rcf-lite 0.24.0 → 0.26.0

package/CHANGELOG.md

@@ -6,6 +6,42 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.26.0] - 2026-09-09
+
+rcf-lite 0.26.0 is a hardening and authoring release. The Cloudflare-platform blueprints on the shelf pick up real-account probe drivers with positive evidence and one shared account-token env matrix, the blueprint authoring standard gains three new sections (7c REQ-layer sufficiency, 7d positive-evidence verification, 7e single-definition ownership) plus RULE 16 for the managed agent block, and `rcf define blueprint` gains a `lint-consistency` verb, a per-slug disposition ledger, an apply-time disposition prompt and an identity-register field on the seeded profile. The schema floor moves to `@stravica-ai/rcf-schemas` 0.6.2. Nothing here is breaking.
+
+### Added
+
+- **Blueprint chain-consistency lint verb: `rcf define blueprint lint-consistency <source>` (PR #183).** Two passes over one blueprint's own JSON and markdown. Pass 1 checks single-definition ownership: HTTP-header and env-var casing drift between an owning TAC's interfaces, internal structure, responsibilities or purpose and any other artefact, plus an `undeclaredRestatement` finding when an AC restates a token owned by a TAC interface without an `ownerRef.tacId` reference. Pass 2 checks REQ delivery: `reqNoDelivery` when a REQ description carries a promise phrase (must, requires, guarantees, ceiling, never, invariant, on boot, at boot, event) without a `deliveredBy` link into a TAC or ADR, and `reqDeliveryNotCarried` when the named TAC or field is absent or does not appear in the TAC's responsibilities or interfaces. Exit 0 on clean, exit 3 on unsuppressed findings, exit 2 on usage error. `--json` emits the envelope `{ blueprint, findings[], verdict, passCounts }`. Pass-1 findings are suppressible via a `## Known chain-consistency-lint suppressions` section on the blueprint README (one row per finding id with a one-sentence reason); pass-2 findings are not suppressible. A soft-mode CI lint step runs the verb across the shelf so authoring drift surfaces on every PR without blocking the merge yet.
+- **Per-slug disposition ledger and `rcf define blueprint dispositions <slug> [--json]` verb (PR #183).** A ledger file at `rcf/blueprints/<slug>.disposition.json` sits alongside the existing applied sidecar and carries one record per contributed AC with an `action` (`pending-disposition`, `pending-operator`, `accepted`, `adjusted`, `dropped`, `escalated-as-defect`), optional `reason`, `resolvedAt`, `resolvedBy`, `escalatedAt`, `escalatedToOperator`, `defectUrl`, and an optional `sourceDisposition` of `fixed` or `template`. Written on a fresh `rcf define blueprint add`; a re-apply leaves an existing ledger byte-identical so operator edits are never clobbered. The read-only `dispositions` verb prints one line per record with action, reason and resolution timestamp, or the raw ledger with `--json`. Exit 0 always; a missing ledger is a legitimate zero state. Schema follow-up: a `$defs/blueprintDispositionLedger` shape lands on `@stravica-ai/rcf-schemas` in a later release; for now the writer guards the record shape inline.
+- **Apply-time disposition prompt (PR #183).** After a fresh `rcf define blueprint add` the CLI prints a canonical prompt naming the newly initialised ledger and the disposition vocabulary, so an operator lands on the ledger before the next verify. Suppressible with `--no-disposition-prompt`.
+- **Identity register field on the seeded profile (PR #183).** The identity seed template gains a `## Register` section under `## Working preferences` with the three-value vocabulary (`productOwner`, `engineer`, `unstated`) seeded to `unstated`. Register capture stays a managed-block flow, so `cli/init.js` is unchanged; existing projects pick up the field on the next `rcf doctor --fix` sweep of the managed block.
