rcf-lite 0.24.0 → 0.25.0

package/rcf/adrs/adr-3903-platform-docker-compose-host-reject-coolify.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-08T01:42:22.057Z",
+  "updatedAt": "2026-09-08T01:44:12.646Z",
+  "adrId": "ADR-3903-platform-docker-compose-host-reject-coolify",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "accepted",
+  "title": "T-2 Coolify rejected per Baz decision 20 (it shadows what the blueprints contract and adds its own DB and UI as a second source of state)",
+  "context": "Coolify was proposed as a candidate platform-* sibling in the round-7 proposal. It is a self-hosted PaaS with its own database and UI. Baz decision 20 on 2026-09-07 09:50Z ruled Coolify out for round 7.",
+  "decision": "reject; it shadows what the blueprints contract and adds its own DB and UI as a second source of state.",
+  "consequences": "No platform-coolify-host blueprint is scoped in round 7 and no reserved slot is allocated. A future platform-coolify-host sibling mints on operator demand under a fresh scope PR. The standards trace clause on this contribution entry is generic enterprise practice; no vendor-doc URL is claimed for the reject decision."
+}

package/rcf/adrs/adr-3904-platform-docker-compose-host-log-driver.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-08T01:42:22.244Z",
+  "updatedAt": "2026-09-08T01:44:12.833Z",
+  "adrId": "ADR-3904-platform-docker-compose-host-log-driver",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "accepted",
+  "title": "T-2 log driver choice: journald default matching Debian 12 and Ubuntu 24.04 baseline; loki opt-in when the project runs Grafana (elicited)",
+  "context": "Containers write stdout and stderr to a log driver. Debian 12 and Ubuntu 24.04 (the T-1 cloud-init baseline) ship journald. Grafana users on the estate reach for loki as a native sink. A one-choice hard-code loses either journald parity with the OS or loki when the operator runs Grafana.",
+  "decision": "The log driver is elicited via the log-driver parameter. The shipped default is journald matching the Debian 12 and Ubuntu 24.04 baselines T-1 sets up. The alternative is loki, opted into when the applying project runs Grafana. When observability-logging is applied, the compose file wires the elicited driver to that companion. Standards trace clause: generic enterprise practice.",
+  "consequences": "A project applying log-driver=journald gets the systemd-native path; the journald sink is queried via journalctl. A project applying log-driver=loki targets the Grafana loki endpoint; the observability-logging companion supplies the endpoint address. Neither choice adds a runtime npm dependency. The compose-config-lint refuses on any driver value outside the allowed set."
+}

package/rcf/adrs/adr-4001-edge-cloudflare-tunnel-ingress-bridge-contract.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-08T03:23:09.408Z",
+  "updatedAt": "2026-09-08T03:23:09.408Z",
+  "adrId": "ADR-4001-edge-cloudflare-tunnel-ingress-bridge-contract",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "T-3 edge ingress bridge contract: Cloudflare Tunnel as the shipped ingress-bridge shape from a cloudHost service to the CF edge (scope global, new topic edgeIngressBridge)",
+  "context": "An applying project running on a Linux cloudHost needs one shipped answer to the question of how a service on that host reaches the public internet without opening origin ports. Round-7 T-3 mints the edgeIngressBridge topic on this ADR. Cloudflare Tunnel is the shipped v1.0.0 mechanism (cloudflared connector out to the CF edge; DNS route on a Cloudflare zone; ingress rules mapping public hostname to internal service URL). Every applied ingress bridge needs one project-wide answer to the edgeIngressBridge topic; a future non-Cloudflare sibling (Tailscale Funnel, Fly.io proxy) would contribute the same topic string with a different mechanism, forcing a DELIBERATE conflict the operator resolves per the round-2 conflict pattern. Standards trace clause: Cloudflare Tunnel overview and get-started documented mechanics per hetzner-round-7-spec-2026-09-07.md.",
+  "decision": "The shipped v1.0.0 default is a Cloudflare Tunnel connector as the edgeIngressBridge provider. A cloudflared connector on the applying host (compose service by default when containerHost is applied per ADR-4002; systemd unit on a bare cloudHost) reads a tunnel manifest at cloudflare/tunnels/<name>.yaml and terminates ingress at the CF edge. The edgeIngressBridge topic scope is global on this blueprint; the topic string is edgeIngressBridge (lower camelCase, one concept per topic, no version suffix, per the round-2 rules-for-new-topics clause on the shelf registry). Standards trace clause: Cloudflare Tunnel overview and get-started documented mechanics per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "Consumer blueprints that expose a service publicly declare capabilities: [tunnelBridge] on their applied contract to know a bridge is in place. Composition with zeroTrustGate (edge-cloudflare-access) toggles the Access-gated ingress shape per ADR-4003. A T-3-only project (no reverse proxy) declares no 80/443 firewall rule; the tunnel is the sole path from the edge to the origin. Rebuild-from-manifest is always possible: the manifest is the source of truth, the running connector is derivative. Folding this shape into edge-cloudflare-access was rejected: Access is an authorisation gate, Tunnel is an ingress bridge; the responsibilities are distinct and one applies without the other."
+}

