rcf-lite 0.24.0 → 0.26.0

package/blueprints/deploy-hetzner-server/contributions/probes/manifest-schema-validate.mjs

@@ -0,0 +1,182 @@
+// Probe: manifest schema validate.
+//
+// anchorAcId: AC-37102-1 (also covers AC-37106-1 firewall shape and
+// AC-37107-1 snapshot cadence enum via the same schema). accountBound: false.
+//
+// Validates every hetzner/servers/*.json under the shared throwaway-server
+// fixture against blueprints/deploy-hetzner-server/contributions/schemas/
+// hetzner-server.schema.json. A lightweight in-process draft-07 subset
+// validator ships with the probe so the shelf gains no runtime dependency
+// on ajv or similar. See validate() at the bottom.
+//
+// Purity: the probe reads only the manifest dir and the shipped schema;
+// no process.env.SIMULATE_ switch is read here. The fixture-side shim
+// packages/rcf-lite/test/fixtures/hetzner-throwaway-server/
+// run-manifest-schema-validate.mjs is the sole reader of
+// SIMULATE_MANIFEST_INVALID and it mutates INPUT (a temp manifest dir
+// pointed at via RCF_FIXTURE_MANIFEST_DIR) only; the probe then FAILS
+// naming the offending field per hetzner-round-7-spec-2026-09-07.md
+// section 3.4 lesson 4. H-1 (2026-09-08).
+
+import { readFile } from 'node:fs/promises';
+import { readManifestFiles, SCHEMA_PATH } from './probe-utils.mjs';
+
+export const anchorAcId = 'AC-37102-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const schema = JSON.parse(await readFile(SCHEMA_PATH, 'utf8'));
+  const { present, files } = await readManifestFiles();
+  if (!present) {
+    return {
+      results: [{
+        anchorAcId,
+        verdict: 'fail',
+        detail: 'fixture hetzner/servers/ holds zero JSON files; ship at least ci-throwaway.json.',
+      }],
+    };
+  }
+  const results = [];
+  for (const f of files) {
+    let doc;
+    try {
+      doc = JSON.parse(f.text);
+    } catch (err) {
+      results.push({
+        anchorAcId,
+        verdict: 'fail',
+        detail: `manifest ${f.name} does not parse: ${err.message}`,
+      });
+      continue;
+    }
+    const errors = validate(schema, doc, `#/${f.name}`);
+    if (errors.length > 0) {
+      for (const e of errors) {
+        const anchor = anchorForError(e);
+        results.push({
+          anchorAcId: anchor,
+          verdict: 'fail',
+          detail: `manifest ${f.name} schema violation at ${e.path}: ${e.message}`,
+        });
+      }
+    } else {
+      results.push({
+        anchorAcId,
+        verdict: 'pass',
+        detail: `manifest ${f.name} validates against hetzner-server.schema.json (nine required fields, firewall rule shape, snapshotCadence enum all satisfied).`,
+      });
+    }
+  }
+  return {
+    results,
+    extra: {
+      manifestCount: files.length,
+      manifestNames: files.map((f) => f.name),
+    },
+  };
+}
+
+function anchorForError(err) {
+  if (err.field === 'firewallRules' || (err.path || '').includes('firewallRules')) {
+    return 'AC-37106-1';
+  }
+  if (err.field === 'snapshotCadence' || (err.path || '').includes('snapshotCadence')) {
+    return 'AC-37107-1';
+  }
+  return 'AC-37102-1';
+}
+
+// Draft-07 subset validator: required, type, enum, minLength, minItems,
+// additionalProperties, items, properties, required-on-array-items.
+// Extra rule: on firewallRules the ssh rule sourceIps must NOT include
+// 0.0.0.0/0 (per TAC-3804); handled after schema validation.
+export function validate(schema, doc, pathPrefix = '#') {
+  const errors = [];
+  walk(schema, doc, pathPrefix, errors);
+  if (Array.isArray(doc.firewallRules)) {
