rcf-lite 0.24.0 → 0.26.0

package/blueprints/deploy-hetzner-server/blueprint.json

@@ -0,0 +1,233 @@
+{
+  "slug": "deploy-hetzner-server",
+  "version": "1.0.1",
+  "category": "deploy",
+  "capabilities": [
+    "cloudHost"
+  ],
+  "suggestedCompanions": [
+    {
+      "role": "logging",
+      "reason": "Every provisioner lifecycle event (provisionerReady, hetznerServerProvisioned, hetznerSnapshotTaken, hetznerServerDestroyed) writes through the applied logger; a logging companion supplies the factory."
+    },
+    {
+      "role": "errorHandling",
+      "reason": "An hcloud CLI non-zero exit, a rate-limited API call, a firewall-apply failure, a cloud-init timeout constructs an internal error record; an error-handling companion supplies the record factory and the boundary."
+    }
+  ],
+  "elicits": [
+    {
+      "id": "provisioning-tool",
+      "prompt": "Provisioning tool for Hetzner Cloud verbs: hcloud (default per ADR-3803, small self-documenting CLI with --output json) or raw-api (the provisioner fetches the Hetzner Cloud REST API directly, useful when the CI runner cannot install the binary).",
+      "kind": "enum",
+      "options": [
+        "hcloud",
+        "raw-api"
+      ],
+      "default": "hcloud"
+    },
+    {
+      "id": "server-type",
+      "prompt": "Hetzner Cloud shared-vCPU server type. cx23 is the cheapest shipped default; cx33 has more RAM and vCPU for a small compose stack.",
+      "kind": "enum",
+      "options": [
+        "cx23",
+        "cx33",
+        "cx43",
+        "cpx11",
+        "cpx21",
+        "cpx31",
+        "cpx41",
+        "cax11",
+        "cax21",
+        "cax31"
+      ],
+      "default": "cx23"
+    },
+    {
+      "id": "location",
+      "prompt": "Hetzner data centre. fsn1 (Falkenstein) is the shipped default per Baz ruling 2026-09-07 09:50Z on the Q2 ratification.",
+      "kind": "enum",
+      "options": [
+        "fsn1",
+        "nbg1",
+        "hel1",
+        "ash",
+        "hil"
+      ],
+      "default": "fsn1"
+    },
+    {
+      "id": "image",
+      "prompt": "Base image. ubuntu-24.04 is the shipped default; the six-block hardening baseline in the cloud-init template targets Debian and Ubuntu shapes.",
+      "kind": "string",
+      "default": "ubuntu-24.04"
+    },
+    {
+      "id": "ssh-source-prefixes",
+      "prompt": "Comma-separated CIDR list permitted on port 22 (operator-nominated set; the manifest schema refuses on 0.0.0.0/0). Populates firewallRules[ssh].sourceIps per TAC-3804.",
+      "kind": "string",
+      "default": "203.0.113.0/24"
+    },
+    {
+      "id": "firewall-id",
+      "prompt": "Reuse an existing Hetzner Cloud firewall id, or leave empty to have the provisioner create one from firewallRules.",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "snapshot-cadence",
+      "prompt": "Snapshot cadence per ADR-3802. weekly is the recommended default; daily has higher recovery-point objective and cost; off skips the scheduled snapshot runner.",
+      "kind": "enum",
+      "options": [
+        "weekly",
+        "daily",
+        "off"
+      ],
+      "default": "weekly"
+    },
+    {
+      "id": "hetzner-managed-backups",
+      "prompt": "Opt-in to Hetzner-managed backups (paid, approximately 20 percent of monthly server price per ADR-3802).",
+      "kind": "enum",
+      "options": [
+        "true",
+        "false"
+      ],
+      "default": "false"
+    }
+  ],
+  "contributions": [
+    {
+      "id": "deploy-hetzner-server-REQ-001",
+      "kind": "req",
+      "path": "requirements/deploy-hetzner-server-req-001.json"
+    },
+    {
+      "id": "deploy-hetzner-server-REQ-002",
+      "kind": "req",
+      "path": "requirements/deploy-hetzner-server-req-002.json"
+    },
+    {
+      "id": "deploy-hetzner-server-REQ-003",
+      "kind": "req",
+      "path": "requirements/deploy-hetzner-server-req-003.json"
+    },
+    {
+      "id": "deploy-hetzner-server-REQ-004",
+      "kind": "req",
+      "path": "requirements/deploy-hetzner-server-req-004.json"
+    },
+    {
+      "id": "deploy-hetzner-server-REQ-005",
+      "kind": "req",
+      "path": "requirements/deploy-hetzner-server-req-005.json"