+- **Blueprint authoring standard sections 7c, 7d, 7e (PR #182).** Section 7c (REQ-layer sufficiency): every capability token declared on `blueprint.json:capabilities[]` and every option value on `elicits[]` is backed by at least one must-priority requirement; a blueprint without an `elicits` key is legal only when no apply-time answer is named anywhere in the requirements, guide or TAC records. Section 7d (positive-evidence verification): every verification artefact asserts positive evidence of the property it exists to protect (a request id, a response body excerpt, a created-then-deleted resource id in an inventory diff, or a real deploy record), never the absence of a previously seen bad signature; env vars are declared on the fixture, and `accountBoundSkipped: true` is legal only when the account env is unset and paired with an exact non-empty `reason`. Section 7e (single-definition ownership and authoring order): every named contract is defined exactly once in one owning artefact (TAC for wire shapes and interfaces, ADR for behaviour decisions, REQ for externally promised properties with a `deliveredBy` link into the delivering TAC or ADR); US, AC and guide reference the owner rather than restating it, and authoring order follows. RULE 16 lands in `guidance/managed/agent-instructions-block.md` so applying agents inherit both disciplines from the managed block on the next `rcf doctor --fix` sweep.
+- **Ten new blueprint-authoring-checklist rows in section 6 (PR #182).** Three rows from section 7c, five from section 7d, two from section 7e; the block hash and the `harness-template.md` fragment regenerate via `scripts/gen-managed-artefacts.mjs`.
+- **Positive-evidence remap at record composition (PR #182).** `packages/rcf-lite/src/browser-verify/manifest-writer.js:composeBrowserVerificationRecord` remaps a `checks[]` or `preChecks[]` record with `verdict: 'pass'` and neither an `evidence` field nor `accountBoundSkipped: true` (with a non-empty `reason`) to `verdict: 'fail'` with `detail: 'positive-evidence-missing'`. The remap fires at record composition so the composed record is what the manifest carries and the fail surfaces at the ship gate. `pack-runner.js` carries `evidence`, `accountBoundSkipped` and `reason` through from each check's and pre-check's `run` outcome so the composer sees the fields.
+- **H-2 Cloudflare-platform probe integrity (PR #179).** The Cloudflare-platform blueprints on the shelf (`platform-cloudflare-kv`, `platform-cloudflare-durable-objects`, `messaging-queue-cloudflare`, `edge-cloudflare-tunnel`) pick up real-account probe drivers that assert positive evidence: KV re-anchor and observability on cache-aside miss/hit, DO storage round-trip with anchor coverage, queue real concurrency with dead-letter observation, tunnel connector health and hostname routing. The `packages/rcf-lite/test/fixtures/cf-platform/` fixture README gains a "Declared env vars" section naming the first-tier `CI_HAS_CLOUDFLARE_ACCOUNT` gate and the four second-tier variables the account-bound branches read (`CF_ACCOUNT_ID`, `CF_API_TOKEN`, `CF_KV_NAMESPACE_ID`, `CF_WORKER_NAME`), so a runner without those env vars sees clean `accountBoundSkipped: true` rows with a stated reason rather than a silent pass.
+
+### Changed
+
+- **Schema floor: `@stravica-ai/rcf-schemas` 0.6.1 to 0.6.2.** No new required fields on shipped artefacts; picks up the shape work that supports the disposition-ledger record and the identity-register field.
+
+#### Also in this release
+
+- **`object-storage-s3` v1.0.0 to v1.1.0 (PR #177).** The Hetzner Object Storage adapter lands as the follow-up sibling to the R2 first adapter shipped in 0.23.0, per the 0.25.0 headline. The blueprint bumps but the rcf-lite package version does not bump for this alone; it rides along in this release.
+- **`deploy-hetzner-server` v1.0.0 to v1.0.1 (PR #178).** Real-path fix for the cloud-init render path resolution so an applied project on Node 24 finds the template through the resolved module directory rather than the workspace-relative path.
+- **Blueprint authoring notes on AC sufficiency and fixed-vs-template dispositions (PRs #180, #181).** Two docs-only additions to `packages/rcf-lite/docs/blueprint-authoring.md` that pair with the section 7c and disposition-ledger work: how many ACs are enough for a given US, and how a contributed AC's `sourceDisposition` reads as `fixed` (delivered verbatim) or `template` (adjusted at apply time).
+
+## [0.25.0] - 2026-09-08
+
+rcf-lite 0.25.0 opens the Hetzner line with three blueprints in one round: a Hetzner Cloud server as the shipped Linux VM shape with the estate hardening baseline and a snapshot cadence, a docker-compose platform on top with healthchecks, secrets as file mounts and a first-class reverse-proxy artefact, and a Cloudflare Tunnel bridge that composes with Access when Zero Trust is applied and drops to public-hostname mode when it is not. Every real-account probe across the round ships accountBoundSkipped pending the Hetzner and Cloudflare token vault ruling; the local probes carry the ship-time verdicts. The follow-up Hetzner Object Storage adapter ships as a sequential PR under `object-storage-s3` v1.1.0 after this release; the rcf-lite package version does not bump for it.