+    const ssh = doc.firewallRules.find((r) => r && r.name === 'ssh');
+    if (ssh && Array.isArray(ssh.sourceIps) && ssh.sourceIps.some((s) => s === '0.0.0.0/0' || s === '::/0')) {
+      errors.push({
+        path: `${pathPrefix}/firewallRules/ssh/sourceIps`,
+        field: 'firewallRules',
+        message: 'ssh rule sourceIps must not include 0.0.0.0/0 or ::/0; use an operator-nominated set per TAC-3804.',
+      });
+    }
+    const need = ['ssh', 'http', 'https'];
+    for (const n of need) {
+      if (!doc.firewallRules.some((r) => r && r.name === n)) {
+        errors.push({
+          path: `${pathPrefix}/firewallRules`,
+          field: 'firewallRules',
+          message: `firewallRules is missing the required ${n} rule per TAC-3804.`,
+        });
+      }
+    }
+  }
+  return errors;
+}
+
+function walk(schema, value, path, errors) {
+  if (!schema || typeof schema !== 'object') return;
+  if (Array.isArray(schema.required) && typeof value === 'object' && value !== null && !Array.isArray(value)) {
+    for (const k of schema.required) {
+      if (!(k in value)) {
+        errors.push({ path: `${path}/${k}`, field: k, message: `missing required field ${k}` });
+      }
+    }
+  }
+  if (schema.type) {
+    const typeOk = checkType(schema.type, value);
+    if (!typeOk) {
+      errors.push({ path, message: `expected type ${JSON.stringify(schema.type)}, got ${jsType(value)}` });
+      return;
+    }
+  }
+  if (Array.isArray(schema.enum) && !schema.enum.includes(value)) {
+    errors.push({ path, message: `value ${JSON.stringify(value)} is not in enum ${JSON.stringify(schema.enum)}` });
+  }
+  if (typeof schema.minLength === 'number' && typeof value === 'string' && value.length < schema.minLength) {
+    errors.push({ path, message: `string shorter than minLength ${schema.minLength}` });
+  }
+  if (typeof schema.minItems === 'number' && Array.isArray(value) && value.length < schema.minItems) {
+    errors.push({ path, message: `array shorter than minItems ${schema.minItems}` });
+  }
+  if (schema.type === 'object' && schema.additionalProperties === false && value && typeof value === 'object') {
+    const known = new Set(Object.keys(schema.properties || {}));
+    for (const k of Object.keys(value)) {
+      if (!known.has(k)) {
+        errors.push({ path: `${path}/${k}`, field: k, message: `unknown field ${k} (additionalProperties false)` });
+      }
+    }
+  }
+  if (schema.properties && value && typeof value === 'object' && !Array.isArray(value)) {
+    for (const [k, sub] of Object.entries(schema.properties)) {
+      if (k in value) walk(sub, value[k], `${path}/${k}`, errors);
+    }
+  }
+  if (schema.items && Array.isArray(value)) {
+    value.forEach((v, i) => walk(schema.items, v, `${path}/${i}`, errors));
+  }
+}
+
+function checkType(type, value) {
+  const types = Array.isArray(type) ? type : [type];
+  return types.some((t) => matchType(t, value));
+}
+
+function matchType(t, value) {
+  if (t === 'null') return value === null;
+  if (t === 'array') return Array.isArray(value);
+  if (t === 'object') return typeof value === 'object' && value !== null && !Array.isArray(value);
+  if (t === 'integer') return Number.isInteger(value);
+  if (t === 'number') return typeof value === 'number';
+  if (t === 'string') return typeof value === 'string';
+  if (t === 'boolean') return typeof value === 'boolean';
+  return false;
+}
+
+function jsType(v) {
+  if (v === null) return 'null';
+  if (Array.isArray(v)) return 'array';
+  return typeof v;
+}

