rcf-lite 0.24.0 → 0.26.0

package/rcf/requirements/req-154.json

@@ -0,0 +1,44 @@
+{
+  "createdAt": "2026-09-08T12:16:30.083Z",
+  "updatedAt": "2026-09-08T12:16:30.218Z",
+  "description": "The four Cloudflare-platform blueprints (platform-cloudflare-kv, platform-cloudflare-durable-objects, messaging-queue-cloudflare, edge-cloudflare-tunnel) carry mutation-purity, envelope-hygiene and marker-wording defects surfaced by stage-2 semantic and stage-1 mechanical passes: SIMULATE_ env reads in probe bodies (cache-aside-hit-then-miss, event-secrecy, sole-reader-scan, storage-round-trip, websocket-hub-broadcast); a committed fail envelope at .rcf/reports/blueprints/platform-cloudflare-kv/event-secrecy.json; comments labelling local doubles as fake state / fake WebSocket pair / fake clock in ways the stage-1 marker sweep flagged. This train moves every probe-body SIMULATE_ branch into a fixture-side shim under packages/rcf-lite/test/fixtures/cf-platform/ or .../cf-edge/ (new shim files carry the h2-cf-platform-probe-integrity slug prefix, short form h2-cf acceptable), deletes the committed fail envelope and commits a shipped-code pass envelope in its place, regenerates the other kv envelopes so committed envelopes reflect the re-anchored shipped-code runs, and reworks probe comments to name the local test doubles honestly (or records adjudicated-acceptable with reason in the PR body). No capability change; 0.25.x patch scope.",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "reqId": "REQ-154",
+  "prdId": "PRD-001",
+  "title": "H-2 cross-cutting probe hygiene: SIMULATE_ branches out of probe bodies into fixture shims; no fail envelope committed; probe comments name test doubles honestly",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "webUi",
+      "httpApi",
+      "persistence"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T12:16:30.216Z",
+    "signals": [
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "durable"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "form"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "delete"
+      }
+    ]
+  }
+}

package/rcf/tacs/tac-3801-deploy-hetzner-server-provisioner.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-07T23:53:56.835Z",
+  "updatedAt": "2026-09-07T23:57:58.678Z",
+  "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "T-1 repo-chain TAC mirror for the shipped blueprints/deploy-hetzner-server/contributions/tacs/tac-3801-deploy-hetzner-server-provisioner.json contribution. Defines the provisioner Node module that wraps hcloud CLI verbs (create server, apply firewall, take snapshot, list snapshots, destroy server) and, under provisioningTool=raw-api, wraps the equivalent Hetzner Cloud REST endpoints. Sole-reader guarantee: only this module reads the HETZNER_ACCOUNT_API_KEY via security-secrets-management (or the project-scoped alternative). Anchors AC-11001-1 (repo chain).",
+  "responsibilities": [
+    "Wrap hcloud CLI verbs (create server, apply firewall, take snapshot, list snapshots, destroy server) and the raw Hetzner Cloud REST endpoints behind one facade (AC-11001-1, AC-11102-1, AC-11402-1).",
+    "Be the sole reader of HETZNER_ACCOUNT_API_KEY via security-secrets-management; every other module reads from the facade (AC-11001-1).",
+    "Emit provisionerReady, hetznerServerProvisioned, hetznerSnapshotTaken and hetznerServerDestroyed with metadata-only payloads (AC-11001-1, AC-11501-1)."
+  ],
+  "name": "deploy-hetzner-server provisioner module: sole reader of the Hetzner API token, hcloud shell path and raw-api fork",
+  "internalStructure": "One module blueprints/deploy-hetzner-server/contributions/tacs/tac-3801-deploy-hetzner-server-provisioner.json plus the provisioner facade proto shipped in the fixture (packages/rcf-lite/test/fixtures/hetzner-throwaway-server/src/provisioner-facade.mjs) reading the token from a single seam and firing provisionerReady on ready()."
+}

package/rcf/tacs/tac-3802-deploy-hetzner-server-manifest-schema.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-07T23:53:57.022Z",
+  "updatedAt": "2026-09-07T23:57:58.866Z",
+  "tacId": "TAC-3802-deploy-hetzner-server-manifest-schema",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "T-1 repo-chain TAC mirror for the shipped blueprints/deploy-hetzner-server/contributions/tacs/tac-3802-deploy-hetzner-server-manifest-schema.json contribution. Defines the JSON Schema shape for the Hetzner server manifest under hetzner/servers/<name>.json: type, location, image, sshKeyIds, firewallId, networkId, cloudInitPath, labels, snapshotCadence. Anchors AC-11101-1 and AC-11102-1 (repo chain).",
+  "responsibilities": [
+    "Ship a draft-07 JSON Schema for the hetzner-server manifest (AC-11101-1, AC-11301-1, AC-11401-1).",
+    "Refuse on required-field violations (missing type, location, image, sshKeyIds, firewallId, cloudInitPath, labels or snapshotCadence).",
+    "Refuse on firewall-rule-shape violations (22 opened to 0.0.0.0/0, or 80/443 missing) (AC-11301-1)."
+  ],
+  "name": "deploy-hetzner-server server manifest schema and file layout at hetzner/servers/*.json",
+  "internalStructure": "One draft-07 JSON Schema at blueprints/deploy-hetzner-server/contributions/schemas/hetzner-server.schema.json and one shipped example manifest under the shared throwaway-server fixture (packages/rcf-lite/test/fixtures/hetzner-throwaway-server/hetzner/servers/ci-throwaway.json)."
+}

