rcf-lite 0.24.0 → 0.25.0

package/blueprints/deploy-hetzner-server/contributions/tacs/tac-3803-deploy-hetzner-server-cloud-init-template.json

@@ -0,0 +1,26 @@
+{
+  "tacId": "TAC-3803-deploy-hetzner-server-cloud-init-template",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Cloud-init template and render lint",
+  "purpose": "One cloud-init user-data template that renders YAML landing the six hardening baseline blocks per ADR-3804 on every provisioned Hetzner server: SSH key-only, root disabled, UFW default-deny incoming, DOCKER-USER iptables chain, fail2ban SSH jail, unattended-upgrades. A local render-lint probe asserts every block appears in the rendered YAML; the SIMULATE_HARDENING_DRIFT mutation removes the unattended-upgrades block and the probe FAILS naming the missing line.",
+  "responsibilities": [
+    "Ship a cloud-init template at contributions/templates/cloud-init.yaml.tmpl that renders the six baseline blocks (AC-37104-1).",
+    "Render deterministically against a manifest via the fixture's cloud-init-renderer.mjs (AC-37104-1).",
+    "Cover the SIMULATE_HARDENING_DRIFT mutation with a probe FAILURE that names the missing line (AC-37104-1).",
+    "Document the runtime ssh baseline check that the account-bound probe drives against the throwaway server (AC-37105-1)."
+  ],
+  "internalStructure": "One template file at blueprints/deploy-hetzner-server/contributions/templates/cloud-init.yaml.tmpl using {{token}} placeholders substituted by the renderer; one renderer module at packages/rcf-lite/test/fixtures/hetzner-throwaway-server/src/cloud-init-renderer.mjs; one probe cloud-init-render-lint.mjs asserts baseline lines.",
+  "interfaces": [
+    {
+      "name": "cloud-init.yaml.tmpl",
+      "kind": "template",
+      "summary": "Cloud-init user-data template with the six baseline blocks and templated substitutions."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/tacs/tac-3804-deploy-hetzner-server-firewall-shape.json

@@ -0,0 +1,25 @@
+{
+  "tacId": "TAC-3804-deploy-hetzner-server-firewall-shape",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Hetzner Cloud firewall rule shape",
+  "purpose": "One canonical firewall rule shape carried inside the server manifest. Rule set: 22 permitted only from a nonempty list of source-prefix ranges (the operator-nominated set; the schema refuses on 0.0.0.0/0 in this list); 80 and 443 permitted from 0.0.0.0/0 for the reverse proxy; all other inbound denied. The provisioner applies the rule set to the server at provision time via hcloud firewall create + apply-to-resource (or the raw-api equivalent).",
+  "responsibilities": [
+    "Define the firewall rule shape as a sub-schema in hetzner-server.schema.json (AC-37106-1).",
+    "Refuse via manifest-schema-validate on a manifest that opens 22 to 0.0.0.0/0 or drops 80/443 (AC-37106-1).",
+    "Enforce that the ssh rule's sourceIps is a nonempty array (AC-37106-1)."
+  ],
+  "internalStructure": "Rule shape lives inside the same hetzner-server.schema.json used by TAC-3802 (properties.firewallRules array items with protocol, port, direction, sourceIps). The applyFirewall verb on the provisioner facade consumes the parsed rule set.",
+  "interfaces": [
+    {
+      "name": "firewallRules sub-schema",
+      "kind": "jsonSchemaFragment",
+      "summary": "Rule-shape invariants inside hetzner-server.schema.json."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/templates/cloud-init.yaml.tmpl