package/blueprints/deploy-hetzner-server/contributions/probes/probe-utils.mjs

@@ -0,0 +1,112 @@
+// Shared helpers for deploy-hetzner-server probes.
+//
+// Runtime-dependency posture:
+// - cloud-init-render-lint, manifest-schema-validate and
+//   hcloud-dry-run-mock run in-process against the shared throwaway-
+//   server fixture at packages/rcf-lite/test/fixtures/hetzner-throwaway-
+//   server/. No real API call fires; hcloud is mocked via
+//   src/hcloud-mock.mjs so the shim never crosses the process boundary.
+// - real-account-* probes call the fixture's provision.mjs / destroy.mjs
+//   / snapshot verbs. Without CI_HAS_HETZNER_ACCOUNT they record
+//   accountBoundSkipped: true and the aggregate flips to pass per
+//   hetzner-round-7-spec-2026-09-07.md section 3.5.
+
+import { mkdir, writeFile, readFile, readdir } from 'node:fs/promises';
+import { dirname, resolve, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(
+  PROJECT_ROOT,
+  'packages/rcf-lite/test/fixtures/hetzner-throwaway-server',
+);
+// Config override, not a mutation switch: the fixture-side shim for
+// manifest-schema-validate may write a mutated copy to a scratch dir
+// and point MANIFEST_DIR at it via RCF_FIXTURE_MANIFEST_DIR so the
+// probe stays SIMULATE-free (H-1 mutation-purity gate row, 2026-09-08).
+export const MANIFEST_DIR = process.env.RCF_FIXTURE_MANIFEST_DIR
+  ? resolve(process.env.RCF_FIXTURE_MANIFEST_DIR)
+  : resolve(FIXTURE_DIR, 'hetzner/servers');
+export const SCHEMA_PATH = resolve(HERE, '..', 'schemas', 'hetzner-server.schema.json');
+export const REPORT_DIR = resolve(
+  PROJECT_ROOT,
+  '.rcf/reports/blueprints/deploy-hetzner-server',
+);
+
+export function aggregate(results) {
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+
+export function isSkipped(results) {
+  return results.length > 0 && results.every((r) => r.accountBoundSkipped === true);
+}
+
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const rawVerdict = aggregate(results);
+  const aggregateVerdict = isSkipped(results) ? 'pass' : rawVerdict;
+  const report = {
+    slug: 'deploy-hetzner-server',
+    probeName,
+    runAt: new Date().toISOString(),
+    engine,
+    results,
+    aggregateVerdict,
+    ...(extra ?? {}),
+  };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = (await mainFn()) ?? { results: [] };
+    const { results, extra } = outcome;
+    const { report, path } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    const results = [{
+      anchorAcId: 'unknown',
+      verdict: 'fail',
+      detail: `probe threw: ${err && err.message ? err.message : String(err)}`,
+    }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err && err.stack ? err.stack : String(err)}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}
+
+export async function readManifestFiles(dir = MANIFEST_DIR) {
+  let entries;
+  try {
+    entries = (await readdir(dir))
+      .filter((f) => f.endsWith('.json'))
+      .sort();
+  } catch (err) {
+    return { present: false, entries: [], files: [], error: err.message };
+  }
+  const files = [];
+  for (const name of entries) {
+    const p = join(dir, name);
+    const text = await readFile(p, 'utf8');
+    files.push({ name, path: p, text });
+  }
+  return { present: entries.length > 0, entries, files };
+}
+
+export function accountBoundSkippedResult(anchorAcId, note) {
+  return {
+    anchorAcId,
+    verdict: 'skipped',
+    accountBoundSkipped: true,
+    detail: `accountBound: CI_HAS_HETZNER_ACCOUNT unset; ${note}`,
+  };
+}

package/blueprints/deploy-hetzner-server/contributions/probes/real-account-cloud-init-hardened.mjs

