rcf-lite 0.24.0 → 0.25.0

package/blueprints/platform-docker-compose-host/blueprint.json

@@ -0,0 +1,209 @@
+{
+  "slug": "platform-docker-compose-host",
+  "version": "1.0.0",
+  "category": "platform",
+  "capabilities": [
+    "containerHost"
+  ],
+  "suggestedCompanions": [
+    {
+      "role": "logging",
+      "reason": "Every composeStackReady, containerHealthy, containerCrashed and reverseProxyReloaded event writes through the applied logger; a logging companion supplies the factory and the log-driver binding."
+    },
+    {
+      "role": "errorHandling",
+      "reason": "A healthcheck timeout, a compose lint refusal, a secret-file-mode mismatch, a reload window overshoot constructs an internal error record; an error-handling companion supplies the record factory and the boundary."
+    }
+  ],
+  "elicits": [
+    {
+      "id": "reverse-proxy",
+      "prompt": "Reverse proxy in front of the compose services. caddy is the shipped default per Baz decision 19 (matches dev-01 and ops-01); traefik is the alternative for docker-label auto-discovery; none is the alternative for projects fronted only by the round-7 tunnel.",
+      "kind": "enum",
+      "options": [
+        "caddy",
+        "traefik",
+        "none"
+      ],
+      "default": "caddy"
+    },
+    {
+      "id": "docker-engine-channel",
+      "prompt": "Docker Engine apt channel per the Docker Engine install-on-Ubuntu docs. stable is the shipped default; test is for pre-release verification; the vendor also documents nightly builds available separately.",
+      "kind": "enum",
+      "options": [
+        "stable",
+        "test"
+      ],
+      "default": "stable"
+    },
+    {
+      "id": "compose-file-location",
+      "prompt": "Where the compose.yaml lives in the applying repo. repo-root is the shipped default; the alternative name is used when a project already owns compose.yaml for another purpose.",
+      "kind": "enum",
+      "options": [
+        "repo-root",
+        "compose/compose.yaml"
+      ],
+      "default": "repo-root"
+    },
+    {
+      "id": "healthcheck-default-kind",
+      "prompt": "Default healthcheck kind per service. http covers the common web service (curl or wget to a /health path); tcp covers a database or plain socket service; command lets the operator supply a bespoke test string.",
+      "kind": "enum",
+      "options": [
+        "http",
+        "tcp",
+        "command"
+      ],
+      "default": "http"
+    },
+    {
+      "id": "log-driver",
+      "prompt": "Container log driver per ADR-3904. journald is the shipped default matching the Debian 12 and Ubuntu 24.04 baseline T-1 sets up; loki is the opt-in alternative when the project runs Grafana.",
+      "kind": "enum",
+      "options": [
+        "journald",
+        "loki"
+      ],
+      "default": "journald"
+    },
+    {
+      "id": "reload-window-seconds",
+      "prompt": "Zero-downtime reverse-proxy reload window in seconds (the maximum time a client burst may see any non-2xx or dropped connection during a reload). 10 is the shipped default per REQ-005.",
+      "kind": "string",
+      "default": "10"
+    }
+  ],
+  "contributions": [
+    {
+      "id": "platform-docker-compose-host-REQ-001",
+      "kind": "req",
+      "path": "requirements/platform-docker-compose-host-req-001.json"
+    },
+    {
+      "id": "platform-docker-compose-host-REQ-002",
+      "kind": "req",
+      "path": "requirements/platform-docker-compose-host-req-002.json"
+    },
+    {
+      "id": "platform-docker-compose-host-REQ-003",
+      "kind": "req",
+      "path": "requirements/platform-docker-compose-host-req-003.json"
+    },
+    {
+      "id": "platform-docker-compose-host-REQ-004",
+      "kind": "req",
+      "path": "requirements/platform-docker-compose-host-req-004.json"
+    },
+    {
+      "id": "platform-docker-compose-host-REQ-005",
+      "kind": "req",
+      "path": "requirements/platform-docker-compose-host-req-005.json"
+    },
+    {
+      "id": "platform-docker-compose-host-REQ-006",
+      "kind": "req",
+      "path": "requirements/platform-docker-compose-host-req-006.json"
+    },
+    {
+      "id": "platform-docker-compose-host-US-38101",
+      "kind": "us",
+      "path": "user-stories/platform-docker-compose-host-us-38101.json"
+    },
+    {
