rcf-lite 0.24.0 → 0.26.0

package/blueprints/platform-docker-compose-host/contributions/requirements/platform-docker-compose-host-req-002.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "platform-docker-compose-host-REQ-002",
+  "prdId": "PRD-001",
+  "title": "Every secret is injected via a docker compose secrets file mount; the compose file carries no plaintext secret literal (grep-refuse); references security-secrets-management when applied",
+  "description": "Every secret referenced by any compose service is declared under the top-level secrets: key with a file: source, and the service references it through its service-level secrets: array so docker mounts the value at 0o400 inside the container. The compose file contains no plaintext secret literal on any argument, environment entry, or command clause (grep-refuse). When security-secrets-management is applied, the secret source path resolves through that facade; when it is not, the guide documents a file-based fallback path.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "rationale": "Ratified in the Hetzner round 7 spec (2026-09-07 section 5.2 REQ-002). Ships as v1.0.0 of platform-docker-compose-host.",
+  "tags": [
+    "blueprint:platform-docker-compose-host",
+    "capability:containerHost"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/requirements/platform-docker-compose-host-req-003.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "platform-docker-compose-host-REQ-003",
+  "prdId": "PRD-001",
+  "title": "Every HTTP-terminating compose service declares a healthcheck; docker compose config refuses on missing",
+  "description": "Every service under services: whose image terminates HTTP declares a healthcheck: block. The compose-config-lint refuses at docker compose config time on any HTTP-terminating service missing the block, naming the service. Healthcheck defaults per service kind are elicited (http default, tcp and command alternatives). The stack is not considered up until every declared service reaches healthy inside the elicited timeout.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "rationale": "Ratified in the Hetzner round 7 spec (2026-09-07 section 5.2 REQ-003). Ships as v1.0.0 of platform-docker-compose-host.",
+  "tags": [
+    "blueprint:platform-docker-compose-host",
+    "capability:containerHost"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/requirements/platform-docker-compose-host-req-004.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "platform-docker-compose-host-REQ-004",
+  "prdId": "PRD-001",
+  "title": "Restart discipline enforced at lint time: unless-stopped on long-running services, on-failure on jobs; unclassified value refuses",
+  "description": "Every service declares a restart policy. Long-running services declare restart: unless-stopped. Jobs (short-lived services that exit after completion) declare restart: on-failure. Any service that declares neither, or declares a value outside the two allowed policies, refuses at the compose-config-lint gate before docker compose up runs. The lint names the service and the offending value.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "rationale": "Ratified in the Hetzner round 7 spec (2026-09-07 section 5.2 REQ-004). Ships as v1.0.0 of platform-docker-compose-host.",
+  "tags": [
+    "blueprint:platform-docker-compose-host",
+    "capability:containerHost"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/requirements/platform-docker-compose-host-req-005.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "platform-docker-compose-host-REQ-005",
+  "prdId": "PRD-001",
+  "title": "Zero-downtime reverse-proxy reload via bind-mounted config artefact; verb per proxy; no non-2xx or dropped connection inside the elicited window",
+  "description": "The reverse-proxy config file (caddy/Caddyfile when reverseProxy=caddy, traefik/traefik.yaml when reverseProxy=traefik) is a first-class checked-in artefact. The compose runtime bind-mounts the artefact read-only into the proxy service. The reload verb is docker compose exec caddy caddy reload for Caddy, or the documented Traefik equivalent. During the elicited reload window (10 s default) a client burst against the proxy sees no non-2xx and no dropped connection.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "rationale": "Ratified in the Hetzner round 7 spec (2026-09-07 section 5.2 REQ-005). Ships as v1.0.0 of platform-docker-compose-host.",
+  "tags": [
+    "blueprint:platform-docker-compose-host",
+    "capability:containerHost"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/requirements/platform-docker-compose-host-req-006.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "platform-docker-compose-host-REQ-006",
+  "prdId": "PRD-001",
+  "title": "Log shipping to the elicited observability-logging sink: journald default matching Debian 12 and Ubuntu 24.04 baseline; loki opt-in when the project runs Grafana",
+  "description": "Every container writes stdout and stderr through the elicited log driver. Journald is the shipped default matching the Debian 12 and Ubuntu 24.04 baselines T-1 cloud-init sets up. Loki is the opt-in alternative when the applying project runs Grafana. When observability-logging is applied, the compose file wires the elicited driver to that companion. The compose-config-lint asserts every service declares a logging driver whose value is one of journald or loki.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "rationale": "Ratified in the Hetzner round 7 spec (2026-09-07 section 5.2 REQ-006). Ships as v1.0.0 of platform-docker-compose-host.",
+  "tags": [
+    "blueprint:platform-docker-compose-host",
+    "capability:containerHost"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/tacs/tac-3901-platform-docker-compose-host-compose-layout.json