+
+### Added
+
+- **Round 7 T-1: `deploy-hetzner-server` v1.0.0 on the shelf (PR #173).** Hetzner Cloud server provisioner with an `hcloud`-shaped adapter as the sole reader of the Hetzner API token through the applied `security-secrets-management` facade, a canonical server manifest under `hetzner/servers/name.json`, a cloud-init template landing the estate hardening baseline (SSH key-only, root disabled, UFW default-deny incoming, DOCKER-USER iptables chain, fail2ban SSH jail, unattended-upgrades, a `/live` probe on a private interface), a Hetzner Cloud Firewall contract, and a snapshots-and-backups posture (weekly snapshot default, daily and off alternatives, Hetzner-managed backups as the elicited paid option). Local probes cover cloud-init render, manifest schema and an hcloud dry-run; the three throwaway-server real-account probes (provision, cloud-init hardened, snapshot on demand) ship accountBoundSkipped pending the Hetzner token vault ruling. Ships the shared throwaway-server CI fixture reused by T-2 and T-3 (label-scoped provision, destroy and orphan sweep; hcloud pulled into a checksummed scratchpad, no system install). Declares `capabilities: ["cloudHost"]`. Mints the new global topics `linuxCloudHostContract` and `snapshotAndBackupCadence`.
+- **Round 7 T-2: `platform-docker-compose-host` v1.0.0 on the shelf (PR #174).** Docker engine and compose plugin install invoked from the T-1 cloud-init playbook, a canonical compose layout (`compose.yaml` at repo root, service-per-container, named networks and volumes), a healthcheck-required contract, a restart discipline (`restart: unless-stopped` for long-running services, `on-failure` for jobs), a zero-downtime reload shape for the reverse proxy, secrets as compose file mounts referencing the applied secrets facade at 0o400, and log shipping to the elicited `observability-logging` sink (default `journald`, opt-in `loki`). Caddy is the shipped default reverse proxy with Traefik as the elicited alternative; Coolify is rejected. The reverse-proxy config is a first-class versioned artefact under `caddy/Caddyfile` or `traefik/traefik.yaml` with a smoke curl after every apply. Local probes drive real docker 29.6.2 and the `caddy:2` image (`docker compose config` lint, secrets-as-files scan, Caddyfile validate); the two real-account probes (minimal-stack-up, reload-burst) ship accountBoundSkipped. Extends the T-1 throwaway-server fixture in place with a two-service compose stack. Declares `capabilities: ["containerHost"]`. Mints the new global topic `containerHostContract`.
+- **Round 7 T-3: `edge-cloudflare-tunnel` v1.0.0 on the shelf (PR #175).** `cloudflared` as a compose service (default when `containerHost` is applied) or a systemd unit (alternative for bare `cloudHost` per the vendor cloudflared as-a-service documentation), a tunnel manifest under `cloudflare/tunnels/<name>.yaml` (tunnel id, credentials reference into the applied secrets facade, ingress rules mapping public hostname to internal service URL with a mandatory catch-all `http_status:404`), and a hostname-management contract that creates the DNS route via the Cloudflare API. Composes with `edge-cloudflare-access` via `zeroTrustGate`: when Access is applied, the ingress rule attaches the Access AUD in `originRequest.access` and the connector-side JWT check refuses requests without a valid Access assertion; when Access is not applied, the tunnel ships in public-hostname mode. Local probes cover manifest schema, `cloudflared tunnel ingress validate` and an AUD-presence sidecar-read check; the two real-account probes (connector-healthy, tunnel-hostname-routes) ship accountBoundSkipped pending the Cloudflare token vault ruling. Declares `capabilities: ["tunnelBridge"]`. Mints the new global topic `edgeIngressBridge`.
+- **Authoring standard capability table extended.** `packages/rcf-lite/docs/blueprint-authoring.md` section 6a gains three new rows: `cloudHost`, `containerHost`, `tunnelBridge`. Chunk-zero-style append, loader unchanged.
+
 ## [0.24.0] - 2026-09-08
 