+      "id": "platform-docker-compose-host-US-38102",
+      "kind": "us",
+      "path": "user-stories/platform-docker-compose-host-us-38102.json"
+    },
+    {
+      "id": "platform-docker-compose-host-US-38103",
+      "kind": "us",
+      "path": "user-stories/platform-docker-compose-host-us-38103.json"
+    },
+    {
+      "id": "platform-docker-compose-host-US-38104",
+      "kind": "us",
+      "path": "user-stories/platform-docker-compose-host-us-38104.json"
+    },
+    {
+      "id": "platform-docker-compose-host-US-38105",
+      "kind": "us",
+      "path": "user-stories/platform-docker-compose-host-us-38105.json"
+    },
+    {
+      "id": "platform-docker-compose-host-US-38106",
+      "kind": "us",
+      "path": "user-stories/platform-docker-compose-host-us-38106.json"
+    },
+    {
+      "id": "platform-docker-compose-host-US-38107",
+      "kind": "us",
+      "path": "user-stories/platform-docker-compose-host-us-38107.json"
+    },
+    {
+      "id": "platform-docker-compose-host-US-38108",
+      "kind": "us",
+      "path": "user-stories/platform-docker-compose-host-us-38108.json"
+    },
+    {
+      "id": "platform-docker-compose-host-US-38109",
+      "kind": "us",
+      "path": "user-stories/platform-docker-compose-host-us-38109.json"
+    },
+    {
+      "id": "TAC-3901-platform-docker-compose-host-compose-layout",
+      "kind": "tac",
+      "path": "tacs/tac-3901-platform-docker-compose-host-compose-layout.json"
+    },
+    {
+      "id": "TAC-3902-platform-docker-compose-host-secrets-mount",
+      "kind": "tac",
+      "path": "tacs/tac-3902-platform-docker-compose-host-secrets-mount.json"
+    },
+    {
+      "id": "TAC-3903-platform-docker-compose-host-healthcheck-lint",
+      "kind": "tac",
+      "path": "tacs/tac-3903-platform-docker-compose-host-healthcheck-lint.json"
+    },
+    {
+      "id": "TAC-3904-platform-docker-compose-host-reverse-proxy-artefact",
+      "kind": "tac",
+      "path": "tacs/tac-3904-platform-docker-compose-host-reverse-proxy-artefact.json"
+    },
+    {
+      "id": "ADR-3901-platform-docker-compose-host-contract",
+      "kind": "adr",
+      "path": "adrs/adr-3901-platform-docker-compose-host-contract.json",
+      "scope": "global",
+      "topic": "containerHostContract",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "Docker Compose file reference AND Docker Engine install-on-Ubuntu docs per hetzner-round-7-spec-2026-09-07.md"
+    },
+    {
+      "id": "ADR-3902-platform-docker-compose-host-reverse-proxy",
+      "kind": "adr",
+      "path": "adrs/adr-3902-platform-docker-compose-host-reverse-proxy.json",
+      "recommendedDefault": true,
+      "elicited": true,
+      "standardsTraceClause": "Caddy docs AND Traefik docs per hetzner-round-7-spec-2026-09-07.md"
+    },
+    {
+      "id": "ADR-3903-platform-docker-compose-host-reject-coolify",
+      "kind": "adr",
+      "path": "adrs/adr-3903-platform-docker-compose-host-reject-coolify.json",
+      "recommendedDefault": false,
+      "elicited": false,
+      "standardsTraceClause": "generic enterprise practice"
+    },
+    {
+      "id": "ADR-3904-platform-docker-compose-host-log-driver",
+      "kind": "adr",
+      "path": "adrs/adr-3904-platform-docker-compose-host-log-driver.json",
+      "recommendedDefault": true,
+      "elicited": true,
+      "standardsTraceClause": "generic enterprise practice"
+    }
+  ]
+}

package/blueprints/platform-docker-compose-host/contributions/adrs/adr-3901-platform-docker-compose-host-contract.json

@@ -0,0 +1,14 @@
+{
+  "adrId": "ADR-3901-platform-docker-compose-host-contract",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Container host contract: docker compose as source of truth on a cloudHost (scope global, new topic containerHostContract)",
+  "context": "An applying project running its stack on a Linux cloudHost needs one shipped contract for how services are declared, wired and brought up on a container-orchestration surface. Round-7 T-2 mints the containerHostContract topic on this ADR. Docker Compose is the shipped v1.0.0 surface (compose.yaml as source of truth, healthchecks required, secrets as files, restart discipline, reverse-proxy as artefact). Every applied container host needs one project-wide answer to the containerHostContract topic; a future non-compose sibling (Docker Swarm, Nomad) would contribute the same topic string with a different mechanism, forcing a DELIBERATE conflict the operator resolves per the round-2 conflict pattern. Standards trace clause: Docker Compose file reference AND Docker Engine install-on-Ubuntu docs per hetzner-round-7-spec-2026-09-07.md.",