@@ -0,0 +1,26 @@
+{
+  "tacId": "TAC-3901-platform-docker-compose-host-compose-layout",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Platform-docker-compose-host compose layout",
+  "purpose": "The applying project ships one compose.yaml at the repo root whose services key names every container the stack runs. Every entry is one image running one container; networks and volumes are top-level named entries; a colocated .env carries non-secret configuration values (never inline). The container host reads compose.yaml as the runtime topology source and refuses to bring the stack up on layout drift.",
+  "responsibilities": [
+    "Serve compose.yaml at the repo root as the sole topology surface (AC-composeHost-topologyValid, AC-composeHost-upClean).",
+    "Guarantee service-per-container: each entry under services: runs one image (AC-composeHost-topologyValid).",
+    "Declare all networks and volumes as top-level named entries: no bare defaults (AC-composeHost-topologyValid).",
+    "Bind non-secret configuration through a colocated .env: no inline literals (AC-composeHost-topologyValid)."
+  ],
+  "internalStructure": "One module exporting a compose.yaml discovery helper that resolves the applied fixture root and returns the parsed document; consumers scan services/networks/volumes/env-file/logging by walking the parsed document.",
+  "interfaces": [
+    {
+      "name": "default export",
+      "kind": "facade",
+      "summary": "Compose stack scan facade exported from the applied fixture module."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/tacs/tac-3902-platform-docker-compose-host-secrets-mount.json

@@ -0,0 +1,26 @@
+{
+  "tacId": "TAC-3902-platform-docker-compose-host-secrets-mount",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Platform-docker-compose-host secrets mount",
+  "purpose": "The compose file declares each secret under its top-level secrets: key with a file: source. Services reference secrets through their service-level secrets: array so docker mounts them as files at 0o400 inside the container. When security-secrets-management is applied, the source path resolves through that facade; when it is not, the guide names a file-based fallback. No plaintext secret literal appears anywhere in compose.yaml or a referenced service config (grep-refuse).",
+  "responsibilities": [
+    "Declare every secret through a compose secrets: file mount (AC-composeHost-secretShape, AC-composeHost-secretsAreFiles).",
+    "Refuse a plaintext secret literal anywhere in compose.yaml (AC-composeHost-secretsAreFiles).",
+    "Mount each secret file at 0o400 inside the container (AC-composeHost-secretShape).",
+    "Bind to security-secrets-management when applied; document the file-based fallback (AC-composeHost-secretShape)."
+  ],
+  "internalStructure": "The secrets-as-files-scan probe module walks the parsed compose document plus the referenced service config files and asserts the secret shape; the mutation switch drives the failure path.",
+  "interfaces": [
+    {
+      "name": "default export",
+      "kind": "facade",
+      "summary": "Compose stack scan facade exported from the applied fixture module."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/tacs/tac-3903-platform-docker-compose-host-healthcheck-lint.json

