rcf-lite 0.24.0 → 0.25.0

package/rcf/test-suites/ts-160.json

@@ -0,0 +1,78 @@
+{
+  "createdAt": "2026-09-08T03:24:23.156Z",
+  "updatedAt": "2026-09-08T03:24:51.162Z",
+  "purpose": "Cover the T-3 chain ACs via the shipped anatomy test at test/blueprint/edge-cloudflare-tunnel-anatomy.test.js and via the three local probe modules driven from the shared throwaway-server fixture (which T-3 extends with cloudflared/compose-service and cloudflared/systemd-unit variants, each in both public-hostname and access-gated sidecar modes).",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-13001-1",
+    "AC-13002-1",
+    "AC-13101-1",
+    "AC-13102-1",
+    "AC-13201-1",
+    "AC-13301-1",
+    "AC-13302-1",
+    "AC-13401-1"
+  ],
+  "id": "TS-160",
+  "usId": "US-13001",
+  "title": "T-3 edge-cloudflare-tunnel anatomy proof: probe modules and cloudflared connector fixture assertions",
+  "testCases": [
+    {
+      "id": "TC-160-connector-shape-variants-shipped",
+      "acId": "AC-13001-1",
+      "description": "Cover AC-13001-1 via anatomy test: the shared fixture ships both cloudflared/compose-service/ and cloudflared/systemd-unit/ variants and the compose-service variant defines a cloudflared service alongside T-2 web and caddy on the same web-net network with no host ports; the systemd-unit variant ships a cloudflared.service unit file per the vendor local-configuration-file docs.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::T-3 edge-cloudflare-tunnel AC-13001-1 connector shape variants shipped (TC-160-connector-shape-variants-shipped)"
+    },
+    {
+      "id": "TC-160-real-account-connector-healthy-declared-and-skipped-shape",
+      "acId": "AC-13002-1",
+      "description": "Cover AC-13002-1 via anatomy test: real-account-connector-healthy probe declares accountBound true and records accountBoundSkipped when CI_HAS_CLOUDFLARE_ACCOUNT or CI_HAS_HETZNER_ACCOUNT is unset.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::T-3 edge-cloudflare-tunnel AC-13002-1 real-account-connector-healthy declared and skipped shape (TC-160-real-account-connector-healthy-declared-and-skipped-shape)"
+    },
+    {
+      "id": "TC-160-manifest-schema-validate-refuses-invalid",
+      "acId": "AC-13101-1",
+      "description": "Cover AC-13101-1 via anatomy test: manifest-schema-validate probe passes on the canonical fixture manifests and fails under the three fixture-side mutations SIMULATE_MANIFEST_INVALID_TUNNEL_ID, SIMULATE_MANIFEST_CREDENTIALS_INLINE and SIMULATE_MANIFEST_MISSING_CATCHALL naming the offending field.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::T-3 edge-cloudflare-tunnel AC-13101-1 manifest schema validate refuses invalid (TC-160-manifest-schema-validate-refuses-invalid)"
+    },
+    {
+      "id": "TC-160-cloudflared-config-lint-passes-and-refuses-invalid-ingress",
+      "acId": "AC-13102-1",
+      "description": "Cover AC-13102-1 via anatomy test: cloudflared-config-lint probe runs cloudflared tunnel ingress validate through the cloudflare/cloudflared container image and exits 0 on the canonical fixture; fails under SIMULATE_INGRESS_INVALID naming the offending line.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::T-3 edge-cloudflare-tunnel AC-13102-1 cloudflared-config-lint passes and refuses invalid ingress (TC-160-cloudflared-config-lint-passes-and-refuses-invalid-ingress)"
+    },
+    {
+      "id": "TC-160-no-public-origin-port-refused",
+      "acId": "AC-13201-1",
+      "description": "Cover AC-13201-1 via anatomy test: manifest-schema-validate refuses under SIMULATE_ORIGIN_PORT_OPEN when an ingress rule service URL binds to a host public interface; the T-1 firewall on the ci-throwaway manifest stays 22 open plus 80/443 open only when a reverse proxy is applied.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::T-3 edge-cloudflare-tunnel AC-13201-1 no public origin port refused (TC-160-no-public-origin-port-refused)"
+    },
+    {
+      "id": "TC-160-aud-presence-flip-on-both-fixture-variants",
+      "acId": "AC-13301-1",
+      "description": "Cover AC-13301-1 via anatomy test: aud-presence-check reads each variant sidecar and asserts the ingress rules attach originRequest.access.aud on the access-gated variant and omit the block on the public-hostname variant.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::T-3 edge-cloudflare-tunnel AC-13301-1 aud-presence-check flips on both fixture variants (TC-160-aud-presence-flip-on-both-fixture-variants)"
+    },
+    {
+      "id": "TC-160-aud-presence-check-refuses-on-drift",
+      "acId": "AC-13302-1",
+      "description": "Cover AC-13302-1 via anatomy test: aud-presence-check FAILS under SIMULATE_AUD_DROP when the gated fixture ingress drifts to omit the originRequest.access block; the finding names the affected rule.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::T-3 edge-cloudflare-tunnel AC-13302-1 aud-presence-check refuses on drift (TC-160-aud-presence-check-refuses-on-drift)"
+    },
+    {
+      "id": "TC-160-credentials-discipline-and-event-secrecy",
+      "acId": "AC-13401-1",
+      "description": "Cover AC-13401-1 via anatomy test: the fixture credentials placeholder documents the 0o400 host mode and secretRef discipline; the event-secrecy scan across lifecycle event bodies passes on canonical fixture and FAILS under SIMULATE_EVENT_SECRECY_LEAK naming the leaked field.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::T-3 edge-cloudflare-tunnel AC-13401-1 credentials discipline and event-secrecy scan (TC-160-credentials-discipline-and-event-secrecy)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/user-stories/us-11001.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T23:55:32.229Z",
+  "updatedAt": "2026-09-07T23:55:46.775Z",
+  "usId": "US-11001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-110",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 provisioner opens on boot with sole HETZNER_ACCOUNT_API_KEY reader and emits provisionerReady with metadata-only payload",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint on a Node project that provisions a Hetzner Cloud VM",
+  "iWant": "the provisioner facade to be the sole reader of the Hetzner API token (via security-secrets-management) and to fire provisionerReady with a metadata-only payload when it opens on boot",
+  "soThat": "the applying project has one auditable seam for the token and the observability sink surfaces the ready event without a secret",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11001-1",
+      "description": "On boot of the shared throwaway-Hetzner-server fixture the provisioner facade opens, and (a) only the provisioner module reads HETZNER_ACCOUNT_API_KEY (grep across the fixture source refuses any other reader), (b) the facade emits a provisionerReady event whose payload carries tool and apiHost only (no token, no ssh key, no user data body).",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3801-deploy-hetzner-server-provisioner"
+  ]
+}