@@ -0,0 +1,93 @@
+#cloud-config
+# deploy-hetzner-server v1.0.0 cloud-init user-data template.
+# Six-block hardening baseline per ADR-3804 (Debian unattended-upgrades wiki
+# and the estate baseline at
+# operator/knowledge/systems/environments/hetzner-cloud/overview.md
+# Security posture baseline). Placeholders in {{double-brace}} form are
+# substituted by the fixture's cloud-init-renderer.mjs against the applying
+# manifest.
+
+hostname: {{name}}
+
+# Block 1: SSH key-only. Password auth disabled at the sshd level too.
+users:
+  - name: deploy
+    groups: [sudo]
+    shell: /bin/bash
+    lock_passwd: true
+    ssh_authorized_keys:
+{{sshAuthorizedKeysBlock}}
+
+# Block 2: root disabled (PermitRootLogin no).
+# Block 1 continued: PasswordAuthentication no.
+write_files:
+  - path: /etc/ssh/sshd_config.d/hardening.conf
+    permissions: '0644'
+    content: |
+      # deploy-hetzner-server v1.0.0 hardening (baseline blocks 1 and 2).
+      PermitRootLogin no
+      PasswordAuthentication no
+      KbdInteractiveAuthentication no
+      ChallengeResponseAuthentication no
+  # Block 4: DOCKER-USER iptables chain drops non-conforming egress.
+  - path: /etc/iptables/rules.v4.d/docker-user.rules
+    permissions: '0644'
+    content: |
+      # deploy-hetzner-server v1.0.0 hardening baseline block 4:
+      # DOCKER-USER iptables chain wired to drop non-conforming egress.
+      *filter
+      :DOCKER-USER - [0:0]
+      -A DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
+      -A DOCKER-USER -j DROP
+      COMMIT
+  # Block 5: fail2ban SSH jail.
+  - path: /etc/fail2ban/jail.d/sshd.conf
+    permissions: '0644'
+    content: |
+      # deploy-hetzner-server v1.0.0 hardening baseline block 5:
+      # fail2ban SSH jail on port 22.
+      [sshd]
+      enabled = true
+      port = 22
+      maxretry = 5
+      findtime = 600
+      bantime = 3600
+  # Block 6: unattended-upgrades on (security updates).
+  - path: /etc/apt/apt.conf.d/50unattended-upgrades
+    permissions: '0644'
+    content: |
+      // deploy-hetzner-server v1.0.0 hardening baseline block 6:
+      // unattended-upgrades on for security updates
+      // per https://wiki.debian.org/UnattendedUpgrades
+      Unattended-Upgrade::Origins-Pattern {
+        "origin=Debian,codename=${distro_codename},label=Debian-Security";
+        "origin=Ubuntu,archive=${distro_codename}-security";
+      };
+      Unattended-Upgrade::Automatic-Reboot "false";
+  - path: /etc/apt/apt.conf.d/20auto-upgrades
+    permissions: '0644'
+    content: |
+      APT::Periodic::Update-Package-Lists "1";
+      APT::Periodic::Unattended-Upgrade "1";
+
+# Package install: ufw for block 3, fail2ban for block 5,
+# unattended-upgrades for block 6, iptables-persistent for block 4.
+packages:
+  - ufw
+  - fail2ban
+  - unattended-upgrades
+  - iptables-persistent
+
+runcmd:
+  # Block 3: UFW default-deny incoming, allow 22 80 443.
+  - ufw default deny incoming
+  - ufw default allow outgoing
+  - ufw allow 22/tcp
+  - ufw allow 80/tcp
+  - ufw allow 443/tcp
+  - ufw --force enable
+  - systemctl reload ssh || systemctl restart ssh
+  - systemctl enable --now fail2ban
+  - systemctl enable --now unattended-upgrades
+  # Load the DOCKER-USER iptables rules on boot.
+  - iptables-restore -n < /etc/iptables/rules.v4.d/docker-user.rules

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37101.json

@@ -0,0 +1,24 @@
+{
+  "usId": "deploy-hetzner-server-US-37101",
+  "prdId": "PRD-001",
+  "reqId": "deploy-hetzner-server-REQ-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "The provisioner opens on boot as the sole token reader and emits provisionerReady",
+  "asA": "developer whose project provisions a Hetzner Cloud VM as its cloudHost",
+  "iWant": "one provisioner facade module to be the sole reader of HETZNER_ACCOUNT_API_KEY and to emit provisionerReady on boot with a metadata-only payload",
+  "soThat": "the token has one auditable seam and the observability sink surfaces boot ordering without ever carrying the secret",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-37101-1",
+      "description": "On process boot the provisioner facade opens against the token, and (a) only the provisioner module reads HETZNER_ACCOUNT_API_KEY (grep across the fixture source refuses any other reader), (b) provisionerReady fires on the injected event sink with a payload of exactly {tool, apiHost}.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3801-deploy-hetzner-server-provisioner"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37102.json