@@ -0,0 +1,26 @@
+{
+  "tacId": "TAC-3903-platform-docker-compose-host-healthcheck-lint",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Platform-docker-compose-host healthcheck and lifecycle lint",
+  "purpose": "A lint pass runs before docker compose up. It asserts every HTTP-terminating service declares a healthcheck: block; every service declares a restart: policy whose value is one of unless-stopped or on-failure; every service declares a logging: driver: entry whose value is one of journald or loki. The lint refuses on any missing or unclassified line, naming the service and the offending field.",
+  "responsibilities": [
+    "Assert every HTTP-terminating service declares a healthcheck: block (AC-composeHost-healthcheckLint).",
+    "Assert every service declares a restart policy in the allowed set (AC-composeHost-restartClassification).",
+    "Assert every service declares a logging driver in the allowed set (AC-composeHost-logDriverClassification).",
+    "Refuse on missing or unclassified fields, naming the service (AC-composeHost-healthcheckLint, AC-composeHost-restartClassification, AC-composeHost-logDriverClassification)."
+  ],
+  "internalStructure": "The compose-config-lint probe module orchestrates docker compose config, healthcheck presence, restart classification and logging driver classification through one parsed compose document; mutation switches drive the four failure paths.",
+  "interfaces": [
+    {
+      "name": "default export",
+      "kind": "facade",
+      "summary": "Compose stack scan facade exported from the applied fixture module."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/tacs/tac-3904-platform-docker-compose-host-reverse-proxy-artefact.json

@@ -0,0 +1,26 @@
+{
+  "tacId": "TAC-3904-platform-docker-compose-host-reverse-proxy-artefact",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Platform-docker-compose-host reverse-proxy artefact",
+  "purpose": "The reverse-proxy config file (caddy/Caddyfile when reverseProxy=caddy, traefik/traefik.yaml when reverseProxy=traefik) lives as a first-class checked-in artefact under the applying repo. The compose file bind-mounts the artefact read-only into the proxy service. The gate runs the vendor validator against the artefact and refuses on an invalid directive. Under the reload verb (docker compose exec caddy caddy reload or the Traefik equivalent), a burst against the proxy inside the elicited window sees no non-2xx and no dropped connection.",
+  "responsibilities": [
+    "Ship the reverse-proxy config as a checked-in artefact bind-mounted into the proxy (AC-composeHost-reverseProxyArtefactValid).",
+    "Validate the artefact with the vendor validator at gate time (AC-composeHost-reverseProxyArtefactValid).",
+    "Prove zero-downtime reload with a real-account burst (AC-composeHost-zeroDowntimeReload).",
+    "Name the reload verb per proxy in the guide and the fixture README (AC-composeHost-reverseProxyArtefactValid, AC-composeHost-zeroDowntimeReload)."
+  ],
+  "internalStructure": "The caddyfile-validate probe shells to caddy validate (local binary or caddy:2 container image) with SIMULATE_INVALID_CADDYFILE writing a broken directive into a scratch copy; the real-account-reload-burst probe drives an undici burst on the throwaway server while docker compose exec caddy caddy reload runs.",
+  "interfaces": [
+    {
+      "name": "default export",
+      "kind": "facade",
+      "summary": "Compose stack scan facade exported from the applied fixture module."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38101.json

@@ -0,0 +1,24 @@
+{
+  "usId": "platform-docker-compose-host-US-38101",
+  "prdId": "PRD-001",
+  "reqId": "platform-docker-compose-host-REQ-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "compose.yaml at repo root is the single-source runtime topology (service-per-container, named networks and volumes, .env for non-secret config)",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint on a project that runs its stack on a Hetzner cloudHost",
+  "iWant": "a single compose.yaml at the repo root to declare every service as one container with explicit named networks, named volumes, and non-secret config in a .env file",
+  "soThat": "the runtime topology has one auditable seam and the container host can bring the stack up from the file alone",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-composeHost-topologyValid",
+      "description": "The applied compose.yaml at the repo root declares (a) every entry under services: as exactly one image running one container, (b) at least one named network under top-level networks:, (c) at least one named volume under top-level volumes:, and (d) non-secret configuration values are loaded from a colocated .env file rather than inlined as service environment entries.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3901-platform-docker-compose-host-compose-layout"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38102.json