+    },
+    {
+      "id": "deploy-hetzner-server-REQ-006",
+      "kind": "req",
+      "path": "requirements/deploy-hetzner-server-req-006.json"
+    },
+    {
+      "id": "deploy-hetzner-server-US-37101",
+      "kind": "us",
+      "path": "user-stories/deploy-hetzner-server-us-37101.json"
+    },
+    {
+      "id": "deploy-hetzner-server-US-37102",
+      "kind": "us",
+      "path": "user-stories/deploy-hetzner-server-us-37102.json"
+    },
+    {
+      "id": "deploy-hetzner-server-US-37103",
+      "kind": "us",
+      "path": "user-stories/deploy-hetzner-server-us-37103.json"
+    },
+    {
+      "id": "deploy-hetzner-server-US-37104",
+      "kind": "us",
+      "path": "user-stories/deploy-hetzner-server-us-37104.json"
+    },
+    {
+      "id": "deploy-hetzner-server-US-37105",
+      "kind": "us",
+      "path": "user-stories/deploy-hetzner-server-us-37105.json"
+    },
+    {
+      "id": "deploy-hetzner-server-US-37106",
+      "kind": "us",
+      "path": "user-stories/deploy-hetzner-server-us-37106.json"
+    },
+    {
+      "id": "deploy-hetzner-server-US-37107",
+      "kind": "us",
+      "path": "user-stories/deploy-hetzner-server-us-37107.json"
+    },
+    {
+      "id": "deploy-hetzner-server-US-37108",
+      "kind": "us",
+      "path": "user-stories/deploy-hetzner-server-us-37108.json"
+    },
+    {
+      "id": "deploy-hetzner-server-US-37109",
+      "kind": "us",
+      "path": "user-stories/deploy-hetzner-server-us-37109.json"
+    },
+    {
+      "id": "TAC-3801-deploy-hetzner-server-provisioner",
+      "kind": "tac",
+      "path": "tacs/tac-3801-deploy-hetzner-server-provisioner.json"
+    },
+    {
+      "id": "TAC-3802-deploy-hetzner-server-manifest-schema",
+      "kind": "tac",
+      "path": "tacs/tac-3802-deploy-hetzner-server-manifest-schema.json"
+    },
+    {
+      "id": "TAC-3803-deploy-hetzner-server-cloud-init-template",
+      "kind": "tac",
+      "path": "tacs/tac-3803-deploy-hetzner-server-cloud-init-template.json"
+    },
+    {
+      "id": "TAC-3804-deploy-hetzner-server-firewall-shape",
+      "kind": "tac",
+      "path": "tacs/tac-3804-deploy-hetzner-server-firewall-shape.json"
+    },
+    {
+      "id": "ADR-3801-deploy-hetzner-server-cloud-host-contract",
+      "kind": "adr",
+      "path": "adrs/adr-3801-deploy-hetzner-server-cloud-host-contract.json",
+      "scope": "global",
+      "topic": "linuxCloudHostContract",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "Hetzner Cloud API server resource and cloud-init user-data contract per hetzner-round-7-spec-2026-09-07.md"
+    },
+    {
+      "id": "ADR-3802-deploy-hetzner-server-snapshot-cadence",
+      "kind": "adr",
+      "path": "adrs/adr-3802-deploy-hetzner-server-snapshot-cadence.json",
+      "scope": "global",
+      "topic": "snapshotAndBackupCadence",
+      "recommendedDefault": true,
+      "elicited": true,
+      "standardsTraceClause": "Hetzner Cloud backups-and-snapshots documented pricing and mechanism per hetzner-round-7-spec-2026-09-07.md"
+    },
+    {
+      "id": "ADR-3803-deploy-hetzner-server-provisioning-tool",
+      "kind": "adr",
+      "path": "adrs/adr-3803-deploy-hetzner-server-provisioning-tool.json",
+      "recommendedDefault": true,
+      "elicited": true,
+      "standardsTraceClause": "Hetzner Cloud CLI documented resource verbs per hetzner-round-7-spec-2026-09-07.md"
+    },
+    {
+      "id": "ADR-3804-deploy-hetzner-server-hardening-baseline",
+      "kind": "adr",
+      "path": "adrs/adr-3804-deploy-hetzner-server-hardening-baseline.json",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "Debian unattended-upgrades wiki AND the estate baseline at operator/knowledge/systems/environments/hetzner-cloud/overview.md Security posture baseline per hetzner-round-7-spec-2026-09-07.md"
+    }
+  ]
+}

package/blueprints/deploy-hetzner-server/contributions/adrs/adr-3801-deploy-hetzner-server-cloud-host-contract.json

@@ -0,0 +1,14 @@
+{
+  "adrId": "ADR-3801-deploy-hetzner-server-cloud-host-contract",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Cloud host contract: Hetzner Cloud VM as the shipped cloudHost shape (scope global, new topic linuxCloudHostContract)",