@@ -0,0 +1,24 @@
+{
+  "usId": "deploy-hetzner-server-US-37102",
+  "prdId": "PRD-001",
+  "reqId": "deploy-hetzner-server-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "hetzner/servers/name.json manifests validate against the shipped JSON Schema",
+  "asA": "developer whose project holds Hetzner server declarations in git",
+  "iWant": "every hetzner/servers/name.json file to validate against a shipped draft-07 JSON Schema naming type, location, image, sshKeyIds, firewallId, networkId, cloudInitPath, labels, firewallRules and snapshotCadence",
+  "soThat": "the operator has a stable declarative source of truth and manifest defects surface locally before they reach the API",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-37102-1",
+      "description": "manifest-schema-validate.mjs asserts every hetzner/servers/*.json under the shared throwaway-server fixture validates against blueprints/deploy-hetzner-server/contributions/schemas/hetzner-server.schema.json and carries every required field; a mutation SIMULATE_MANIFEST_INVALID=true replaces location with an unknown token and the probe FAILS naming the offending field.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3802-deploy-hetzner-server-manifest-schema"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37103.json

@@ -0,0 +1,25 @@
+{
+  "usId": "deploy-hetzner-server-US-37103",
+  "prdId": "PRD-001",
+  "reqId": "deploy-hetzner-server-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Manifest applies: the provisioner creates a matching live server and fires hetznerServerProvisioned",
+  "asA": "developer whose project provisions a Hetzner Cloud VM from git-managed manifests",
+  "iWant": "applying the provisioner to read each manifest under hetzner/servers/, create a matching live Hetzner Cloud server, and emit hetznerServerProvisioned with id, primaryIpv4, location and serverType",
+  "soThat": "the manifest is the source of truth for what actually exists in the project",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-37103-1",
+      "description": "The real-account-throwaway-server-provision probe (accountBound: true, skipped without CI_HAS_HETZNER_ACCOUNT) applies the ci-throwaway.json manifest via provision.mjs, asserts (a) hcloud server list --output json shows the new server whose id is written to the fixture scratch file, (b) hetznerServerProvisioned fired with id, primaryIpv4, location=fsn1, serverType=cx23; teardown via destroy.mjs runs regardless of probe verdict.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3801-deploy-hetzner-server-provisioner",
+    "TAC-3802-deploy-hetzner-server-manifest-schema"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37104.json

@@ -0,0 +1,24 @@
+{
+  "usId": "deploy-hetzner-server-US-37104",
+  "prdId": "PRD-001",
+  "reqId": "deploy-hetzner-server-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Cloud-init template renders the six hardening baseline blocks",
+  "asA": "developer whose project provisions Hetzner servers that face the public internet",
+  "iWant": "the shipped cloud-init template to render YAML that lands SSH key-only, root disabled, UFW default-deny incoming, DOCKER-USER iptables chain, fail2ban SSH jail and unattended-upgrades on every server",
+  "soThat": "I inherit the six-block hardening baseline declaratively without hand-authoring per host",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-37104-1",
+      "description": "cloud-init-render-lint.mjs renders the template with the fixture manifest and asserts each of the six baseline blocks (SSH key-only, root disabled, UFW default-deny incoming, DOCKER-USER iptables chain, fail2ban SSH jail, unattended-upgrades) appears in the rendered YAML by grep; a mutation SIMULATE_HARDENING_DRIFT=true removes the unattended-upgrades block and the probe FAILS with a message naming the missing line.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3803-deploy-hetzner-server-cloud-init-template"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37105.json

@@ -0,0 +1,24 @@
+{
+  "usId": "deploy-hetzner-server-US-37105",
+  "prdId": "PRD-001",
+  "reqId": "deploy-hetzner-server-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Provisioned server is hardened at runtime as the rendered cloud-init promised",
+  "asA": "operator running Hetzner servers provisioned by this blueprint",
+  "iWant": "the running server to refuse root ssh, refuse password auth, run UFW default-deny incoming, hold the DOCKER-USER chain and run unattended-upgrades",
+  "soThat": "I can trust the cloud-init contract without ssh-in-and-check on every server",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-37105-1",
+      "description": "real-account-cloud-init-hardened.mjs (accountBound: true, skipped without CI_HAS_HETZNER_ACCOUNT) waits for cloud-init status --wait on the throwaway server, then ssh-checks the six baseline blocks and asserts each check passes; failure names the missing block. Teardown via destroy.mjs runs regardless.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3803-deploy-hetzner-server-cloud-init-template"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37106.json