 rcf-lite 0.24.0 opens the Cloudflare line with six blueprints in one round: a Workers KV facade, cron triggers with an expression-router, durable objects covering strong-consistency and hibernatable WebSocket shapes, a Zero-Trust Access gate the admin console consumes, Turnstile with the pinned test keys running under a Playwright pack, and edge rate limiting with a committed manifest. Each blueprint verifies against the real Cloudflare engine through node-only probes, and the admin console reads the Access-gate capability to switch its sign-in surface.

package/blueprints/application-account-settings/docs/topics.md

@@ -26,7 +26,7 @@ The blueprint claims no new global topics at v1.0.0. Account-settings is a consu
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
@@ -35,6 +35,9 @@ The blueprint claims no new global topics at v1.0.0. Account-settings is a consu
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-admin-console/docs/topics.md

@@ -26,7 +26,7 @@ The blueprint claims no new global topics at v1.0.0. The console is a consumer o
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
@@ -35,6 +35,9 @@ The blueprint claims no new global topics at v1.0.0. The console is a consumer o
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-api-rest/docs/topics.md

@@ -49,7 +49,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
@@ -58,6 +58,9 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 Suffix-family ids (ADR, TAC): SPA numbers in the 2xx range, this package takes 3xx (ADR-301 to ADR-308, TAC-301 to TAC-306); the next blueprint should take 4xx.
 

package/blueprints/application-charts/docs/topics.md

@@ -25,7 +25,7 @@ The blueprint claims no new global topics at v1.0.0. The chart-component contrac
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
@@ -34,6 +34,9 @@ The blueprint claims no new global topics at v1.0.0. The chart-component contrac
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-dashboard/docs/topics.md

@@ -25,7 +25,7 @@ The blueprint claims no new global topics at v1.0.0. The dashboard-shell contrac
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
@@ -34,6 +34,9 @@ The blueprint claims no new global topics at v1.0.0. The dashboard-shell contrac
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-datatable/docs/topics.md

@@ -24,7 +24,7 @@ The blueprint claims no new global topics at v1.0.0. The datatable shell is a ge
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
@@ -33,6 +33,9 @@ The blueprint claims no new global topics at v1.0.0. The datatable shell is a ge
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-empty-error-states/docs/topics.md

@@ -25,7 +25,7 @@ The blueprint claims no new global topics at v1.0.0. Every ADR (HTTP status cont
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
@@ -34,6 +34,9 @@ The blueprint claims no new global topics at v1.0.0. Every ADR (HTTP status cont
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-error-handling/docs/topics.md

@@ -31,7 +31,7 @@
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
@@ -40,5 +40,8 @@
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.

package/blueprints/application-file-upload/docs/topics.md

@@ -26,7 +26,7 @@ The blueprint claims no new global topics at v1.0.0. Every ADR (transport branch
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
@@ -35,6 +35,9 @@ The blueprint claims no new global topics at v1.0.0. Every ADR (transport branch
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-forms-wizard/docs/topics.md

@@ -25,7 +25,7 @@ The blueprint claims no new global topics at v1.0.0. Every ADR (navigation postu
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorage` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorage` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
@@ -34,6 +34,9 @@ The blueprint claims no new global topics at v1.0.0. Every ADR (navigation postu
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-notifications-in-app/docs/topics.md

@@ -28,7 +28,7 @@ The `application-notifications-` prefix is reserved for the sibling channel blue
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
@@ -37,6 +37,9 @@ The `application-notifications-` prefix is reserved for the sibling channel blue
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 | application-notifications-email (reserved) | to be claimed at ship | to be claimed at ship | name-only doc reservation (not shipped) | tba |
 | application-notifications-push (reserved) | to be claimed at ship | to be claimed at ship | name-only doc reservation (not shipped) | tba |
 | application-notifications-webhook (reserved) | to be claimed at ship | to be claimed at ship | name-only doc reservation (not shipped) | tba |

package/blueprints/application-onboarding-tour/docs/topics.md

@@ -24,7 +24,7 @@ The blueprint claims no new global topics at v1.0.0. Onboarding-tour is a consum
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
@@ -33,6 +33,9 @@ The blueprint claims no new global topics at v1.0.0. Onboarding-tour is a consum
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-spa/docs/topics.md

@@ -54,7 +54,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
@@ -63,6 +63,9 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 SPA v1.1.0 stays on the LOW end of its band: v1.0.0 occupied US-1101 through US-1128; v1.1.0 adds US-1129 and US-1130, leaving headroom above 1130 for future minor bumps and for project-side stories that mechanically derive to the 11xx numeric range.
 

package/blueprints/delivery-ci-workflows/docs/topics.md

@@ -60,7 +60,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
@@ -69,6 +69,9 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 US 6101-6110 sit at the LOW end of the 6101-6899 band on purpose. A project-side story that mechanically derives from `delivery-ci-workflows-REQ-011` into the number `6111` would collide against delivery-ci-workflows-US-6111 in this package; the band leaves headroom at the HIGH end (US 6181-6899) so a project's own stories anchored to delivery-ci-workflows REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/deploy-cloudflare-workers/docs/topics.md