package/rcf/tacs/tac-3803-deploy-hetzner-server-cloud-init-template.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-07T23:53:57.210Z",
+  "updatedAt": "2026-09-07T23:57:59.054Z",
+  "tacId": "TAC-3803-deploy-hetzner-server-cloud-init-template",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "T-1 repo-chain TAC mirror for the shipped blueprints/deploy-hetzner-server/contributions/tacs/tac-3803-deploy-hetzner-server-cloud-init-template.json contribution. Defines the cloud-init user-data template landing the six hardening baseline blocks: SSH key-only, root disabled, UFW default-deny incoming, DOCKER-USER iptables chain, fail2ban SSH jail, unattended-upgrades. Local render-lint asserts every block appears in the rendered YAML. Anchors AC-11201-1 and AC-11202-1 (repo chain).",
+  "responsibilities": [
+    "Ship a cloud-init user-data template that renders the six hardening baseline blocks (AC-11201-1, AC-11202-1).",
+    "Provide the render-lint check that asserts each block appears in the rendered YAML (AC-11201-1).",
+    "Cover the SIMULATE_HARDENING_DRIFT mutation with a probe FAILURE that names the missing line (AC-11201-1)."
+  ],
+  "name": "deploy-hetzner-server cloud-init template with the six hardening baseline blocks and render lint",
+  "internalStructure": "One template file at blueprints/deploy-hetzner-server/contributions/templates/cloud-init.yaml.tmpl and one render module at packages/rcf-lite/test/fixtures/hetzner-throwaway-server/src/cloud-init-renderer.mjs; the render-lint probe consumes the rendered output."
+}

package/rcf/tacs/tac-3804-deploy-hetzner-server-firewall-shape.json

@@ -0,0 +1,16 @@
+{
+  "createdAt": "2026-09-07T23:53:57.397Z",
+  "updatedAt": "2026-09-07T23:57:59.243Z",
+  "tacId": "TAC-3804-deploy-hetzner-server-firewall-shape",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "T-1 repo-chain TAC mirror for the shipped blueprints/deploy-hetzner-server/contributions/tacs/tac-3804-deploy-hetzner-server-firewall-shape.json contribution. Defines the Hetzner Cloud firewall rule shape carried inside the server manifest: 22 permitted only from an operator-nominated set of source-prefix ranges; 80/443 permitted from 0.0.0.0/0 for the reverse proxy; all other inbound denied. Manifest schema refuses on a rule set that opens 22 to 0.0.0.0/0 or drops 80/443. Anchors AC-11301-1 (repo chain).",
+  "responsibilities": [
+    "Define the firewall rule shape inside the manifest: 22 permitted only from a nonempty list of source-prefix ranges; 80 and 443 permitted; all other inbound denied (AC-11301-1).",
+    "Refuse (via manifest-schema-validate) on a manifest that opens 22 to 0.0.0.0/0 or drops 80/443."
+  ],
+  "name": "deploy-hetzner-server firewall rule shape: 22 from operator-nominated prefixes, 80/443 open, deny all else, applied at provision time",
+  "internalStructure": "Rule shape carried inside the same hetzner-server.schema.json used by TAC-3802; the applyFirewall verb on the provisioner facade consumes the parsed rule set."
+}

package/rcf/tacs/tac-3901-platform-docker-compose-host-compose-layout.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-08T01:42:20.942Z",
+  "updatedAt": "2026-09-08T01:44:10.970Z",
+  "tacId": "TAC-3901-platform-docker-compose-host-compose-layout",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "The applying project ships one compose.yaml at the repo root whose services key names every container the stack runs. Every entry is one image running one container; networks and volumes are top-level named entries; a colocated .env carries non-secret configuration values (never inline). The container host reads compose.yaml as the runtime topology source and refuses to bring the stack up on layout drift.",
+  "responsibilities": [
+    "Serve compose.yaml at the repo root as the sole topology surface (AC-12001-1, AC-12202-1).",
+    "Guarantee service-per-container: each entry under services: runs one image (AC-12001-1).",
+    "Declare all networks and volumes as top-level named entries: no bare defaults (AC-12001-1).",
+    "Bind non-secret configuration through a colocated .env: no inline literals (AC-12001-1)."
+  ],
+  "name": "T-2 platform-docker-compose-host compose layout"
+}