@@ -0,0 +1,25 @@
+{
+  "usId": "deploy-hetzner-server-US-37106",
+  "prdId": "PRD-001",
+  "reqId": "deploy-hetzner-server-REQ-004",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Firewall rule shape restricts SSH to nominated prefixes, permits 80/443, denies all else",
+  "asA": "operator running Hetzner servers that face the public internet",
+  "iWant": "the firewall rule set carried in hetzner/servers/name.json to permit 22 only from an operator-nominated set of source-prefix ranges, permit 80 and 443 from any source for the reverse proxy, and deny all other inbound; the provisioner applies the rules at provision time",
+  "soThat": "I inherit a documented least-privilege firewall shape on every server without opening ssh to the world",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-37106-1",
+      "description": "manifest-schema-validate.mjs asserts every fixture manifest carries a firewallRules array matching the shape (22 permitted only from a nonempty list of source-prefix ranges with no 0.0.0.0/0; 80 and 443 permitted from 0.0.0.0/0; no other inbound rule); an induced defect (a manifest that opens 22 to 0.0.0.0/0) FAILS schema validation with a message naming the offending rule.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3802-deploy-hetzner-server-manifest-schema",
+    "TAC-3804-deploy-hetzner-server-firewall-shape"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37107.json

@@ -0,0 +1,24 @@
+{
+  "usId": "deploy-hetzner-server-US-37107",
+  "prdId": "PRD-001",
+  "reqId": "deploy-hetzner-server-REQ-005",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Snapshot cadence is elicited (weekly default, daily and off alternatives) and validated on the manifest",
+  "asA": "operator whose project takes recovery-point snapshots on Hetzner Cloud",
+  "iWant": "the elicited snapshot cadence value on hetzner/servers/name.json to match the shipped enum {weekly, daily, off}, with weekly the recommended default per ADR-3802",
+  "soThat": "I have one project-wide answer for how often each server snapshots",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-37107-1",
+      "description": "manifest-schema-validate.mjs asserts every fixture manifest carries snapshotCadence with a value in the shipped enum {weekly, daily, off}; a manifest missing the field FAILS schema validation naming the missing field.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3802-deploy-hetzner-server-manifest-schema"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37108.json

@@ -0,0 +1,24 @@
+{
+  "usId": "deploy-hetzner-server-US-37108",
+  "prdId": "PRD-001",
+  "reqId": "deploy-hetzner-server-REQ-005",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Snapshot-on-demand fires a tagged snapshot and emits hetznerSnapshotTaken",
+  "asA": "operator whose project needs an on-demand recovery point at any moment",
+  "iWant": "the snapshot-on-demand verb on the provisioner to shell to hcloud image create-image (or the raw-api equivalent) and tag the snapshot with server name and wall-clock time; hetznerSnapshotTaken carries snapshot id and time",
+  "soThat": "I have a documented on-demand recovery point at any moment without a manual dashboard visit",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-37108-1",
+      "description": "real-account-snapshot-on-demand.mjs (accountBound: true, skipped without CI_HAS_HETZNER_ACCOUNT) fires the snapshot verb on the throwaway server, then asserts hcloud image list --type=snapshot --output json shows a snapshot tagged with the server name and current wall-clock time; hetznerSnapshotTaken event carries snapshot id and time. Teardown via destroy.mjs.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3801-deploy-hetzner-server-provisioner"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37109.json