+  "decision": "The shipped v1.0.0 default is docker compose on a cloudHost as the containerHostContract provider. A canonical compose.yaml at the repo root drives docker compose up on the applied cloudHost (T-1 deploy-hetzner-server); healthchecks refuse at docker compose config on missing; secrets are file mounts; restart policies are unless-stopped or on-failure; the reverse-proxy config is a first-class versioned artefact per TAC-3904. The containerHostContract topic scope is global on this blueprint; the topic string is containerHostContract (lower camelCase, one concept per topic, no version suffix, per the round-2 rules-for-new-topics clause on the shelf registry). Standards trace clause: Docker Compose file reference AND Docker Engine install-on-Ubuntu docs per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "Consumer blueprints that ship as containers declare capabilities: [containerHost] on their applied contract; the round-7 T-3 edge-cloudflare-tunnel reads this capability at apply-time to choose the compose-service runtime. Rebuild-from-manifest is always possible: the compose file is the source of truth, the running stack is derivative. Compose is famously many right ways; over-specifying alienates a project with a defensible different shape, so v1.0.0 pins the small load-bearing set (healthchecks, secrets-as-files, restart discipline, reverse-proxy-as-artefact) and leaves everything else to project-owned ADRs.",
+  "alternativesConsidered": [],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/adrs/adr-3902-platform-docker-compose-host-reverse-proxy.json

@@ -0,0 +1,14 @@
+{
+  "adrId": "ADR-3902-platform-docker-compose-host-reverse-proxy",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Reverse proxy choice: caddy default (matches dev-01 and ops-01), traefik alternative for docker-label auto-discovery, none for tunnel-fronted projects (elicited)",
+  "context": "Compose stacks need a reverse-proxy for HTTPS termination and hostname-to-service routing. Caddy is the estate baseline (dev-01 and ops-01 already run it per Baz decision 19 on 2026-09-07 09:50Z). Traefik has a docker-label auto-discovery model some projects prefer. Some projects front their stack only with the round-7 tunnel and skip a reverse proxy inside compose.",
+  "decision": "The reverse-proxy choice is elicited via the reverseProxy parameter. The shipped default is caddy per Baz decision 19. The alternatives are traefik (for projects that want docker-label auto-discovery) and none (for projects fronted only by the round-7 tunnel). Standards trace clause: Caddy docs AND Traefik docs per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "A project applying reverseProxy=caddy gets the caddy/Caddyfile artefact and the caddy reload verb. A project applying reverseProxy=traefik gets the traefik/traefik.yaml artefact and the Traefik equivalent reload verb; docker-label auto-discovery is a project-side pattern the guide names. A project applying reverseProxy=none omits the reverse-proxy service and must apply edge-cloudflare-tunnel (T-3) so ingress terminates at the CF edge.",
+  "alternativesConsidered": [],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/adrs/adr-3903-platform-docker-compose-host-reject-coolify.json

@@ -0,0 +1,14 @@
+{
+  "adrId": "ADR-3903-platform-docker-compose-host-reject-coolify",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Coolify rejected per Baz decision 20 (it shadows what the blueprints contract and adds its own DB and UI as a second source of state)",
+  "context": "Coolify was proposed as a candidate platform-* sibling in the round-7 proposal. It is a self-hosted PaaS with its own database and UI. Baz decision 20 on 2026-09-07 09:50Z ruled Coolify out for round 7.",
+  "decision": "reject; it shadows what the blueprints contract and adds its own DB and UI as a second source of state.",