package/rcf/tacs/tac-3902-platform-docker-compose-host-secrets-mount.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-08T01:42:21.128Z",
+  "updatedAt": "2026-09-08T01:44:11.343Z",
+  "tacId": "TAC-3902-platform-docker-compose-host-secrets-mount",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "The compose file declares each secret under its top-level secrets: key with a file: source. Services reference secrets through their service-level secrets: array so docker mounts them as files at 0o400 inside the container. When security-secrets-management is applied, the source path resolves through that facade; when it is not, the guide names a file-based fallback. No plaintext secret literal appears anywhere in compose.yaml or a referenced service config (grep-refuse).",
+  "responsibilities": [
+    "Declare every secret through a compose secrets: file mount (AC-12101-1, AC-12102-1).",
+    "Refuse a plaintext secret literal anywhere in compose.yaml (AC-12102-1).",
+    "Mount each secret file at 0o400 inside the container (AC-12101-1).",
+    "Bind to security-secrets-management when applied; document the file-based fallback (AC-12101-1)."
+  ],
+  "name": "T-2 platform-docker-compose-host secrets mount"
+}

package/rcf/tacs/tac-3903-platform-docker-compose-host-healthcheck-lint.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-08T01:42:21.313Z",
+  "updatedAt": "2026-09-08T01:44:11.716Z",
+  "tacId": "TAC-3903-platform-docker-compose-host-healthcheck-lint",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "A lint pass runs before docker compose up. It asserts every HTTP-terminating service declares a healthcheck: block; every service declares a restart: policy whose value is one of unless-stopped or on-failure; every service declares a logging: driver: entry whose value is one of journald or loki. The lint refuses on any missing or unclassified line, naming the service and the offending field.",
+  "responsibilities": [
+    "Assert every HTTP-terminating service declares a healthcheck: block (AC-12201-1).",
+    "Assert every service declares a restart policy in the allowed set (AC-12301-1).",
+    "Assert every service declares a logging driver in the allowed set (AC-12501-1).",
+    "Refuse on missing or unclassified fields, naming the service (AC-12201-1, AC-12301-1, AC-12501-1)."
+  ],
+  "name": "T-2 platform-docker-compose-host healthcheck and lifecycle lint"
+}

package/rcf/tacs/tac-3904-platform-docker-compose-host-reverse-proxy-artefact.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-08T01:42:21.500Z",
+  "updatedAt": "2026-09-08T01:44:12.088Z",
+  "tacId": "TAC-3904-platform-docker-compose-host-reverse-proxy-artefact",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "The reverse-proxy config file (caddy/Caddyfile when reverseProxy=caddy, traefik/traefik.yaml when reverseProxy=traefik) lives as a first-class checked-in artefact under the applying repo. The compose file bind-mounts the artefact read-only into the proxy service. The gate runs the vendor validator against the artefact and refuses on an invalid directive. Under the reload verb (docker compose exec caddy caddy reload or the Traefik equivalent), a burst against the proxy inside the elicited window sees no non-2xx and no dropped connection.",
+  "responsibilities": [
+    "Ship the reverse-proxy config as a checked-in artefact bind-mounted into the proxy (AC-12401-1).",
+    "Validate the artefact with the vendor validator at gate time (AC-12401-1).",
+    "Prove zero-downtime reload with a real-account burst (AC-12402-1).",
+    "Name the reload verb per proxy in the guide and the fixture README (AC-12401-1, AC-12402-1)."
+  ],
+  "name": "T-2 platform-docker-compose-host reverse-proxy artefact"
+}

package/rcf/tacs/tac-4001-edge-cloudflare-tunnel-connector-shape.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-08T03:23:08.838Z",
+  "updatedAt": "2026-09-08T03:23:08.838Z",
+  "tacId": "TAC-4001-edge-cloudflare-tunnel-connector-shape",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "The cloudflared connector installs in one of two runtime shapes as selected by ADR-4002 from the applied capability set. When containerHost is applied (T-2 platform-docker-compose-host on top of T-1 deploy-hetzner-server) the connector ships as a compose service alongside the applying project services on the same web-net network with no host ports and a healthcheck. When the host runs bare (only T-1 applied) the connector ships as a systemd unit per the vendor local-configuration-file docs. Either shape emits cloudflaredReady on boot with connector id, region and version metadata (metadata only).",
+  "responsibilities": [
+    "Ship the compose-service variant under packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/compose-service/ (AC-13001-1).",
+    "Ship the systemd-unit variant under packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/systemd-unit/ (AC-13001-1).",
+    "Emit cloudflaredReady on boot with connector id, region and version metadata (AC-13002-1).",
+    "Never expose an origin port on the host firewall (AC-13201-1)."
+  ],
+  "name": "edge-cloudflare-tunnel TAC"
+}