@@ -0,0 +1,24 @@
+{
+  "usId": "deploy-hetzner-server-US-37109",
+  "prdId": "PRD-001",
+  "reqId": "deploy-hetzner-server-REQ-006",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Four lifecycle events fire with metadata-only payloads and no event body carries a secret",
+  "asA": "operator whose observability sink carries the Hetzner lifecycle trail",
+  "iWant": "the provisioner facade to fire the four lifecycle events (provisionerReady, hetznerServerProvisioned, hetznerSnapshotTaken, hetznerServerDestroyed) with metadata-only payloads and no secret content",
+  "soThat": "the observability sink carries the operational trail without ever leaking a token or an ssh key",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-37109-1",
+      "description": "hcloud-dry-run-mock.mjs drives every lifecycle event through the facade against a mocked hcloud shim; the accumulated event stream carries only the metadata fields named on REQ-006; a mutation SIMULATE_EVENT_SECRECY_LEAK=true injects the token into the hetznerServerProvisioned payload and the probe FAILS with a defensive-fake finding naming the leaked field.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3801-deploy-hetzner-server-provisioner"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/docs/topics.md

@@ -0,0 +1,48 @@
+# deploy-hetzner-server topics
+
+Shelf registry of global ADR topics and shelf-band anchors relevant
+to `deploy-hetzner-server` v1.0.0.
+
+## Global topics minted by this blueprint
+
+| Topic | ADR | Meaning |
+|---|---|---|
+| `linuxCloudHostContract` | `ADR-3801` | The Hetzner Cloud VM as the shipped `cloudHost` shape. A future non-Hetzner sibling (Vultr, DigitalOcean, Fly.io) contributes the same topic string with a different provider and forces a deliberate conflict per the round-2 pattern. |
+| `snapshotAndBackupCadence` | `ADR-3802` | Weekly snapshot as the shipped default, daily and off alternatives, Hetzner-managed backups as an elicited paid opt-in at approximately 20 percent of monthly server price. |
+
+## Shelf id band and suffix block
+
+| Blueprint | US band | ADR/TAC suffix block | Status | Global topics |
+|---|---|---|---|---|
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
+
+The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
+
+## Cross-references
+
+- `security-secrets-management` (v1.0.1): the provisioner facade reads `HETZNER_ACCOUNT_API_KEY` through the applied secrets facade. The facade is the sole reader; every other module in the applying project imports the facade and never dereferences the token.
+- `deploy-cloudflare-workers` (v1.2.0): sibling in the `deploy-*` family. The family enforces one-target-per-project at apply time (a project applying both refuses with `deploy-family-multiple-targets`).
+- Round-7 T-2 `platform-docker-compose-host`: composes on `capabilities: [cloudHost]`; ships the compose runtime on the Hetzner host this blueprint provisions.
+- Round-7 T-3 `edge-cloudflare-tunnel`: composes on `cloudHost` (systemd unit shape) or on `containerHost` (compose service shape); either shape bridges the Hetzner host to the Cloudflare edge without opening origin ports.