@@ -46,7 +46,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
@@ -55,6 +55,9 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 US 12101-12112 sit at the LOW end of the 12101-12899 band on purpose. A project-side story that mechanically derives from a deploy-cloudflare-workers REQ id into the number `12112` would collide against deploy-cloudflare-workers-US-12112 in this package; the band leaves headroom at the HIGH end (US 12181-12899) so a project's own stories anchored to deploy-cloudflare-workers REQs can allocate without conflict. The watchpost run4 lesson applies here too. Band spacing between the last shipped block (security-secrets-management, 8101-8899, 9xx) and this one (12101-12899, 13xx) leaves the 9xxx-11xxx US bands and the 10xx-12xx suffix blocks open for concurrent-lane authoring so a peer authoring another blueprint in the same PR window does not collide with this one.
 

package/blueprints/deploy-hetzner-server/CHANGELOG.md

@@ -0,0 +1,55 @@
+## 1.0.1
+
+H-1 hardening patch train (round-7 real-account gate d-2026-09-08-010 defect list). Fixes nine real-path defects in the shared throwaway-Hetzner-server fixture at packages/rcf-lite/test/fixtures/hetzner-throwaway-server/ so the three T-1 real-account probes return aggregateVerdict pass on a live Hetzner Cloud project unpatched, and destroy plus sweep-orphans never leak a server. Every existing v1.0.0 contribution id byte-identical apart from the cloud-init template bodies (baseline unchanged; adds a NOPASSWD sudoers.d fragment for the deploy user) and the three T-1 mocked probe bodies (mutation-purity clean plus a new rendered-file assertion).
+
+Defect list fixed:
+
+- (1) provision.mjs reads snake_case fields off the hcloud server create response (public_net.ipv4.ip, datacenter.location.name, server_type.name). v1.0.0 read camelCase and threw on every real-account provision, so destroy.mjs could not find the server to tear down.
+- (2) provision.mjs renders the cloud-init user-data via src/cloud-init-renderer.mjs before hcloud server create fires and writes it to hetzner/servers/rendered/<name>.cloud-init.yaml. v1.0.0 expected a file that no shipped code wrote; every provision failed on missing user-data.
+- (3) src/cloud-init-renderer.mjs resolves each ssh key name to its .publicKey via hcloud ssh-key describe --output json and inlines the material into ssh_authorized_keys under the deploy user. v1.0.0 inlined the key NAME and the deploy user had no working authorized_keys entry.
+- (4) destroy.mjs and sweep-orphans.mjs never pass --output json to a hcloud <resource> delete verb (the delete verbs reject the flag with unknown flag: --output). The tolerant JSON parser accepts arrays, objects and the delete verbs short informational text output.
+- (5) src/snapshot-verb.mjs shells hcloud server create-image --type snapshot --description <label> <server-id> and recovers the created snapshot id via hcloud image list --type=snapshot --output json by matching the serverName label. v1.0.0 called a non-existent hcloud image create-image verb.
+- (6) src/ssh-baseline-check.mjs polls port 22 open and a trivial ssh true exec (bounded up to 6 minutes) before firing the six baseline checks. v1.0.0 spawned ssh immediately after provision and every check timed out on connection refused because cloud-init had not finished.