package/rcf/tacs/tac-4002-edge-cloudflare-tunnel-manifest-schema.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-08T03:23:09.027Z",
+  "updatedAt": "2026-09-08T03:23:09.027Z",
+  "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "The tunnel manifest at cloudflare/tunnels/<name>.yaml under the applying project is the sole runtime source of truth for what the cloudflared connector serves. The shipped JSON schema requires a uuid-shaped tunnel id, a secretRef credentials reference (never a literal path or JSON body inline), and an ingress rules array whose last entry is a catch-all rule returning http_status 404. The schema refuses ingress rules whose service URL binds to a host public interface (only internal addresses reachable through the compose network or a loopback interface are allowed).",
+  "responsibilities": [
+    "Ship the JSON schema at blueprints/edge-cloudflare-tunnel/contributions/probes/tunnel-manifest.schema.json (AC-13101-1).",
+    "Validate the fixture manifests at cloudflared/*/cloudflare/tunnels/probe.yaml on every reviewer boot (AC-13101-1, AC-13102-1).",
+    "Refuse ingress rules that bind to a host public port (AC-13201-1).",
+    "Refuse a manifest whose credentials reference is not a secretRef (AC-13101-1, AC-13401-1)."
+  ],
+  "name": "edge-cloudflare-tunnel TAC"
+}

package/rcf/tacs/tac-4003-edge-cloudflare-tunnel-access-binding.json

@@ -0,0 +1,16 @@
+{
+  "createdAt": "2026-09-08T03:23:09.218Z",
+  "updatedAt": "2026-09-08T03:23:09.218Z",
+  "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "The blueprint reads the applying project sidecar rcf/blueprints/edge-cloudflare-tunnel.applied.json at apply time and inspects appliedCapabilities. When zeroTrustGate is present every ingress rule attaches an originRequest.access.aud block naming the Access AUD; when absent the block is omitted and the tunnel serves in public-hostname mode. The shape is a pure function of the sidecar and never silently degrades to open ingress.",
+  "responsibilities": [
+    "Ship the aud-presence-check probe module (AC-13301-1, AC-13302-1).",
+    "Ship both fixture variants (access-gated and public-hostname) under cloudflared/*/access-gated and cloudflared/*/public-hostname (AC-13301-1).",
+    "Refuse when the gated variant drifts to open ingress (AC-13302-1)."
+  ],
+  "name": "edge-cloudflare-tunnel TAC"
+}

package/rcf/test-suites/ts-071.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-06T17:50:13.712Z",
-  "updatedAt": "2026-09-06T17:51:32.845Z",
+  "updatedAt": "2026-09-08T09:26:29.965Z",
   "purpose": "Cover AC-4101-1..6 via unit tests over the shipped object-storage-s3 blueprint shape (contribution count, capabilities, suggestedCompanions, ADR standardsTraceClause), applies-clean-with-secrets and refuses-without behaviour, six Node-only probe module contract with anchorAcId cross-check, induced-failure switch documentation on the fixture README, and shelf-doc consistency (section 6a table row for objectStorage, shelf-wide docs/topics.md row for object-storage-s3 at 28101-28899 / 29xx).",
   "testLevel": "unit",
   "acIds": [
@@ -20,7 +20,7 @@
       "acId": "AC-4101-1",
       "description": "Cover AC-4101-1 via anatomy test",
       "status": "pending",
-      "testPointer": "test/blueprint/object-storage-s3-anatomy.test.js::blueprint.json declares 21 contributions with capabilities objectStorage, suggestedCompanions logging and errorHandling, and standardsTraceClause on every ADR entry (TC-071-blueprint-json-shape)"
+      "testPointer": "test/blueprint/object-storage-s3-anatomy.test.js::blueprint.json declares 25 contributions at v1.1.0 with capabilities objectStorage, suggestedCompanions logging and errorHandling, and standardsTraceClause on every ADR entry including the Hetzner Object Storage provider entry (TC-071-blueprint-json-shape)"
     },
     {
       "id": "TC-071-applies-clean-with-secrets",

package/rcf/test-suites/ts-086.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T10:20:32.919Z",
-  "updatedAt": "2026-09-07T10:21:02.065Z",
+  "updatedAt": "2026-09-08T15:28:06.407Z",
   "purpose": "Cover AC-5302-1 via event-secrecy probe with two-layer assertions and a mutation-run under SIMULATE_PII_LEAK",
   "testLevel": "unit",
   "acIds": [
@@ -15,7 +15,7 @@
       "acId": "AC-5302-1",
       "description": "Cover AC-5302-1 via event-secrecy probe: no body bytes / PII / user id reach the sink even under a mutation-run",
       "status": "pending",
-      "testPointer": "test/blueprint/platform-cloudflare-kv-anatomy.test.js::event-secrecy probe passes on PII fixture and fails under SIMULATE_PII_LEAK (TC-086-event-secrecy)"
+      "testPointer": "test/blueprint/platform-cloudflare-kv-anatomy.test.js::event-secrecy probe passes on PII fixture and fails under fixture-side SIMULATE_PII_LEAK (TC-086-event-secrecy)"
     }
   ],
   "status": "draft"

