rcf-lite 0.24.0 → 0.26.0

package/rcf/code-nodes/cn-522.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-522",
+  "path": "../../packages/rcf-lite/test/blueprint/platform-cloudflare-kv-anatomy.test.js",
+  "implementsAcIds": [
+    "AC-15001-1",
+    "AC-15001-2"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T12:22:47.694Z",
+  "updatedAt": "2026-09-08T12:22:47.694Z"
+}

package/rcf/code-nodes/cn-523.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-523",
+  "path": "../../packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-event-secrecy-shim.mjs",
+  "implementsAcIds": [
+    "AC-15401-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T12:23:45.054Z",
+  "updatedAt": "2026-09-08T12:23:45.054Z"
+}

package/rcf/code-nodes/cn-524.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-524",
+  "path": "../../blueprints/platform-cloudflare-durable-objects/blueprint.json",
+  "implementsAcIds": [
+    "AC-15101-1",
+    "AC-15101-2",
+    "AC-15401-3"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T13:01:58.227Z",
+  "updatedAt": "2026-09-08T13:01:58.227Z"
+}

package/rcf/code-nodes/cn-525.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-525",
+  "path": "../../blueprints/messaging-queue-cloudflare/blueprint.json",
+  "implementsAcIds": [
+    "AC-15201-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T13:01:58.602Z",
+  "updatedAt": "2026-09-08T13:01:58.602Z"
+}

package/rcf/code-nodes/cn-526.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-526",
+  "path": "../../blueprints/edge-cloudflare-tunnel/blueprint.json",
+  "implementsAcIds": [
+    "AC-15301-1",
+    "AC-15301-2",
+    "AC-15301-3"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T13:01:58.994Z",
+  "updatedAt": "2026-09-08T13:01:58.994Z"
+}