+- (7) contributions/templates/cloud-init.yaml.tmpl adds a write_files sudoers.d fragment at /etc/sudoers.d/90-deploy-nopasswd (mode 0440) that grants NOPASSWD to the deploy user, so the sudoed baseline checks (cloud-init status --wait, ufw status, iptables -L, systemctl is-active fail2ban) never block on a tty prompt.
+- (9) provision.mjs reads an env override RCF_LITE_CI_SSH_KEY_NAME (per-key comma-separated) for the manifest sshKeyIds, with the manifest value staying the default when the override is unset. Documented in the fixture README.
+
+Also: the three T-1 mocked probe modules (cloud-init-render-lint, manifest-schema-validate, hcloud-dry-run-mock) no longer read any process.env.SIMULATE_ switch inside the probe body per the H-1 mutation-purity gate row. The switches live entirely inside fixture-side files (src/cloud-init-renderer.mjs, src/hcloud-mock.mjs, src/provisioner-facade.mjs and the fixture-side run-manifest-schema-validate.mjs shim) and alter INPUT only. The hcloud-dry-run-mock probe now consumes the SAME rendered cloud-init file the real path consumes (renderer writes it, both the mock and real path read it) and asserts an ssh public-key line under the deploy user plus a NOPASSWD directive naming that user (H-1 REQ-145 / AC-14501-1). Report envelopes under .rcf/reports/blueprints/deploy-hetzner-server/ regenerated from the real run.
+
+Chain: HQ hardening block H-1 REQ-145..149 / TS-175..179 / FBS-165..169 / CN-510..519 per HQ chain-block ruling 2026-09-08. Real run under Baz one-off approval 2026-09-08: yes, one-off for round 7 gates; Ensure that after any testing etc the Hertner account leaves NO orphaned resources behind. Leave it in the state it started in.
+
+Defect (8) T-2 and T-3 stub drivers are OUT of scope for H-1 (H-2 owns them).
+
+# deploy-hetzner-server changelog
+
+## 1.0.0
+
+Initial shelf release. Ships an hcloud-shaped provisioner facade
+(with a raw-api elicited alternative) as the sole reader of the
+Hetzner API token; a manifest schema at `hetzner/servers/*.json`; a
+cloud-init template landing the six-block hardening baseline (SSH
+key-only, root disabled, UFW default-deny incoming, DOCKER-USER
+iptables chain, fail2ban SSH jail, unattended-upgrades); a firewall
+rule shape (22 from operator-nominated prefixes, 80/443 open, deny
+all else); a snapshot cadence elicit (weekly default, daily and off
+alternatives) plus a snapshot-on-demand verb; four metadata-only
+lifecycle events (`provisionerReady`, `hetznerServerProvisioned`,
+`hetznerSnapshotTaken`, `hetznerServerDestroyed`). Provides the
+`cloudHost` capability. Mints two new global topics:
+`linuxCloudHostContract` and `snapshotAndBackupCadence`. Suggests
+companions `logging` and `errorHandling`.
+
+Ships six Node-only probes: `cloud-init-render-lint`,
+`manifest-schema-validate`, `hcloud-dry-run-mock` (three mocked; each
+paired with a mutation switch that flips the probe to FAIL), plus
+`real-account-throwaway-server-provision`,
+`real-account-cloud-init-hardened`,
+`real-account-snapshot-on-demand` (three account-bound; skipped
+without `CI_HAS_HETZNER_ACCOUNT`).
+
+Mints the shared `hetzner-throwaway-server` fixture under
+`packages/rcf-lite/test/fixtures/` (round-7 T-2 and T-3 EXTEND it,
+they do not ship a second copy).
+
+Trace: hetzner-round-7-spec-2026-09-07.md section 5.1;
+Baz ruling 2026-09-07 09:50Z (decisions 18 through 24 approved as
+recommended, "round 7 - agreee to all").