package/rcf/adrs/adr-4002-edge-cloudflare-tunnel-connector-runtime.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-08T03:23:09.604Z",
+  "updatedAt": "2026-09-08T03:23:09.604Z",
+  "adrId": "ADR-4002-edge-cloudflare-tunnel-connector-runtime",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "T-3 connector runtime: compose-service default when containerHost applied; systemd-unit alternative on bare cloudHost",
+  "context": "The cloudflared connector runs in one of two supported vendor shapes: as a container image published on the cloudflared downloads page, or as a systemd unit installed via the vendor package per the cloudflared as-a-service local-configuration-file docs. An applying project running its stack under docker compose has a natural home for the connector alongside its other services (same network, same logging driver, same restart policy). An applying project running bare on the host has no compose stack and needs a systemd unit for boot ordering and journald logging. Standards trace clause: Cloudflare cloudflared as-a-service documented systemd unit per hetzner-round-7-spec-2026-09-07.md.",
+  "decision": "The connector runtime is elicited via ADR-4002 with enum {compose-service, systemd-unit} and recommendedDefault compose-service. When the containerHost capability is applied (T-2 platform-docker-compose-host) the shipped default is compose-service; when the host runs bare (only T-1 applied) the operator picks systemd-unit at apply time. Standards trace clause: Cloudflare cloudflared as-a-service documented systemd unit per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "The fixture ships both variants and both pass the local probes (manifest-schema-validate, cloudflared-config-lint, aud-presence-check). A future non-Cloudflare tunnel sibling (Tailscale Funnel, Fly.io proxy) reuses the runtime enum shape but the elicit lives on that siblings own ADR (conflict-by-design on edgeIngressBridge per ADR-4001). The systemd variant carries an install caveat in the guide: the vendor package landed via apt/curl per the as-a-service docs, which is out of scope for the blueprint itself."
+}

package/rcf/adrs/adr-4003-edge-cloudflare-tunnel-hostname-mode.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-08T03:23:09.794Z",
+  "updatedAt": "2026-09-08T03:23:09.794Z",
+  "adrId": "ADR-4003-edge-cloudflare-tunnel-hostname-mode",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "T-3 hostname mode: access-gated when zeroTrustGate applied (ingress attaches AUD); public-hostname when absent (block omitted)",
+  "context": "A tunnel can serve a public hostname openly (any request reaches the origin, protected only by whatever authentication the origin itself carries) or Access-gated (cloudflared refuses at the edge any request without a valid Access JWT for a named AUD, per the vendor self-hosted-public-app docs). The hostname mode is not elicited: it is DISCOVERED from the applied capability set. When zeroTrustGate is applied (edge-cloudflare-access v1.0.0), the tunnel binds the Access AUD; when it is not, the tunnel serves in public-hostname mode. Standards trace clause: Cloudflare Access self-hosted-public-app documented shape per hetzner-round-7-spec-2026-09-07.md.",
+  "decision": "ADR-4003 records the hostname mode as elicited: false and discovered from applied capabilities via the sidecar rcf/blueprints/edge-cloudflare-tunnel.applied.json. When appliedCapabilities includes zeroTrustGate, every ingress rule under the tunnel manifest attaches an originRequest.access block naming the AUD; when it does not, the block is omitted. The aud-presence-check probe runs on both fixture variants and asserts the shape flips correctly. Standards trace clause: Cloudflare Access self-hosted-public-app documented shape per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "A project that applies zeroTrustGate later inherits the Access-gated shape on the next reapply of edge-cloudflare-tunnel without a manual manifest edit; a project that removes zeroTrustGate drops to public-hostname mode explicitly. A silent drift (the sidecar keeps zeroTrustGate but the ingress loses the AUD block) is caught by aud-presence-check refusing before the shape ships. Fixture variants live under cloudflared/*/access-gated and cloudflared/*/public-hostname; the SIMULATE_AUD_DROP mutation on the gated fixture proves the refuse path."
+}

