rcf-lite 0.24.0 → 0.26.0

package/rcf/test-suites/ts-180.json

@@ -0,0 +1,30 @@
+{
+  "createdAt": "2026-09-08T12:20:54.397Z",
+  "updatedAt": "2026-09-08T12:21:44.136Z",
+  "purpose": "Cover AC-15001-1 (no AC-5xxx string survives in the kv blueprint tree) and AC-15001-2 (every shipped kv AC appears as an anchor on at least one probe result) via the kv-anatomy test file whose assertions moved with the re-anchor per dispatch addendum ruling 1",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-15001-1",
+    "AC-15001-2"
+  ],
+  "id": "TS-180",
+  "usId": "US-15001",
+  "title": "H-2 kv re-anchor: probes cite shipped AC-31xxx band, README pointers align, every shipped kv AC covered by a probe with a runtime observable",
+  "testCases": [
+    {
+      "id": "TC-180-no-ac-5xxx-after-re-anchor",
+      "acId": "AC-15001-1",
+      "description": "Cover AC-15001-1 via kv-anatomy test: grep for AC-5 across the kv blueprint tree returns zero hits after H-2 re-anchor; every anchorAcId string in the five kv probes cites AC-31xxx; the kv README chain-slice pointer paragraph names US-31101..US-31108 and no AC-5xxx string remains.",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-cloudflare-kv-anatomy.test.js::H-2 kv AC-15001-1 no AC-5xxx string survives on the kv blueprint tree after re-anchor"
+    },
+    {
+      "id": "TC-180-shipped-kv-ac-coverage-union",
+      "acId": "AC-15001-2",
+      "description": "Cover AC-15001-2 via kv-anatomy test: each of the nine shipped kv ACs (AC-31101-1, AC-31102-1, AC-31103-1, AC-31103-2, AC-31104-1, AC-31105-1, AC-31106-1, AC-31107-1, AC-31108-1) appears in the union of shipped probe results and each cited result is pass; AC-31102-1 is observed via the runtime env.CACHE-grep result on facade-round-trip; AC-31107-1 is observed via the whitelist-scan result on event-secrecy.",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-cloudflare-kv-anatomy.test.js::H-2 kv AC-15001-2 every shipped kv AC appears in the union of probe results with pass verdict"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-181.json