package/rcf/test-suites/ts-140.json

@@ -0,0 +1,86 @@
+{
+  "createdAt": "2026-09-07T23:57:26.071Z",
+  "updatedAt": "2026-09-07T23:58:51.258Z",
+  "purpose": "Cover the T-1 chain ACs via the shipped anatomy test at test/blueprint/deploy-hetzner-server-anatomy.test.js and via the six blueprint probes driven from the shared throwaway-server fixture",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-11001-1",
+    "AC-11101-1",
+    "AC-11102-1",
+    "AC-11201-1",
+    "AC-11202-1",
+    "AC-11301-1",
+    "AC-11401-1",
+    "AC-11402-1",
+    "AC-11501-1"
+  ],
+  "id": "TS-140",
+  "usId": "US-11001",
+  "title": "T-1 hetzner-server anatomy proof: probe modules and mocked fixture assertions",
+  "testCases": [
+    {
+      "id": "TC-140-provisioner-boot-and-sole-reader",
+      "acId": "AC-11001-1",
+      "description": "Cover AC-11001-1 via anatomy test: provisioner facade boot emits provisionerReady with metadata-only payload and only the facade reads the token",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11001-1 provisioner boot and sole reader (TC-140)"
+    },
+    {
+      "id": "TC-140-manifest-schema-shape-valid",
+      "acId": "AC-11101-1",
+      "description": "Cover AC-11101-1 via anatomy test: hetzner-server.schema.json validates the fixture manifests",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11101-1 manifest schema shape valid (TC-140-manifest-schema-shape-valid)"
+    },
+    {
+      "id": "TC-140-manifest-applies-mocked-provision",
+      "acId": "AC-11102-1",
+      "description": "Cover AC-11102-1 via anatomy test: mocked hcloud shell path returns id, primaryIpv4, location, serverType and hetznerServerProvisioned fires",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11102-1 manifest applies to mocked provision (TC-140-manifest-applies-mocked-provision)"
+    },
+    {
+      "id": "TC-140-cloud-init-render-baseline-present",
+      "acId": "AC-11201-1",
+      "description": "Cover AC-11201-1 via anatomy test: rendered cloud-init YAML carries the six baseline blocks",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11201-1 cloud-init render baseline present (TC-140-cloud-init-render-baseline-present)"
+    },
+    {
+      "id": "TC-140-cloud-init-hardened-account-bound-probe",
+      "acId": "AC-11202-1",
+      "description": "Cover AC-11202-1 via anatomy test: probe module manifest declares accountBound true and the fixture readme documents the ssh baseline checks",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11202-1 cloud-init hardened account-bound probe declared (TC-140-cloud-init-hardened-account-bound-probe)"
+    },
+    {
+      "id": "TC-140-firewall-shape-valid-and-refuses-open-ssh",
+      "acId": "AC-11301-1",
+      "description": "Cover AC-11301-1 via anatomy test: schema accepts a rule set with 22 restricted plus 80/443 open and refuses an open-ssh mutation",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11301-1 firewall shape valid and refuses open ssh (TC-140-firewall-shape-valid-and-refuses-open-ssh)"
+    },
+    {
+      "id": "TC-140-snapshot-cadence-enum",
+      "acId": "AC-11401-1",
+      "description": "Cover AC-11401-1 via anatomy test: snapshotCadence enum is weekly, daily, off",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11401-1 snapshot cadence enum (TC-140-snapshot-cadence-enum)"
+    },
+    {
+      "id": "TC-140-snapshot-on-demand-account-bound-probe",
+      "acId": "AC-11402-1",
+      "description": "Cover AC-11402-1 via anatomy test: snapshot on-demand probe declares accountBound true and readme names the hcloud image list check",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11402-1 snapshot on demand account-bound probe declared (TC-140-snapshot-on-demand-account-bound-probe)"
+    },
+    {
+      "id": "TC-140-lifecycle-events-metadata-only",
+      "acId": "AC-11501-1",
+      "description": "Cover AC-11501-1 via anatomy test: hcloud dry-run mock drives four lifecycle events, payloads carry only metadata fields, event-secrecy mutation FAILS",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11501-1 lifecycle events metadata only (TC-140-lifecycle-events-metadata-only)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-150.json