@@ -0,0 +1,24 @@
+{
+  "usId": "platform-docker-compose-host-US-38102",
+  "prdId": "PRD-001",
+  "reqId": "platform-docker-compose-host-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "secrets flow via docker compose secrets file mounts, no plaintext literal in compose.yaml",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint on a project with secret material bound to a container",
+  "iWant": "every secret to be declared under the compose secrets top-level key and mounted into the service via secrets: rather than inlined as an environment literal",
+  "soThat": "the compose file is safe to read at review time and the mounted file inherits 0o400 inside the container",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-composeHost-secretShape",
+      "description": "The applied compose.yaml declares at least one secret under the top-level secrets: key with a file: source and references it from the consuming service through the service-level secrets: array. The mounted secret file lands at mode 0o400 inside the container.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3902-platform-docker-compose-host-secrets-mount"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38103.json

@@ -0,0 +1,24 @@
+{
+  "usId": "platform-docker-compose-host-US-38103",
+  "prdId": "PRD-001",
+  "reqId": "platform-docker-compose-host-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "the secrets-as-files probe refuses any plaintext secret literal in compose.yaml or a referenced service config",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint on a project with sensitive material",
+  "iWant": "the secrets-as-files probe to walk compose.yaml and every referenced service config in the fixture and refuse on any plaintext secret literal, naming the file and line",
+  "soThat": "a secret accidentally inlined in a review is caught by the probe before docker compose up runs",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-composeHost-secretsAreFiles",
+      "description": "The secrets-as-files-scan probe walks compose.yaml plus every referenced service config file in the applied fixture and asserts (a) no line contains the applied plaintext token pattern (literal name plus literal value), (b) every declared secret in the compose secrets: key has a file: source, and (c) SIMULATE_PLAINTEXT_SECRET=true writes a plaintext literal into compose.yaml and the probe FAILS naming the file and the literal.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3902-platform-docker-compose-host-secrets-mount"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38104.json

@@ -0,0 +1,24 @@
+{
+  "usId": "platform-docker-compose-host-US-38104",
+  "prdId": "PRD-001",
+  "reqId": "platform-docker-compose-host-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "healthcheck contract enforced by docker compose config: refuses on any HTTP-terminating service missing a healthcheck block",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint on a project that terminates HTTP inside a container",
+  "iWant": "the compose-config-lint to refuse at gate time on any HTTP-terminating service that is missing a healthcheck block, naming the service",
+  "soThat": "the stack never comes up with a service the container host cannot know is ready",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-composeHost-healthcheckLint",
+      "description": "The compose-config-lint probe shells to docker compose config against the applied compose.yaml, asserts exit 0, and additionally asserts every HTTP-terminating service declares a healthcheck: block. SIMULATE_MISSING_HEALTHCHECK=true strips the block from the web service and the probe FAILS naming the service.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3903-platform-docker-compose-host-healthcheck-lint"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38105.json

@@ -0,0 +1,25 @@
+{
+  "usId": "platform-docker-compose-host-US-38105",
+  "prdId": "PRD-001",
+  "reqId": "platform-docker-compose-host-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "the minimal stack comes up clean and every declared service reaches healthy on the throwaway server",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint on a Hetzner cloudHost",
+  "iWant": "the real-account minimal-stack-up probe to scp the compose.yaml to the throwaway server, run docker compose up -d --wait, and assert every declared service reaches healthy inside the elicited timeout",
+  "soThat": "the composeStackReady claim is proven on real docker before the blueprint ships",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-composeHost-upClean",
+      "description": "The real-account-minimal-stack-up probe, when CI_HAS_HETZNER_ACCOUNT is set, scps the compose.yaml to the throwaway server, runs docker compose up -d --wait, asserts every declared service reaches healthy inside the elicited timeout, and tears the stack plus the server down in always(). Without CI_HAS_HETZNER_ACCOUNT the probe records accountBoundSkipped: true and the aggregate flips to pass.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3901-platform-docker-compose-host-compose-layout",
+    "TAC-3903-platform-docker-compose-host-healthcheck-lint"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38106.json