package/rcf/fbs/fbs-130.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T23:59:15.656Z",
+  "updatedAt": "2026-09-07T23:59:15.844Z",
+  "acIds": [
+    "AC-11001-1",
+    "AC-11101-1",
+    "AC-11102-1",
+    "AC-11201-1",
+    "AC-11202-1",
+    "AC-11301-1",
+    "AC-11401-1",
+    "AC-11402-1",
+    "AC-11501-1"
+  ],
+  "fbsId": "FBS-130",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 60,
+  "executionStatus": "notStarted",
+  "title": "T-1 deploy-hetzner-server v1.0.0: 6 REQs 9 USs 4 TACs 4 ADRs 6 Node-only probes; shared hetzner-throwaway-server fixture mint with provision/destroy/sweep-orphans and dry-run mock",
+  "summary": "HQ round-7 T-1: deploy-hetzner-server v1.0.0 blueprint on the shelf under blueprints/deploy-hetzner-server/ (23 contributions: 6 REQs, 9 USs, 4 TACs, 4 ADRs; inventory per hetzner-round-7-spec-2026-09-07 section 5.1). Mints the shared throwaway-Hetzner-server fixture at packages/rcf-lite/test/fixtures/hetzner-throwaway-server/ (provision.mjs, destroy.mjs, sweep-orphans.mjs, hcloud-mock shim, cloud-init renderer, provisioner-facade proto, hetzner/servers/ci-throwaway.json manifest, README) that T-2 and T-3 will extend. Six Node-only probes under blueprints/deploy-hetzner-server/contributions/probes/: cloud-init-render-lint (AC-11201-1; SIMULATE_HARDENING_DRIFT mutation), manifest-schema-validate (AC-11101-1, AC-11301-1, AC-11401-1; SIMULATE_MANIFEST_INVALID mutation), hcloud-dry-run-mock (AC-11001-1, AC-11501-1; JSON-parser-strip mutation plus event-secrecy leak mutation), real-account-throwaway-server-provision (AC-11102-1; accountBound), real-account-cloud-init-hardened (AC-11202-1; accountBound), real-account-snapshot-on-demand (AC-11402-1; accountBound). Blueprint README, guide, CHANGELOG, docs/topics.md; shelf-wide topics.md sweep adding the deploy-hetzner-server row across every prior blueprint; section 6a cloudHost row on packages/rcf-lite/docs/blueprint-authoring.md. New global topics minted: linuxCloudHostContract, snapshotAndBackupCadence. Repo chain: REQ-110..115, US-11001, 11101, 11102, 11201, 11202, 11301, 11401, 11402, 11501, TS-140 with nine TCs, FBS-130, CN-410, TAC-3801..3804, ADR-3801..3804 minted via rcf define create --id per HQ round-7 T-1 reserved-block ruling (REQ-110..119 / TS-140..149 / FBS-130..139 / CN-410..439). Base commit origin/main 150d9c6.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-140.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T01:45:31.629Z",
+  "updatedAt": "2026-09-08T01:45:31.816Z",
+  "acIds": [
+    "AC-12001-1",
+    "AC-12101-1",
+    "AC-12102-1",
+    "AC-12201-1",
+    "AC-12202-1",
+    "AC-12301-1",
+    "AC-12401-1",
+    "AC-12402-1",
+    "AC-12501-1"
+  ],
+  "fbsId": "FBS-140",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 61,
+  "executionStatus": "notStarted",
+  "title": "T-2 platform-docker-compose-host v1.0.0: 6 REQs 9 USs 4 TACs 4 ADRs 5 Node-only probes; extend shared hetzner-throwaway-server fixture with compose stack, Caddyfile, secret file mount and healthchecked service",
+  "summary": "HQ round-7 T-2: platform-docker-compose-host v1.0.0 blueprint on the shelf under blueprints/platform-docker-compose-host/ (23 contributions: 6 REQs, 9 USs, 4 TACs, 4 ADRs; inventory per hetzner-round-7-spec-2026-09-07 section 5.2). Extends the shared throwaway-Hetzner-server fixture minted by T-1 (packages/rcf-lite/test/fixtures/hetzner-throwaway-server/) with a compose stack (compose.yaml, caddy/Caddyfile, secrets/web-token file mount, src/serve.mjs healthchecked stub) plus five run-<probe>.mjs delegate shims. Five Node-only probes under blueprints/platform-docker-compose-host/contributions/probes/: compose-config-lint (AC-12201-1, AC-12301-1, AC-12501-1; SIMULATE_MISSING_HEALTHCHECK, SIMULATE_UNCLASSIFIED_RESTART, SIMULATE_UNCLASSIFIED_LOG_DRIVER, SIMULATE_EVENT_SECRECY_LEAK mutations), secrets-as-files-scan (AC-12101-1, AC-12102-1; SIMULATE_PLAINTEXT_SECRET mutation), caddyfile-validate (AC-12401-1; SIMULATE_INVALID_CADDYFILE mutation; runs the caddy:2 vendor container so a caddy binary on PATH is optional), real-account-minimal-stack-up (AC-12202-1; accountBound), real-account-reload-burst (AC-12402-1; accountBound). Blueprint README, guide, CHANGELOG, docs/topics.md; shelf-wide topics.md sweep adding the platform-docker-compose-host row across every prior blueprint; section 6a containerHost row on packages/rcf-lite/docs/blueprint-authoring.md. New global topic minted: containerHostContract. Repo chain: REQ-120..125, US-12001, 12101, 12102, 12201, 12202, 12301, 12401, 12402, 12501, TS-150 with nine TCs, FBS-140, CN-440, TAC-3901..3904, ADR-3901..3904 minted via rcf define create --id per HQ round-7 T-2 reserved-block ruling (REQ-120..129 / TS-150..159 / FBS-140..149 / CN-440..469). Base commit origin/main 30f7b77.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-150.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-08T03:25:02.808Z",
+  "updatedAt": "2026-09-08T03:25:02.808Z",
+  "acIds": [
+    "AC-13001-1",
+    "AC-13002-1",
+    "AC-13101-1",
+    "AC-13102-1",
+    "AC-13201-1",
+    "AC-13301-1",
+    "AC-13302-1",
+    "AC-13401-1"
+  ],
+  "fbsId": "FBS-150",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 62,
+  "executionStatus": "notStarted",
+  "title": "T-3 edge-cloudflare-tunnel v1.0.0: 5 REQs 8 USs 3 TACs 3 ADRs 5 Node-only probes; extend shared hetzner-throwaway-server fixture with cloudflared connector (compose-service and systemd-unit variants; access-gated and public-hostname sidecar modes)",
+  "summary": "HQ round-7 T-3: edge-cloudflare-tunnel v1.0.0 blueprint on the shelf under blueprints/edge-cloudflare-tunnel/ (five REQs, eight USs, three TACs, three ADRs; inventory per hetzner-round-7-spec-2026-09-07 section 5.3). Extends the shared throwaway-Hetzner-server fixture minted by T-1 and extended by T-2 (packages/rcf-lite/test/fixtures/hetzner-throwaway-server/) with a cloudflared connector in both runtime shapes (compose-service alongside the T-2 web and caddy services when containerHost is applied; systemd-unit for a bare cloudHost) and both hostname modes (access-gated when zeroTrustGate is applied; public-hostname when absent), all under cloudflared/{compose-service,systemd-unit}/{access-gated,public-hostname}/. Five Node-only probes under blueprints/edge-cloudflare-tunnel/contributions/probes/: manifest-schema-validate (AC-13101-1, AC-13201-1, AC-13401-1; fixture-side SIMULATE_MANIFEST_INVALID_TUNNEL_ID, SIMULATE_MANIFEST_CREDENTIALS_INLINE, SIMULATE_MANIFEST_MISSING_CATCHALL, SIMULATE_ORIGIN_PORT_OPEN, SIMULATE_EVENT_SECRECY_LEAK mutations), cloudflared-config-lint (AC-13102-1; SIMULATE_INGRESS_INVALID mutation; runs the cloudflare/cloudflared vendor container so a cloudflared binary on PATH is optional), aud-presence-check (AC-13301-1, AC-13302-1; SIMULATE_AUD_DROP mutation; runs on both fixture variants and asserts the sidecar-read shape flips), real-account-connector-healthy (AC-13002-1; accountBound on CI_HAS_CLOUDFLARE_ACCOUNT plus CI_HAS_HETZNER_ACCOUNT), real-account-tunnel-hostname-routes (AC-13102-1 (secondary), AC-13301-1 (Access-gated sub-case); accountBound; the Access-gated sub-case additionally reads CI_HAS_CLOUDFLARE_ACCESS per Q4 ratification). Blueprint README, guide, CHANGELOG, docs/topics.md; shelf-wide topics.md sweep adding the edge-cloudflare-tunnel row across every prior blueprint; section 6a tunnelBridge row on packages/rcf-lite/docs/blueprint-authoring.md. New global topic minted: edgeIngressBridge. Repo chain: REQ-130..134, US-13001, 13002, 13101, 13102, 13201, 13301, 13302, 13401, TS-160 with eight TCs, FBS-150, CN-470, TAC-4001..4003, ADR-4001..4003 minted via rcf define create --id per HQ round-7 T-3 reserved-block ruling (REQ-130..139 / TS-160..169 / FBS-150..159 / CN-470..499). Base commit origin/main 6b4df05.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-160.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-08T09:03:37.649Z",