package/rcf/user-stories/us-11101.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T23:56:32.763Z",
+  "updatedAt": "2026-09-07T23:56:33.164Z",
+  "usId": "US-11101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-111",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 server manifest schema at hetzner/servers/name.json validates and names type location image ssh-key ids firewall id network id cloud-init path labels",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint",
+  "iWant": "the applying project's hetzner/servers/name.json manifests to validate against a shipped JSON Schema naming type, location, image, sshKeyIds, firewallId, networkId, cloudInitPath, labels, snapshotCadence",
+  "soThat": "the operator has a stable declarative source of truth for every server",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11101-1",
+      "description": "Every hetzner/servers/*.json under the shared throwaway-Hetzner-server fixture parses, validates against blueprints/deploy-hetzner-server/contributions/schemas/hetzner-server.schema.json, and carries the nine named fields with correct types; an induced defect (SIMULATE_MANIFEST_INVALID=true replaces location with an unknown token) fails schema validation naming the offending field.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3802-deploy-hetzner-server-manifest-schema"
+  ]
+}

package/rcf/user-stories/us-11102.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T23:56:33.351Z",
+  "updatedAt": "2026-09-07T23:56:33.765Z",
+  "usId": "US-11102",
+  "prdId": "PRD-001",
+  "reqId": "REQ-111",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 applying the provisioner reads each manifest and creates a matching live server, hetznerServerProvisioned event carries id primary IPv4 location server-type",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint against a Hetzner project",
+  "iWant": "applying the provisioner to read each manifest under hetzner/servers/, create a matching live Hetzner Cloud server, and emit hetznerServerProvisioned with id, primaryIpv4, location, serverType",
+  "soThat": "the manifest is the source of truth for what actually exists in the project",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11102-1",
+      "description": "The real-account-throwaway-server-provision probe (accountBound: true, skipped without CI_HAS_HETZNER_ACCOUNT) applies the ci-throwaway.json manifest via provision.mjs, asserts (a) hcloud server list --output json shows the new server whose id is written to the fixture scratch file, (b) hetznerServerProvisioned fired with id, primaryIpv4, location=fsn1, serverType=cx23; teardown via destroy.mjs runs regardless of probe verdict.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3801-deploy-hetzner-server-provisioner",
+    "TAC-3802-deploy-hetzner-server-manifest-schema"
+  ]
+}