package/blueprints/deploy-hetzner-server/guide/deploy-hetzner-server.md

@@ -0,0 +1,180 @@
+# deploy-hetzner-server guide
+
+Practical guide for the operator applying `deploy-hetzner-server`
+v1.0.0. Covers manifest authoring, the two provisioner paths, the
+hardening baseline, snapshot posture, elicitation shortcuts, and
+the runtime probe rig.
+
+## Prerequisites
+
+- A Hetzner Cloud project and API token. The token binds to one
+  project; a fresh throwaway project keeps the blast radius small
+  during onboarding.
+- `hcloud` on `PATH` when `provisioning-tool` is `hcloud`. Install:
+  Homebrew `brew install hcloud` on macOS, or download the OS/arch
+  tarball from https://github.com/hetznercloud/cli/releases/latest,
+  verify against `checksums.txt`, drop the binary on `PATH`. Skip
+  the install when `provisioning-tool` is `raw-api`; the provisioner
+  reaches the REST API directly.
+- `security-secrets-management` applied so the facade reads
+  `HETZNER_ACCOUNT_API_KEY` from the operator's vault of choice.
+
+## Authoring `hetzner/servers/<name>.json`
+
+Every server declaration lives at
+`hetzner/servers/<server-name>.json` and validates against the
+shipped `hetzner-server.schema.json`. The fixture manifest at
+`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/hetzner/servers/ci-throwaway.json`
+is the canonical example. Copy it and edit:
+
+```jsonc
+{
+  "name": "ops-01",
+  "serverType": "cx33",
+  "location": "fsn1",
+  "image": "ubuntu-24.04",
+  "sshKeyIds": ["dave-ed25519", "baz-yubikey"],
+  "networkId": null,
+  "firewallId": null,
+  "cloudInitPath": "hetzner/servers/rendered/ops-01.cloud-init.yaml",
+  "labels": {
+    "role": "ops-host",
+    "blueprint": "deploy-hetzner-server"
+  },
+  "firewallRules": [
+    { "name": "ssh", "protocol": "tcp", "port": 22, "direction": "in", "sourceIps": ["203.0.113.0/24"] },
+    { "name": "http", "protocol": "tcp", "port": 80, "direction": "in", "sourceIps": ["0.0.0.0/0", "::/0"] },
+    { "name": "https", "protocol": "tcp", "port": 443, "direction": "in", "sourceIps": ["0.0.0.0/0", "::/0"] }
+  ],
+  "snapshotCadence": "weekly",
+  "hetznerManagedBackups": false
+}
+```
+
+The manifest-schema-validate probe refuses on missing required
+fields and on a rule set that opens 22 to `0.0.0.0/0`.
+
+## Rendering cloud-init
+
+Point `cloudInitPath` at a rendered file the provisioner uploads
+with `--user-data-from-file`. The fixture renderer at
+`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/src/cloud-init-renderer.mjs`
+consumes the shipped template with two placeholders:
+
+- `{{name}}` (the manifest name)
+- `{{sshAuthorizedKeysBlock}}` (the ssh-authorized_keys entries per
+  `sshKeyIds`)
+
+An applying project runs the renderer at manifest edit time (a git
+pre-commit hook, or a `pnpm build:cloud-init` script) and commits
+the rendered YAML alongside the manifest.
+
+## Six hardening baseline blocks (ADR-3804)
+
+The rendered YAML lands the six blocks per the estate baseline at
+`operator/knowledge/systems/environments/hetzner-cloud/overview.md`
+Security posture baseline and the Debian unattended-upgrades wiki
+at https://wiki.debian.org/UnattendedUpgrades.
+
+1. SSH key-only. `PasswordAuthentication no`.
+2. Root disabled. `PermitRootLogin no`.
+3. UFW default-deny incoming. `ufw allow 22/tcp 80/tcp 443/tcp`.
+4. DOCKER-USER iptables chain. Drops non-conforming egress from
+   containers before Docker rules apply.
+5. fail2ban SSH jail on port 22. `maxretry 5`, `bantime 3600`.
+6. `unattended-upgrades` on for security-only updates
+   (`Unattended-Upgrade::Automatic-Reboot "false"`).
+
+Deviation costs an ADR at the applying project level; the shipped
+lint refuses on drift.
+
+## When to reach for hcloud vs raw-api
+
+- `hcloud` (default). Choose it when the operator laptop and CI
+  runner can install the binary. Small, self-documenting, JSON
+  output on `--output json`; the vendor updates it in step with the
+  API. Docs: https://github.com/hetznercloud/cli.
+- `raw-api`. Choose it when a container base image cannot install
+  `hcloud` (Alpine minimal builds, a locked-down runtime). The
+  provisioner reaches the REST endpoints directly per
+  https://docs.hetzner.cloud/. Vendor SLAs cover the API; the local
+  CLI is a convenience layer.
+
+The facade shape is identical on both paths so switching is a one
+elicit change.
+
+## When to reach for `cx23` vs `cx33`
+
+- `cx23` (default). Two vCPU, 4 GB RAM, 40 GB SSD. Approximately
+  EUR 4.15/month. Fine for the docker-compose stack that ops-01
+  runs (fewer than ten containers, each below 300 MB RSS).
+- `cx33`. Two vCPU, 8 GB RAM, 80 GB SSD. Approximately EUR
+  7.99/month. Reach when the compose stack holds a Postgres, a
+  Grafana, or any container that regularly touches 1 GB RSS.
+- `cx43`. Four vCPU, 16 GB RAM. Reach for a home for the
+  `platform-cloudflare-durable-objects` self-hosted mode or a
+  Postgres + Grafana + Loki triad.
+- `cpx*`. AMD EPYC. Faster per vCPU; slightly more expensive.
+- `cax*`. ARM64. Choose when every runtime component has an ARM
+  build (Node, Postgres, cloudflared, most caddy modules do).
+
+Vendor pricing:
+https://docs.hetzner.com/cloud/servers/overview.
+
+## Snapshot cadence choices (ADR-3802)
+
+- `weekly` (default). One snapshot every Sunday at 02:00 local. On
+  a `cx23`, adds approximately EUR 0.005/month in snapshot storage.
+- `daily`. Higher recovery-point objective. On a `cx23`, adds
+  approximately EUR 0.035/month.
+- `off`. No automatic snapshot. Choose only when Hetzner-managed
+  backups are opted-in AND the application layer takes its own
+  logical backups on cadence.
+
+Hetzner-managed backups are a separately elicited paid opt-in at
+approximately 20 percent of monthly server price (on a `cx23`,
+approximately EUR 0.80/month). They compose with the scheduled
+snapshot runner; both fire independently.
+Vendor pricing:
+https://docs.hetzner.com/cloud/servers/backups-snapshots/overview.
+
+## Snapshot-on-demand
+
+Fire a snapshot manually from the applying project's CLI:
+
+```
+node ./scripts/snapshot.mjs --server ops-01
+```
+
+The script imports the provisioner facade, calls `takeSnapshot`,
+and emits `hetznerSnapshotTaken` on the injected sink. The account-
+bound probe `real-account-snapshot-on-demand` covers the same shape.
+
+## The shared throwaway-server fixture
+
+Every real-account probe runs against a throwaway `cx23` in `fsn1`
+provisioned from the fixture manifest. Fixture location:
+`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/`. Cost
+ceiling: EUR 0.006/hour per run; destroy runs in `always()`; nightly
+`sweep-orphans` cron collects any leak on a 60-minute label-age
+cutoff.
+
+Round-7 T-2 (`platform-docker-compose-host`) and T-3
+(`edge-cloudflare-tunnel`) EXTEND this fixture rather than shipping
+a second copy. T-2 mounts the docker + compose verbs on the same
+throwaway server after cloud-init seals the baseline; T-3 mounts
+`cloudflared` on the runtime T-2 stands up.
+
+## Standards trace
+
+Every URL fetched 200 in the ratifying pass before the T-1 PR.
+
+- Hetzner Cloud API https://docs.hetzner.cloud/
+- Hetzner Cloud CLI https://github.com/hetznercloud/cli
+- Hetzner Cloud servers overview https://docs.hetzner.com/cloud/servers/overview
+- Hetzner Cloud firewalls overview https://docs.hetzner.com/cloud/firewalls/overview/
+- Hetzner Cloud backups-and-snapshots overview https://docs.hetzner.com/cloud/servers/backups-snapshots/overview
+- Hetzner Cloud networks overview https://docs.hetzner.com/cloud/networks/overview/
+- Hetzner community basic-cloud-config tutorial https://community.hetzner.com/tutorials/basic-cloud-config
+- cloud-init https://cloudinit.readthedocs.io/en/latest/
+- Debian unattended-upgrades wiki https://wiki.debian.org/UnattendedUpgrades