+  "updatedAt": "2026-09-08T09:03:57.443Z",
+  "acIds": [
+    "AC-14001-1"
+  ],
+  "fbsId": "FBS-160",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 63,
+  "executionStatus": "notStarted",
+  "title": "Adapter object-storage-s3 v1.1.0 Hetzner Object Storage: minor bump adds hetznerObjectStorage provider; new hetzner-endpoint helper on the fixture side; new hetzner-object-storage-round-trip probe (accountBound gated on CI_HAS_HETZNER_OBJECT_STORAGE); MinIO round-5 T-2 probes and R2 smoke unchanged",
+  "summary": "HQ round-7 follow-up: object-storage-s3 v1.1.0 minor bump adding the Hetzner Object Storage provider value under the shipped S3-API facade contract (blueprints/object-storage-s3/, was 1.0.0). Delta contributions on the blueprint side (target 4): one blueprint REQ object-storage-s3-REQ-101 (Hetzner endpoint-shape contract), one blueprint US object-storage-s3-US-28110 with AC-28110-1 (labelled AC-hetznerObjectStorage-endpointRoundTrip), one blueprint TAC TAC-2904-object-storage-s3-hetzner-endpoint-helper, one blueprint ADR ADR-2905-object-storage-s3-hetzner-object-storage-provider with standardsTraceClause 'Hetzner Object Storage S3 compatibility documented endpoint shape'. Every existing v1.0.0 contribution id byte-identical (no renumber, no reshape). Extends the shared fixture packages/rcf-lite/test/fixtures/infra-s3-and-queue/ (no second fixture directory) with src/hetzner-endpoint.mjs (composes <bucket>.<location>.your-objectstorage.com from an elicited bucket and location per Hetzner storage overview fsn1/hel1/nbg1 codes) plus a fixture-side shim run-hetzner-object-storage-round-trip.mjs. New Node-only probe blueprints/object-storage-s3/contributions/probes/hetzner-object-storage-round-trip.mjs (accountBound true, gated on CI_HAS_HETZNER_OBJECT_STORAGE, records accountBoundSkipped when unset per spec section 3.5); mutation SIMULATE_HETZNER_ENDPOINT_MISSHAPEN true (fixture-side INPUT-side mutation) composes an invalid endpoint via the fixture shim and the probe FAILS naming the missing subdomain. The round-5 T-2 shipped probes (facade-round-trip, put-get-round-trip, presigned-url, multipart-upload, event-secrecy) and the R2 real-account smoke stay unchanged and continue to pass byte-identical on the extended fixture. Blueprint README extended with a Hetzner Object Storage sub-section under the provider-choice section; guide extended with a Hetzner sub-section; blueprint CHANGELOG gains a 1.1.0 entry; shelf-wide topics.md sweep updates the object-storage-s3 row from shipped v1.0.0 to shipped v1.1.0 across every blueprint's docs/topics.md per the round-6 admin-console 1.1.0 precedent (PR #169). rcf-lite package version does NOT bump for this follow-up (spec section 8). Repo chain: REQ-140, US-14001 with AC-14001-1, TS-170 with TC-170-hetzner-endpoint-round-trip-and-skipped-shape, FBS-160 (buildOrder 63), CN-500, plus blueprint REQ-101 and blueprint US-28110 as blueprint-owned deltas, minted via rcf define create --id per HQ round-7 follow-up reserved-block ruling 2026-09-08 (adapter block REQ-140..144 / TS-170..174 / FBS-160..164 / CN-500..509). Base commit origin/main 25ccece.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-165.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-08T10:52:49.604Z",
+  "updatedAt": "2026-09-08T10:52:49.604Z",
+  "summary": "H-1 patch train against deploy-hetzner-server (blueprint bump 1.0.0 to 1.0.1; every existing contribution id byte-identical) and the shared throwaway-Hetzner-server fixture at packages/rcf-lite/test/fixtures/hetzner-throwaway-server/. Defect list from projects/blueprint-library/reports/real-account-r7-2026-09-08/README.md CONCERNS: (1) provision.mjs reads camelCase off the hcloud JSON (publicNet.ipv4.ip, datacenter.location.name, serverType.name) but hcloud emits snake_case (public_net, server_type, datacenter.location.name); fix reads s.public_net.ipv4.ip, s.datacenter.location.name, s.server_type.name; (2) provision.mjs expects hetzner/servers/rendered/ci-throwaway.cloud-init.yaml that nothing writes; fix renders inline via src/cloud-init-renderer.mjs before hcloud server create fires; (3) renderer substitutes ssh key NAMES into ssh_authorized_keys; fix resolves each name to its public-key material via hcloud ssh-key describe <name> --output json and inlines the .publicKey text; (4) destroy.mjs and sweep-orphans.mjs pass --output json to delete verbs that reject the flag; fix drops it and the tolerant JSON parser accepts arrays; (5) src/snapshot-verb.mjs calls a non-existent hcloud image create-image; fix shells hcloud server create-image --type snapshot --description <label> <id> and recovers the created snapshot id via hcloud image list --type=snapshot --output json by matching the serverName label; (6) src/ssh-baseline-check.mjs runs ssh immediately after provisionThrowawayServer; fix polls port 22 open plus a trivial ssh true exec, bounded up to 6 minutes, before firing the six baseline checks; (7) the deploy user has no NOPASSWD sudo in the rendered user-data; fix adds a write_files sudoers.d fragment granting NOPASSWD to that user with mode 0440; (9) hetzner/servers/ci-throwaway.json hard-codes sshKeyIds ['rcf-lite-ci']; fix adds an env override RCF_LITE_CI_SSH_KEY_NAME resolved at provision time with the manifest value as default, documented in the fixture README. Defect (8) T-2 and T-3 stub drivers are OUT of scope (H-2 owns them). Also: hcloud-dry-run-mock and the two other T-1 mocked probes gain fixture-side SIMULATE_ switches that alter INPUT only, satisfying the mutation-purity gate row; the mock reads the same rendered cloud-init the real path consumes and asserts an ssh public-key line and a NOPASSWD directive for the deploy user. Report envelopes under .rcf/reports/blueprints/deploy-hetzner-server/ regenerated from the REAL run under Baz one-off approval 2026-09-08 (repo-relative paths only, no secrets). CHANGELOG 1.0.1 entry lists the fixes by defect number. Chain: HQ hardening block H-1 REQ-145..149 / TS-175..179 / FBS-165..169 / CN-510..519 per HQ chain-block ruling 2026-09-08. Base commit origin/main 231bc74.",
+  "acIds": [
+    "AC-14501-1"
+  ],
+  "fbsId": "FBS-165",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 64,
+  "executionStatus": "notStarted",
+  "title": "H-1 hardening: deploy-hetzner-server v1.0.0 to v1.0.1 patch train; fixes the nine defects the round-7 real-account gate run d-2026-09-08-010 found; makes the shared throwaway-server fixture consume the same rendered cloud-init the real path consumes",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-170.json