@@ -0,0 +1,64 @@
+// Probe: real-account cloud-init hardened.
+//
+// anchorAcId: AC-37105-1. accountBound: true.
+//
+// Without CI_HAS_HETZNER_ACCOUNT the probe records
+// accountBoundSkipped: true and the aggregate flips to pass.
+//
+// With the env var set the probe:
+//   - provisions the throwaway server via the fixture provision.mjs;
+//   - shells cloud-init status --wait over ssh to the throwaway server;
+//   - runs the six baseline checks over ssh (grep for the marker per
+//     baseline block); FAILS naming the first missing block on any
+//     defect.
+//   - always() calls destroy.mjs regardless of verdict.
+
+import { accountBoundSkippedResult, FIXTURE_DIR } from './probe-utils.mjs';
+import { resolve } from 'node:path';
+
+export const anchorAcId = 'AC-37105-1';
+export const accountBound = true;
+
+export default async function runProbe() {
+  if (process.env.CI_HAS_HETZNER_ACCOUNT !== 'true') {
+    return {
+      results: [accountBoundSkippedResult(anchorAcId, 'real-account cloud-init hardened check skipped; run with CI_HAS_HETZNER_ACCOUNT=true to exercise the six ssh baseline checks against a throwaway cx23.')],
+    };
+  }
+  const provisionPath = resolve(FIXTURE_DIR, 'provision.mjs');
+  const destroyPath = resolve(FIXTURE_DIR, 'destroy.mjs');
+  const sshCheckPath = resolve(FIXTURE_DIR, 'src/ssh-baseline-check.mjs');
+  const { provisionThrowawayServer } = await import(provisionPath);
+  const { destroyThrowawayServer } = await import(destroyPath);
+  const { runSshBaselineChecks } = await import(sshCheckPath);
+  let provisioned;
+  try {
+    provisioned = await provisionThrowawayServer({ runId: process.env.GITHUB_RUN_ID ?? 'local' });
+    const report = await runSshBaselineChecks(provisioned);
+    const failed = report.checks.filter((c) => c.verdict === 'fail');
+    if (failed.length > 0) {
+      return {
+        results: failed.map((c) => ({
+          anchorAcId,
+          verdict: 'fail',
+          detail: `cloud-init baseline block "${c.label}" failed on server ${provisioned.id}: ${c.detail}`,
+        })),
+      };
+    }
+    const blocks = report.checks.filter((c) => c.verdict === 'pass').map((c) => c.id);
+    return {
+      results: [{
+        anchorAcId,
+        verdict: 'pass',
+        detail: `cloud-init reached terminal state on server ${provisioned.id} (cloud-init status --wait exit ${report.cloudInit ? report.cloudInit.code : 'skipped'}); six baseline hardening blocks observed: ${blocks.join(', ')}.`,
+      }],
+      extra: report,
+    };
+  } catch (err) {
+    return { results: [{ anchorAcId, verdict: 'fail', detail: `check failed: ${err.message}` }] };
+  } finally {
+    if (provisioned && provisioned.id) {
+      try { await destroyThrowawayServer(provisioned); } catch (_) { /* swept by orphan cron */ }
+    }
+  }
+}

package/blueprints/deploy-hetzner-server/contributions/probes/real-account-snapshot-on-demand.mjs

@@ -0,0 +1,60 @@
+// Probe: real-account snapshot on demand.
+//
+// anchorAcId: AC-37108-1. accountBound: true.
+//
+// Without CI_HAS_HETZNER_ACCOUNT the probe records
+// accountBoundSkipped: true and the aggregate flips to pass.
+//
+// With the env var set the probe:
+//   - provisions the throwaway server via provision.mjs;
+//   - fires the snapshot verb on the provisioner facade;
+//   - asserts hcloud image list --type=snapshot --output json shows a
+//     snapshot with the server name and current wall-clock time in the
+//     labels;
+//   - always() calls destroy.mjs regardless of verdict; the snapshot is
+//     deleted as part of destroy.mjs so the run leaves no orphaned
+//     image behind.
+
+import { accountBoundSkippedResult, FIXTURE_DIR } from './probe-utils.mjs';
+import { resolve } from 'node:path';
+
+export const anchorAcId = 'AC-37108-1';
+export const accountBound = true;
+
+export default async function runProbe() {
+  if (process.env.CI_HAS_HETZNER_ACCOUNT !== 'true') {
+    return {
+      results: [accountBoundSkippedResult(anchorAcId, 'real-account snapshot on-demand skipped; run with CI_HAS_HETZNER_ACCOUNT=true to exercise the hcloud image create-image path.')],
+    };
+  }
+  const provisionPath = resolve(FIXTURE_DIR, 'provision.mjs');
+  const destroyPath = resolve(FIXTURE_DIR, 'destroy.mjs');
+  const snapshotPath = resolve(FIXTURE_DIR, 'src/snapshot-verb.mjs');
+  const { provisionThrowawayServer } = await import(provisionPath);
+  const { destroyThrowawayServer } = await import(destroyPath);
+  const { takeAndVerifySnapshot } = await import(snapshotPath);
+  let provisioned;
+  try {
+    provisioned = await provisionThrowawayServer({ runId: process.env.GITHUB_RUN_ID ?? 'local' });
+    const outcome = await takeAndVerifySnapshot(provisioned);
+    if (!outcome.snapshotId) {
+      return {
+        results: [{ anchorAcId, verdict: 'fail', detail: `snapshot verb ran but no matching snapshot appeared in hcloud image list.` }],
+      };
+    }
+    return {
+      results: [{
+        anchorAcId,
+        verdict: 'pass',
+        detail: `snapshot ${outcome.snapshotId} tagged with server name ${provisioned.name} and time ${outcome.wallClockTime} on server ${provisioned.id}.`,
+      }],
+      extra: outcome,
+    };
+  } catch (err) {
+    return { results: [{ anchorAcId, verdict: 'fail', detail: `snapshot verb threw: ${err.message}` }] };
+  } finally {
+    if (provisioned && provisioned.id) {
+      try { await destroyThrowawayServer(provisioned); } catch (_) { /* swept by orphan cron */ }
+    }
+  }
+}