@@ -0,0 +1,30 @@
+{
+  "createdAt": "2026-09-08T12:20:54.783Z",
+  "updatedAt": "2026-09-08T12:21:44.894Z",
+  "purpose": "Cover AC-15101-1 (real HTTP round-trip drives DO facade byte-equal; no pass on credential-presence alone) and AC-15101-2 (all thirteen shipped DO ACs bound as probe anchors) via the DO anatomy test and via the storage-round-trip probe module",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-15101-1",
+    "AC-15101-2"
+  ],
+  "id": "TS-181",
+  "usId": "US-15101",
+  "title": "H-2 DO real storage driver and anchor coverage: real-account-storage-smoke drives a real round-trip against a deployed Worker; all thirteen DO ACs bound as probe anchors",
+  "testCases": [
+    {
+      "id": "TC-181-do-real-storage-round-trip-driver",
+      "acId": "AC-15101-1",
+      "description": "Cover AC-15101-1 via DO anatomy test: real-account-storage-smoke drives a byte-equal HTTP round trip against a deployed Worker route on the account-set branch (or local miniflare/wrangler-dev via wrangler-seam); pass is unreachable from credential-presence alone; the fixture-side mutation switch (returns wrong bytes on read) flips the probe to aggregateVerdict fail with observed and expected bytes named.",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-cloudflare-durable-objects-anatomy.test.js::H-2 DO AC-15101-1 real-account-storage-smoke drives byte-equal round-trip via deployed Worker or wrangler-dev"
+    },
+    {
+      "id": "TC-181-do-thirteen-ac-coverage-union",
+      "acId": "AC-15101-2",
+      "description": "Cover AC-15101-2 via DO anatomy test: each of the thirteen shipped DO ACs (AC-33101-1..AC-33113-1) appears in the union of shipped DO probe results; the five previously-unbound DO ACs (AC-33106-1, AC-33108-1, AC-33109-1, AC-33110-1, AC-33111-1) are bound as additional-result anchors on the wrangler-seam, storage-round-trip and concurrent-increment probes with a runtime observable.",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-cloudflare-durable-objects-anatomy.test.js::H-2 DO AC-15101-2 all thirteen shipped DO ACs appear in the union of probe results with pass verdict"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-182.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-08T12:20:55.203Z",
+  "updatedAt": "2026-09-08T12:21:45.254Z",
+  "purpose": "Cover AC-15201-1 (real 500-message concurrency drive against a live Queues binding on a deployed Worker; no accountBoundSkipped on the account-set branch) via the queue anatomy test and the real-account-concurrency-smoke probe",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-15201-1"
+  ],
+  "id": "TS-182",
+  "usId": "US-15201",
+  "title": "H-2 queue real concurrency driver: real-account-concurrency-smoke publishes 500 messages against a live Queues binding and asserts concurrent processing",
+  "testCases": [
+    {
+      "id": "TC-182-queue-real-concurrency-500-msg",
+      "acId": "AC-15201-1",
+      "description": "Cover AC-15201-1 via queue anatomy test: real-account-concurrency-smoke publishes 500 messages through the producer facade against a live Queues binding on a deployed Worker (or local miniflare/wrangler-dev queue) and asserts observed max-in-flight consumers greater than one and not exceeding the documented push-invocation cap; accountBoundSkipped is never set on the account-set branch; the documented limits URL answered 200 at merge time.",
+      "status": "pending",
+      "testPointer": "test/blueprint/messaging-queue-cloudflare-anatomy.test.js::H-2 queue AC-15201-1 real-account-concurrency-smoke publishes 500 messages and asserts concurrent processing under cap"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-183.json

@@ -0,0 +1,38 @@
+{
+  "createdAt": "2026-09-08T12:20:55.592Z",
+  "updatedAt": "2026-09-08T12:21:46.445Z",
+  "purpose": "Cover AC-15301-1 (connector-healthy provisions hetzner throwaway server and asserts healthy connector count), AC-15301-2 (hostname-routes drives undici and JWT sub-cases with pass-only via real driver evidence), and AC-15301-3 (manifest-schema-validate placeholder becomes fail-with-pointer) via the tunnel anatomy test and the three tunnel probes",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-15301-1",
+    "AC-15301-2",
+    "AC-15301-3"
+  ],
+  "id": "TS-183",
+  "usId": "US-15301",
+  "title": "H-2 tunnel real drivers: connector-healthy runs cloudflared tunnel info against the throwaway hetzner host; hostname-routes drives undici and (with Access) a two-identity JWT probe; manifest-schema-validate placeholder becomes fail-with-pointer",
+  "testCases": [
+    {
+      "id": "TC-183-tunnel-connector-healthy-real-driver",
+      "acId": "AC-15301-1",
+      "description": "Cover AC-15301-1 via tunnel anatomy test: real-account-connector-healthy provisions the throwaway hetzner server via the T-1 hetzner fixture, brings a cloudflared connector up, runs cloudflared tunnel info <name> through a control shim, asserts healthy connector count is at least one, captures tunnelConnectorUp event; hetzner-fixture failure fails the driver with a fixture-step pointer, never warn.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::H-2 tunnel AC-15301-1 real-account-connector-healthy asserts healthy connector count via cloudflared tunnel info"
+    },
+    {
+      "id": "TC-183-tunnel-hostname-routes-real-driver",
+      "acId": "AC-15301-2",
+      "description": "Cover AC-15301-2 via tunnel anatomy test: real-account-tunnel-hostname-routes drives undici for the public-hostname sub-case (pass on HTTP 200 with expected body signature); when CI_HAS_CLOUDFLARE_ACCESS is set, the two-identity JWT sub-case succeeds with JWT and is denied without; accountBoundSkipped is never set on the account-set branch; AUD sub-case stays pass-with-skip when Access is unset.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::H-2 tunnel AC-15301-2 real-account-tunnel-hostname-routes drives undici and (with Access) two-identity JWT"
+    },
+    {
+      "id": "TC-183-manifest-schema-fail-with-pointer",
+      "acId": "AC-15301-3",
+      "description": "Cover AC-15301-3 via tunnel anatomy test: manifest-schema-validate returns aggregateVerdict fail (not warn) with a detail string naming the missing credentials placeholder file and the fixture-setup step that would create it; the warn-on-missing-credentials-placeholder branch is removed.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::H-2 tunnel AC-15301-3 manifest-schema-validate fails with fixture-setup pointer when credentials placeholder is missing"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-184.json