@@ -0,0 +1,16 @@
+{
+  "createdAt": "2026-09-08T12:22:31.659Z",
+  "updatedAt": "2026-09-08T14:04:50.163Z",
+  "acIds": [
+    "AC-15001-1",
+    "AC-15001-2"
+  ],
+  "fbsId": "FBS-170",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 65,
+  "executionStatus": "notStarted",
+  "title": "H-2 kv re-anchor and observability: five kv probes and README anchored to shipped AC-31xxx band; two previously-uncovered ACs gain runtime observables via facade-round-trip env.CACHE grep and event-secrecy whitelist scan; kv-anatomy test assertions moved with the re-anchor (addendum ruling 1)",
+  "summary": "H-2 kv re-anchor: renumber every anchorAcId in the five contributed kv probes (facade-round-trip, list-with-prefix, cache-aside-hit-then-miss, event-secrecy, real-account-eventual-consistency-smoke) and their header comments from AC-5xxx to the shipped AC-31xxx band; correct the kv README chain-slice pointer paragraph to name US-31101..US-31108; move kv-anatomy test assertions to the new AC-31xxx ids per dispatch addendum ruling 1; add a runtime env.CACHE-grep result on facade-round-trip covering AC-31102-1; add a whitelist-scan result on event-secrecy covering AC-31107-1; the real-account probe carries AC-31103-1 as its bound AC. Two ACs on this FBS: AC-15001-1 (no AC-5xxx string survives on the kv blueprint tree) and AC-15001-2 (every shipped kv AC appears as an anchor on a probe result with a runtime observable).",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-171.json