@@ -0,0 +1,24 @@
+{
+  "usId": "platform-docker-compose-host-US-38106",
+  "prdId": "PRD-001",
+  "reqId": "platform-docker-compose-host-REQ-004",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "restart discipline enforced at lint: unless-stopped or on-failure only",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint",
+  "iWant": "the compose-config-lint to enforce a restart policy on every service and refuse on any value outside the two allowed policies (unless-stopped for long-running, on-failure for jobs)",
+  "soThat": "the operator sees a wrong or missing restart policy at gate time rather than as a stuck container",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-composeHost-restartClassification",
+      "description": "The compose-config-lint probe asserts every service in the compose.yaml declares a restart policy AND every declared value is one of unless-stopped or on-failure. SIMULATE_UNCLASSIFIED_RESTART=true sets restart: always on the web service and the probe FAILS naming the service and the disallowed value.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3903-platform-docker-compose-host-healthcheck-lint"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38107.json

@@ -0,0 +1,24 @@
+{
+  "usId": "platform-docker-compose-host-US-38107",
+  "prdId": "PRD-001",
+  "reqId": "platform-docker-compose-host-REQ-005",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "reverse-proxy config is a first-class versioned artefact validated by the vendor validator",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint with reverseProxy=caddy",
+  "iWant": "a checked-in caddy/Caddyfile bind-mounted into the proxy service so the reload verb picks up an operator change, validated at gate time by caddy validate",
+  "soThat": "a broken Caddyfile is caught before the reload burst runs, and there is one place in the tree the operator edits to route hostnames",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-composeHost-reverseProxyArtefactValid",
+      "description": "The applied fixture ships caddy/Caddyfile under a caddy/ directory, the compose file bind-mounts it read-only into the caddy service, and the caddyfile-validate probe shells to caddy validate against the file (using the caddy:2 container image when a local caddy binary is not on PATH) and asserts exit 0. SIMULATE_INVALID_CADDYFILE=true writes an invalid directive and the probe FAILS naming the line. Skipped when the applied reverseProxy is not caddy.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3904-platform-docker-compose-host-reverse-proxy-artefact"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38108.json

@@ -0,0 +1,24 @@
+{
+  "usId": "platform-docker-compose-host-US-38108",
+  "prdId": "PRD-001",
+  "reqId": "platform-docker-compose-host-REQ-005",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "zero-downtime reverse-proxy reload: a client burst inside the elicited window sees no non-2xx and no dropped connection",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint",
+  "iWant": "the real-account reload-burst probe to fire an undici burst against the reverse proxy while docker compose exec caddy caddy reload runs and assert no non-2xx or dropped connection inside the elicited window",
+  "soThat": "the zeroDowntimeReload claim is proven on real docker before the blueprint ships",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-composeHost-zeroDowntimeReload",
+      "description": "The real-account-reload-burst probe, when CI_HAS_HETZNER_ACCOUNT is set, runs undici GETs against the proxy service on the throwaway server while docker compose exec caddy caddy reload runs, asserts every request returns a 2xx status inside the elicited window (10 s default), asserts no dropped connection, and tears the stack down in always(). Without CI_HAS_HETZNER_ACCOUNT the probe records accountBoundSkipped: true and the aggregate flips to pass.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3904-platform-docker-compose-host-reverse-proxy-artefact"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38109.json

@@ -0,0 +1,24 @@
+{
+  "usId": "platform-docker-compose-host-US-38109",
+  "prdId": "PRD-001",
+  "reqId": "platform-docker-compose-host-REQ-006",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "log shipping to the elicited observability-logging sink: every service declares a logging driver in the allowed set",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint on a project that may run Grafana or the estate default",
+  "iWant": "the elicited log driver to be wired into every service in the compose file (journald default, loki opt-in) and the choice recorded on the log-driver ADR",
+  "soThat": "container stdout and stderr reach the applied observability sink without a per-service edit",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-composeHost-logDriverClassification",
+      "description": "Every service in the applied compose.yaml declares a logging: driver: block whose driver value matches the elicited log driver (default journald). The compose-config-lint probe asserts (a) every service declares logging: driver, (b) the value is one of journald or loki, and (c) SIMULATE_UNCLASSIFIED_LOG_DRIVER=true sets a disallowed driver and the probe FAILS naming the service and the disallowed value.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3903-platform-docker-compose-host-healthcheck-lint"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/docs/topics.md