+  "consequences": "No platform-coolify-host blueprint is scoped in round 7 and no reserved slot is allocated. A future platform-coolify-host sibling mints on operator demand under a fresh scope PR. The standards trace clause on the contribution entry is generic enterprise practice; no vendor-doc URL is claimed for the reject decision.",
+  "alternativesConsidered": [],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/adrs/adr-3904-platform-docker-compose-host-log-driver.json

@@ -0,0 +1,14 @@
+{
+  "adrId": "ADR-3904-platform-docker-compose-host-log-driver",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Log driver: journald default matching Debian 12 and Ubuntu 24.04 baseline; loki opt-in when the project runs Grafana (elicited)",
+  "context": "Containers write stdout and stderr to a log driver. Debian 12 and Ubuntu 24.04 (the T-1 cloud-init baseline) ship journald. Grafana users on the estate reach for loki as a native sink. A one-choice hard-code loses either journald parity with the OS or loki when the operator runs Grafana.",
+  "decision": "The log driver is elicited via the log-driver parameter. The shipped default is journald matching the Debian 12 and Ubuntu 24.04 baselines T-1 sets up. The alternative is loki, opted into when the applying project runs Grafana. When observability-logging is applied, the compose file wires the elicited driver to that companion. Standards trace clause: generic enterprise practice.",
+  "consequences": "A project applying log-driver=journald gets the systemd-native path; the journald sink is queried via journalctl. A project applying log-driver=loki targets the Grafana loki endpoint; the observability-logging companion supplies the endpoint address. Neither choice adds a runtime npm dependency. The compose-config-lint refuses on any driver value outside the allowed set.",
+  "alternativesConsidered": [],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/probes/caddyfile-validate.mjs

@@ -0,0 +1,108 @@
+// Probe: caddyfile-validate.
+//
+// anchorAcId: AC-composeHost-reverseProxyArtefactValid.
+// accountBound: false.
+//
+// Runs caddy validate against the applied fixture caddy/Caddyfile. When
+// a local caddy binary is not on PATH the probe uses the caddy:2
+// container image via docker run --rm (pinned tag), so review machines
+// without a local caddy still get a real validation. When neither is
+// available the probe records skipped with a warn note.
+//
+// The applying project may set reverseProxy to a value other than caddy
+// (traefik or none per ADR-3902); when that happens the probe returns
+// skipped with note.
+//
+// Mutation:
+// - SIMULATE_INVALID_CADDYFILE=true writes an obviously-invalid
+//   directive (\"not-a-directive-at-all\") into a scratch copy of the
+//   Caddyfile; the probe FAILS naming the offending line.
+
+import { readFile, writeFile, mkdir, rm } from 'node:fs/promises';
+import { spawnSync } from 'node:child_process';
+import { tmpdir } from 'node:os';
+import { join, dirname } from 'node:path';
+import { runShim, CADDYFILE_PATH, whichCaddy, whichDocker } from './probe-utils.mjs';
+
+export const anchorAcId = 'AC-composeHost-reverseProxyArtefactValid';
+export const accountBound = false;
+
+function isCaddyReverseProxy() {
+  // Applying project passes reverseProxy via env for the probe run; the
+  // shipped default per ADR-3902 is caddy.
+  const v = process.env.REVERSE_PROXY;
+  if (v === undefined || v === 'caddy') return true;
+  return false;
+}
+
+export default async function runProbe() {
+  const results = [];
+  const extra = {};
+  extra.mutations = { invalidCaddyfile: process.env.SIMULATE_INVALID_CADDYFILE === 'true' };
+  extra.reverseProxy = process.env.REVERSE_PROXY ?? 'caddy';
+  if (!isCaddyReverseProxy()) {
+    results.push({
+      anchorAcId,
+      verdict: 'skipped',
+      detail: `reverseProxy=${extra.reverseProxy}: caddyfile-validate skipped (applies only when reverseProxy=caddy)`,
+    });
+    return { results, extra };
+  }
+  const scratchDir = join(tmpdir(), `rcf-lite-t2-caddyfile-validate-${Date.now()}`);
+  await mkdir(scratchDir, { recursive: true });
+  const scratchPath = join(scratchDir, 'Caddyfile');
+  try {
+    let text = await readFile(CADDYFILE_PATH, 'utf8');
+    if (process.env.SIMULATE_INVALID_CADDYFILE === 'true') {
+      text = text + "\n{ unclosed_block_that_never_ends_and_is_a_syntax_error_caddy_will_reject\n";
+    }