package/blueprints/deploy-hetzner-server/README.md

@@ -0,0 +1,202 @@
+# deploy-hetzner-server v1.0.0
+
+Ship a Hetzner Cloud Linux VM as the project's `cloudHost`. A facade
+over `hcloud` (or the raw Hetzner Cloud REST API) that provisions a
+server from a git-managed manifest, lands a six-block hardening
+baseline via cloud-init, applies a documented firewall shape, and
+emits four metadata-only lifecycle events on the injected sink.
+
+- Category: `deploy` (sibling of `deploy-cloudflare-workers`; the deploy
+  family enforces one target per project at apply time).
+- Capabilities provided: `cloudHost`.
+- Suggested companions: `logging`, `errorHandling`.
+- New global topics minted: `linuxCloudHostContract`,
+  `snapshotAndBackupCadence`.
+
+## What the blueprint contracts
+
+Six REQs realise the shape:
+
+| REQ | What it commits |
+|---|---|
+| REQ-001 | The provisioner facade is the sole reader of `HETZNER_ACCOUNT_API_KEY` and emits `provisionerReady` with `{tool, apiHost}` on boot. |
+| REQ-002 | Server declarations live at `hetzner/servers/<name>.json` and validate against the shipped JSON Schema (nine required fields). |
+| REQ-003 | The cloud-init template renders YAML that lands the six hardening baseline blocks on every provisioned server. |
+| REQ-004 | Firewall rule shape: 22 from operator-nominated prefixes, 80 and 443 open, all other inbound denied. Applied at provision time. |
+| REQ-005 | Snapshot cadence elicited (weekly default, daily and off alternatives). A snapshot-on-demand verb fires a tagged snapshot. |
+| REQ-006 | Four lifecycle events fire with metadata-only payloads; no event body carries the token, an ssh private key, or the user-data body. |
+
+Nine USs (37101 through 37109) split those REQs into one user story
+per shape plus three cross-cutting cases: manifest-applies,
+cloud-init-hardened, snapshot-on-demand.
+
+Four TACs anchor the mechanism: `TAC-3801` provisioner, `TAC-3802`
+manifest schema, `TAC-3803` cloud-init template, `TAC-3804` firewall
+shape.
+
+Four ADRs record the load-bearing decisions:
+
+- `ADR-3801` cloud host contract (scope global, new topic
+  `linuxCloudHostContract`).
+- `ADR-3802` snapshot cadence (scope global, new topic
+  `snapshotAndBackupCadence`); weekly default; Hetzner-managed backups
+  are an elicited paid opt-in at approximately 20 percent of monthly
+  server price per
+  https://docs.hetzner.com/cloud/servers/backups-snapshots/overview.
+- `ADR-3803` provisioning tool: `hcloud` default, `raw-api`
+  alternative, Terraform rejected on second toolchain and state file
+  grounds per Baz ruling 2026-09-07.
+- `ADR-3804` hardening baseline: the six blocks named below.
+
+## Two provisioner paths: hcloud and raw-api
+
+The `provisioningTool` elicit takes `hcloud` (default) or `raw-api`.
+Both paths sit behind the same facade so consumer code never diverges.
+
+- `hcloud` shells to the Hetzner Cloud CLI with `--output json` for
+  every verb. Small, self-documenting, dependency-free (the operator
+  installs the binary once). Vendor doc:
+  https://github.com/hetznercloud/cli.
+- `raw-api` fetches the Hetzner Cloud REST API directly. Useful when
+  the target host or CI runner cannot install a binary. Vendor doc:
+  https://docs.hetzner.cloud/.
+
+## Hardening baseline (per ADR-3804)
+
+Every rendered cloud-init lands these six blocks. The render-lint
+probe asserts each block appears in the YAML; the
+`SIMULATE_HARDENING_DRIFT` mutation removes a block and the probe
+FAILS naming the missing line.
+
+1. SSH key-only. `PasswordAuthentication no` via
+   `/etc/ssh/sshd_config.d/hardening.conf`.
+2. Root disabled. `PermitRootLogin no` in the same file.
+3. UFW default-deny incoming with 22, 80, 443 permitted per the
+   manifest firewall shape.
+4. DOCKER-USER iptables chain wired to drop non-conforming egress
+   (loaded on boot via `iptables-persistent`).
+5. fail2ban SSH jail on port 22.
+6. `unattended-upgrades` on for security updates per
+   https://wiki.debian.org/UnattendedUpgrades.
+
+## Elicited parameters
+
+| Elicit | Choices | Default |
+|---|---|---|
+| `provisioning-tool` | `hcloud`, `raw-api` | `hcloud` (ADR-3803) |
+| `server-type` | `cx23`, `cx33`, `cx43`, `cpx11`..`cpx41`, `cax11`..`cax31` | `cx23` |
+| `location` | `fsn1`, `nbg1`, `hel1`, `ash`, `hil` | `fsn1` (Baz ruling 2026-09-07 09:50Z) |
+| `image` | any Hetzner image slug | `ubuntu-24.04` |
+| `ssh-source-prefixes` | CSV of CIDR ranges | `203.0.113.0/24` (example only; supply the real prefix set) |
+| `firewall-id` | existing firewall id or empty | empty (create from `firewallRules`) |
+| `snapshot-cadence` | `weekly`, `daily`, `off` | `weekly` (ADR-3802) |
+| `hetzner-managed-backups` | `true`, `false` | `false` (ADR-3802) |
+
+ssh-key ids are delegated to `security-secrets-management`; the
+manifest carries a nonempty array of key references (names) and the
+facade never sees the private material.
+
+## Companions
+