@@ -0,0 +1,86 @@
+{
+  "createdAt": "2026-09-08T01:44:51.205Z",
+  "updatedAt": "2026-09-08T01:45:31.442Z",
+  "purpose": "Cover the T-2 chain ACs via the shipped anatomy test at test/blueprint/platform-docker-compose-host-anatomy.test.js and via the five blueprint probes driven from the shared throwaway-server fixture (which T-2 extends with a compose stack, Caddyfile, secret file mount and healthchecked service)",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-12001-1",
+    "AC-12101-1",
+    "AC-12102-1",
+    "AC-12201-1",
+    "AC-12202-1",
+    "AC-12301-1",
+    "AC-12401-1",
+    "AC-12402-1",
+    "AC-12501-1"
+  ],
+  "id": "TS-150",
+  "usId": "US-12001",
+  "title": "T-2 platform-docker-compose-host anatomy proof: probe modules and compose-stack fixture assertions",
+  "testCases": [
+    {
+      "id": "TC-150-compose-layout-shape-valid",
+      "acId": "AC-12001-1",
+      "description": "Cover AC-12001-1 via anatomy test: fixture compose.yaml declares service-per-container, named networks and volumes, and a .env for non-secret config",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12001-1 compose layout shape valid (TC-150-compose-layout-shape-valid)"
+    },
+    {
+      "id": "TC-150-secrets-file-mount-shape",
+      "acId": "AC-12101-1",
+      "description": "Cover AC-12101-1 via anatomy test: compose.yaml declares secrets under top-level secrets with a file source and mounts them into the web service; the mounted file is 0o400",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12101-1 secrets file mount shape (TC-150-secrets-file-mount-shape)"
+    },
+    {
+      "id": "TC-150-secrets-scan-fails-on-plaintext",
+      "acId": "AC-12102-1",
+      "description": "Cover AC-12102-1 via anatomy test: secrets-as-files-scan probe passes on the canonical fixture and fails under SIMULATE_PLAINTEXT_SECRET naming the literal",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12102-1 secrets-as-files scan fails on plaintext (TC-150-secrets-scan-fails-on-plaintext)"
+    },
+    {
+      "id": "TC-150-compose-config-lint-refuses-missing-healthcheck",
+      "acId": "AC-12201-1",
+      "description": "Cover AC-12201-1 via anatomy test: compose-config-lint probe passes on canonical fixture and fails under SIMULATE_MISSING_HEALTHCHECK naming the service",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12201-1 compose-config-lint refuses missing healthcheck (TC-150-compose-config-lint-refuses-missing-healthcheck)"
+    },
+    {
+      "id": "TC-150-real-account-minimal-stack-up-declared-and-skipped-shape",
+      "acId": "AC-12202-1",
+      "description": "Cover AC-12202-1 via anatomy test: real-account-minimal-stack-up probe declares accountBound true and records accountBoundSkipped when the env var is unset",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12202-1 real-account-minimal-stack-up declared and skipped shape (TC-150-real-account-minimal-stack-up-declared-and-skipped-shape)"
+    },
+    {
+      "id": "TC-150-restart-discipline-lint-refuses-unclassified",
+      "acId": "AC-12301-1",
+      "description": "Cover AC-12301-1 via anatomy test: compose-config-lint enforces restart policy classification and fails under SIMULATE_UNCLASSIFIED_RESTART naming the service",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12301-1 restart discipline lint refuses unclassified (TC-150-restart-discipline-lint-refuses-unclassified)"
+    },
+    {
+      "id": "TC-150-caddyfile-validate-refuses-invalid-directive",
+      "acId": "AC-12401-1",
+      "description": "Cover AC-12401-1 via anatomy test: caddyfile-validate probe passes on canonical Caddyfile and fails under SIMULATE_INVALID_CADDYFILE naming the line",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12401-1 caddyfile-validate refuses invalid directive (TC-150-caddyfile-validate-refuses-invalid-directive)"
+    },
+    {
+      "id": "TC-150-real-account-reload-burst-declared-and-skipped-shape",
+      "acId": "AC-12402-1",
+      "description": "Cover AC-12402-1 via anatomy test: real-account-reload-burst probe declares accountBound true and records accountBoundSkipped when the env var is unset",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12402-1 real-account-reload-burst declared and skipped shape (TC-150-real-account-reload-burst-declared-and-skipped-shape)"
+    },
+    {
+      "id": "TC-150-log-driver-classification",
+      "acId": "AC-12501-1",
+      "description": "Cover AC-12501-1 via anatomy test: compose-config-lint asserts every service declares a logging driver and fails under SIMULATE_UNCLASSIFIED_LOG_DRIVER naming the service",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12501-1 log driver classification (TC-150-log-driver-classification)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-160.json