@@ -0,0 +1,16 @@
+{
+  "createdAt": "2026-09-08T12:22:32.025Z",
+  "updatedAt": "2026-09-08T14:04:49.784Z",
+  "acIds": [
+    "AC-15101-1",
+    "AC-15101-2"
+  ],
+  "fbsId": "FBS-171",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 66,
+  "executionStatus": "notStarted",
+  "title": "H-2 DO real storage round-trip driver and anchor coverage: real-account-storage-smoke replaces credential-readiness pass-stub with byte-equal put/get round-trip via deployed Worker (or wrangler-dev locally); five previously-unbound DO ACs bound as additional-result anchors on existing probes; DO anatomy test assertions extended for the new bindings",
+  "summary": "H-2 DO storage round-trip driver and anchor coverage: replace the credential-readiness pass-stub in blueprints/platform-cloudflare-durable-objects/contributions/probes/real-account-storage-smoke.mjs with a real HTTP round-trip driver against a deployed Worker route (byte-equal read-back on 1 KiB payload); local proof via the existing wrangler-seam.mjs against miniflare or wrangler dev. Bind the five previously-unbound DO ACs (AC-33106-1, AC-33108-1, AC-33109-1, AC-33110-1, AC-33111-1) as additional-result anchors on the wrangler-seam, storage-round-trip and concurrent-increment probes; add a new probe body inside existing capability only if no existing probe carries the observable honestly. Extend the DO anatomy test to assert the thirteen-AC coverage union. Move the DO probe-body SIMULATE_ branches (sole-reader-scan, storage-round-trip, websocket-hub-broadcast) into fixture-side h2-cf shim modules (Group B scope, tracked by AC-15401-1).",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-172.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-08T12:22:32.405Z",
+  "updatedAt": "2026-09-08T14:04:49.404Z",
+  "acIds": [
+    "AC-15201-1"
+  ],
+  "fbsId": "FBS-172",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 67,
+  "executionStatus": "notStarted",
+  "title": "H-2 queue real concurrency driver: real-account-concurrency-smoke publishes 500 messages against a live Queues binding on a deployed Worker and asserts concurrent processing up to the documented push-invocation cap; env-absent branch keeps pass-with-skip; queue anatomy test assertions extended",
+  "summary": "H-2 queue real concurrency driver: replace the accountBoundSkipped pass-stub in blueprints/messaging-queue-cloudflare/contributions/probes/real-account-concurrency-smoke.mjs with a real driver that publishes 500 messages through the producer facade wired to a live Queues binding on a deployed Worker (queue name and binding parameterised via env; canonical queue rcf-lite-ci-queue-smoke, HQ supplies values at gate time) and asserts concurrent processing up to the documented push-invocation cap (Cloudflare Queues limits URL). Local proof via miniflare or wrangler dev with local queue simulation. Env-absent branch keeps section 3.5 pass-with-skip. Re-verify the Cloudflare Queues limits URL 200 at merge time and log in the PR provenance. Extend the queue anatomy test to assert the real-account round-trip shape.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-173.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-08T12:22:32.784Z",
+  "updatedAt": "2026-09-08T14:04:49.011Z",
+  "acIds": [
+    "AC-15301-1",
+    "AC-15301-2",
+    "AC-15301-3"
+  ],
+  "fbsId": "FBS-173",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 68,
+  "executionStatus": "notStarted",
+  "title": "H-2 tunnel real drivers: connector-healthy runs cloudflared tunnel info against a throwaway hetzner server via T-1 fixture; hostname-routes drives undici + (with Access) two-identity JWT; manifest-schema-validate placeholder becomes fail-with-pointer; tunnel anatomy test assertions extended and the symbolic-anchor ruling recorded",
+  "summary": "H-2 tunnel real drivers: replace blueprints/edge-cloudflare-tunnel/contributions/probes/real-account-connector-healthy.mjs and real-account-tunnel-hostname-routes.mjs warn-on-env stubs with real drivers. connector-healthy provisions the throwaway hetzner server via the T-1 hetzner fixture surface (consumed as-is; hetzner-fixture defects are H-1 scope at HQ), brings a named cloudflared tunnel connector up, runs cloudflared tunnel info <name> through a cloudflared control shim, asserts healthy connector count is at least one, captures tunnelConnectorUp event. hostname-routes drives undici for the public-hostname sub-case and (when CI_HAS_CLOUDFLARE_ACCESS is set) a two-identity JWT sub-case (HQ note: Access is not enabled on the HQ account today, so at gate time the AUD sub-case stays pass-with-skip until HQ enables Access). manifest-schema-validate warn-on-missing-credentials-placeholder becomes fail with a fixture-setup pointer. Tunnel symbolic-anchor ruling (AC-tunnel-*) resolved and recorded in the PR body per brief C4.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-174.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-08T12:22:33.140Z",
+  "updatedAt": "2026-09-08T14:04:48.623Z",
+  "acIds": [
+    "AC-15401-1",
+    "AC-15401-2",
+    "AC-15401-3"
+  ],
+  "fbsId": "FBS-174",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 69,
+  "executionStatus": "notStarted",
+  "title": "H-2 cross-cutting probe hygiene: SIMULATE_ branches moved out of shipped probe bodies into fixture-side h2-cf-platform-probe-integrity shims across the four blueprints; committed fail envelope removed and shipped-code pass envelopes committed; probe comments name test doubles honestly; new h2-cf-platform-probe-integrity anatomy test asserts SIMULATE_ purity, envelope hygiene and marker honesty",
+  "summary": "H-2 cross-cutting probe hygiene: SIMULATE_ branches moved out of the shipped probe bodies on the four Cloudflare-platform blueprints (kv: cache-aside-hit-then-miss, event-secrecy; DO: sole-reader-scan, storage-round-trip, websocket-hub-broadcast) into fixture-side shim modules under packages/rcf-lite/test/fixtures/cf-platform/ and .../cf-edge/ whose file names carry the h2-cf-platform-probe-integrity slug prefix (short form h2-cf). Delete the committed fail envelope at .rcf/reports/blueprints/platform-cloudflare-kv/event-secrecy.json and commit a shipped-code pass envelope in its place; regenerate the other kv envelopes and commit shipped-code pass envelopes for the DO/queue/tunnel probes. Rework or adjudicate probe comments flagged by stage-1 marker rows (kv fake clock; DO fake state, fake WebSocket pair; DO probe-utils lines 73 and 75; kv not-yet elicit gating). Add a new h2-cf-platform-probe-integrity anatomy test at packages/rcf-lite/test/blueprint/h2-cf-platform-probe-integrity.test.js that greps the four probe trees for SIMULATE_ (must be zero), walks committed envelopes for fail/warn aggregateVerdict (must be zero), and asserts marker rewording.",
+  "dependsOnFbsIds": []
+}