package/rcf/code-nodes/cn-410.json

@@ -0,0 +1,20 @@
+{
+  "cnId": "CN-410",
+  "path": "../../blueprints/deploy-hetzner-server/blueprint.json",
+  "implementsAcIds": [
+    "AC-11001-1",
+    "AC-11101-1",
+    "AC-11102-1",
+    "AC-11201-1",
+    "AC-11202-1",
+    "AC-11301-1",
+    "AC-11401-1",
+    "AC-11402-1",
+    "AC-11501-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T23:59:16.031Z",
+  "updatedAt": "2026-09-07T23:59:16.220Z"
+}

package/rcf/code-nodes/cn-440.json

@@ -0,0 +1,20 @@
+{
+  "cnId": "CN-440",
+  "path": "../../blueprints/platform-docker-compose-host/blueprint.json",
+  "implementsAcIds": [
+    "AC-12001-1",
+    "AC-12101-1",
+    "AC-12102-1",
+    "AC-12201-1",
+    "AC-12202-1",
+    "AC-12301-1",
+    "AC-12401-1",
+    "AC-12402-1",
+    "AC-12501-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T01:45:43.708Z",
+  "updatedAt": "2026-09-08T01:45:43.708Z"
+}

package/rcf/code-nodes/cn-470.json

@@ -0,0 +1,19 @@
+{
+  "cnId": "CN-470",
+  "path": "../../blueprints/edge-cloudflare-tunnel/blueprint.json",
+  "implementsAcIds": [
+    "AC-13001-1",
+    "AC-13002-1",
+    "AC-13101-1",
+    "AC-13102-1",
+    "AC-13201-1",
+    "AC-13301-1",
+    "AC-13302-1",
+    "AC-13401-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T03:25:10.642Z",
+  "updatedAt": "2026-09-08T03:25:10.642Z"
+}

