories anchored to delivery-ci-workflows REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/deploy-cloudflare-workers/docs/topics.md

@@ -55,6 +55,9 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 US 12101-12112 sit at the LOW end of the 12101-12899 band on purpose. A project-side story that mechanically derives from a deploy-cloudflare-workers REQ id into the number `12112` would collide against deploy-cloudflare-workers-US-12112 in this package; the band leaves headroom at the HIGH end (US 12181-12899) so a project's own stories anchored to deploy-cloudflare-workers REQs can allocate without conflict. The watchpost run4 lesson applies here too. Band spacing between the last shipped block (security-secrets-management, 8101-8899, 9xx) and this one (12101-12899, 13xx) leaves the 9xxx-11xxx US bands and the 10xx-12xx suffix blocks open for concurrent-lane authoring so a peer authoring another blueprint in the same PR window does not collide with this one.
 

package/blueprints/deploy-hetzner-server/CHANGELOG.md

@@ -0,0 +1,34 @@
+# deploy-hetzner-server changelog
+
+## 1.0.0
+
+Initial shelf release. Ships an hcloud-shaped provisioner facade
+(with a raw-api elicited alternative) as the sole reader of the
+Hetzner API token; a manifest schema at `hetzner/servers/*.json`; a
+cloud-init template landing the six-block hardening baseline (SSH
+key-only, root disabled, UFW default-deny incoming, DOCKER-USER
+iptables chain, fail2ban SSH jail, unattended-upgrades); a firewall
+rule shape (22 from operator-nominated prefixes, 80/443 open, deny
+all else); a snapshot cadence elicit (weekly default, daily and off
+alternatives) plus a snapshot-on-demand verb; four metadata-only
+lifecycle events (`provisionerReady`, `hetznerServerProvisioned`,
+`hetznerSnapshotTaken`, `hetznerServerDestroyed`). Provides the
+`cloudHost` capability. Mints two new global topics:
+`linuxCloudHostContract` and `snapshotAndBackupCadence`. Suggests
+companions `logging` and `errorHandling`.
+
+Ships six Node-only probes: `cloud-init-render-lint`,
+`manifest-schema-validate`, `hcloud-dry-run-mock` (three mocked; each
+paired with a mutation switch that flips the probe to FAIL), plus
+`real-account-throwaway-server-provision`,
+`real-account-cloud-init-hardened`,
+`real-account-snapshot-on-demand` (three account-bound; skipped
+without `CI_HAS_HETZNER_ACCOUNT`).
+
+Mints the shared `hetzner-throwaway-server` fixture under
+`packages/rcf-lite/test/fixtures/` (round-7 T-2 and T-3 EXTEND it,
+they do not ship a second copy).
+
+Trace: hetzner-round-7-spec-2026-09-07.md section 5.1;
+Baz ruling 2026-09-07 09:50Z (decisions 18 through 24 approved as
+recommended, "round 7 - agreee to all").