@@ -0,0 +1,71 @@
+# platform-docker-compose-host blueprint coordination vocabulary
+
+This file is the platform-docker-compose-host half of the cross-blueprint contract. The Phase 1 conflict detector matches scope:global ADR topics by EXACT string equality, and AC ids are unnamespaced by the 0.4.4 grammar. Any blueprint intended to compose with this one must reuse these exact strings and respect these bands.
+
+## Global ADR topics this blueprint contributes (exact strings)
+
+| Topic string | platform-docker-compose-host contribution | Origin | Composition note |
+|---|---|---|---|
+| `containerHostContract` | ADR-3901-platform-docker-compose-host-contract | Minted by this blueprint. Names the wire-shape contract for the project-wide container-orchestration surface running on a `cloudHost`; the shipped answer is docker compose as source of truth (compose.yaml at repo root; healthchecks required; secrets as file mounts; restart discipline unless-stopped or on-failure; reverse-proxy config as a first-class checked-in artefact) per `https://docs.docker.com/reference/compose-file/` and `https://docs.docker.com/engine/install/ubuntu/`. | The one project-wide decision on how services are declared, wired and brought up on a container-orchestration surface. A future non-compose sibling (Docker Swarm, Nomad) would contribute the same topic string with a different mechanism, forcing a DELIBERATE conflict the operator resolves with a project-level ADR. |
+
+The platform-docker-compose-host blueprint claims one global topic (minted here, shipped as the docker compose file contract on a Linux `cloudHost`). ADR-3902 reverse-proxy elicit, ADR-3903 reject Coolify and ADR-3904 log-driver elicit do not contribute global topics; a composing blueprint that holds an opinion on either authors its own project-level ADR.
+
+Rules for new topics: lower camel case, one concept per topic, no version suffixes. A topic names the decision area, not the chosen answer.
+
+## Id number bands (registry bootstrap)
+
+This table is maintained shelf-wide across every blueprint's `docs/topics.md`. Rows are recorded at ship, never predicted.
+
+| Blueprint | US band | ADR/TAC suffix block | Status | Global topics |
+|---|---|---|---|---|
+| application-spa | 1101-1899 | 2xx | shipped v1.3.0 | `clientRouting`, `theming`, `clientState`, `errorEnvelope`, `authModel` |
+| application-api-rest | 2101-2899 | 3xx | shipped v1.0.0 | `errorEnvelope`, `authModel`, `apiVersioning`, `logging` |
+| security-auth-magic-link | 3101-3899 | 5xx | shipped v1.2.0 | `authModel` |
+| email-smtp-resend | 4101-4899 | 4xx | shipped v1.0.0 | none |
+| hello-panel (walkthrough exemplar) | 4101-4899 | 4xx | doc-reserved; teaching exemplar in `packages/rcf-lite/docs/blueprint-authoring-walkthrough.md`, not shipped as a blueprint directory | `operatorPanel` |
+| persistence-data-sqlite | 5101-5899 | 6xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| delivery-ci-workflows | 6101-6899 | 7xx | shipped v2.0.0 (renamed from ci-pipeline) | `ciGates`, `strictCoverageGate`, `releaseArtefacts` |
+| observability-essentials | 7101-7899 | 8xx | shipped v2.0.0 | `statusPageContract` |
+| security-secrets-management | 8101-8899 | 9xx | shipped v1.0.1 | `secretsSource` |
+| security-auth-clerk | 9101-9899 | 10xx | shipped v1.0.0 | `authModel` |
+| security-auth-oauth2 | 10101-10899 | 11xx | shipped v1.0.0 | `authModel` |
+| security-auth-keycloak | 11101-11899 | 12xx | shipped v1.0.0 | `authModel` |
+| deploy-cloudflare-workers | 12101-12899 | 13xx | shipped v1.2.0 | `deploymentTarget` |
+| persistence-data-d1 | 13101-13899 | 14xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| observability-probe-endpoints | 14101-14899 | 15xx | shipped v1.1.0 | `healthProbes`, `readinessSemantics` |
+| observability-logging | 15101-15899 | 16xx | shipped v1.0.0 | `logging` |
+| application-error-handling | 16101-16899 | 17xx | shipped v1.0.0 | `errorHandling` |
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
+
+US 38101-38109 sit at the LOW end of the 38101-38899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from a platform-docker-compose-host REQ id into the number 38109 would collide against the shipped US-38109; band headroom (38110-38899) leaves that space.
+
+Platform-docker-compose-host suffixes for this blueprint use the 3901-3904 block, continuing the widening pattern (deploy-hetzner-server 3801-3804 for the T-1 sibling).
+
+## Cross-references
+
+- `deploy-hetzner-server` (v1.0.0): consumed via `capabilities: [cloudHost]`; this blueprint composes on the Hetzner cloudHost T-1 provisions.
+- `security-secrets-management` (v1.0.1): the compose secrets file source resolves through the applied secrets facade when the secrets blueprint is applied; the guide names a file-based fallback path when it is not.
+- Round-7 T-3 `edge-cloudflare-tunnel`: composes on `capabilities: [containerHost]`; runs cloudflared as a compose service in this stack.
+- `observability-logging`: elicited log-driver wires the applied logging companion's endpoint (journald by default, loki opt-in).