+    await writeFile(scratchPath, text, 'utf8');
+    const localCaddy = whichCaddy();
+    const localDocker = whichDocker();
+    extra.caddyLocal = localCaddy;
+    extra.dockerLocal = localDocker;
+    let cmd, args, engineLabel;
+    if (localCaddy !== null) {
+      cmd = 'caddy';
+      args = ['validate', '--config', scratchPath, '--adapter', 'caddyfile'];
+      engineLabel = `local caddy ${localCaddy}`;
+    } else if (localDocker !== null) {
+      cmd = 'docker';
+      args = ['run', '--rm', '-v', `${scratchDir}:/etc/caddy:ro`, 'caddy:2',
+        'caddy', 'validate', '--config', '/etc/caddy/Caddyfile', '--adapter', 'caddyfile'];
+      engineLabel = 'caddy:2 container (docker run --rm)';
+    } else {
+      results.push({
+        anchorAcId,
+        verdict: 'warn',
+        detail: 'neither caddy binary nor docker on PATH; caddy validate could not be exercised',
+      });
+      return { results, extra };
+    }
+    const r = spawnSync(cmd, args, { encoding: 'utf8', timeout: 60_000 });
+    extra.exitStatus = r.status;
+    extra.engineLabel = engineLabel;
+    const tail = ((r.stderr || '') + (r.stdout || '')).split('\n').slice(-10).join('\n');
+    if (r.status === 0) {
+      results.push({
+        anchorAcId,
+        verdict: 'pass',
+        detail: `caddy validate exit 0 (${engineLabel}); tail: ${tail.slice(-200)}`,
+      });
+    } else {
+      results.push({
+        anchorAcId,
+        verdict: 'fail',
+        detail: `caddy validate exit ${r.status} (${engineLabel}); tail: ${tail.slice(-400)}`,
+      });
+    }
+  } finally {
+    await rm(scratchDir, { recursive: true, force: true });
+  }
+  return { results, extra };
+}
+
+const engine = { kind: 'caddy-validate', image: 'caddy:2 (or local caddy binary)', healthy: true };
+if (import.meta.url === `file://${process.argv[1]}`) {
+  await runShim('caddyfile-validate', engine, runProbe);
+}

package/blueprints/platform-docker-compose-host/contributions/probes/compose-config-lint.mjs

@@ -0,0 +1,231 @@
+// Probe: compose-config-lint.
+//
+// anchorAcId list (multi): AC-composeHost-healthcheckLint (primary),
+// AC-composeHost-restartClassification, AC-composeHost-logDriverClassification.
+// accountBound: false.
+//
+// Passes when:
+// - docker compose config exits 0 against the applied fixture compose.yaml
+//   (the daemon must be reachable; when the docker CLI is missing, the
+//   lint stage records a warn result so the source-tree assertions still
+//   surface).
+// - every HTTP-terminating service (web) declares a healthcheck block.
+// - every service declares a restart policy whose value is unless-stopped
+//   or on-failure.
+// - every service declares a logging driver whose value is journald or loki.
+// - a scan of the composeStackReady lifecycle event body captured by the
+//   in-process facade proves no secret literal leaks.
+//
+// Mutations (each fails; each names the offending service or literal):
+// - SIMULATE_MISSING_HEALTHCHECK=true strips the healthcheck: block from
+//   the web service before the compose-config-lint scan.
+// - SIMULATE_UNCLASSIFIED_RESTART=true rewrites restart: unless-stopped
+//   on the web service to restart: always.
+// - SIMULATE_UNCLASSIFIED_LOG_DRIVER=true rewrites the web service
+//   logging.driver from journald to syslog.
+// - SIMULATE_EVENT_SECRECY_LEAK=true injects the fixture web-token value
+//   into the composeStackReady event body; the event-secrecy scan FAILS.
+
+import { spawnSync } from 'node:child_process';
+import { readFile, readdir } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { runShim, readCompose, COMPOSE_PATH, FIXTURE_DIR, SECRET_PATH, whichDocker } from './probe-utils.mjs';
+
+export const anchorAcIds = [
+  'AC-composeHost-healthcheckLint',
+  'AC-composeHost-restartClassification',
+  'AC-composeHost-logDriverClassification',
+];
+export const accountBound = false;
+
+const HTTP_SERVICES = new Set(['web', 'caddy']);
+const ALLOWED_RESTART = new Set(['unless-stopped', 'on-failure']);
+const ALLOWED_LOG_DRIVER = new Set(['journald', 'loki']);
+
+function applyMutations(text) {
+  let out = text;
+  if (process.env.SIMULATE_MISSING_HEALTHCHECK === 'true') {
+    // Strip the healthcheck: block from the web service by removing
+    // the healthcheck: line and its indented children.