package/blueprints/edge-cloudflare-access/docs/topics.md

@@ -55,6 +55,9 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 US 34101-34109 sit at the LOW end of the 34101-34899 band on purpose (watchpost run-4 lesson). ADR/TAC suffixes for this blueprint use the 3501-3599 block, continuing the shelf pattern.
 

package/blueprints/edge-cloudflare-rate-limiting/docs/topics.md

@@ -5,6 +5,9 @@ This file is the edge-cloudflare-rate-limiting half of the cross-blueprint contr
 ## Global ADR topics this blueprint contributes (exact strings)
 
 | Topic string | edge-cloudflare-rate-limiting contribution | Origin | Composition note |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 |---|---|---|---|
 | `edgeThrottleContract` | ADR-3701-edge-cloudflare-rate-limiting-throttle-contract | Minted by this blueprint. Names the wire-shape contract for the project-wide edge throttle; the shipped answer is Cloudflare WAF rate-limiting rules per `https://developers.cloudflare.com/waf/rate-limiting-rules/`. | The one project-wide decision on the edge throttle at the shipped-shape boundary. A future non-Cloudflare sibling (Fastly rate-limits, Vercel Edge Config throttles) would contribute the same topic string with a different answer, forcing a DELIBERATE conflict the operator resolves with a project-level ADR. |