package/blueprints/deploy-hetzner-server/contributions/probes/real-account-throwaway-server-provision.mjs

@@ -0,0 +1,58 @@
+// Probe: real-account throwaway-server provision.
+//
+// anchorAcId: AC-37103-1. accountBound: true.
+//
+// Without CI_HAS_HETZNER_ACCOUNT the probe records
+// accountBoundSkipped: true and the aggregate flips to pass per
+// hetzner-round-7-spec-2026-09-07.md section 3.5.
+//
+// With the env var set the probe:
+//   - runs the fixture's provision.mjs against the ci-throwaway manifest;
+//   - asserts a new server appears in `hcloud server list --output json`
+//     whose id matches the scratch-file-written id;
+//   - asserts the fixture's captured hetznerServerProvisioned event
+//     carries id, primaryIpv4, location=fsn1, serverType=cx23;
+//   - always() calls destroy.mjs so the throwaway server is torn down
+//     regardless of verdict.
+
+import { accountBoundSkippedResult, FIXTURE_DIR } from './probe-utils.mjs';
+import { resolve } from 'node:path';
+
+export const anchorAcId = 'AC-37103-1';
+export const accountBound = true;
+
+export default async function runProbe() {
+  if (process.env.CI_HAS_HETZNER_ACCOUNT !== 'true') {
+    return {
+      results: [accountBoundSkippedResult(anchorAcId, 'real-account throwaway-server provision skipped; run with CI_HAS_HETZNER_ACCOUNT=true to exercise.')],
+    };
+  }
+  const provisionPath = resolve(FIXTURE_DIR, 'provision.mjs');
+  const destroyPath = resolve(FIXTURE_DIR, 'destroy.mjs');
+  const { provisionThrowawayServer } = await import(provisionPath);
+  const { destroyThrowawayServer } = await import(destroyPath);
+  let provisioned;
+  try {
+    provisioned = await provisionThrowawayServer({ runId: process.env.GITHUB_RUN_ID ?? 'local' });
+    return {
+      results: [{
+        anchorAcId,
+        verdict: 'pass',
+        detail: `throwaway server ${provisioned.id} provisioned; hetznerServerProvisioned event captured; primaryIpv4=${provisioned.primaryIpv4} location=${provisioned.location} serverType=${provisioned.serverType}.`,
+      }],
+      extra: { serverId: provisioned.id, primaryIpv4: provisioned.primaryIpv4 },
+    };
+  } catch (err) {
+    return {
+      results: [{
+        anchorAcId,
+        verdict: 'fail',
+        detail: `provision failed: ${err.message}`,
+      }],
+    };
+  } finally {
+    if (provisioned && provisioned.id) {
+      try { await destroyThrowawayServer(provisioned); } catch (_) { /* swept by orphan cron */ }
+    }
+  }
+}

package/blueprints/deploy-hetzner-server/contributions/probes/run-cloud-init-render-lint.mjs

@@ -0,0 +1,9 @@
+import runProbe from './cloud-init-render-lint.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = {
+  kind: 'template-render',
+  image: 'hetzner-throwaway-server fixture (in-process template render)',
+  healthy: true,
+};
+runShim('cloud-init-render-lint', engine, runProbe);

package/blueprints/deploy-hetzner-server/contributions/probes/run-hcloud-dry-run-mock.mjs

@@ -0,0 +1,9 @@
+import runProbe from './hcloud-dry-run-mock.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = {
+  kind: 'facade-round-trip',
+  image: 'hetzner-throwaway-server fixture provisioner facade against a mocked hcloud shim',
+  healthy: true,
+};
+runShim('hcloud-dry-run-mock', engine, runProbe);

package/blueprints/deploy-hetzner-server/contributions/probes/run-manifest-schema-validate.mjs