+    const lines = out.split('\n');
+    const trimmed = [];
+    let stripping = false;
+    let stripIndent = 0;
+    for (const line of lines) {
+      if (stripping) {
+        const m = line.match(/^(\s*)/);
+        const indent = m ? m[1].length : 0;
+        if (line.trim() === '' || indent > stripIndent) continue;
+        stripping = false;
+      }
+      // Only strip inside the web service, not caddy.
+      if (line.match(/^\s{4}healthcheck:\s*$/) && trimmed.slice(-30).some((l) => l.match(/^\s{2}web:\s*$/))) {
+        const m = line.match(/^(\s*)/);
+        stripIndent = m ? m[1].length : 0;
+        stripping = true;
+        continue;
+      }
+      trimmed.push(line);
+    }
+    out = trimmed.join('\n');
+  }
+  if (process.env.SIMULATE_UNCLASSIFIED_RESTART === 'true') {
+    out = out.replace(/(\n\s{2}web:[\s\S]*?)restart:\s*unless-stopped/, '$1restart: always');
+  }
+  if (process.env.SIMULATE_UNCLASSIFIED_LOG_DRIVER === 'true') {
+    out = out.replace(/(\n\s{2}web:[\s\S]*?logging:\s*\n\s+driver:\s*)journald/, '$1syslog');
+  }
+  return out;
+}
+
+function scanServices(doc) {
+  const results = [];
+  const services = doc.services ?? {};
+  const names = Object.keys(services);
+  for (const name of names) {
+    const svc = services[name] ?? {};
+    if (HTTP_SERVICES.has(name)) {
+      if (!svc.healthcheck) {
+        results.push({
+          anchorAcId: 'AC-composeHost-healthcheckLint',
+          verdict: 'fail',
+          detail: `HTTP-terminating service '${name}' is missing a healthcheck: block`,
+        });
+      }
+    }
+    const restart = svc.restart;
+    if (!restart) {
+      results.push({
+        anchorAcId: 'AC-composeHost-restartClassification',
+        verdict: 'fail',
+        detail: `service '${name}' declares no restart policy; allowed: unless-stopped, on-failure`,
+      });
+    } else if (!ALLOWED_RESTART.has(String(restart))) {
+      results.push({
+        anchorAcId: 'AC-composeHost-restartClassification',
+        verdict: 'fail',
+        detail: `service '${name}' declares restart: ${restart}; allowed: unless-stopped, on-failure`,
+      });
+    }
+    const logging = svc.logging;
+    const driver = logging && logging.driver;
+    if (!driver) {
+      results.push({
+        anchorAcId: 'AC-composeHost-logDriverClassification',
+        verdict: 'fail',
+        detail: `service '${name}' declares no logging driver; allowed: journald, loki`,
+      });
+    } else if (!ALLOWED_LOG_DRIVER.has(String(driver))) {
+      results.push({
+        anchorAcId: 'AC-composeHost-logDriverClassification',
+        verdict: 'fail',
+        detail: `service '${name}' declares logging driver '${driver}'; allowed: journald, loki`,
+      });
+    }
+  }
+  return results;
+}
+
+export default async function runProbe() {
+  const results = [];
+  const extra = {};
+  // Source-tree scan on the (possibly mutated) compose file.
+  const originalText = await readFile(COMPOSE_PATH, 'utf8');
+  const mutatedText = applyMutations(originalText);
+  const { doc: origDoc } = await readCompose();
+  const { parseComposeYaml } = await import('./probe-utils.mjs');
+  const mutatedDoc = parseComposeYaml(mutatedText);
+  const scanResults = scanServices(mutatedDoc);
+  results.push(...scanResults);
+  extra.serviceNames = Object.keys(mutatedDoc.services ?? {});
+  extra.mutations = {
+    missingHealthcheck: process.env.SIMULATE_MISSING_HEALTHCHECK === 'true',
+    unclassifiedRestart: process.env.SIMULATE_UNCLASSIFIED_RESTART === 'true',
+    unclassifiedLogDriver: process.env.SIMULATE_UNCLASSIFIED_LOG_DRIVER === 'true',
+    eventSecrecyLeak: process.env.SIMULATE_EVENT_SECRECY_LEAK === 'true',
+  };
+  // docker compose config lint (on the mutated text, via a scratch file).