+- `logging` supplies the sink factory for the four lifecycle events.
+- `errorHandling` supplies the internal-error record factory and the
+  facade boundary that turns hcloud non-zero exits, rate-limited API
+  calls, firewall-apply failures and cloud-init timeouts into typed
+  records.
+
+## The six probes and how to run them
+
+Every probe lives at `contributions/probes/<name>.mjs` with a
+`run-<name>.mjs` shim, and is exercised through a fixture-side
+`run-<name>.mjs` under
+`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/`.
+
+- Three mocked probes run in-process without an API call:
+  - `cloud-init-render-lint` (AC-37104-1): renders the template
+    against the fixture manifest and asserts the six baseline blocks
+    appear. Mutation switch: `SIMULATE_HARDENING_DRIFT=true`.
+  - `manifest-schema-validate` (AC-37102-1, also AC-37106-1 and
+    AC-37107-1): validates every fixture manifest. Mutation switch:
+    `SIMULATE_MANIFEST_INVALID=true`.
+  - `hcloud-dry-run-mock` (AC-37101-1 and AC-37109-1): drives the
+    facade lifecycle against a mocked hcloud shim and asserts every
+    lifecycle event fires with a metadata-only payload; runs an
+    event-secrecy scan across every event body. Mutation switches:
+    `SIMULATE_JSON_PARSE_STRIP=true` (parser failure) and
+    `SIMULATE_EVENT_SECRECY_LEAK=true` (defensive-fake token leak).
+- Three account-bound probes gate on `CI_HAS_HETZNER_ACCOUNT`:
+  - `real-account-throwaway-server-provision` (AC-37103-1): applies
+    the ci-throwaway manifest, asserts the server appears in
+    `hcloud server list`, tears down in `always()`.
+  - `real-account-cloud-init-hardened` (AC-37105-1): waits for
+    `cloud-init status --wait`, runs six ssh baseline checks.
+  - `real-account-snapshot-on-demand` (AC-37108-1): fires the snapshot
+    verb, asserts a tagged snapshot appears in `hcloud image list`.
+
+Without `CI_HAS_HETZNER_ACCOUNT=true` the three account-bound probes
+record `accountBoundSkipped: true` and the aggregate flips to pass per
+hetzner-round-7-spec-2026-09-07.md section 3.5.
+
+Reviewer boot from the fixture directory (mocked path, no account):
+
+```
+cd packages/rcf-lite/test/fixtures/hetzner-throwaway-server
+node ./run-cloud-init-render-lint.mjs && node ./run-manifest-schema-validate.mjs && node ./run-hcloud-dry-run-mock.mjs
+```
+
+Every probe writes its report envelope to
+`.rcf/reports/blueprints/deploy-hetzner-server/<probe-name>.json`.
+
+## Shared throwaway-server fixture
+
+The one new pattern this round. Lives at
+`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/`; ships
+`provision.mjs`, `destroy.mjs`, `sweep-orphans.mjs`, the mocked hcloud
+shim and the manifest at `hetzner/servers/ci-throwaway.json`. T-2
+(`platform-docker-compose-host`) and T-3 (`edge-cloudflare-tunnel`)
+EXTEND the fixture rather than shipping a second copy. Cost ceiling:
+one `cx23` at approximately EUR 0.006/hour per run; destroy runs in
+`always()`; the nightly `sweep-orphans` cron collects any leak with a
+60-minute label-age cutoff and emits a `throwawayServerSweptCount`
+metric.
+
+## When to reach for this blueprint
+
+Reach for `deploy-hetzner-server` when the project needs a persistent
+Linux runtime: something a Cloudflare Worker cannot host (a
+long-running process, a container runtime, an outbound network
+adapter that needs a stable egress). Sibling `deploy-cloudflare-workers`
+still ships every V8-isolate workload the Workers runtime accepts;
+this blueprint is the Hetzner-line answer for the workloads Workers
+cannot host.
+
+## Consumers
+
+- ops-01 is the first HQ consumer (`w-2026-09-07-dave-004` migration).
+- Round-7 T-2 `platform-docker-compose-host` composes on
+  `capabilities: [cloudHost]`.
+- Round-7 T-3 `edge-cloudflare-tunnel` composes on `cloudHost` (via
+  the systemd unit shape) or on `containerHost` (via T-2).
+
+Blueprint acceptance never depends on the ops-01 migration.
+
+## Standards trace
+
+- Hetzner Cloud API: https://docs.hetzner.cloud/
+- Hetzner Cloud CLI: https://github.com/hetznercloud/cli
+- Hetzner Cloud servers overview: https://docs.hetzner.com/cloud/servers/overview
+- Hetzner Cloud firewalls overview: https://docs.hetzner.com/cloud/firewalls/overview/
+- Hetzner Cloud backups-and-snapshots overview:
+  https://docs.hetzner.com/cloud/servers/backups-snapshots/overview
+- Hetzner Cloud networks overview: https://docs.hetzner.com/cloud/networks/overview/
+- Hetzner community basic cloud-config tutorial:
+  https://community.hetzner.com/tutorials/basic-cloud-config
+- cloud-init documentation: https://cloudinit.readthedocs.io/en/latest/
+- Debian unattended-upgrades wiki: https://wiki.debian.org/UnattendedUpgrades
+
+## Rejected alternatives
+
+- Terraform. Adds a second toolchain and a state file that nobody in
+  the estate needs. Baz ruling 2026-09-07 09:50Z on decision 18.
+- A Load Balancer blueprint. Out of scope for round-7 T-1; may ship as
+  a follow-up if a second Hetzner consumer needs it.