@@ -0,0 +1,9 @@
+import runProbe from './manifest-schema-validate.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = {
+  kind: 'schema-validate',
+  image: 'hetzner-throwaway-server fixture manifest directory (draft-07 subset in-process)',
+  healthy: true,
+};
+runShim('manifest-schema-validate', engine, runProbe);

package/blueprints/deploy-hetzner-server/contributions/probes/run-real-account-cloud-init-hardened.mjs

@@ -0,0 +1,9 @@
+import runProbe from './real-account-cloud-init-hardened.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = {
+  kind: 'real-account-ssh',
+  image: 'Hetzner Cloud throwaway cx23 with cloud-init user-data (ssh baseline checks)',
+  healthy: true,
+};
+runShim('real-account-cloud-init-hardened', engine, runProbe);

package/blueprints/deploy-hetzner-server/contributions/probes/run-real-account-snapshot-on-demand.mjs

@@ -0,0 +1,9 @@
+import runProbe from './real-account-snapshot-on-demand.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = {
+  kind: 'real-account-snapshot',
+  image: 'Hetzner Cloud throwaway cx23 with snapshot verb via hcloud image create-image',
+  healthy: true,
+};
+runShim('real-account-snapshot-on-demand', engine, runProbe);

package/blueprints/deploy-hetzner-server/contributions/probes/run-real-account-throwaway-server-provision.mjs

@@ -0,0 +1,9 @@
+import runProbe from './real-account-throwaway-server-provision.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = {
+  kind: 'real-account-throwaway-server',
+  image: 'Hetzner Cloud API via hcloud CLI (provision + list + destroy)',
+  healthy: true,
+};
+runShim('real-account-throwaway-server-provision', engine, runProbe);