+  "context": "An applying project needs a first-class Linux VM contract that container-orchestration and edge-ingress consumers (round-7 T-2 platform-docker-compose-host, T-3 edge-cloudflare-tunnel) can compose on. Hetzner Cloud servers plus cloud-init user-data provide the v1.0.0 shape per https://docs.hetzner.cloud/ and https://docs.hetzner.com/cloud/servers/overview. Every applied cloud host needs one project-wide answer to the linuxCloudHostContract topic; a future non-Hetzner sibling (Vultr, DigitalOcean, Fly.io) would contribute the same topic string with a different provider, forcing a DELIBERATE conflict the operator resolves per the round-2 conflict pattern.",
+  "decision": "The shipped v1.0.0 default is a Hetzner Cloud server as the linuxCloudHostContract provider. The provisioner reads its shape from the applying manifest at hetzner/servers/name.json (TAC-3802) and creates a matching live server via hcloud CLI verbs (ADR-3803) or the raw Hetzner Cloud API. The linuxCloudHostContract topic scope is global on this blueprint; the topic string is linuxCloudHostContract (lower camelCase, one concept per topic, no version suffix, per the round-2 rules-for-new-topics clause on the shelf registry). Standards trace clause: Hetzner Cloud API server resource and cloud-init user-data contract per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "Consumer blueprints that run on a Linux host declare capabilities: [cloudHost] on their applied contract; the round-7 T-2 platform-docker-compose-host reads this capability at apply-time. Rebuild-from-manifest is always possible: the manifest is the source of truth, the live server is derivative. Drift from the shipped manifest to the live server is out of scope for v1.0.0; a later minor may add a drift-audit runner.",
+  "alternativesConsidered": [],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/adrs/adr-3802-deploy-hetzner-server-snapshot-cadence.json

@@ -0,0 +1,14 @@
+{
+  "adrId": "ADR-3802-deploy-hetzner-server-snapshot-cadence",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Snapshot cadence: weekly default, daily and off alternatives, Hetzner-managed backups elicited (scope global, new topic snapshotAndBackupCadence)",
+  "context": "An applying project needs a discipline for how often the Hetzner Cloud server takes a snapshot and whether Hetzner-managed backups are enabled. Hetzner documents snapshots as manual on-demand actions kept on cloud storage, and Hetzner-managed backups as a paid subscription at approximately 20 percent of monthly server price per https://docs.hetzner.com/cloud/servers/backups-snapshots/overview. Every cloud host needs one project-wide answer to the snapshotAndBackupCadence topic; a future sibling snapshot mechanism would contribute the same topic string with a different answer and force a DELIBERATE conflict.",
+  "decision": "The shipped v1.0.0 default is weekly snapshot cadence fired by a scheduled snapshot runner in the applying project. Alternatives elicited: daily (higher recovery-point objective, higher storage cost) and off (no automatic snapshot). Hetzner-managed backups are an elicited paid opt-in (approximately 20 percent monthly per the vendor docs); when opted-in, the scheduled snapshot runner still fires so the two mechanisms compose. The snapshotAndBackupCadence topic scope is global on this blueprint. recommendedDefault: true. Standards trace clause: Hetzner Cloud backups-and-snapshots documented pricing and mechanism per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "Weekly snapshot on a cx23 costs approximately EUR 0.005 per month in extra storage; daily is approximately EUR 0.035; Hetzner-managed backups add approximately EUR 0.80 per month on a cx23. The scheduled snapshot runner emits hetznerSnapshotTaken with snapshot id and wall-clock time so the observability sink surfaces the cadence.",
+  "alternativesConsidered": [],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/adrs/adr-3803-deploy-hetzner-server-provisioning-tool.json

@@ -0,0 +1,20 @@
+{
+  "adrId": "ADR-3803-deploy-hetzner-server-provisioning-tool",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Provisioning tool: hcloud CLI default, raw Hetzner Cloud API alternative, Terraform rejected",