package/rcf/requirements/req-110.json

@@ -0,0 +1,58 @@
+{
+  "createdAt": "2026-09-07T23:53:24.739Z",
+  "updatedAt": "2026-09-07T23:53:41.232Z",
+  "description": "The provisioner module wraps the hcloud CLI verbs (or the raw Hetzner Cloud API when provisioningTool=raw-api) and is the sole reader of the Hetzner API token via security-secrets-management. It opens on the applying project's boot path and emits a provisionerReady lifecycle event with metadata-only fields (tool, apiHost, sha of the shim). Chain: HQ round-7 T-1 reserved-block per HQ chain-block ruling 2026-09-07 (REQ-110..119 / TS-140..149 / FBS-130..139 / CN-410..439). Round-7 T-1 track of hetzner-round-7-spec-2026-09-07 section 5.1.",
+  "reqId": "REQ-110",
+  "prdId": "PRD-001",
+  "title": "T-1 deploy-hetzner-server v1.0.0 blueprint: provisioner is sole reader of the Hetzner API token, opens on boot, fires provisionerReady event with metadata-only payload",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "httpApi",
+      "auth"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T23:53:24.779Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "httpApi",
+        "match": "API"
+      },
+      {
+        "source": "title",
+        "shape": "auth",
+        "match": "token"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "API"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "api"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "API"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "token"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "api"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-111.json