@@ -0,0 +1,38 @@
+{
+  "createdAt": "2026-09-08T12:20:55.987Z",
+  "updatedAt": "2026-09-08T12:21:47.637Z",
+  "purpose": "Cover AC-15401-1 (SIMULATE_ purity across the four Cloudflare-platform blueprints), AC-15401-2 (envelope hygiene: no fail/warn envelopes committed) and AC-15401-3 (probe comment honesty on the four blueprints) via a new h2-cf-platform-probe-integrity anatomy test that greps the shipped tree and reads the committed envelopes",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-15401-1",
+    "AC-15401-2",
+    "AC-15401-3"
+  ],
+  "id": "TS-184",
+  "usId": "US-15401",
+  "title": "H-2 cross-cutting probe hygiene: no SIMULATE_ in shipped probes on the four blueprints; no fail envelope committed; probe comments name test doubles honestly",
+  "testCases": [
+    {
+      "id": "TC-184-simulate-purity-four-blueprints",
+      "acId": "AC-15401-1",
+      "description": "Cover AC-15401-1 via new h2-cf-platform-probe-integrity anatomy test: a recursive grep for the token SIMULATE_ across contributions/probes/*.mjs on the four Cloudflare-platform blueprints returns zero hits; every fixture shim under packages/rcf-lite/test/fixtures/cf-platform/ and .../cf-edge/ that carries a mutation switch has a file name prefixed h2-cf-platform-probe-integrity or h2-cf; FAIL tails from each moved switch are recorded in the PR provenance transcript at Group D close.",
+      "status": "pending",
+      "testPointer": "test/blueprint/h2-cf-platform-probe-integrity.test.js::H-2 hygiene AC-15401-1 SIMULATE_ purity across the four Cloudflare-platform probe trees"
+    },
+    {
+      "id": "TC-184-envelope-hygiene-four-blueprints",
+      "acId": "AC-15401-2",
+      "description": "Cover AC-15401-2 via new h2-cf-platform-probe-integrity anatomy test: every committed envelope under .rcf/reports/blueprints/{platform-cloudflare-kv, platform-cloudflare-durable-objects, messaging-queue-cloudflare, edge-cloudflare-tunnel}/ carries aggregateVerdict pass; the previously committed fail envelope at .rcf/reports/blueprints/platform-cloudflare-kv/event-secrecy.json is replaced with a shipped-code pass envelope.",
+      "status": "pending",
+      "testPointer": "test/blueprint/h2-cf-platform-probe-integrity.test.js::H-2 hygiene AC-15401-2 no fail or warn envelope committed under .rcf/reports on the four blueprints"
+    },
+    {
+      "id": "TC-184-marker-hygiene-four-blueprints",
+      "acId": "AC-15401-3",
+      "description": "Cover AC-15401-3 via new h2-cf-platform-probe-integrity anatomy test: every stage-1 marker-flagged probe comment or probe-utils comment on the four blueprints is either reworded to name the local test double honestly (in-memory KV driver realising the Workers KV binding shape; synthetic WebSocket pair; elicited deterministic clock; explicit follow-up work-item note in place of not-yet) or listed as adjudicated acceptable in the PR body's stage-1 adjudication table with a stated reason.",
+      "status": "pending",
+      "testPointer": "test/blueprint/h2-cf-platform-probe-integrity.test.js::H-2 hygiene AC-15401-3 probe comments name test doubles honestly on the four blueprints"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/user-stories/us-11001.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T23:55:32.229Z",
+  "updatedAt": "2026-09-07T23:55:46.775Z",
+  "usId": "US-11001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-110",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 provisioner opens on boot with sole HETZNER_ACCOUNT_API_KEY reader and emits provisionerReady with metadata-only payload",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint on a Node project that provisions a Hetzner Cloud VM",
+  "iWant": "the provisioner facade to be the sole reader of the Hetzner API token (via security-secrets-management) and to fire provisionerReady with a metadata-only payload when it opens on boot",
+  "soThat": "the applying project has one auditable seam for the token and the observability sink surfaces the ready event without a secret",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11001-1",
+      "description": "On boot of the shared throwaway-Hetzner-server fixture the provisioner facade opens, and (a) only the provisioner module reads HETZNER_ACCOUNT_API_KEY (grep across the fixture source refuses any other reader), (b) the facade emits a provisionerReady event whose payload carries tool and apiHost only (no token, no ssh key, no user data body).",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3801-deploy-hetzner-server-provisioner"
+  ]
+}