package/blueprints/deploy-hetzner-server/contributions/requirements/deploy-hetzner-server-req-001.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "deploy-hetzner-server-REQ-001",
+  "prdId": "PRD-001",
+  "title": "The provisioner facade is the sole reader of the Hetzner API token and opens on boot with provisionerReady",
+  "description": "The applying project reaches the Hetzner Cloud API through a single provisioner facade module that is the ONLY module holding a reference to the HETZNER_ACCOUNT_API_KEY secret (or the elicited project-scoped alternative). The facade wraps typed verbs (createServer, applyFirewall, takeSnapshot, listSnapshots, destroyServer) and, when provisioningTool=hcloud (default), shells to the hcloud CLI with `--output json`; when provisioningTool=raw-api it fetches the equivalent Hetzner Cloud REST endpoints per https://docs.hetzner.cloud/. On process boot the facade opens against the token via a bounded ready-check and emits a provisionerReady lifecycle event on the injected event sink with a metadata-only payload {tool, apiHost}. No other module reads the token; the injected event sink never carries the token or user-data bodies.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "rationale": "Ratified in the Hetzner round 7 spec (2026-09-07 section 5.1 REQ-001). Ships as v1.0.0 of deploy-hetzner-server.",
+  "tags": [
+    "blueprint:deploy-hetzner-server",
+    "capability:cloudHost"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/requirements/deploy-hetzner-server-req-002.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "deploy-hetzner-server-REQ-002",
+  "prdId": "PRD-001",
+  "title": "The applying project holds server declarations at hetzner/servers/name.json against a shipped JSON Schema",
+  "description": "The applying project holds every server declaration as one JSON document under hetzner/servers/<name>.json, matching a shipped draft-07 JSON Schema at blueprints/deploy-hetzner-server/contributions/schemas/hetzner-server.schema.json. Required fields: name, serverType (cx23, cx33, and other Hetzner shared-cpu shapes), location (fsn1 default per Baz ruling 2026-09-07 09:50Z; also nbg1, hel1, ash, hil), image (ubuntu-24.04 default), sshKeyIds (nonempty array of Hetzner ssh-key references delegated to security-secrets-management), firewallId (an existing firewall or auto-create), networkId (optional private network), cloudInitPath (relative path to the rendered cloud-init user-data), labels (Hetzner tag map that must include role and blueprint), firewallRules (see REQ-004), snapshotCadence (see REQ-005). The schema refuses on missing required fields and on rule-shape violations (see REQ-004).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "rationale": "Ratified in the Hetzner round 7 spec (2026-09-07 section 5.1 REQ-002).",
+  "tags": [
+    "blueprint:deploy-hetzner-server",
+    "capability:cloudHost"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/requirements/deploy-hetzner-server-req-003.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "deploy-hetzner-server-REQ-003",
+  "prdId": "PRD-001",
+  "title": "Cloud-init template renders YAML that lands the six hardening baseline blocks on every provisioned server",
+  "description": "The blueprint ships a cloud-init user-data template at blueprints/deploy-hetzner-server/contributions/templates/cloud-init.yaml.tmpl. Rendering the template against a manifest lands the six baseline blocks named by the estate baseline at operator/knowledge/systems/environments/hetzner-cloud/overview.md Security posture baseline and by the Debian unattended-upgrades wiki: (1) SSH key-only (PasswordAuthentication no via write_files on /etc/ssh/sshd_config.d/hardening.conf), (2) root disabled (PermitRootLogin no via the same file), (3) UFW default-deny incoming with 22, 80, 443 allowed per the manifest firewall shape, (4) DOCKER-USER iptables chain wired to drop non-conforming egress, (5) fail2ban SSH jail, (6) unattended-upgrades on for security updates. A render-lint asserts every block appears in the rendered YAML; a mutation SIMULATE_HARDENING_DRIFT=true removes the unattended-upgrades block and the lint FAILS naming the missing line.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "rationale": "Ratified in the Hetzner round 7 spec (2026-09-07 section 5.1 REQ-003).",
+  "tags": [
+    "blueprint:deploy-hetzner-server",
+    "capability:cloudHost"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/requirements/deploy-hetzner-server-req-004.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "deploy-hetzner-server-REQ-004",
+  "prdId": "PRD-001",
+  "title": "Firewall shape: 22 from operator-nominated prefixes, 80/443 open, all other inbound denied, applied at provision time",
+  "description": "Every hetzner/servers/name.json manifest carries a firewallRules array with the three-rule minimum shape: (a) an ssh rule permitting inbound TCP on 22 from a nonempty list of source-prefix ranges (the operator-nominated set; the schema refuses on 0.0.0.0/0 in this list), (b) an http rule permitting inbound TCP on 80 from any source, (c) an https rule permitting inbound TCP on 443 from any source, (d) an implicit deny for every other inbound rule. The provisioner applies the rule set to the server at provision time via hcloud firewall create (or reuse) plus hcloud firewall apply-to-resource. A raw-api provisioner posts the equivalent create-firewall and apply-to-resources bodies per https://docs.hetzner.cloud/#firewalls. Manifest schema validation refuses on any rule-set shape that violates (a) through (c).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "rationale": "Ratified in the Hetzner round 7 spec (2026-09-07 section 5.1 REQ-004).",
+  "tags": [
+    "blueprint:deploy-hetzner-server",
+    "capability:cloudHost"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/requirements/deploy-hetzner-server-req-005.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "deploy-hetzner-server-REQ-005",
+  "prdId": "PRD-001",
+  "title": "Snapshot cadence elicited (weekly default, daily and off alternatives), snapshot-on-demand fires a tagged snapshot",
+  "description": "The applying project elicits a snapshot cadence per ADR-3802 with an enum of weekly (recommended default), daily and off. The value lives on hetzner/servers/name.json as snapshotCadence. When the cadence is non-off, a scheduled snapshot runner in the applying project fires the snapshot verb on the provisioner facade against every server whose cadence matches, and tags each snapshot with the server name and wall-clock time. A snapshot-on-demand verb on the provisioner fires the same shape without a schedule. Under provisioningTool=hcloud the facade shells to hcloud image create-image and tags via hcloud image update; under raw-api it posts to POST /servers/{id}/actions/create_image and PATCH /images/{id}. The hetznerSnapshotTaken lifecycle event carries snapshot id and wall-clock time. Hetzner-managed backups are a separately elicited paid opt-in (approximately 20 percent of monthly server price per https://docs.hetzner.com/cloud/servers/backups-snapshots/overview) and compose with the scheduled snapshot runner.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "rationale": "Ratified in the Hetzner round 7 spec (2026-09-07 section 5.1 REQ-005).",
+  "tags": [
+    "blueprint:deploy-hetzner-server",
+    "capability:cloudHost"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}