package/blueprints/platform-docker-compose-host/guide/platform-docker-compose-host.md

@@ -0,0 +1,94 @@
+# Guide: platform-docker-compose-host v1.0.0
+
+Round-7 T-2 of the Hetzner spec at `projects/blueprint-library/specs/hetzner-round-7-spec-2026-09-07.md`. Applies on top of `deploy-hetzner-server` (or any future `cloudHost` provider) and mints `containerHost` for downstream consumers.
+
+## What this blueprint gives you
+
+A docker compose stack as your application runtime on a Linux VM. The compose file is the source of truth for the topology: services, networks, volumes, secrets, healthchecks, restart policy, log driver and the reverse-proxy bind-mount all live in one file at the repo root. Every claim the blueprint makes is provable at gate time by a Node-only probe against a real docker daemon and a real reverse-proxy config.
+
+## Layout
+
+```
+<repo-root>/
+  compose.yaml            # single-source topology per REQ-001
+  .env                    # non-secret config per REQ-001
+  caddy/
+    Caddyfile             # reverse-proxy artefact per REQ-005 (when reverseProxy=caddy)
+  secrets/
+    <name>                # file-mount source per REQ-002 (0o400 inside the container)
+  src/
+    ...                   # your service code, bind-mounted into services
+```
+
+## When to reach for Caddy vs Traefik vs none
+
+The `reverse-proxy` elicit is the one you will hit first. The defaults:
+
+- **`caddy` (default per Baz decision 19).** Matches the estate baseline (dev-01 and ops-01 both run Caddy). Small config file, automatic HTTPS in production, `docker compose exec caddy caddy reload` picks up changes instantly. Reach for it whenever you do not have a strong project-side reason for something else. See the Caddy docs at https://caddyserver.com/docs/.
+- **`traefik` (alternative).** Reach for it when your project wants docker-label auto-discovery (each service declares its hostname/route via labels in `compose.yaml` and Traefik configures itself). Trade-off: your routing is spread across many service blocks rather than one Caddyfile. See the Traefik docs at https://doc.traefik.io/traefik/.
+- **`none` (alternative).** Reach for it when the project is fronted only by the round-7 tunnel (`edge-cloudflare-tunnel` v1.0.0). The connector terminates at the CF edge and forwards to a service on the internal `web-net` network; no reverse proxy is needed inside compose. The lint refuses to add a `caddy/Caddyfile` when `reverse-proxy` is `none`.
+
+The Coolify note (ADR-3903 body): "reject; it shadows what the blueprints contract and adds its own DB and UI as a second source of state". Baz decision 20, verbatim. A `platform-coolify-host` sibling mints on operator demand later; it is not part of round 7.
+
+## Healthcheck contract
+
+Every HTTP-terminating service declares a `healthcheck:` block. The compose-config-lint probe refuses at `docker compose config` on any missing block, naming the service. Defaults per service kind are elicited:
+
+- `http` (default): a `wget --quiet --spider` against the service's `/health` (or `/live`) path.
+- `tcp`: a socket connect against the declared port.
+- `command`: a bespoke test string the operator supplies.
+
+The stack is not considered up until every declared service reaches healthy inside the elicited timeout; the real-account minimal-stack-up probe proves this on the throwaway server.
+
+## Secrets as files, never literals
+