package/rcf/fbs/fbs-130.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T23:59:15.656Z",
+  "updatedAt": "2026-09-07T23:59:15.844Z",
+  "acIds": [
+    "AC-11001-1",
+    "AC-11101-1",
+    "AC-11102-1",
+    "AC-11201-1",
+    "AC-11202-1",
+    "AC-11301-1",
+    "AC-11401-1",
+    "AC-11402-1",
+    "AC-11501-1"
+  ],
+  "fbsId": "FBS-130",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 60,
+  "executionStatus": "notStarted",
+  "title": "T-1 deploy-hetzner-server v1.0.0: 6 REQs 9 USs 4 TACs 4 ADRs 6 Node-only probes; shared hetzner-throwaway-server fixture mint with provision/destroy/sweep-orphans and dry-run mock",
+  "summary": "HQ round-7 T-1: deploy-hetzner-server v1.0.0 blueprint on the shelf under blueprints/deploy-hetzner-server/ (23 contributions: 6 REQs, 9 USs, 4 TACs, 4 ADRs; inventory per hetzner-round-7-spec-2026-09-07 section 5.1). Mints the shared throwaway-Hetzner-server fixture at packages/rcf-lite/test/fixtures/hetzner-throwaway-server/ (provision.mjs, destroy.mjs, sweep-orphans.mjs, hcloud-mock shim, cloud-init renderer, provisioner-facade proto, hetzner/servers/ci-throwaway.json manifest, README) that T-2 and T-3 will extend. Six Node-only probes under blueprints/deploy-hetzner-server/contributions/probes/: cloud-init-render-lint (AC-11201-1; SIMULATE_HARDENING_DRIFT mutation), manifest-schema-validate (AC-11101-1, AC-11301-1, AC-11401-1; SIMULATE_MANIFEST_INVALID mutation), hcloud-dry-run-mock (AC-11001-1, AC-11501-1; JSON-parser-strip mutation plus event-secrecy leak mutation), real-account-throwaway-server-provision (AC-11102-1; accountBound), real-account-cloud-init-hardened (AC-11202-1; accountBound), real-account-snapshot-on-demand (AC-11402-1; accountBound). Blueprint README, guide, CHANGELOG, docs/topics.md; shelf-wide topics.md sweep adding the deploy-hetzner-server row across every prior blueprint; section 6a cloudHost row on packages/rcf-lite/docs/blueprint-authoring.md. New global topics minted: linuxCloudHostContract, snapshotAndBackupCadence. Repo chain: REQ-110..115, US-11001, 11101, 11102, 11201, 11202, 11301, 11401, 11402, 11501, TS-140 with nine TCs, FBS-130, CN-410, TAC-3801..3804, ADR-3801..3804 minted via rcf define create --id per HQ round-7 T-1 reserved-block ruling (REQ-110..119 / TS-140..149 / FBS-130..139 / CN-410..439). Base commit origin/main 150d9c6.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-140.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T01:45:31.629Z",
+  "updatedAt": "2026-09-08T01:45:31.816Z",
+  "acIds": [
+    "AC-12001-1",
+    "AC-12101-1",
+    "AC-12102-1",
+    "AC-12201-1",
+    "AC-12202-1",
+    "AC-12301-1",
+    "AC-12401-1",
+    "AC-12402-1",
+    "AC-12501-1"
+  ],
+  "fbsId": "FBS-140",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 61,
+  "executionStatus": "notStarted",
+  "title": "T-2 platform-docker-compose-host v1.0.0: 6 REQs 9 USs 4 TACs 4 ADRs 5 Node-only probes; extend shared hetzner-throwaway-server fixture with compose stack, Caddyfile, secret file mount and healthchecked service",
+  "summary": "HQ round-7 T-2: platform-docker-compose-host v1.0.0 blueprint on the shelf under blueprints/platform-docker-compose-host/ (23 contributions: 6 REQs, 9 USs, 4 TACs, 4 ADRs; inventory per hetzner-round-7-spec-2026-09-07 section 5.2). Extends the shared throwaway-Hetzner-server fixture minted by T-1 (packages/rcf-lite/test/fixtures/hetzner-throwaway-server/) with a compose stack (compose.yaml, caddy/Caddyfile, secrets/web-token file mount, src/serve.mjs healthchecked stub) plus five run-<probe>.mjs delegate shims. Five Node-only probes under blueprints/platform-docker-compose-host/contributions/probes/: compose-config-lint (AC-12201-1, AC-12301-1, AC-12501-1; SIMULATE_MISSING_HEALTHCHECK, SIMULATE_UNCLASSIFIED_RESTART, SIMULATE_UNCLASSIFIED_LOG_DRIVER, SIMULATE_EVENT_SECRECY_LEAK mutations), secrets-as-files-scan (AC-12101-1, AC-12102-1; SIMULATE_PLAINTEXT_SECRET