package/rcf/user-stories/us-11201.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T23:56:33.951Z",
+  "updatedAt": "2026-09-07T23:57:58.302Z",
+  "usId": "US-11201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-112",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 cloud-init template lands the six hardening baseline blocks in the rendered YAML for every provisioned server",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint",
+  "iWant": "the shipped cloud-init template to render YAML that lands SSH key-only, root disabled, UFW default-deny incoming, DOCKER-USER iptables chain, fail2ban SSH jail and unattended-upgrades on every server",
+  "soThat": "the operator inherits the six-block hardening baseline without hand-authoring per host",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11201-1",
+      "description": "cloud-init-render-lint.mjs renders the template with the fixture manifest and asserts each of the six baseline blocks (SSH key-only, root disabled, UFW default-deny incoming, DOCKER-USER iptables chain, fail2ban SSH jail, unattended-upgrades) appears in the rendered YAML by grep; a mutation SIMULATE_HARDENING_DRIFT=true removes the unattended-upgrades block and the probe FAILS with a message naming the missing line.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3803-deploy-hetzner-server-cloud-init-template"
+  ]
+}

package/rcf/user-stories/us-11202.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T23:56:34.564Z",
+  "updatedAt": "2026-09-07T23:57:58.489Z",
+  "usId": "US-11202",
+  "prdId": "PRD-001",
+  "reqId": "REQ-112",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 provisioned server is hardened at runtime: root ssh refused, password auth refused, UFW active default-deny, DOCKER-USER present, unattended-upgrades service active",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint on a real Hetzner account",
+  "iWant": "the provisioned server to be hardened at runtime as the rendered cloud-init promised: root ssh refused, password auth refused, UFW active default-deny incoming, DOCKER-USER present, unattended-upgrades service active",
+  "soThat": "the operator can trust the cloud-init contract without ssh-in-and-check for every server",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11202-1",
+      "description": "real-account-cloud-init-hardened.mjs (accountBound: true, skipped without CI_HAS_HETZNER_ACCOUNT) waits for cloud-init status --wait on the throwaway server, then ssh-checks the six baseline blocks and asserts each check passes; failure names the missing block. Teardown via destroy.mjs runs regardless.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3803-deploy-hetzner-server-cloud-init-template"
+  ]
+}

package/rcf/user-stories/us-11301.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T23:56:35.165Z",
+  "updatedAt": "2026-09-07T23:56:35.601Z",
+  "usId": "US-11301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-113",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 firewall rule shape: 22 from operator-nominated prefixes, 80 and 443 open, all other inbound denied, applied at provision time",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint",
+  "iWant": "the firewall rule set carried in hetzner/servers/name.json to permit 22 only from an operator-nominated set of source-prefix ranges, permit 80 and 443 from 0.0.0.0/0 for the reverse proxy, and deny all other inbound; the provisioner applies the rules at provision time",
+  "soThat": "the operator inherits a documented least-privilege firewall shape on every server without opening ssh to the world",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11301-1",
+      "description": "manifest-schema-validate.mjs asserts every fixture manifest carries a firewall rule set matching the shape (22 permitted only from a nonempty list of source-prefix ranges; 80 and 443 permitted; no other inbound rule); an induced defect (a manifest that opens 22 to 0.0.0.0/0) fails schema validation with a message naming the offending rule.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3802-deploy-hetzner-server-manifest-schema",
+    "TAC-3804-deploy-hetzner-server-firewall-shape"
+  ]
+}