+  "context": "An applying project needs a documented answer to how the provisioner shells out to Hetzner Cloud. Options considered: hcloud CLI (small, self-documenting, JSON output on --output json, per https://github.com/hetznercloud/cli); the raw Hetzner Cloud REST API (no CLI dependency, useful when the target host cannot install a binary, per https://docs.hetzner.cloud/); Terraform (declarative, adds a second toolchain and a state file). Baz ruling 2026-09-07 09:50Z on decision 18 of the round-7 summary: hcloud not Terraform. Terraform adds a second toolchain and a state file that nobody in the estate needs.",
+  "decision": "The shipped v1.0.0 default is the hcloud CLI as the provisioning tool. Alternative elicited: raw-api (the provisioner fetches the Hetzner Cloud REST API directly). Terraform is a rejected alternative recorded in the blueprint README section 9 rejected-alternatives. elicited: true. recommendedDefault: hcloud. Standards trace clause: Hetzner Cloud CLI documented resource verbs per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "The applying project installs the hcloud binary on the operator laptop and every CI runner that provisions. The raw-api fork sits behind the same provisioner facade so no consumer code diverges. The provisioner-facade sole-reader guarantee holds on both paths.",
+  "alternativesConsidered": [
+    {
+      "id": "terraform",
+      "summary": "Terraform declaring the Hetzner resources with the hetznercloud provider.",
+      "rejectedBecause": "Adds a second toolchain and a state file. The state file becomes a new source of truth to reconcile with git and with the live account. Baz ruling 2026-09-07 09:50Z."
+    }
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/adrs/adr-3804-deploy-hetzner-server-hardening-baseline.json

@@ -0,0 +1,14 @@
+{
+  "adrId": "ADR-3804-deploy-hetzner-server-hardening-baseline",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Hardening baseline: SSH key-only, root disabled, UFW default-deny, DOCKER-USER chain, fail2ban, unattended-upgrades",
+  "context": "Every Hetzner server exposed to the public internet needs a minimum hardening set. Cloud-init landing the set at first boot is the operator-friendly shape: declarative, reproducible, kept in git per https://cloudinit.readthedocs.io/en/latest/. The Debian unattended-upgrades wiki (https://wiki.debian.org/UnattendedUpgrades) documents the auto-update mechanism the baseline turns on; the estate baseline at operator/knowledge/systems/environments/hetzner-cloud/overview.md Security posture baseline names the exact block set. The Hetzner community basic-cloud-config tutorial (https://community.hetzner.com/tutorials/basic-cloud-config) shows the vendor-recommended shape.",
+  "decision": "The shipped v1.0.0 hardening baseline is the six blocks: SSH key-only (PasswordAuthentication no), root disabled (PermitRootLogin no), UFW default-deny incoming with 22, 80 and 443 permitted per the manifest firewall shape, DOCKER-USER iptables chain wired to drop non-conforming egress, fail2ban SSH jail, unattended-upgrades on for security updates. The render-lint probe (cloud-init-render-lint.mjs) asserts every block appears in the rendered cloud-init YAML; the SIMULATE_HARDENING_DRIFT mutation removes a block and the probe FAILS naming the missing line. recommendedDefault: true. Standards trace clause: Debian unattended-upgrades wiki AND the estate baseline at operator/knowledge/systems/environments/hetzner-cloud/overview.md Security posture baseline per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "The applying project inherits the six-block baseline on every provisioned server. Deviation costs a fresh ADR at the applying project level. The baseline is text plus a rendered template; extension (extra ssh key, extra fail2ban jail) sits on top without rewriting.",
+  "alternativesConsidered": [],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/probes/cloud-init-render-lint.mjs

@@ -0,0 +1,71 @@
+// Probe: cloud-init render lint.
+//
+// anchorAcId: AC-37104-1. accountBound: false.