package/rcf/user-stories/us-11101.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T23:56:32.763Z",
+  "updatedAt": "2026-09-07T23:56:33.164Z",
+  "usId": "US-11101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-111",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 server manifest schema at hetzner/servers/name.json validates and names type location image ssh-key ids firewall id network id cloud-init path labels",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint",
+  "iWant": "the applying project's hetzner/servers/name.json manifests to validate against a shipped JSON Schema naming type, location, image, sshKeyIds, firewallId, networkId, cloudInitPath, labels, snapshotCadence",
+  "soThat": "the operator has a stable declarative source of truth for every server",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11101-1",
+      "description": "Every hetzner/servers/*.json under the shared throwaway-Hetzner-server fixture parses, validates against blueprints/deploy-hetzner-server/contributions/schemas/hetzner-server.schema.json, and carries the nine named fields with correct types; an induced defect (SIMULATE_MANIFEST_INVALID=true replaces location with an unknown token) fails schema validation naming the offending field.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3802-deploy-hetzner-server-manifest-schema"
+  ]
+}

package/rcf/user-stories/us-11102.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T23:56:33.351Z",
+  "updatedAt": "2026-09-07T23:56:33.765Z",
+  "usId": "US-11102",
+  "prdId": "PRD-001",
+  "reqId": "REQ-111",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 applying the provisioner reads each manifest and creates a matching live server, hetznerServerProvisioned event carries id primary IPv4 location server-type",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint against a Hetzner project",
+  "iWant": "applying the provisioner to read each manifest under hetzner/servers/, create a matching live Hetzner Cloud server, and emit hetznerServerProvisioned with id, primaryIpv4, location, serverType",
+  "soThat": "the manifest is the source of truth for what actually exists in the project",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11102-1",
+      "description": "The real-account-throwaway-server-provision probe (accountBound: true, skipped without CI_HAS_HETZNER_ACCOUNT) applies the ci-throwaway.json manifest via provision.mjs, asserts (a) hcloud server list --output json shows the new server whose id is written to the fixture scratch file, (b) hetznerServerProvisioned fired with id, primaryIpv4, location=fsn1, serverType=cx23; teardown via destroy.mjs runs regardless of probe verdict.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3801-deploy-hetzner-server-provisioner",
+    "TAC-3802-deploy-hetzner-server-manifest-schema"
+  ]
+}