package/blueprints/deploy-hetzner-server/README.md

@@ -0,0 +1,202 @@
+# deploy-hetzner-server v1.0.0
+
+Ship a Hetzner Cloud Linux VM as the project's `cloudHost`. A facade
+over `hcloud` (or the raw Hetzner Cloud REST API) that provisions a
+server from a git-managed manifest, lands a six-block hardening
+baseline via cloud-init, applies a documented firewall shape, and
+emits four metadata-only lifecycle events on the injected sink.
+
+- Category: `deploy` (sibling of `deploy-cloudflare-workers`; the deploy
+  family enforces one target per project at apply time).
+- Capabilities provided: `cloudHost`.
+- Suggested companions: `logging`, `errorHandling`.
+- New global topics minted: `linuxCloudHostContract`,
+  `snapshotAndBackupCadence`.
+
+## What the blueprint contracts
+
+Six REQs realise the shape:
+
+| REQ | What it commits |
+|---|---|
+| REQ-001 | The provisioner facade is the sole reader of `HETZNER_ACCOUNT_API_KEY` and emits `provisionerReady` with `{tool, apiHost}` on boot. |
+| REQ-002 | Server declarations live at `hetzner/servers/<name>.json` and validate against the shipped JSON Schema (nine required fields). |
+| REQ-003 | The cloud-init template renders YAML that lands the six hardening baseline blocks on every provisioned server. |
+| REQ-004 | Firewall rule shape: 22 from operator-nominated prefixes, 80 and 443 open, all other inbound denied. Applied at provision time. |
+| REQ-005 | Snapshot cadence elicited (weekly default, daily and off alternatives). A snapshot-on-demand verb fires a tagged snapshot. |
+| REQ-006 | Four lifecycle events fire with metadata-only payloads; no event body carries the token, an ssh private key, or the user-data body. |
+
+Nine USs (37101 through 37109) split those REQs into one user story
+per shape plus three cross-cutting cases: manifest-applies,
+cloud-init-hardened, snapshot-on-demand.
+
+Four TACs anchor the mechanism: `TAC-3801` provisioner, `TAC-3802`
+manifest schema, `TAC-3803` cloud-init template, `TAC-3804` firewall
+shape.
+
+Four ADRs record the load-bearing decisions:
+
+- `ADR-3801` cloud host contract (scope global, new topic
+  `linuxCloudHostContract`).
+- `ADR-3802` snapshot cadence (scope global, new topic
+  `snapshotAndBackupCadence`); weekly default; Hetzner-managed backups
+  are an elicited paid opt-in at approximately 20 percent of monthly
+  server price per
+  https://docs.hetzner.com/cloud/servers/backups-snapshots/overview.
+- `ADR-3803` provisioning tool: `hcloud` default, `raw-api`
+  alternative, Terraform rejected on second toolchain and state file
+  grounds per Baz ruling 2026-09-07.
+- `ADR-3804` hardening baseline: the six blocks named below.
+
+## Two provisioner paths: hcloud and raw-api
+
+The `provisioningTool` elicit takes `hcloud` (default) or `raw-api`.
+Both paths sit behind the same facade so consumer code never diverges.
+
+- `hcloud` shells to the Hetzner Cloud CLI with `--output json` for
+  every verb. Small, self-documenting, dependency-free (the operator
+  installs the binary once). Vendor doc:
+  https://github.com/hetznercloud/cli.
+- `raw-api` fetches the Hetzner Cloud REST API directly. Useful when
+  the target host or CI runner cannot install a binary. Vendor doc:
+  https://docs.hetzner.cloud/.
+
+## Hardening baseline (per ADR-3804)
+
+Every rendered cloud-init lands these six blocks. The render-lint
+probe asserts each block appears in the YAML; the
+`SIMULATE_HARDENING_DRIFT` mutation removes a block and the probe
+FAILS naming the missing line.
+
+1. SSH key-only. `PasswordAuthentication no` via
+   `/etc/ssh/sshd_config.d/hardening.conf`.
+2. Root disabled. `PermitRootLogin no` in the same file.
+3. UFW default-deny incoming with 22, 80, 443 permitted per the
+   manifest firewall shape.
+4. DOCKER-USER iptables chain wired to drop non-conforming egress
+   (loaded on boot via `iptables-persistent`).
+5. fail2ban SSH jail on port 22.
+6. `unattended-upgrades` on for security updates per
+   https://wiki.debian.org/UnattendedUpgrades.
+
+## Elicited parameters
+
+| Elicit | Choices | Default |
+|---|---|---|
+| `provisioning-tool` | `hcloud`, `raw-api` | `hcloud` (ADR-3803) |
+| `server-type` | `cx23`, `cx33`, `cx43`, `cpx11`..`cpx41`, `cax11`..`cax31` | `cx23` |
+| `location` | `fsn1`, `nbg1`, `hel1`, `ash`, `hil` | `fsn1` (Baz ruling 2026-09-07 09:50Z) |
+| `image` | any Hetzner image slug | `ubuntu-24.04` |
+| `ssh-source-prefixes` | CSV of CIDR ranges | `203.0.113.0/24` (example only; supply the real prefix set) |
+| `firewall-id` | existing firewall id or empty | empty (create from `firewallRules`) |
+| `snapshot-cadence` | `weekly`, `daily`, `off` | `weekly` (ADR-3802) |
+| `hetzner-managed-backups` | `true`, `false` | `false` (ADR-3802) |
+
+ssh-key ids are delegated to `security-secrets-management`; the
+manifest carries a nonempty array of key references (names) and the
+facade never sees the private material.
+
+## Companions
+