+//
+// Renders the shipped cloud-init template against the fixture manifest at
+// packages/rcf-lite/test/fixtures/hetzner-throwaway-server/hetzner/servers/ci-throwaway.json
+// via the fixture's src/cloud-init-renderer.mjs. Asserts the six hardening
+// baseline blocks appear in the rendered YAML.
+//
+// Purity: the probe reads only the shipped template and the fixture
+// manifest; no process.env.SIMULATE_ switch is read here. The
+// fixture-side renderer at src/cloud-init-renderer.mjs is the sole
+// reader of SIMULATE_HARDENING_DRIFT and it mutates INPUT (the
+// rendered YAML) only; the probe then FAILS naming the missing
+// baseline block per hetzner-round-7-spec-2026-09-07.md section 3.4
+// lesson 4. H-1 (2026-09-08).
+
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { FIXTURE_DIR } from './probe-utils.mjs';
+
+export const anchorAcId = 'AC-37104-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const rendererPath = resolve(FIXTURE_DIR, 'src/cloud-init-renderer.mjs');
+  const manifestPath = resolve(FIXTURE_DIR, 'hetzner/servers/ci-throwaway.json');
+  const { renderCloudInit, BASELINE_BLOCKS } = await import(rendererPath);
+  const manifest = JSON.parse(await readFile(manifestPath, 'utf8'));
+  // In-process render only; pass explicit stub public-key material so
+  // the renderer never shells to hcloud (mock path stays hermetic).
+  const rendered = await renderCloudInit(manifest, {
+    publicKeys: ['ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFakePubKeyForRenderLintHardeningH1 rcf-lite-ci-mock'],
+  });
+  const missing = [];
+  const present = [];
+  for (const block of BASELINE_BLOCKS) {
+    const ok = block.markers.every((m) => rendered.includes(m));
+    if (ok) {
+      present.push(block.id);
+    } else {
+      const missingMarkers = block.markers.filter((m) => !rendered.includes(m));
+      missing.push({ id: block.id, label: block.label, missingMarkers });
+    }
+  }
+  const results = [];
+  if (missing.length > 0) {
+    for (const m of missing) {
+      results.push({
+        anchorAcId,
+        verdict: 'fail',
+        detail: `cloud-init hardening baseline block "${m.label}" is missing from the rendered YAML (missing markers: ${m.missingMarkers.join(', ')}).`,
+      });
+    }
+  } else {
+    results.push({
+      anchorAcId,
+      verdict: 'pass',
+      detail: `all ${BASELINE_BLOCKS.length} baseline blocks present in the rendered YAML: ${present.join(', ')}.`,
+    });
+  }
+  return {
+    results,
+    extra: {
+      manifestName: manifest.name,
+      renderedByteLength: rendered.length,
+      presentBlocks: present,
+      missingBlocks: missing.map((m) => m.id),
+    },
+  };
+}

package/blueprints/deploy-hetzner-server/contributions/probes/hcloud-dry-run-mock.mjs

@@ -0,0 +1,164 @@
+// Probe: hcloud dry-run mock (v1.0.1 mutation-purified per H-1).
+//
+// anchorAcId: AC-37101-1 (provisioner facade sole reader + provisionerReady
+// on boot; also covers AC-37109-1 event-secrecy across the lifecycle;
+// also covers AC-14501-1 mock-consumes-rendered-file assertions per H-1
+// hardening block REQ-145).
+// accountBound: false.
+//
+// Drives the provisioner facade with the fixture's ci-throwaway manifest
+// against the mocked hcloud shim (src/hcloud-mock.mjs) and consumes the
+// SAME rendered cloud-init user-data file the real path consumes (the
+// fixture renderer writes it under hetzner/servers/rendered/ before the
+// facade is exercised, and this probe reads it back and asserts an
+// ssh-ed25519/ssh-rsa public-key line under the deploy user plus a
+// NOPASSWD directive naming that user). The rendered-file assertion is
+// what stops a mocked probe from passing while the real path fails on
+// the same artefact (H-1 REQ-145 / AC-14501-1).
+//
+// The probe body reads NO process.env.SIMULATE_ switch. Fixture-side
+// mutations live in src/cloud-init-renderer.mjs, src/hcloud-mock.mjs
+// and src/provisioner-facade.mjs and alter INPUT only.
+//
+// Assertions:
+//   - the facade opens on ready() and fires provisionerReady with a
+//     metadata-only payload {tool, apiHost}.
