rcf-lite 0.24.0 → 0.26.0

package/blueprints/deploy-hetzner-server/contributions/requirements/deploy-hetzner-server-req-006.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "deploy-hetzner-server-REQ-006",
+  "prdId": "PRD-001",
+  "title": "Four lifecycle events fire with metadata-only payloads and no secret ever crosses the sink boundary",
+  "description": "The provisioner facade emits four lifecycle events on the injected event sink: provisionerReady (tool, apiHost), hetznerServerProvisioned (id, primaryIpv4, location, serverType, labels), hetznerSnapshotTaken (serverId, snapshotId, wallClockTime), hetznerServerDestroyed (id, wallClockTime). Every payload carries only metadata; no event body carries the HETZNER_ACCOUNT_API_KEY value, an ssh private key, or a rendered user-data body. The event-secrecy check inside the hcloud-dry-run-mock probe accumulates every emitted event body across a full lifecycle run and asserts the token, an ssh private-key marker (BEGIN OPENSSH PRIVATE KEY), and the elicited user-data bytes appear in NO event body; a mutation SIMULATE_EVENT_SECRECY_LEAK=true injects the token into the hetznerServerProvisioned payload and the probe FAILS with a defensive-fake finding naming the leaked field.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "rationale": "Ratified in the Hetzner round 7 spec (2026-09-07 section 5.1 REQ-006).",
+  "tags": [
+    "blueprint:deploy-hetzner-server",
+    "capability:cloudHost"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/schemas/hetzner-server.schema.json

@@ -0,0 +1,108 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://stravica.ai/rcf-lite/schemas/hetzner-server.schema.json",
+  "title": "Hetzner Cloud server manifest file",
+  "description": "One server per file under the applying project's hetzner/servers/ directory. Fields track the Hetzner Cloud API server resource shape at https://docs.hetzner.cloud/.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "name",
+    "serverType",
+    "location",
+    "image",
+    "sshKeyIds",
+    "firewallId",
+    "cloudInitPath",
+    "labels",
+    "firewallRules",
+    "snapshotCadence"
+  ],
+  "properties": {
+    "name": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Operator-facing stable server name (kebab-case). Used as the Hetzner server name and prefixed onto snapshot names."
+    },
+    "serverType": {
+      "type": "string",
+      "enum": ["cx23", "cx33", "cx43", "cpx11", "cpx21", "cpx31", "cpx41", "cax11", "cax21", "cax31"],
+      "description": "Hetzner Cloud shared-vCPU server type. cx23 is the shipped default per the round-7 spec section 5.1."
+    },
+    "location": {
+      "type": "string",
+      "enum": ["fsn1", "nbg1", "hel1", "ash", "hil"],
+      "description": "Hetzner data centre location. fsn1 is the shipped default per Baz ruling 2026-09-07 09:50Z on the Q2 ratification."
+    },
+    "image": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Hetzner Cloud base image identifier. ubuntu-24.04 is the shipped default."
+    },
+    "sshKeyIds": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "string",
+        "minLength": 1
+      },
+      "description": "Nonempty array of Hetzner ssh-key references. Delegated to security-secrets-management for the actual key material."
+    },
+    "networkId": {
+      "type": ["string", "null"],
+      "description": "Optional Hetzner Cloud private network id. null for no attached private network."
+    },
+    "firewallId": {
+      "type": ["string", "null"],
+      "description": "Existing Hetzner Cloud firewall id to reuse; when null the provisioner creates one from firewallRules."
+    },
+    "cloudInitPath": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Relative path to the rendered cloud-init user-data file. The renderer at src/cloud-init-renderer.mjs consumes contributions/templates/cloud-init.yaml.tmpl and writes the output here."
+    },
+    "labels": {
+      "type": "object",
+      "additionalProperties": {
+        "type": "string"
+      },
+      "required": [
+        "role",
+        "blueprint"
+      ],
+      "description": "Hetzner tag map. Must include role and blueprint. Under the shared throwaway-server fixture role=rcf-lite-ci-throwaway is required per section 3.3 of the round-7 spec."
+    },
+    "firewallRules": {
+      "type": "array",
+      "minItems": 3,
+      "description": "The rule shape from TAC-3804. Must include an ssh rule (protocol tcp, port 22, direction in, sourceIps nonempty and NOT containing 0.0.0.0/0), an http rule (protocol tcp, port 80, direction in, sourceIps [\"0.0.0.0/0\", \"::/0\"]) and an https rule (protocol tcp, port 443, direction in, sourceIps [\"0.0.0.0/0\", \"::/0\"]).",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["name", "protocol", "port", "direction", "sourceIps"],
+        "properties": {
+          "name": { "type": "string", "enum": ["ssh", "http", "https"] },
+          "protocol": { "type": "string", "enum": ["tcp", "udp", "icmp"] },
+          "port": { "type": "integer", "minimum": 1, "maximum": 65535 },
+          "direction": { "type": "string", "enum": ["in", "out"] },
+          "sourceIps": {
+            "type": "array",
+            "minItems": 1,
+            "items": {
+              "type": "string",
+              "minLength": 1
+            }
+          }
+        }
+      }
+    },
+    "snapshotCadence": {
+      "type": "string",
+      "enum": ["weekly", "daily", "off"],
+      "description": "Snapshot cadence per ADR-3802. weekly is the recommended default."
+    },
+    "hetznerManagedBackups": {
+      "type": "boolean",
+      "description": "Optional paid opt-in for Hetzner-managed backups per ADR-3802 (approximately 20 percent of monthly server price)."
+    }
+  }
+}