package/rcf/user-stories/us-11201.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T23:56:33.951Z",
+  "updatedAt": "2026-09-07T23:57:58.302Z",
+  "usId": "US-11201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-112",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 cloud-init template lands the six hardening baseline blocks in the rendered YAML for every provisioned server",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint",
+  "iWant": "the shipped cloud-init template to render YAML that lands SSH key-only, root disabled, UFW default-deny incoming, DOCKER-USER iptables chain, fail2ban SSH jail and unattended-upgrades on every server",
+  "soThat": "the operator inherits the six-block hardening baseline without hand-authoring per host",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11201-1",
+      "description": "cloud-init-render-lint.mjs renders the template with the fixture manifest and asserts each of the six baseline blocks (SSH key-only, root disabled, UFW default-deny incoming, DOCKER-USER iptables chain, fail2ban SSH jail, unattended-upgrades) appears in the rendered YAML by grep; a mutation SIMULATE_HARDENING_DRIFT=true removes the unattended-upgrades block and the probe FAILS with a message naming the missing line.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3803-deploy-hetzner-server-cloud-init-template"
+  ]
+}

package/rcf/user-stories/us-11202.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T23:56:34.564Z",
+  "updatedAt": "2026-09-07T23:57:58.489Z",
+  "usId": "US-11202",
+  "prdId": "PRD-001",
+  "reqId": "REQ-112",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 provisioned server is hardened at runtime: root ssh refused, password auth refused, UFW active default-deny, DOCKER-USER present, unattended-upgrades service active",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint on a real Hetzner account",
+  "iWant": "the provisioned server to be hardened at runtime as the rendered cloud-init promised: root ssh refused, password auth refused, UFW active default-deny incoming, DOCKER-USER present, unattended-upgrades service active",
+  "soThat": "the operator can trust the cloud-init contract without ssh-in-and-check for every server",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11202-1",
+      "description": "real-account-cloud-init-hardened.mjs (accountBound: true, skipped without CI_HAS_HETZNER_ACCOUNT) waits for cloud-init status --wait on the throwaway server, then ssh-checks the six baseline blocks and asserts each check passes; failure names the missing block. Teardown via destroy.mjs runs regardless.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3803-deploy-hetzner-server-cloud-init-template"
+  ]
+}

package/rcf/user-stories/us-11301.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T23:56:35.165Z",
+  "updatedAt": "2026-09-07T23:56:35.601Z",
+  "usId": "US-11301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-113",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 firewall rule shape: 22 from operator-nominated prefixes, 80 and 443 open, all other inbound denied, applied at provision time",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint",
+  "iWant": "the firewall rule set carried in hetzner/servers/name.json to permit 22 only from an operator-nominated set of source-prefix ranges, permit 80 and 443 from 0.0.0.0/0 for the reverse proxy, and deny all other inbound; the provisioner applies the rules at provision time",
+  "soThat": "the operator inherits a documented least-privilege firewall shape on every server without opening ssh to the world",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11301-1",
+      "description": "manifest-schema-validate.mjs asserts every fixture manifest carries a firewall rule set matching the shape (22 permitted only from a nonempty list of source-prefix ranges; 80 and 443 permitted; no other inbound rule); an induced defect (a manifest that opens 22 to 0.0.0.0/0) fails schema validation with a message naming the offending rule.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3802-deploy-hetzner-server-manifest-schema",
+    "TAC-3804-deploy-hetzner-server-firewall-shape"
+  ]
+}

package/rcf/user-stories/us-11401.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T23:56:35.790Z",
+  "updatedAt": "2026-09-07T23:56:36.205Z",
+  "usId": "US-11401",
+  "prdId": "PRD-001",
+  "reqId": "REQ-114",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 snapshot cadence file present under the manifest set, cadence value elicited (weekly default, daily and off alternatives) matches the schema",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint",
+  "iWant": "the elicited snapshot cadence value on hetzner/servers/name.json to match the shipped enum (weekly, daily, off), with weekly the recommended default per ADR-3802",
+  "soThat": "the operator has a single project-wide answer for how often each server snapshots",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11401-1",
+      "description": "manifest-schema-validate.mjs asserts every fixture manifest carries snapshotCadence with a value in the shipped enum {weekly, daily, off}; a manifest missing the field fails schema validation naming the missing field.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3802-deploy-hetzner-server-manifest-schema"
+  ]
+}