+//   - createServer parses the mocked JSON stdout and emits
+//     hetznerServerProvisioned with id, primaryIpv4, location=fsn1,
+//     serverType=cx23.
+//   - takeSnapshot fires hetznerSnapshotTaken with snapshot id and time.
+//   - destroyServer fires hetznerServerDestroyed with the id.
+//   - no event body across the run carries the token, an ssh private-key
+//     marker, or the rendered user-data bytes (event-secrecy check).
+//   - the rendered cloud-init file exists under the fixture's rendered
+//     directory and carries at least one ssh-ed25519 or ssh-rsa
+//     authorized-keys line under the deploy user plus a NOPASSWD
+//     directive naming that user (H-1 REQ-145 / AC-14501-1).
+
+import { readFile, access } from 'node:fs/promises';
+import { relative, resolve } from 'node:path';
+import { FIXTURE_DIR, PROJECT_ROOT } from './probe-utils.mjs';
+
+export const anchorAcId = 'AC-37101-1';
+export const accountBound = false;
+
+const TOKEN = 'test-fixture-token-000000000000000000000000000000000000000000';
+const USER_DATA_MARKER = 'unattended-upgrades on for security updates';
+const PRIVATE_KEY_MARKER = 'BEGIN OPENSSH PRIVATE KEY';
+
+export default async function runProbe() {
+  const facadePath = resolve(FIXTURE_DIR, 'src/provisioner-facade.mjs');
+  const rendererPath = resolve(FIXTURE_DIR, 'src/cloud-init-renderer.mjs');
+  const manifestPath = resolve(FIXTURE_DIR, 'hetzner/servers/ci-throwaway.json');
+  const { createProvisionerFacade, createEventLog } = await import(facadePath);
+  const { renderCloudInitToFile } = await import(rendererPath);
+  const manifest = JSON.parse(await readFile(manifestPath, 'utf8'));
+  const results = [];
+
+  // Render the cloud-init to disk with a fixture-side stubbed public
+  // key (the mock path never calls hcloud ssh-key describe); the real
+  // path resolves the material via hcloud and writes to the same
+  // location. Both consume the same file shape.
+  const publicKeys = ['ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFakePubKeyForMockedRunHardeningH1 rcf-lite-ci-mock'];
+  const { renderedPath, rendered } = await renderCloudInitToFile(manifest, { publicKeys });
+
+  // H-1 REQ-145 / AC-14501-1: assert the rendered file carries an
+  // ssh-ed25519 or ssh-rsa line for the deploy user AND a NOPASSWD
+  // directive naming that user. This assertion is what breaks the
+  // "mock passes while real path fails on the same artefact" class.
+  const renderedFromDisk = await readFile(renderedPath, 'utf8');
+  const sshKeyLine = /(ssh-ed25519|ssh-rsa)\s+/i.test(renderedFromDisk);
+  const nopasswdLine = /deploy\s+ALL\s*=\s*\(ALL\)\s+NOPASSWD/i.test(renderedFromDisk);
+  if (!sshKeyLine) {
+    results.push({
+      anchorAcId: 'AC-14501-1',
+      verdict: 'fail',
+      detail: `rendered cloud-init at ${relative(PROJECT_ROOT, renderedPath)} carries no ssh-ed25519 or ssh-rsa authorized-keys line for the deploy user; the real path would provision a server with an unusable authorized_keys entry.`,
+    });
+  } else if (!nopasswdLine) {
+    results.push({
+      anchorAcId: 'AC-14501-1',
+      verdict: 'fail',
+      detail: `rendered cloud-init at ${relative(PROJECT_ROOT, renderedPath)} carries no NOPASSWD directive for the deploy user; the six sudoed baseline checks would block on a tty prompt.`,
+    });
+  } else {
+    results.push({
+      anchorAcId: 'AC-14501-1',
+      verdict: 'pass',
+      detail: `rendered cloud-init at ${relative(PROJECT_ROOT, renderedPath)} carries an ssh public-key line for the deploy user (byteLength ${rendered.length}) and a NOPASSWD sudoers directive for that user; the mock and the real path consume the same artefact.`,
+    });
+  }
+
+  const { events, eventSink } = createEventLog();
+  const facade = createProvisionerFacade({
+    token: TOKEN,
+    tool: 'hcloud',
+    apiHost: 'https://api.hetzner.cloud/v1',