mutation), caddyfile-validate (AC-12401-1; SIMULATE_INVALID_CADDYFILE mutation; runs the caddy:2 vendor container so a caddy binary on PATH is optional), real-account-minimal-stack-up (AC-12202-1; accountBound), real-account-reload-burst (AC-12402-1; accountBound). Blueprint README, guide, CHANGELOG, docs/topics.md; shelf-wide topics.md sweep adding the platform-docker-compose-host row across every prior blueprint; section 6a containerHost row on packages/rcf-lite/docs/blueprint-authoring.md. New global topic minted: containerHostContract. Repo chain: REQ-120..125, US-12001, 12101, 12102, 12201, 12202, 12301, 12401, 12402, 12501, TS-150 with nine TCs, FBS-140, CN-440, TAC-3901..3904, ADR-3901..3904 minted via rcf define create --id per HQ round-7 T-2 reserved-block ruling (REQ-120..129 / TS-150..159 / FBS-140..149 / CN-440..469). Base commit origin/main 30f7b77.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-150.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-08T03:25:02.808Z",
+  "updatedAt": "2026-09-08T03:25:02.808Z",
+  "acIds": [
+    "AC-13001-1",
+    "AC-13002-1",
+    "AC-13101-1",
+    "AC-13102-1",
+    "AC-13201-1",
+    "AC-13301-1",
+    "AC-13302-1",
+    "AC-13401-1"
+  ],
+  "fbsId": "FBS-150",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 62,
+  "executionStatus": "notStarted",
+  "title": "T-3 edge-cloudflare-tunnel v1.0.0: 5 REQs 8 USs 3 TACs 3 ADRs 5 Node-only probes; extend shared hetzner-throwaway-server fixture with cloudflared connector (compose-service and systemd-unit variants; access-gated and public-hostname sidecar modes)",
+  "summary": "HQ round-7 T-3: edge-cloudflare-tunnel v1.0.0 blueprint on the shelf under blueprints/edge-cloudflare-tunnel/ (five REQs, eight USs, three TACs, three ADRs; inventory per hetzner-round-7-spec-2026-09-07 section 5.3). Extends the shared throwaway-Hetzner-server fixture minted by T-1 and extended by T-2 (packages/rcf-lite/test/fixtures/hetzner-throwaway-server/) with a cloudflared connector in both runtime shapes (compose-service alongside the T-2 web and caddy services when containerHost is applied; systemd-unit for a bare cloudHost) and both hostname modes (access-gated when zeroTrustGate is applied; public-hostname when absent), all under cloudflared/{compose-service,systemd-unit}/{access-gated,public-hostname}/. Five Node-only probes under blueprints/edge-cloudflare-tunnel/contributions/probes/: manifest-schema-validate (AC-13101-1, AC-13201-1, AC-13401-1; fixture-side SIMULATE_MANIFEST_INVALID_TUNNEL_ID, SIMULATE_MANIFEST_CREDENTIALS_INLINE, SIMULATE_MANIFEST_MISSING_CATCHALL, SIMULATE_ORIGIN_PORT_OPEN, SIMULATE_EVENT_SECRECY_LEAK mutations), cloudflared-config-lint (AC-13102-1; SIMULATE_INGRESS_INVALID mutation; runs the cloudflare/cloudflared vendor container so a cloudflared binary on PATH is optional), aud-presence-check (AC-13301-1, AC-13302-1; SIMULATE_AUD_DROP mutation; runs on both fixture variants and asserts the sidecar-read shape flips), real-account-connector-healthy (AC-13002-1; accountBound on CI_HAS_CLOUDFLARE_ACCOUNT plus CI_HAS_HETZNER_ACCOUNT), real-account-tunnel-hostname-routes (AC-13102-1 (secondary), AC-13301-1 (Access-gated sub-case); accountBound; the Access-gated sub-case additionally reads CI_HAS_CLOUDFLARE_ACCESS per Q4 ratification). Blueprint README, guide, CHANGELOG, docs/topics.md; shelf-wide topics.md sweep adding the edge-cloudflare-tunnel row across every prior blueprint; section 6a tunnelBridge row on packages/rcf-lite/docs/blueprint-authoring.md. New global topic minted: edgeIngressBridge. Repo chain: REQ-130..134, US-13001, 13002, 13101, 13102, 13201, 13301, 13302, 13401, TS-160 with eight TCs, FBS-150, CN-470, TAC-4001..4003, ADR-4001..4003 minted via rcf define create --id per HQ round-7 T-3 reserved-block ruling (REQ-130..139 / TS-160..169 / FBS-150..159 / CN-470..499). Base commit origin/main 6b4df05.",
+  "dependsOnFbsIds": []
+}