package/rcf/user-stories/us-11401.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T23:56:35.790Z",
+  "updatedAt": "2026-09-07T23:56:36.205Z",
+  "usId": "US-11401",
+  "prdId": "PRD-001",
+  "reqId": "REQ-114",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 snapshot cadence file present under the manifest set, cadence value elicited (weekly default, daily and off alternatives) matches the schema",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint",
+  "iWant": "the elicited snapshot cadence value on hetzner/servers/name.json to match the shipped enum (weekly, daily, off), with weekly the recommended default per ADR-3802",
+  "soThat": "the operator has a single project-wide answer for how often each server snapshots",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11401-1",
+      "description": "manifest-schema-validate.mjs asserts every fixture manifest carries snapshotCadence with a value in the shipped enum {weekly, daily, off}; a manifest missing the field fails schema validation naming the missing field.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3802-deploy-hetzner-server-manifest-schema"
+  ]
+}

package/rcf/user-stories/us-11402.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T23:56:36.391Z",
+  "updatedAt": "2026-09-07T23:56:36.806Z",
+  "usId": "US-11402",
+  "prdId": "PRD-001",
+  "reqId": "REQ-114",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 snapshot-on-demand verb fires the hcloud snapshot verb, tags the snapshot with server name and wall-clock time, hetznerSnapshotTaken event fires with snapshot id",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint on a real Hetzner account",
+  "iWant": "the snapshot-on-demand verb on the provisioner to shell to hcloud image create-image (or the raw-api equivalent) and tag the snapshot with server name and wall-clock time; hetznerSnapshotTaken carries snapshot id and time",
+  "soThat": "the operator has a documented on-demand recovery point at any moment",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11402-1",
+      "description": "real-account-snapshot-on-demand.mjs (accountBound: true, skipped without CI_HAS_HETZNER_ACCOUNT) fires the snapshot verb on the throwaway server, then asserts hcloud image list --type=snapshot --output json shows a snapshot tagged with the server name and current wall-clock time; hetznerSnapshotTaken event carries snapshot id and time. Teardown via destroy.mjs.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3801-deploy-hetzner-server-provisioner"
+  ]
+}

package/rcf/user-stories/us-11501.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T23:56:36.993Z",
+  "updatedAt": "2026-09-07T23:56:37.410Z",
+  "usId": "US-11501",
+  "prdId": "PRD-001",
+  "reqId": "REQ-115",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 four lifecycle events fire with metadata-only payloads, no secret leaks through any event body",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint",
+  "iWant": "the provisioner facade to fire the four lifecycle events (provisionerReady, hetznerServerProvisioned, hetznerSnapshotTaken, hetznerServerDestroyed) with metadata-only payloads (id, primaryIpv4, location, serverType, snapshotId, wallClockTime) and no secret content",
+  "soThat": "the observability sink carries the operational trail without ever leaking a token or an ssh key",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11501-1",
+      "description": "hcloud-dry-run-mock.mjs drives every lifecycle event through the facade against a mocked hcloud shim; the accumulated event stream carries only the metadata fields named; a mutation (event-secrecy leak: inject the token into the hetznerServerProvisioned payload) FAILS the probe with a defensive-fake finding.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3801-deploy-hetzner-server-provisioner"
+  ]
+}

package/rcf/user-stories/us-12001.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T01:41:01.418Z",
+  "updatedAt": "2026-09-08T01:42:32.120Z",
+  "usId": "US-12001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-120",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 compose.yaml at repo root is the single-source runtime topology (service-per-container, named networks and volumes, .env for non-secret config)",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint on a project that runs its stack on a Hetzner cloudHost",
+  "iWant": "a single compose.yaml at the repo root to declare every service as one container with explicit named networks, named volumes, and non-secret config in a .env file",
+  "soThat": "the runtime topology has one auditable seam and the container host can bring the stack up from the file alone",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-12001-1",
+      "description": "The shared throwaway-server fixture ships compose.yaml at the fixture root with (a) every service running exactly one container image (service-per-container), (b) at least one named network under the top-level networks key, (c) at least one named volume under the top-level volumes key, and (d) non-secret config values are read via a colocated .env file rather than inlined into service environment entries.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3901-platform-docker-compose-host-compose-layout"
+  ]
+}