+    eventSink,
+  });
+  try {
+    await facade.ready();
+    const server = await facade.createServer(manifest);
+    const snapshot = await facade.takeSnapshot({ id: server.id, name: manifest.name }, `${manifest.name}-${new Date().toISOString()}`);
+    await facade.destroyServer(server);
+    const provisionerReady = events.find((e) => e.event === 'provisionerReady');
+    const provisioned = events.find((e) => e.event === 'hetznerServerProvisioned');
+    const snapped = events.find((e) => e.event === 'hetznerSnapshotTaken');
+    const destroyed = events.find((e) => e.event === 'hetznerServerDestroyed');
+    if (!provisionerReady) {
+      results.push({ anchorAcId: 'AC-37101-1', verdict: 'fail', detail: 'provisionerReady event did not fire on ready().' });
+    } else if (provisionerReady.tool !== 'hcloud' || provisionerReady.apiHost !== 'https://api.hetzner.cloud/v1') {
+      results.push({ anchorAcId: 'AC-37101-1', verdict: 'fail', detail: `provisionerReady payload shape wrong: ${JSON.stringify(provisionerReady)}` });
+    } else {
+      results.push({ anchorAcId: 'AC-37101-1', verdict: 'pass', detail: 'provisionerReady fired with metadata-only {tool, apiHost} payload.' });
+    }
+    if (!provisioned || !provisioned.id || !provisioned.primaryIpv4 || provisioned.location !== 'fsn1' || provisioned.serverType !== 'cx23') {
+      results.push({ anchorAcId: 'AC-37101-1', verdict: 'fail', detail: `hetznerServerProvisioned event missing or malformed: ${JSON.stringify(provisioned)}` });
+    } else {
+      results.push({ anchorAcId: 'AC-37101-1', verdict: 'pass', detail: `hetznerServerProvisioned fired with id=${provisioned.id} primaryIpv4=${provisioned.primaryIpv4} location=fsn1 serverType=cx23.` });
+    }
+    if (!snapped || !snapped.snapshotId || !snapped.wallClockTime) {
+      results.push({ anchorAcId: 'AC-37101-1', verdict: 'fail', detail: `hetznerSnapshotTaken event missing or malformed: ${JSON.stringify(snapped)}` });
+    }
+    if (!destroyed || !destroyed.id) {
+      results.push({ anchorAcId: 'AC-37101-1', verdict: 'fail', detail: `hetznerServerDestroyed event missing or malformed: ${JSON.stringify(destroyed)}` });
+    }
+    // Event-secrecy scan across every event body.
+    const leaks = [];
+    for (const e of events) {
+      const body = JSON.stringify(e);
+      if (body.includes(TOKEN)) leaks.push({ event: e.event, marker: 'HETZNER_ACCOUNT_API_KEY value' });
+      if (body.includes(PRIVATE_KEY_MARKER)) leaks.push({ event: e.event, marker: 'ssh private key' });
+      if (body.includes(USER_DATA_MARKER)) leaks.push({ event: e.event, marker: 'rendered user-data bytes' });
+    }
+    if (leaks.length > 0) {
+      results.push({
+        anchorAcId: 'AC-37109-1',
+        verdict: 'fail',
+        detail: `event-secrecy leak: ${leaks.map((l) => `${l.event} carries ${l.marker}`).join('; ')} (defensive-fake finding; check for a SIMULATE_EVENT_SECRECY_LEAK mutation in the fixture-side facade shim).`,
+      });
+    } else {
+      results.push({
+        anchorAcId: 'AC-37109-1',
+        verdict: 'pass',
+        detail: `event-secrecy scan across ${events.length} event bodies found no leak of the token, ssh private key, or user-data content.`,
+      });
+    }
+  } catch (err) {
+    results.push({
+      anchorAcId: 'AC-37101-1',
+      verdict: 'fail',
+      detail: `provisioner facade lifecycle threw: ${err.message} (probable cause: mocked hcloud stdout is not JSON; check for a SIMULATE_JSON_PARSE_STRIP mutation in the fixture-side mock shim).`,
+    });
+  }
+  return {
+    results,
+    extra: {
+      eventCount: events.length,
+      events: events.map((e) => ({ event: e.event, keys: Object.keys(e).sort() })),
+      renderedPath: relative(PROJECT_ROOT, renderedPath),
+      renderedByteLength: rendered.length,
+      renderedAssertions: { sshKeyLine, nopasswdLine },
+    },
+  };
+}