package/rcf/requirements/req-110.json

@@ -0,0 +1,58 @@
+{
+  "createdAt": "2026-09-07T23:53:24.739Z",
+  "updatedAt": "2026-09-07T23:53:41.232Z",
+  "description": "The provisioner module wraps the hcloud CLI verbs (or the raw Hetzner Cloud API when provisioningTool=raw-api) and is the sole reader of the Hetzner API token via security-secrets-management. It opens on the applying project's boot path and emits a provisionerReady lifecycle event with metadata-only fields (tool, apiHost, sha of the shim). Chain: HQ round-7 T-1 reserved-block per HQ chain-block ruling 2026-09-07 (REQ-110..119 / TS-140..149 / FBS-130..139 / CN-410..439). Round-7 T-1 track of hetzner-round-7-spec-2026-09-07 section 5.1.",
+  "reqId": "REQ-110",
+  "prdId": "PRD-001",
+  "title": "T-1 deploy-hetzner-server v1.0.0 blueprint: provisioner is sole reader of the Hetzner API token, opens on boot, fires provisionerReady event with metadata-only payload",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "httpApi",
+      "auth"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T23:53:24.779Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "httpApi",
+        "match": "API"
+      },
+      {
+        "source": "title",
+        "shape": "auth",
+        "match": "token"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "API"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "api"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "API"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "token"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "api"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-111.json

@@ -0,0 +1,32 @@
+{
+  "createdAt": "2026-09-07T23:53:24.971Z",
+  "updatedAt": "2026-09-07T23:53:41.419Z",
+  "description": "The applying project holds its server declarations as JSON documents under hetzner/servers/<name>.json, one file per server, matching a shipped JSON Schema that names type, location, image, ssh-key ids, firewall id, network id, cloud-init user-data path and labels. Applying the provisioner reads each manifest and creates a matching live server; the hetznerServerProvisioned event carries id, primary IPv4, location and server-type. Chain: HQ round-7 T-1 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-1 track of hetzner-round-7-spec-2026-09-07 section 5.1.",
+  "reqId": "REQ-111",
+  "prdId": "PRD-001",
+  "title": "T-1 deploy-hetzner-server v1.0.0 blueprint: server manifest schema at hetzner/servers/*.json applies to a live Hetzner Cloud server",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "persistence"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T23:53:25.012Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "persistence",
+        "match": "schema"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "Schema"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-112.json

@@ -0,0 +1,42 @@
+{
+  "createdAt": "2026-09-07T23:53:25.205Z",
+  "updatedAt": "2026-09-07T23:53:41.612Z",
+  "description": "The cloud-init template shipped with the blueprint renders YAML that lands SSH key-only, root disabled, UFW default-deny incoming, DOCKER-USER iptables chain, fail2ban SSH jail and unattended-upgrades on every provisioned Hetzner server. A local render lint asserts the six baseline blocks are present in the rendered YAML before any provision runs. Chain: HQ round-7 T-1 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-1 track of hetzner-round-7-spec-2026-09-07 section 5.1.",
+  "reqId": "REQ-112",
+  "prdId": "PRD-001",
+  "title": "T-1 deploy-hetzner-server v1.0.0 blueprint: cloud-init hardening baseline lands the six documented lines on the provisioned server",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "webUi"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T23:53:25.246Z",
+    "signals": [
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "template"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "renders"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "render"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "rendered"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-113.json

@@ -0,0 +1,33 @@
+{
+  "createdAt": "2026-09-07T23:53:25.436Z",
+  "updatedAt": "2026-09-07T23:53:41.809Z",
+  "description": "The firewall rule set lives inside the server manifest and is applied to the server at provision time. Rules: 22 permitted only from an operator-nominated set of source-prefix ranges; 80/443 permitted from anywhere for the reverse proxy; all other inbound traffic denied. Manifest schema validation refuses on a rule set that opens 22 to 0.0.0.0/0 or drops the 80/443 rules. Chain: HQ round-7 T-1 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-1 track of hetzner-round-7-spec-2026-09-07 section 5.1.",
+  "reqId": "REQ-113",
+  "prdId": "PRD-001",
+  "title": "T-1 deploy-hetzner-server v1.0.0 blueprint: firewall shape restricts SSH to operator-nominated prefixes, permits 80/443, denies all else",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "httpApi",
+      "persistence"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T23:53:25.477Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "httpApi",
+        "match": "rest"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "schema"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-114.json