+Under REQ-002 every secret referenced by any compose service is declared under the top-level `secrets:` key with a `file:` source. Services reference the secret through their service-level `secrets:` array so docker mounts the value at 0o400 inside the container at `/run/secrets/<name>`. The compose file carries no plaintext secret literal (grep-refuse).
+
+When `security-secrets-management` is applied, the source path resolves through that facade. When it is not, the file-based fallback path is: land the secret in `secrets/<name>` on the applying repo under a `.gitignore` line that lists the file, and rotate through the operator's out-of-band vault. Never commit the secret; never inline the value in `compose.yaml` or `.env`.
+
+## When to reach for `journald` vs `loki`
+
+The `log-driver` elicit (ADR-3904):
+
+- **`journald` (default).** Matches the Debian 12 and Ubuntu 24.04 baseline the T-1 cloud-init sets up on the throwaway server. `journalctl -u docker.service` and `journalctl CONTAINER_NAME=<name>` reach the same stream you would see in `docker logs`.
+- **`loki` (opt-in).** Reach for it when the applying project runs Grafana. The compose logging block wires each service through the Grafana Loki docker plugin; the observability-logging companion supplies the loki endpoint.
+
+The compose-config-lint refuses on any driver value outside the two. The lint fires before `docker compose up` runs.
+
+## Restart discipline
+
+Under REQ-004: `restart: unless-stopped` on long-running services, `restart: on-failure` on jobs (short-lived services that exit after completion). Any service that declares neither, or declares a value outside those two, refuses at the lint. `SIMULATE_UNCLASSIFIED_RESTART=true` on the compose-config-lint probe exercises the refusal path.
+
+## Zero-downtime reverse-proxy reload
+
+Under REQ-005 the reverse-proxy config lives as a first-class checked-in artefact under `caddy/Caddyfile` (or `traefik/traefik.yaml`). The compose file bind-mounts it read-only into the proxy service. The reload verb is:
+
+- `docker compose exec caddy caddy reload` for Caddy.
+- `docker compose kill -s USR1 traefik` for Traefik (the documented equivalent).
+
+During the elicited reload window (10 s default per `reload-window-seconds`) a client burst against the proxy sees no non-2xx and no dropped connection. The real-account reload-burst probe proves this on the throwaway server.
+
+## Running the probes
+
+From the shared throwaway-server fixture directory the three local probes run without a Hetzner account:
+
+```
+cd packages/rcf-lite/test/fixtures/hetzner-throwaway-server
+node ./run-compose-config-lint.mjs
+node ./run-secrets-as-files-scan.mjs
+node ./run-caddyfile-validate.mjs
+```
+
+`caddyfile-validate` reaches for a local `caddy` binary when one is on PATH; otherwise it runs `caddy validate` inside the `caddy:2` container via `docker run --rm`. Verify the image once with `docker run --rm caddy:2 caddy version`.
+
+Real-account probes require `CI_HAS_HETZNER_ACCOUNT=true` plus `HCLOUD_TOKEN`; without them each records `accountBoundSkipped: true` and the aggregate flips to `pass` per spec section 3.5.
+
+## Applying to your project
+
+Once T-1 (`deploy-hetzner-server`) has provisioned a `cloudHost`:
+
+```
+rcf apply platform-docker-compose-host
+```
+
+Answer the elicits (reverse-proxy, healthcheck-default-kind, log-driver, reload-window-seconds). The blueprint drops `compose.yaml`, `.env`, `caddy/Caddyfile` (when reverseProxy=caddy), the `secrets/` directory (empty, `.gitignored`) and the READMEs into your applying tree. Then `docker compose up -d --wait` on the applied host brings the stack up.