package/rcf/user-stories/us-12101.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T01:41:59.208Z",
+  "updatedAt": "2026-09-08T01:42:32.309Z",
+  "usId": "US-12101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-121",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 secrets flow via docker compose secrets file mounts (no plaintext literal in compose.yaml)",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint on a project with secret material bound to a container",
+  "iWant": "every secret to be declared under the compose secrets top-level key and mounted into the service via secrets: rather than inlined as an environment literal",
+  "soThat": "the compose file is safe to read at review time and the mounted file inherits 0o400 inside the container",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-12101-1",
+      "description": "The fixture compose.yaml declares at least one secret under the top-level secrets key with a file: source, references it from the web service through the service-level secrets: array, and no plaintext value for that secret appears anywhere in compose.yaml (grep-refuses on the literal). The secret file mode is 0o400 inside the container.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3902-platform-docker-compose-host-secrets-mount"
+  ]
+}

package/rcf/user-stories/us-12102.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T01:44:43.238Z",
+  "updatedAt": "2026-09-08T01:44:43.862Z",
+  "usId": "US-12102",
+  "prdId": "PRD-001",
+  "reqId": "REQ-121",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 cross-cutting secretsAreFiles: the source-tree scan refuses any plaintext secret literal in compose.yaml or a referenced service config",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint on a project with sensitive material",
+  "iWant": "the secrets-as-files probe to walk compose.yaml and every service config in the fixture and refuse on any plaintext secret literal, naming the file and line",
+  "soThat": "a secret accidentally inlined in a review is caught by the probe before docker compose up runs",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-12102-1",
+      "description": "The secrets-as-files-scan probe walks compose.yaml plus every referenced service config file in the fixture and asserts (a) no line contains a plaintext token pattern (the applied literal name plus the applied literal value), (b) every declared secret in the compose secrets: key has a file: source, and (c) SIMULATE_PLAINTEXT_SECRET=true writes a plaintext literal into compose.yaml and the probe FAILS naming the file and the literal.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3902-platform-docker-compose-host-secrets-mount"
+  ]
+}

package/rcf/user-stories/us-12201.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T01:42:40.956Z",
+  "updatedAt": "2026-09-08T01:42:41.556Z",
+  "usId": "US-12201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-122",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 healthcheck contract: docker compose config refuses when an HTTP-terminating service is missing a healthcheck block",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint on a project that terminates HTTP inside a container",
+  "iWant": "the compose config lint to refuse at gate time on any HTTP-terminating service that is missing a healthcheck block, naming the service",
+  "soThat": "the stack never comes up with a service the container host cannot know is ready",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-12201-1",
+      "description": "The compose-config-lint probe shells to docker compose config against the fixture compose.yaml, asserts exit 0, and additionally asserts every HTTP-terminating service declares a healthcheck: block. SIMULATE_MISSING_HEALTHCHECK=true strips the block from the web service and the probe FAILS naming the service.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3903-platform-docker-compose-host-healthcheck-lint"
+  ]
+}

package/rcf/user-stories/us-12202.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-08T01:42:41.742Z",
+  "updatedAt": "2026-09-08T01:42:42.341Z",
+  "usId": "US-12202",
+  "prdId": "PRD-001",
+  "reqId": "REQ-122",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 cross-cutting upClean: the stack comes up clean and every declared service reaches healthy",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint on a Hetzner cloudHost",
+  "iWant": "the real-account minimal-stack-up probe to scp the compose.yaml to the throwaway server, run docker compose up -d --wait, and assert every declared service reaches healthy inside the elicited timeout",
+  "soThat": "the composeStackReady claim is proven on real docker before the blueprint ships",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-12202-1",
+      "description": "The real-account-minimal-stack-up probe, when CI_HAS_HETZNER_ACCOUNT is set, provisions the throwaway server, scps the compose.yaml, runs docker compose up -d --wait, asserts every declared service reaches healthy inside the elicited timeout, and tears down the stack plus the server in always(). Without CI_HAS_HETZNER_ACCOUNT the probe records accountBoundSkipped: true and the aggregate flips to pass.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3901-platform-docker-compose-host-compose-layout",
+    "TAC-3903-platform-docker-compose-host-healthcheck-lint"
+  ]
+}

package/rcf/user-stories/us-12301.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T01:42:42.527Z",
+  "updatedAt": "2026-09-08T01:42:43.125Z",
+  "usId": "US-12301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-123",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 restart discipline: unless-stopped on long-running, on-failure on jobs; unclassified value refuses at lint",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint",
+  "iWant": "the compose config lint to enforce a restart policy on every service and refuse on any value outside the two allowed policies (unless-stopped for long-running, on-failure for jobs)",
+  "soThat": "the operator sees a wrong or missing restart policy at gate time rather than as a stuck container",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-12301-1",
+      "description": "The compose-config-lint probe asserts every service in the compose.yaml declares a restart policy AND every declared value is one of unless-stopped or on-failure. SIMULATE_UNCLASSIFIED_RESTART=true sets restart: always on the web service and the probe FAILS naming the service and the disallowed value.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3903-platform-docker-compose-host-healthcheck-lint"
+  ]
+}