@@ -0,0 +1,20 @@
+{
+  "createdAt": "2026-09-07T23:53:25.669Z",
+  "updatedAt": "2026-09-07T23:53:41.996Z",
+  "description": "The applying project elicits a snapshot cadence per ADR-3802 (default weekly, alternatives daily and off). When non-off, the scheduled snapshot runner fires the hcloud snapshot verb and tags the snapshot with server name and wall-clock time; a snapshot-on-demand verb fires the same shape. The hetznerSnapshotTaken event carries snapshot id and wall-clock time. Chain: HQ round-7 T-1 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-1 track of hetzner-round-7-spec-2026-09-07 section 5.1.",
+  "reqId": "REQ-114",
+  "prdId": "PRD-001",
+  "title": "T-1 deploy-hetzner-server v1.0.0 blueprint: snapshot cadence elicited (weekly default, daily and off alternatives), snapshot-on-demand fires a tagged snapshot",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "none"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T23:53:25.710Z"
+  }
+}

package/rcf/requirements/req-115.json

@@ -0,0 +1,38 @@
+{
+  "createdAt": "2026-09-07T23:53:25.903Z",
+  "updatedAt": "2026-09-07T23:53:42.183Z",
+  "description": "The provisioner facade emits four lifecycle events: provisionerReady, hetznerServerProvisioned, hetznerSnapshotTaken and hetznerServerDestroyed. Payloads are metadata-only: id, primary IPv4, location, server-type, snapshot id, wall-clock time. An event-secrecy probe asserts no event body carries the API token, an ssh private key, or a plaintext secret; a mutation that leaks a token into an event body FAILS the probe with a defensive-fake finding. Chain: HQ round-7 T-1 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-1 track of hetzner-round-7-spec-2026-09-07 section 5.1.",
+  "reqId": "REQ-115",
+  "prdId": "PRD-001",
+  "title": "T-1 deploy-hetzner-server v1.0.0 blueprint: four lifecycle events fire with metadata-only payloads and no secret leak",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "httpApi",
+      "auth"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T23:53:25.943Z",
+    "signals": [
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "API"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "token"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "token"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-120.json

@@ -0,0 +1,20 @@
+{
+  "createdAt": "2026-09-08T01:39:09.362Z",
+  "updatedAt": "2026-09-08T01:39:28.241Z",
+  "description": "The applying project runs its containerised services from a single compose.yaml at the repo root. Each service is one container. Networks and volumes are declared with explicit names. Non-secret config lives in a .env file loaded by compose. The compose file is the single source of truth for the runtime topology; the container host reads it to bring the stack up and refuses on unclassified or malformed shape. Chain: HQ round-7 T-2 reserved-block per HQ chain-block ruling 2026-09-07 (REQ-120..129 / TS-150..159 / FBS-140..149 / CN-440..469). Round-7 T-2 track of hetzner-round-7-spec-2026-09-07 section 5.2.",
+  "reqId": "REQ-120",
+  "prdId": "PRD-001",
+  "title": "T-2 platform-docker-compose-host v1.0.0 blueprint: compose.yaml at repo root is the source of truth (service-per-container, named networks and volumes, .env for non-secret config)",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "none"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T01:39:09.405Z"
+  }
+}

package/rcf/requirements/req-121.json

@@ -0,0 +1,20 @@
+{
+  "createdAt": "2026-09-08T01:40:03.788Z",
+  "updatedAt": "2026-09-08T01:40:04.018Z",
+  "description": "Every secret used by any compose service is injected as a file mount under the compose secrets top-level key. The compose file contains no plaintext secret literal on any service argument, environment variable, or command clause (grep-refuse). When security-secrets-management is applied, the secret is sourced through that facade; when it is not, the guide names a documented file-based fallback path. The mounted secret file lands at mode 0o400 inside the container. Chain: HQ round-7 T-2 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-2 track of hetzner-round-7-spec-2026-09-07 section 5.2.",
+  "reqId": "REQ-121",
+  "prdId": "PRD-001",
+  "title": "T-2 platform-docker-compose-host: secrets as file mounts, no plaintext literal in compose (grep-refuse); references security-secrets-management when applied",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "none"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T01:40:03.831Z"
+  }
+}