@@ -0,0 +1,78 @@
+{
+  "createdAt": "2026-09-08T03:24:23.156Z",
+  "updatedAt": "2026-09-08T03:24:51.162Z",
+  "purpose": "Cover the T-3 chain ACs via the shipped anatomy test at test/blueprint/edge-cloudflare-tunnel-anatomy.test.js and via the three local probe modules driven from the shared throwaway-server fixture (which T-3 extends with cloudflared/compose-service and cloudflared/systemd-unit variants, each in both public-hostname and access-gated sidecar modes).",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-13001-1",
+    "AC-13002-1",
+    "AC-13101-1",
+    "AC-13102-1",
+    "AC-13201-1",
+    "AC-13301-1",
+    "AC-13302-1",
+    "AC-13401-1"
+  ],
+  "id": "TS-160",
+  "usId": "US-13001",
+  "title": "T-3 edge-cloudflare-tunnel anatomy proof: probe modules and cloudflared connector fixture assertions",
+  "testCases": [
+    {
+      "id": "TC-160-connector-shape-variants-shipped",
+      "acId": "AC-13001-1",
+      "description": "Cover AC-13001-1 via anatomy test: the shared fixture ships both cloudflared/compose-service/ and cloudflared/systemd-unit/ variants and the compose-service variant defines a cloudflared service alongside T-2 web and caddy on the same web-net network with no host ports; the systemd-unit variant ships a cloudflared.service unit file per the vendor local-configuration-file docs.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::T-3 edge-cloudflare-tunnel AC-13001-1 connector shape variants shipped (TC-160-connector-shape-variants-shipped)"
+    },
+    {
+      "id": "TC-160-real-account-connector-healthy-declared-and-skipped-shape",
+      "acId": "AC-13002-1",
+      "description": "Cover AC-13002-1 via anatomy test: real-account-connector-healthy probe declares accountBound true and records accountBoundSkipped when CI_HAS_CLOUDFLARE_ACCOUNT or CI_HAS_HETZNER_ACCOUNT is unset.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::T-3 edge-cloudflare-tunnel AC-13002-1 real-account-connector-healthy declared and skipped shape (TC-160-real-account-connector-healthy-declared-and-skipped-shape)"
+    },
+    {
+      "id": "TC-160-manifest-schema-validate-refuses-invalid",
+      "acId": "AC-13101-1",
+      "description": "Cover AC-13101-1 via anatomy test: manifest-schema-validate probe passes on the canonical fixture manifests and fails under the three fixture-side mutations SIMULATE_MANIFEST_INVALID_TUNNEL_ID, SIMULATE_MANIFEST_CREDENTIALS_INLINE and SIMULATE_MANIFEST_MISSING_CATCHALL naming the offending field.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::T-3 edge-cloudflare-tunnel AC-13101-1 manifest schema validate refuses invalid (TC-160-manifest-schema-validate-refuses-invalid)"
+    },
+    {
+      "id": "TC-160-cloudflared-config-lint-passes-and-refuses-invalid-ingress",
+      "acId": "AC-13102-1",
+      "description": "Cover AC-13102-1 via anatomy test: cloudflared-config-lint probe runs cloudflared tunnel ingress validate through the cloudflare/cloudflared container image and exits 0 on the canonical fixture; fails under SIMULATE_INGRESS_INVALID naming the offending line.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::T-3 edge-cloudflare-tunnel AC-13102-1 cloudflared-config-lint passes and refuses invalid ingress (TC-160-cloudflared-config-lint-passes-and-refuses-invalid-ingress)"
+    },
+    {
+      "id": "TC-160-no-public-origin-port-refused",
+      "acId": "AC-13201-1",
+      "description": "Cover AC-13201-1 via anatomy test: manifest-schema-validate refuses under SIMULATE_ORIGIN_PORT_OPEN when an ingress rule service URL binds to a host public interface; the T-1 firewall on the ci-throwaway manifest stays 22 open plus 80/443 open only when a reverse proxy is applied.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::T-3 edge-cloudflare-tunnel AC-13201-1 no public origin port refused (TC-160-no-public-origin-port-refused)"
+    },
+    {
+      "id": "TC-160-aud-presence-flip-on-both-fixture-variants",
+      "acId": "AC-13301-1",
+      "description": "Cover AC-13301-1 via anatomy test: aud-presence-check reads each variant sidecar and asserts the ingress rules attach originRequest.access.aud on the access-gated variant and omit the block on the public-hostname variant.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::T-3 edge-cloudflare-tunnel AC-13301-1 aud-presence-check flips on both fixture variants (TC-160-aud-presence-flip-on-both-fixture-variants)"
+    },
+    {
+      "id": "TC-160-aud-presence-check-refuses-on-drift",
+      "acId": "AC-13302-1",
+      "description": "Cover AC-13302-1 via anatomy test: aud-presence-check FAILS under SIMULATE_AUD_DROP when the gated fixture ingress drifts to omit the originRequest.access block; the finding names the affected rule.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::T-3 edge-cloudflare-tunnel AC-13302-1 aud-presence-check refuses on drift (TC-160-aud-presence-check-refuses-on-drift)"