@@ -0,0 +1,32 @@
+{
+  "createdAt": "2026-09-07T23:53:24.971Z",
+  "updatedAt": "2026-09-07T23:53:41.419Z",
+  "description": "The applying project holds its server declarations as JSON documents under hetzner/servers/<name>.json, one file per server, matching a shipped JSON Schema that names type, location, image, ssh-key ids, firewall id, network id, cloud-init user-data path and labels. Applying the provisioner reads each manifest and creates a matching live server; the hetznerServerProvisioned event carries id, primary IPv4, location and server-type. Chain: HQ round-7 T-1 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-1 track of hetzner-round-7-spec-2026-09-07 section 5.1.",
+  "reqId": "REQ-111",
+  "prdId": "PRD-001",
+  "title": "T-1 deploy-hetzner-server v1.0.0 blueprint: server manifest schema at hetzner/servers/*.json applies to a live Hetzner Cloud server",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "persistence"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T23:53:25.012Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "persistence",
+        "match": "schema"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "Schema"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-112.json

@@ -0,0 +1,42 @@
+{
+  "createdAt": "2026-09-07T23:53:25.205Z",
+  "updatedAt": "2026-09-07T23:53:41.612Z",
+  "description": "The cloud-init template shipped with the blueprint renders YAML that lands SSH key-only, root disabled, UFW default-deny incoming, DOCKER-USER iptables chain, fail2ban SSH jail and unattended-upgrades on every provisioned Hetzner server. A local render lint asserts the six baseline blocks are present in the rendered YAML before any provision runs. Chain: HQ round-7 T-1 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-1 track of hetzner-round-7-spec-2026-09-07 section 5.1.",
+  "reqId": "REQ-112",
+  "prdId": "PRD-001",
+  "title": "T-1 deploy-hetzner-server v1.0.0 blueprint: cloud-init hardening baseline lands the six documented lines on the provisioned server",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "webUi"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T23:53:25.246Z",
+    "signals": [
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "template"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "renders"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "render"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "rendered"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-113.json

@@ -0,0 +1,33 @@
+{
+  "createdAt": "2026-09-07T23:53:25.436Z",
+  "updatedAt": "2026-09-07T23:53:41.809Z",
+  "description": "The firewall rule set lives inside the server manifest and is applied to the server at provision time. Rules: 22 permitted only from an operator-nominated set of source-prefix ranges; 80/443 permitted from anywhere for the reverse proxy; all other inbound traffic denied. Manifest schema validation refuses on a rule set that opens 22 to 0.0.0.0/0 or drops the 80/443 rules. Chain: HQ round-7 T-1 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-1 track of hetzner-round-7-spec-2026-09-07 section 5.1.",
+  "reqId": "REQ-113",
+  "prdId": "PRD-001",
+  "title": "T-1 deploy-hetzner-server v1.0.0 blueprint: firewall shape restricts SSH to operator-nominated prefixes, permits 80/443, denies all else",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "httpApi",
+      "persistence"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T23:53:25.477Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "httpApi",
+        "match": "rest"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "schema"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-114.json

@@ -0,0 +1,20 @@
+{
+  "createdAt": "2026-09-07T23:53:25.669Z",
+  "updatedAt": "2026-09-07T23:53:41.996Z",
+  "description": "The applying project elicits a snapshot cadence per ADR-3802 (default weekly, alternatives daily and off). When non-off, the scheduled snapshot runner fires the hcloud snapshot verb and tags the snapshot with server name and wall-clock time; a snapshot-on-demand verb fires the same shape. The hetznerSnapshotTaken event carries snapshot id and wall-clock time. Chain: HQ round-7 T-1 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-1 track of hetzner-round-7-spec-2026-09-07 section 5.1.",
+  "reqId": "REQ-114",
+  "prdId": "PRD-001",
+  "title": "T-1 deploy-hetzner-server v1.0.0 blueprint: snapshot cadence elicited (weekly default, daily and off alternatives), snapshot-on-demand fires a tagged snapshot",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "none"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T23:53:25.710Z"
+  }
+}

package/rcf/requirements/req-115.json

@@ -0,0 +1,38 @@
+{
+  "createdAt": "2026-09-07T23:53:25.903Z",
+  "updatedAt": "2026-09-07T23:53:42.183Z",
+  "description": "The provisioner facade emits four lifecycle events: provisionerReady, hetznerServerProvisioned, hetznerSnapshotTaken and hetznerServerDestroyed. Payloads are metadata-only: id, primary IPv4, location, server-type, snapshot id, wall-clock time. An event-secrecy probe asserts no event body carries the API token, an ssh private key, or a plaintext secret; a mutation that leaks a token into an event body FAILS the probe with a defensive-fake finding. Chain: HQ round-7 T-1 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-1 track of hetzner-round-7-spec-2026-09-07 section 5.1.",
+  "reqId": "REQ-115",
+  "prdId": "PRD-001",
+  "title": "T-1 deploy-hetzner-server v1.0.0 blueprint: four lifecycle events fire with metadata-only payloads and no secret leak",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "httpApi",
+      "auth"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T23:53:25.943Z",
+    "signals": [
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "API"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "token"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "token"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-120.json