package/rcf/user-stories/us-12401.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T01:42:43.312Z",
+  "updatedAt": "2026-09-08T01:42:43.912Z",
+  "usId": "US-12401",
+  "prdId": "PRD-001",
+  "reqId": "REQ-124",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 reverse-proxy config as a first-class versioned artefact (caddy/Caddyfile) validated by the vendor validator",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint with reverseProxy=caddy",
+  "iWant": "a checked-in caddy/Caddyfile bind-mounted into the proxy service so the reload verb picks up an operator change, validated at gate time by caddy validate",
+  "soThat": "a broken Caddyfile is caught before the reload burst runs, and there is one place in the tree the operator edits to route hostnames",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-12401-1",
+      "description": "The fixture ships caddy/Caddyfile at the fixture root under a caddy/ directory, the compose file bind-mounts it read-only into the caddy service, and the caddyfile-validate probe shells to caddy validate against the file and asserts exit 0. SIMULATE_INVALID_CADDYFILE=true writes an invalid directive into a scratch copy and the probe FAILS naming the line. Skipped when the applied reverseProxy is not caddy.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3904-platform-docker-compose-host-reverse-proxy-artefact"
+  ]
+}

package/rcf/user-stories/us-12402.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T01:42:44.098Z",
+  "updatedAt": "2026-09-08T01:42:44.701Z",
+  "usId": "US-12402",
+  "prdId": "PRD-001",
+  "reqId": "REQ-124",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 cross-cutting zeroDowntimeReload: a client burst against the proxy during a config reload sees no non-2xx and no dropped connection inside the elicited window",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint",
+  "iWant": "the real-account reload-burst probe to fire an undici burst against the reverse proxy while docker compose exec caddy caddy reload runs and assert no non-2xx or dropped connection inside the elicited window",
+  "soThat": "the zero-downtime reload claim is proven on real docker before the blueprint ships",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-12402-1",
+      "description": "The real-account-reload-burst probe, when CI_HAS_HETZNER_ACCOUNT is set, runs undici GETs against the proxy service on the throwaway server while docker compose exec caddy caddy reload runs, asserts every request returns a 2xx status inside the elicited window (10 s default), asserts no dropped connection, tears the stack down in always(). Without CI_HAS_HETZNER_ACCOUNT the probe records accountBoundSkipped: true and the aggregate flips to pass.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3904-platform-docker-compose-host-reverse-proxy-artefact"
+  ]
+}

package/rcf/user-stories/us-12501.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T01:42:44.888Z",
+  "updatedAt": "2026-09-08T01:42:45.499Z",
+  "usId": "US-12501",
+  "prdId": "PRD-001",
+  "reqId": "REQ-125",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 log shipping to the elicited observability-logging sink (journald default; loki opt-in)",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint on a project that may run Grafana or the estate default",
+  "iWant": "the elicited log driver to be wired into every service in the compose file (journald default, loki opt-in) and the choice recorded on the log-driver ADR",
+  "soThat": "the container stdout and stderr reach the applied observability sink without a per-service edit",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-12501-1",
+      "description": "Every service in the fixture compose.yaml declares a logging: driver: block whose driver value matches the elicited log driver (default journald). The compose-config-lint probe asserts (a) every service declares logging: driver, (b) the value is one of journald or loki, and (c) SIMULATE_UNCLASSIFIED_LOG_DRIVER=true sets a disallowed driver and the probe FAILS naming the service and the disallowed value.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3903-platform-docker-compose-host-healthcheck-lint"
+  ]
+}