+- `logging` supplies the sink factory for the four lifecycle events.
+- `errorHandling` supplies the internal-error record factory and the
+  facade boundary that turns hcloud non-zero exits, rate-limited API
+  calls, firewall-apply failures and cloud-init timeouts into typed
+  records.
+
+## The six probes and how to run them
+
+Every probe lives at `contributions/probes/<name>.mjs` with a
+`run-<name>.mjs` shim, and is exercised through a fixture-side
+`run-<name>.mjs` under
+`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/`.
+
+- Three mocked probes run in-process without an API call:
+  - `cloud-init-render-lint` (AC-37104-1): renders the template
+    against the fixture manifest and asserts the six baseline blocks
+    appear. Mutation switch: `SIMULATE_HARDENING_DRIFT=true`.
+  - `manifest-schema-validate` (AC-37102-1, also AC-37106-1 and
+    AC-37107-1): validates every fixture manifest. Mutation switch:
+    `SIMULATE_MANIFEST_INVALID=true`.
+  - `hcloud-dry-run-mock` (AC-37101-1 and AC-37109-1): drives the
+    facade lifecycle against a mocked hcloud shim and asserts every
+    lifecycle event fires with a metadata-only payload; runs an
+    event-secrecy scan across every event body. Mutation switches:
+    `SIMULATE_JSON_PARSE_STRIP=true` (parser failure) and
+    `SIMULATE_EVENT_SECRECY_LEAK=true` (defensive-fake token leak).
+- Three account-bound probes gate on `CI_HAS_HETZNER_ACCOUNT`:
+  - `real-account-throwaway-server-provision` (AC-37103-1): applies
+    the ci-throwaway manifest, asserts the server appears in
+    `hcloud server list`, tears down in `always()`.
+  - `real-account-cloud-init-hardened` (AC-37105-1): waits for
+    `cloud-init status --wait`, runs six ssh baseline checks.
+  - `real-account-snapshot-on-demand` (AC-37108-1): fires the snapshot
+    verb, asserts a tagged snapshot appears in `hcloud image list`.
+
+Without `CI_HAS_HETZNER_ACCOUNT=true` the three account-bound probes
+record `accountBoundSkipped: true` and the aggregate flips to pass per
+hetzner-round-7-spec-2026-09-07.md section 3.5.
+
+Reviewer boot from the fixture directory (mocked path, no account):
+
+```
+cd packages/rcf-lite/test/fixtures/hetzner-throwaway-server
+node ./run-cloud-init-render-lint.mjs && node ./run-manifest-schema-validate.mjs && node ./run-hcloud-dry-run-mock.mjs
+```
+
+Every probe writes its report envelope to
+`.rcf/reports/blueprints/deploy-hetzner-server/<probe-name>.json`.
+
+## Shared throwaway-server fixture
+
+The one new pattern this round. Lives at
+`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/`; ships
+`provision.mjs`, `destroy.mjs`, `sweep-orphans.mjs`, the mocked hcloud
+shim and the manifest at `hetzner/servers/ci-throwaway.json`. T-2
+(`platform-docker-compose-host`) and T-3 (`edge-cloudflare-tunnel`)
+EXTEND the fixture rather than shipping a second copy. Cost ceiling:
+one `cx23` at approximately EUR 0.006/hour per run; destroy runs in
+`always()`; the nightly `sweep-orphans` cron collects any leak with a
+60-minute label-age cutoff and emits a `throwawayServerSweptCount`
+metric.
+
+## When to reach for this blueprint
+
+Reach for `deploy-hetzner-server` when the project needs a persistent
+Linux runtime: something a Cloudflare Worker cannot host (a
+long-running process, a container runtime, an outbound network
+adapter that needs a stable egress). Sibling `deploy-cloudflare-workers`
+still ships every V8-isolate workload the Workers runtime accepts;
+this blueprint is the Hetzner-line answer for the workloads Workers
+cannot host.
+
+## Consumers
+
+- ops-01 is the first HQ consumer (`w-2026-09-07-dave-004` migration).
+- Round-7 T-2 `platform-docker-compose-host` composes on
+  `capabilities: [cloudHost]`.
+- Round-7 T-3 `edge-cloudflare-tunnel` composes on `cloudHost` (via
+  the systemd unit shape) or on `containerHost` (via T-2).
+
+Blueprint acceptance never depends on the ops-01 migration.
+
+## Standards trace
+
+- Hetzner Cloud API: https://docs.hetzner.cloud/
+- Hetzner Cloud CLI: https://github.com/hetznercloud/cli
+- Hetzner Cloud servers overview: https://docs.hetzner.com/cloud/servers/overview
+- Hetzner Cloud firewalls overview: https://docs.hetzner.com/cloud/firewalls/overview/
+- Hetzner Cloud backups-and-snapshots overview:
+  https://docs.hetzner.com/cloud/servers/backups-snapshots/overview
+- Hetzner Cloud networks overview: https://docs.hetzner.com/cloud/networks/overview/
+- Hetzner community basic cloud-config tutorial:
+  https://community.hetzner.com/tutorials/basic-cloud-config
+- cloud-init documentation: https://cloudinit.readthedocs.io/en/latest/
+- Debian unattended-upgrades wiki: https://wiki.debian.org/UnattendedUpgrades
+
+## Rejected alternatives
+
+- Terraform. Adds a second toolchain and a state file that nobody in
+  the estate needs. Baz ruling 2026-09-07 09:50Z on decision 18.
+- A Load Balancer blueprint. Out of scope for round-7 T-1; may ship as
+  a follow-up if a second Hetzner consumer needs it.