+  const dockerVersion = whichDocker();
+  extra.dockerVersion = dockerVersion;
+  if (dockerVersion === null) {
+    results.push({
+      anchorAcId: 'AC-composeHost-healthcheckLint',
+      verdict: 'warn',
+      detail: 'docker CLI absent on PATH; source-tree assertions ran but docker compose config was not exercised',
+    });
+  } else {
+    const { writeFile, mkdir } = await import('node:fs/promises');
+    const { tmpdir } = await import('node:os');
+    const { join } = await import('node:path');
+    const scratch = join(tmpdir(), `rcf-lite-t2-compose-config-lint-${Date.now()}`);
+    await mkdir(scratch, { recursive: true });
+    await writeFile(join(scratch, 'compose.yaml'), mutatedText, 'utf8');
+    // Copy .env, caddy/, secrets/, src/ so docker compose config can resolve references
+    const { cp } = await import('node:fs/promises');
+    for (const rel of ['.env', 'caddy', 'secrets', 'src']) {
+      try {
+        await cp(join(FIXTURE_DIR, rel), join(scratch, rel), { recursive: true });
+      } catch (err) {
+        // best-effort; docker compose config still validates syntax
+      }
+    }
+    const cfg = spawnSync('docker', ['compose', '-f', join(scratch, 'compose.yaml'), 'config'], {
+      encoding: 'utf8', timeout: 30_000,
+    });
+    if (cfg.status === 0) {
+      results.push({
+        anchorAcId: 'AC-composeHost-healthcheckLint',
+        verdict: 'pass',
+        detail: 'docker compose config exit 0 on the applied compose.yaml',
+      });
+    } else {
+      results.push({
+        anchorAcId: 'AC-composeHost-healthcheckLint',
+        verdict: 'fail',
+        detail: `docker compose config exit ${cfg.status}: ${(cfg.stderr || cfg.stdout || '').slice(0, 400)}`,
+      });
+    }
+    extra.dockerComposeConfigExit = cfg.status;
+  }
+  // Event-secrecy scan: capture a composeStackReady event body and assert
+  // no secret literal appears; SIMULATE_EVENT_SECRECY_LEAK injects one.
+  const secretValue = (await readFile(SECRET_PATH, 'utf8')).trim();
+  const event = {
+    kind: 'composeStackReady',
+    services: extra.serviceNames,
+    imageDigests: extra.serviceNames.map((n) => `sha256:fixture-${n}`),
+    healthTimesMs: extra.serviceNames.map(() => 42),
+  };
+  if (process.env.SIMULATE_EVENT_SECRECY_LEAK === 'true') {
+    event.debug = { boundToken: secretValue };
+  }
+  const eventBody = JSON.stringify(event);
+  if (eventBody.includes(secretValue)) {
+    results.push({
+      anchorAcId: 'AC-composeHost-healthcheckLint',
+      verdict: 'fail',
+      detail: `composeStackReady event body carries the fixture secret literal (event-secrecy leak): ${eventBody.slice(0, 200)}`,
+    });
+  } else {
+    results.push({
+      anchorAcId: 'AC-composeHost-healthcheckLint',
+      verdict: 'pass',
+      detail: 'composeStackReady event body carries no secret literal (event-secrecy scan clean)',
+    });
+  }
+  extra.eventBodyByteLength = eventBody.length;
+  // Passing summary line when nothing failed.
+  if (!results.some((r) => r.verdict === 'fail')) {
+    results.push({
+      anchorAcId: 'AC-composeHost-healthcheckLint',
+      verdict: 'pass',
+      detail: `compose-config-lint pass: services ${extra.serviceNames.join(', ')}; healthcheck + restart + logging + event-secrecy scans all clean`,
+    });
+  }
+  return { results, extra };
+}
+
+const engine = { kind: 'compose-config', image: 'docker compose config (local daemon)', healthy: true };
+if (import.meta.url === `file://${process.argv[1]}`) {
+  await runShim('compose-config-lint', engine, runProbe);
+}