package/rcf/user-stories/us-13001.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T03:21:16.415Z",
+  "updatedAt": "2026-09-08T03:21:16.415Z",
+  "usId": "US-13001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-130",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 cloudflared connector install shape switches on applied containerHost (compose-service default; systemd-unit fallback for bare cloudHost)",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel v1.0.0 alongside deploy-hetzner-server (and optionally platform-docker-compose-host)",
+  "iWant": "the cloudflared connector to install as a compose service when the containerHost capability is applied and as a systemd unit when the host runs bare",
+  "soThat": "the runtime shape matches the applied platform rather than forcing a container onto a bare host or a bare service into a compose-managed stack",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-13001-1",
+      "description": "The blueprint declares its connector runtime via ADR-4002 with elicited enum {compose-service, systemd-unit} and recommendedDefault compose-service. The shared fixture ships both variants under packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/{compose-service,systemd-unit}/; the compose-service variant defines a cloudflared service alongside the T-2 web and caddy services on the same web-net network with restart unless-stopped, no host ports and a healthcheck; the systemd-unit variant ships a cloudflared.service unit file per the vendor local-configuration-file docs.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4001-edge-cloudflare-tunnel-connector-shape"
+  ]
+}

package/rcf/user-stories/us-13002.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T03:21:16.655Z",
+  "updatedAt": "2026-09-08T03:21:16.655Z",
+  "usId": "US-13002",
+  "prdId": "PRD-001",
+  "reqId": "REQ-130",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 cloudflared connector reports healthy on boot (tunnelConnectorUp fires with connector id, region, version)",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel v1.0.0 on a cloudHost",
+  "iWant": "the connector to emit a tunnelConnectorUp event on boot with connector id, region and version metadata (metadata only)",
+  "soThat": "the observability sink proves the tunnel is up without a shell into the host",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-13002-1",
+      "description": "real-account-connector-healthy probe declares accountBound true (on CI_HAS_CLOUDFLARE_ACCOUNT AND CI_HAS_HETZNER_ACCOUNT) and records accountBoundSkipped when either env var is unset. When both are set the probe drives cloudflared tunnel info against the fixture tunnel and asserts at least one healthy connector plus a tunnelConnectorUp event with connector id, region and version.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4001-edge-cloudflare-tunnel-connector-shape"
+  ]
+}

package/rcf/user-stories/us-13101.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T03:21:16.885Z",
+  "updatedAt": "2026-09-08T03:21:16.885Z",
+  "usId": "US-13101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-131",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 tunnel manifest schema at cloudflare/tunnels/<name>.yaml validates on shape (tunnel id, credentials secretRef, ingress rules with catch-all 404)",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel v1.0.0",
+  "iWant": "the tunnel manifest at cloudflare/tunnels/<name>.yaml to validate against a shipped JSON schema (uuid-shaped tunnel id, secretRef credentials, ingress rules with a mandatory catch-all http_status 404)",
+  "soThat": "a mis-shaped manifest is caught at apply-time rather than at first inbound request",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-13101-1",
+      "description": "manifest-schema-validate probe passes on the canonical fixture at cloudflared/*/cloudflare/tunnels/probe.yaml and fails when the fixture is mutated: SIMULATE_MANIFEST_INVALID_TUNNEL_ID rewrites the tunnel-id field to a non-uuid literal; SIMULATE_MANIFEST_CREDENTIALS_INLINE writes the credentials JSON body inline (bypassing the secretRef); SIMULATE_MANIFEST_MISSING_CATCHALL removes the catch-all rule. Each mutation FAILS naming the offending field.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4002-edge-cloudflare-tunnel-manifest-schema"
+  ]
+}

package/rcf/user-stories/us-13102.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T03:21:17.114Z",
+  "updatedAt": "2026-09-08T03:21:17.114Z",
+  "usId": "US-13102",
+  "prdId": "PRD-001",
+  "reqId": "REQ-131",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 ingress rules route the public hostname to an internal service URL and cloudflared config lint exits 0",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel v1.0.0 with a compose service listening on an internal port",
+  "iWant": "the ingress rule mapping the public hostname to the internal service URL (e.g. http://web:8080) to pass cloudflared tunnel ingress validate cleanly",
+  "soThat": "a rule that would fail at boot fails at gate instead",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-13102-1",
+      "description": "cloudflared-config-lint probe runs cloudflared tunnel ingress validate through the cloudflare/cloudflared container image (when the binary is not on PATH) against the fixture manifest and exits 0 on the canonical fixture; SIMULATE_INGRESS_INVALID rewrites the ingress rule service URL to an unresolvable scheme and the probe FAILS naming the offending line.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4002-edge-cloudflare-tunnel-manifest-schema"
+  ]
+}