package/rcf/user-stories/us-11402.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T23:56:36.391Z",
+  "updatedAt": "2026-09-07T23:56:36.806Z",
+  "usId": "US-11402",
+  "prdId": "PRD-001",
+  "reqId": "REQ-114",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 snapshot-on-demand verb fires the hcloud snapshot verb, tags the snapshot with server name and wall-clock time, hetznerSnapshotTaken event fires with snapshot id",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint on a real Hetzner account",
+  "iWant": "the snapshot-on-demand verb on the provisioner to shell to hcloud image create-image (or the raw-api equivalent) and tag the snapshot with server name and wall-clock time; hetznerSnapshotTaken carries snapshot id and time",
+  "soThat": "the operator has a documented on-demand recovery point at any moment",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11402-1",
+      "description": "real-account-snapshot-on-demand.mjs (accountBound: true, skipped without CI_HAS_HETZNER_ACCOUNT) fires the snapshot verb on the throwaway server, then asserts hcloud image list --type=snapshot --output json shows a snapshot tagged with the server name and current wall-clock time; hetznerSnapshotTaken event carries snapshot id and time. Teardown via destroy.mjs.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3801-deploy-hetzner-server-provisioner"
+  ]
+}

package/rcf/user-stories/us-11501.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T23:56:36.993Z",
+  "updatedAt": "2026-09-07T23:56:37.410Z",
+  "usId": "US-11501",
+  "prdId": "PRD-001",
+  "reqId": "REQ-115",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 four lifecycle events fire with metadata-only payloads, no secret leaks through any event body",
+  "asA": "shelf consumer applying the deploy-hetzner-server v1.0.0 blueprint",
+  "iWant": "the provisioner facade to fire the four lifecycle events (provisionerReady, hetznerServerProvisioned, hetznerSnapshotTaken, hetznerServerDestroyed) with metadata-only payloads (id, primaryIpv4, location, serverType, snapshotId, wallClockTime) and no secret content",
+  "soThat": "the observability sink carries the operational trail without ever leaking a token or an ssh key",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11501-1",
+      "description": "hcloud-dry-run-mock.mjs drives every lifecycle event through the facade against a mocked hcloud shim; the accumulated event stream carries only the metadata fields named; a mutation (event-secrecy leak: inject the token into the hetznerServerProvisioned payload) FAILS the probe with a defensive-fake finding.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3801-deploy-hetzner-server-provisioner"
+  ]
+}

package/rcf/user-stories/us-12001.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T01:41:01.418Z",
+  "updatedAt": "2026-09-08T01:42:32.120Z",
+  "usId": "US-12001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-120",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 compose.yaml at repo root is the single-source runtime topology (service-per-container, named networks and volumes, .env for non-secret config)",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint on a project that runs its stack on a Hetzner cloudHost",
+  "iWant": "a single compose.yaml at the repo root to declare every service as one container with explicit named networks, named volumes, and non-secret config in a .env file",
+  "soThat": "the runtime topology has one auditable seam and the container host can bring the stack up from the file alone",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-12001-1",
+      "description": "The shared throwaway-server fixture ships compose.yaml at the fixture root with (a) every service running exactly one container image (service-per-container), (b) at least one named network under the top-level networks key, (c) at least one named volume under the top-level volumes key, and (d) non-secret config values are read via a colocated .env file rather than inlined into service environment entries.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3901-platform-docker-compose-host-compose-layout"
+  ]
+}

package/rcf/user-stories/us-12101.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T01:41:59.208Z",
+  "updatedAt": "2026-09-08T01:42:32.309Z",
+  "usId": "US-12101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-121",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 secrets flow via docker compose secrets file mounts (no plaintext literal in compose.yaml)",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint on a project with secret material bound to a container",
+  "iWant": "every secret to be declared under the compose secrets top-level key and mounted into the service via secrets: rather than inlined as an environment literal",
+  "soThat": "the compose file is safe to read at review time and the mounted file inherits 0o400 inside the container",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-12101-1",
+      "description": "The fixture compose.yaml declares at least one secret under the top-level secrets key with a file: source, references it from the web service through the service-level secrets: array, and no plaintext value for that secret appears anywhere in compose.yaml (grep-refuses on the literal). The secret file mode is 0o400 inside the container.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3902-platform-docker-compose-host-secrets-mount"
+  ]
+}