+    },
+    {
+      "id": "TC-160-credentials-discipline-and-event-secrecy",
+      "acId": "AC-13401-1",
+      "description": "Cover AC-13401-1 via anatomy test: the fixture credentials placeholder documents the 0o400 host mode and secretRef discipline; the event-secrecy scan across lifecycle event bodies passes on canonical fixture and FAILS under SIMULATE_EVENT_SECRECY_LEAK naming the leaked field.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::T-3 edge-cloudflare-tunnel AC-13401-1 credentials discipline and event-secrecy scan (TC-160-credentials-discipline-and-event-secrecy)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-170.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-08T09:03:22.340Z",
+  "updatedAt": "2026-09-08T09:03:32.202Z",
+  "purpose": "Cover the adapter chain AC via the shipped anatomy test at test/blueprint/object-storage-s3-hetzner-anatomy.test.js and via the new probe module hetzner-object-storage-round-trip.mjs driven from the extended infra-s3-and-queue fixture (accountBoundSkipped path without CI_HAS_HETZNER_OBJECT_STORAGE, endpoint-composition mutation via SIMULATE_HETZNER_ENDPOINT_MISSHAPEN)",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-14001-1"
+  ],
+  "id": "TS-170",
+  "usId": "US-14001",
+  "title": "Adapter object-storage-s3 v1.1.0 Hetzner Object Storage: probe module anatomy and fixture-side helper contract",
+  "testCases": [
+    {
+      "id": "TC-170-hetzner-endpoint-round-trip-and-skipped-shape",
+      "acId": "AC-14001-1",
+      "description": "Cover AC-14001-1 via anatomy test: hetzner-endpoint helper composes the vendor pattern <bucket>.<location>.your-objectstorage.com from an elicited bucket and location; the run-hetzner-object-storage-round-trip probe records accountBoundSkipped true and aggregateVerdict pass without CI_HAS_HETZNER_OBJECT_STORAGE; the extended fixture ships hetzner-endpoint.mjs and run-hetzner-object-storage-round-trip.mjs alongside the shipped MinIO and R2 assets; SIMULATE_HETZNER_ENDPOINT_MISSHAPEN true composes an invalid endpoint via the fixture-side shim and the probe FAILS naming the missing subdomain",
+      "status": "pending",
+      "testPointer": "test/blueprint/object-storage-s3-hetzner-anatomy.test.js::adapter object-storage-s3 v1.1.0 hetzner AC-14001-1 endpoint round-trip and skipped shape (TC-170-hetzner-endpoint-round-trip-and-skipped-shape)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-175.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-08T10:51:19.406Z",
+  "updatedAt": "2026-09-08T10:51:55.354Z",
+  "purpose": "Anchor AC-14501-1 via the shipped anatomy test: the hcloud-dry-run-mock probe reads the rendered cloud-init user-data written by the fixture renderer and asserts (a) at least one ssh-ed25519 or ssh-rsa public-key line is present under the deploy user and (b) a write_files or sudoers.d fragment grants NOPASSWD to that user; the probe FAILS on either missing marker. Purity: the three T-1 mocked probes no longer read SIMULATE_ switches inside the probe body; those live in fixture-side shims and alter INPUT only.",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-14501-1"
+  ],
+  "id": "TS-175",
+  "usId": "US-14501",
+  "title": "H-1 patch train verifiers for deploy-hetzner-server 1.0.1: hcloud-dry-run-mock consumes the same rendered cloud-init the real path consumes and asserts an ssh public-key line for the deploy user plus a NOPASSWD sudoers.d entry; ssh baseline check module gains an unmocked purity assertion that no SIMULATE_ branch remains in the probes for T-1",
+  "testCases": [
+    {
+      "id": "TC-175-mock-consumes-rendered-file-and-probe-purity",
+      "acId": "AC-14501-1",
+      "description": "Render the shipped cloud-init.yaml.tmpl against ci-throwaway.json via the fixture renderer with an ssh key material substitution and NOPASSWD sudoers.d fragment for the deploy user. Assert the rendered file appears at hetzner/servers/rendered/ci-throwaway.cloud-init.yaml with at least one ssh-ed25519 or ssh-rsa authorized-keys line under the deploy user and a NOPASSWD directive naming that user. Run the hcloud-dry-run-mock probe: assert the mock reads back that same rendered file and returns pass. Also assert none of the three T-1 mocked probes (cloud-init-render-lint, hcloud-dry-run-mock, manifest-schema-validate) contain the token SIMULATE_ inside the probe body; the switches live only in the fixture-side shims. Anchors AC-14501-1.",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::H-1 deploy-hetzner-server AC-14501-1 mock consumes the same rendered cloud-init and probes carry no SIMULATE reads (TC-175-mock-consumes-rendered-file-and-probe-purity)"
+    }
+  ],
+  "status": "draft"
+}