package/rcf/requirements/req-122.json

@@ -0,0 +1,20 @@
+{
+  "createdAt": "2026-09-08T01:40:04.204Z",
+  "updatedAt": "2026-09-08T01:40:04.433Z",
+  "description": "Every service that terminates HTTP declares a healthcheck block. The compose file refuses at docker compose config time when any HTTP-terminating service is missing the block. The healthcheck defaults per service kind are elicited (http default, tcp and command alternatives). The stack is not considered up until every declared service reaches healthy inside the elicited timeout. Chain: HQ round-7 T-2 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-2 track of hetzner-round-7-spec-2026-09-07 section 5.2.",
+  "reqId": "REQ-122",
+  "prdId": "PRD-001",
+  "title": "T-2 platform-docker-compose-host: healthcheck contract on every HTTP-terminating service refuses at docker compose config on missing",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "none"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T01:40:04.247Z"
+  }
+}

package/rcf/requirements/req-123.json

@@ -0,0 +1,42 @@
+{
+  "createdAt": "2026-09-08T01:40:04.619Z",
+  "updatedAt": "2026-09-08T01:40:04.848Z",
+  "description": "Every service declares a restart policy. Long-running services declare restart: unless-stopped. Jobs (short-lived services that exit after completion) declare restart: on-failure. Any service that declares neither, or declares an unclassified value outside the two allowed policies, refuses at the compose-config-lint gate before docker compose up runs. Chain: HQ round-7 T-2 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-2 track of hetzner-round-7-spec-2026-09-07 section 5.2.",
+  "reqId": "REQ-123",
+  "prdId": "PRD-001",
+  "title": "T-2 platform-docker-compose-host: restart discipline (unless-stopped on long-running, on-failure on jobs); refuses at lint on unclassified",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "httpApi"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T01:40:04.662Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "httpApi",
+        "match": "rest"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "rest"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "rest"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "rest"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-124.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-08T01:40:05.035Z",
+  "updatedAt": "2026-09-08T01:40:05.264Z",
+  "description": "The reverse-proxy config file (caddy/Caddyfile when reverseProxy=caddy; traefik/traefik.yaml when reverseProxy=traefik) is a first-class versioned artefact under the applying repo. The compose runtime bind-mounts the file into the proxy service so an operator change to the file is picked up by the reload verb. The reload verb is docker compose exec caddy caddy reload when Caddy, or the documented Traefik equivalent. The reload window is elicited (10 s default). During the window a client burst against the proxy sees no non-2xx and no dropped connection. Chain: HQ round-7 T-2 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-2 track of hetzner-round-7-spec-2026-09-07 section 5.2.",
+  "reqId": "REQ-124",
+  "prdId": "PRD-001",
+  "title": "T-2 platform-docker-compose-host: zero-downtime reverse-proxy reload via bind-mounted config; verb per proxy; no non-2xx or dropped connection inside the elicited window (10 s default)",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "webUi"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T01:40:05.078Z",
+    "signals": [
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "sees"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-125.json

@@ -0,0 +1,20 @@
+{
+  "createdAt": "2026-09-08T01:40:05.460Z",
+  "updatedAt": "2026-09-08T01:40:05.690Z",
+  "description": "Every container writes stdout and stderr through the elicited log driver. Journald is the shipped default matching the Debian 12 and Ubuntu 24.04 baselines the T-1 cloud-init sets up. Loki is the opt-in alternative when the applying project runs Grafana. The choice is elicited via the log-driver ADR. When observability-logging is applied, the compose file wires the elicited driver to that companion. Chain: HQ round-7 T-2 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-2 track of hetzner-round-7-spec-2026-09-07 section 5.2.",
+  "reqId": "REQ-125",
+  "prdId": "PRD-001",
+  "title": "T-2 platform-docker-compose-host: log shipping to the elicited observability-logging sink (journald default; loki opt-in when the project runs Grafana)",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "none"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T01:40:05.504Z"
+  }
+}