package/rcf/user-stories/us-12102.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T01:44:43.238Z",
+  "updatedAt": "2026-09-08T01:44:43.862Z",
+  "usId": "US-12102",
+  "prdId": "PRD-001",
+  "reqId": "REQ-121",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 cross-cutting secretsAreFiles: the source-tree scan refuses any plaintext secret literal in compose.yaml or a referenced service config",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint on a project with sensitive material",
+  "iWant": "the secrets-as-files probe to walk compose.yaml and every service config in the fixture and refuse on any plaintext secret literal, naming the file and line",
+  "soThat": "a secret accidentally inlined in a review is caught by the probe before docker compose up runs",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-12102-1",
+      "description": "The secrets-as-files-scan probe walks compose.yaml plus every referenced service config file in the fixture and asserts (a) no line contains a plaintext token pattern (the applied literal name plus the applied literal value), (b) every declared secret in the compose secrets: key has a file: source, and (c) SIMULATE_PLAINTEXT_SECRET=true writes a plaintext literal into compose.yaml and the probe FAILS naming the file and the literal.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3902-platform-docker-compose-host-secrets-mount"
+  ]
+}

package/rcf/user-stories/us-12201.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T01:42:40.956Z",
+  "updatedAt": "2026-09-08T01:42:41.556Z",
+  "usId": "US-12201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-122",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 healthcheck contract: docker compose config refuses when an HTTP-terminating service is missing a healthcheck block",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint on a project that terminates HTTP inside a container",
+  "iWant": "the compose config lint to refuse at gate time on any HTTP-terminating service that is missing a healthcheck block, naming the service",
+  "soThat": "the stack never comes up with a service the container host cannot know is ready",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-12201-1",
+      "description": "The compose-config-lint probe shells to docker compose config against the fixture compose.yaml, asserts exit 0, and additionally asserts every HTTP-terminating service declares a healthcheck: block. SIMULATE_MISSING_HEALTHCHECK=true strips the block from the web service and the probe FAILS naming the service.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3903-platform-docker-compose-host-healthcheck-lint"
+  ]
+}

package/rcf/user-stories/us-12202.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-08T01:42:41.742Z",
+  "updatedAt": "2026-09-08T01:42:42.341Z",
+  "usId": "US-12202",
+  "prdId": "PRD-001",
+  "reqId": "REQ-122",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 cross-cutting upClean: the stack comes up clean and every declared service reaches healthy",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint on a Hetzner cloudHost",
+  "iWant": "the real-account minimal-stack-up probe to scp the compose.yaml to the throwaway server, run docker compose up -d --wait, and assert every declared service reaches healthy inside the elicited timeout",
+  "soThat": "the composeStackReady claim is proven on real docker before the blueprint ships",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-12202-1",
+      "description": "The real-account-minimal-stack-up probe, when CI_HAS_HETZNER_ACCOUNT is set, provisions the throwaway server, scps the compose.yaml, runs docker compose up -d --wait, asserts every declared service reaches healthy inside the elicited timeout, and tears down the stack plus the server in always(). Without CI_HAS_HETZNER_ACCOUNT the probe records accountBoundSkipped: true and the aggregate flips to pass.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3901-platform-docker-compose-host-compose-layout",
+    "TAC-3903-platform-docker-compose-host-healthcheck-lint"
+  ]
+}