@@ -0,0 +1,20 @@
+{
+  "createdAt": "2026-09-08T01:39:09.362Z",
+  "updatedAt": "2026-09-08T01:39:28.241Z",
+  "description": "The applying project runs its containerised services from a single compose.yaml at the repo root. Each service is one container. Networks and volumes are declared with explicit names. Non-secret config lives in a .env file loaded by compose. The compose file is the single source of truth for the runtime topology; the container host reads it to bring the stack up and refuses on unclassified or malformed shape. Chain: HQ round-7 T-2 reserved-block per HQ chain-block ruling 2026-09-07 (REQ-120..129 / TS-150..159 / FBS-140..149 / CN-440..469). Round-7 T-2 track of hetzner-round-7-spec-2026-09-07 section 5.2.",
+  "reqId": "REQ-120",
+  "prdId": "PRD-001",
+  "title": "T-2 platform-docker-compose-host v1.0.0 blueprint: compose.yaml at repo root is the source of truth (service-per-container, named networks and volumes, .env for non-secret config)",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "none"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T01:39:09.405Z"
+  }
+}

package/rcf/requirements/req-121.json

@@ -0,0 +1,20 @@
+{
+  "createdAt": "2026-09-08T01:40:03.788Z",
+  "updatedAt": "2026-09-08T01:40:04.018Z",
+  "description": "Every secret used by any compose service is injected as a file mount under the compose secrets top-level key. The compose file contains no plaintext secret literal on any service argument, environment variable, or command clause (grep-refuse). When security-secrets-management is applied, the secret is sourced through that facade; when it is not, the guide names a documented file-based fallback path. The mounted secret file lands at mode 0o400 inside the container. Chain: HQ round-7 T-2 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-2 track of hetzner-round-7-spec-2026-09-07 section 5.2.",
+  "reqId": "REQ-121",
+  "prdId": "PRD-001",
+  "title": "T-2 platform-docker-compose-host: secrets as file mounts, no plaintext literal in compose (grep-refuse); references security-secrets-management when applied",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "none"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T01:40:03.831Z"
+  }
+}

package/rcf/requirements/req-122.json

@@ -0,0 +1,20 @@
+{
+  "createdAt": "2026-09-08T01:40:04.204Z",
+  "updatedAt": "2026-09-08T01:40:04.433Z",
+  "description": "Every service that terminates HTTP declares a healthcheck block. The compose file refuses at docker compose config time when any HTTP-terminating service is missing the block. The healthcheck defaults per service kind are elicited (http default, tcp and command alternatives). The stack is not considered up until every declared service reaches healthy inside the elicited timeout. Chain: HQ round-7 T-2 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-2 track of hetzner-round-7-spec-2026-09-07 section 5.2.",
+  "reqId": "REQ-122",
+  "prdId": "PRD-001",
+  "title": "T-2 platform-docker-compose-host: healthcheck contract on every HTTP-terminating service refuses at docker compose config on missing",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "none"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T01:40:04.247Z"
+  }
+}

package/rcf/requirements/req-123.json

@@ -0,0 +1,42 @@
+{
+  "createdAt": "2026-09-08T01:40:04.619Z",
+  "updatedAt": "2026-09-08T01:40:04.848Z",
+  "description": "Every service declares a restart policy. Long-running services declare restart: unless-stopped. Jobs (short-lived services that exit after completion) declare restart: on-failure. Any service that declares neither, or declares an unclassified value outside the two allowed policies, refuses at the compose-config-lint gate before docker compose up runs. Chain: HQ round-7 T-2 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-2 track of hetzner-round-7-spec-2026-09-07 section 5.2.",
+  "reqId": "REQ-123",
+  "prdId": "PRD-001",
+  "title": "T-2 platform-docker-compose-host: restart discipline (unless-stopped on long-running, on-failure on jobs); refuses at lint on unclassified",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "httpApi"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T01:40:04.662Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "httpApi",
+        "match": "rest"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "rest"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "rest"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "rest"
+      }
+    ]
+  }
+}