package/rcf/user-stories/us-12301.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T01:42:42.527Z",
+  "updatedAt": "2026-09-08T01:42:43.125Z",
+  "usId": "US-12301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-123",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 restart discipline: unless-stopped on long-running, on-failure on jobs; unclassified value refuses at lint",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint",
+  "iWant": "the compose config lint to enforce a restart policy on every service and refuse on any value outside the two allowed policies (unless-stopped for long-running, on-failure for jobs)",
+  "soThat": "the operator sees a wrong or missing restart policy at gate time rather than as a stuck container",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-12301-1",
+      "description": "The compose-config-lint probe asserts every service in the compose.yaml declares a restart policy AND every declared value is one of unless-stopped or on-failure. SIMULATE_UNCLASSIFIED_RESTART=true sets restart: always on the web service and the probe FAILS naming the service and the disallowed value.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3903-platform-docker-compose-host-healthcheck-lint"
+  ]
+}

package/rcf/user-stories/us-12401.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T01:42:43.312Z",
+  "updatedAt": "2026-09-08T01:42:43.912Z",
+  "usId": "US-12401",
+  "prdId": "PRD-001",
+  "reqId": "REQ-124",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 reverse-proxy config as a first-class versioned artefact (caddy/Caddyfile) validated by the vendor validator",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint with reverseProxy=caddy",
+  "iWant": "a checked-in caddy/Caddyfile bind-mounted into the proxy service so the reload verb picks up an operator change, validated at gate time by caddy validate",
+  "soThat": "a broken Caddyfile is caught before the reload burst runs, and there is one place in the tree the operator edits to route hostnames",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-12401-1",
+      "description": "The fixture ships caddy/Caddyfile at the fixture root under a caddy/ directory, the compose file bind-mounts it read-only into the caddy service, and the caddyfile-validate probe shells to caddy validate against the file and asserts exit 0. SIMULATE_INVALID_CADDYFILE=true writes an invalid directive into a scratch copy and the probe FAILS naming the line. Skipped when the applied reverseProxy is not caddy.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3904-platform-docker-compose-host-reverse-proxy-artefact"
+  ]
+}

package/rcf/user-stories/us-12402.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T01:42:44.098Z",
+  "updatedAt": "2026-09-08T01:42:44.701Z",
+  "usId": "US-12402",
+  "prdId": "PRD-001",
+  "reqId": "REQ-124",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 cross-cutting zeroDowntimeReload: a client burst against the proxy during a config reload sees no non-2xx and no dropped connection inside the elicited window",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint",
+  "iWant": "the real-account reload-burst probe to fire an undici burst against the reverse proxy while docker compose exec caddy caddy reload runs and assert no non-2xx or dropped connection inside the elicited window",
+  "soThat": "the zero-downtime reload claim is proven on real docker before the blueprint ships",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-12402-1",
+      "description": "The real-account-reload-burst probe, when CI_HAS_HETZNER_ACCOUNT is set, runs undici GETs against the proxy service on the throwaway server while docker compose exec caddy caddy reload runs, asserts every request returns a 2xx status inside the elicited window (10 s default), asserts no dropped connection, tears the stack down in always(). Without CI_HAS_HETZNER_ACCOUNT the probe records accountBoundSkipped: true and the aggregate flips to pass.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3904-platform-docker-compose-host-reverse-proxy-artefact"
+  ]
+}

package/rcf/user-stories/us-12501.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T01:42:44.888Z",
+  "updatedAt": "2026-09-08T01:42:45.499Z",
+  "usId": "US-12501",
+  "prdId": "PRD-001",
+  "reqId": "REQ-125",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 log shipping to the elicited observability-logging sink (journald default; loki opt-in)",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint on a project that may run Grafana or the estate default",
+  "iWant": "the elicited log driver to be wired into every service in the compose file (journald default, loki opt-in) and the choice recorded on the log-driver ADR",
+  "soThat": "the container stdout and stderr reach the applied observability sink without a per-service edit",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-12501-1",
+      "description": "Every service in the fixture compose.yaml declares a logging: driver: block whose driver value matches the elicited log driver (default journald). The compose-config-lint probe asserts (a) every service declares logging: driver, (b) the value is one of journald or loki, and (c) SIMULATE_UNCLASSIFIED_LOG_DRIVER=true sets a disallowed driver and the probe FAILS naming the service and the disallowed value.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3903-platform-docker-compose-host-healthcheck-lint"
+  ]
+}