package/blueprints/deploy-hetzner-server/contributions/tacs/tac-3801-deploy-hetzner-server-provisioner.json

@@ -0,0 +1,27 @@
+{
+  "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Deploy-hetzner-server provisioner facade",
+  "purpose": "The single project-side module that dereferences HETZNER_ACCOUNT_API_KEY, wraps typed Hetzner Cloud verbs (createServer, applyFirewall, takeSnapshot, listSnapshots, destroyServer), and emits four lifecycle events to the injected event sink. Under provisioningTool=hcloud the module shells to hcloud CLI with --output json; under raw-api it fetches the equivalent Hetzner Cloud REST endpoints. Consumers never dereference the token; the facade is the one place vendor credentials live.",
+  "responsibilities": [
+    "Open the facade on boot via a bounded ready-check; be the ONLY module that reads the HETZNER_ACCOUNT_API_KEY value, and export no symbol that leaks it (AC-37101-1).",
+    "Expose typed verbs createServer, applyFirewall, takeSnapshot, listSnapshots and destroyServer as returned methods on the factory result; refuse a raw-token passthrough on the public surface (AC-37101-1, AC-37103-1, AC-37108-1).",
+    "Emit provisionerReady, hetznerServerProvisioned, hetznerSnapshotTaken and hetznerServerDestroyed on the injected event sink; every payload is metadata-only per REQ-006 (AC-37101-1, AC-37103-1, AC-37108-1, AC-37109-1).",
+    "Shell path (hcloud): call hcloud <verb> --output json, JSON.parse the stdout, project the documented fields (id, primaryIpv4, location, serverType, snapshotId) into the returned record (AC-37103-1, AC-37108-1).",
+    "Raw-api path: fetch the documented REST endpoints (POST /servers, POST /firewalls, POST /servers/{id}/actions/create_image, DELETE /servers/{id}) with the token in Authorization: Bearer and project the same records (AC-37103-1)."
+  ],
+  "internalStructure": "One module exporting createProvisionerFacade({ token, tool, apiHost, eventSink, hcloudPath?, fetch? }) returning a ProvisionerFacade whose methods are the typed verbs. The token capture lives at the top of the factory; the shell path passes the token via HCLOUD_TOKEN in the child environment (never on the argv); the raw-api path passes it in the Authorization header. Consumers call the returned methods for the process lifetime; the raw token never crosses the module boundary again.",
+  "interfaces": [
+    {
+      "name": "default export",
+      "kind": "factory",
+      "summary": "Provisioner facade factory exported from the applied fixture module."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/tacs/tac-3802-deploy-hetzner-server-manifest-schema.json

@@ -0,0 +1,26 @@
+{
+  "tacId": "TAC-3802-deploy-hetzner-server-manifest-schema",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Hetzner server manifest schema",
+  "purpose": "One draft-07 JSON Schema declaring the shape of hetzner/servers/name.json in the applying project. Names required fields (name, serverType, location, image, sshKeyIds, firewallId, cloudInitPath, labels, firewallRules, snapshotCadence) and enforces enums (location, serverType, snapshotCadence) and rule-shape invariants (see TAC-3804). Manifest-schema-validate.mjs uses the schema to accept or refuse every fixture manifest.",
+  "responsibilities": [
+    "Ship a draft-07 JSON Schema for the hetzner-server manifest at contributions/schemas/hetzner-server.schema.json (AC-37102-1).",
+    "Refuse on missing required fields with an error message that names the offending field (AC-37102-1).",
+    "Refuse on firewall-rule-shape violations (22 opened to 0.0.0.0/0, or 80/443 missing) with an error message that names the offending rule (AC-37106-1).",
+    "Enforce snapshotCadence enum {weekly, daily, off} and refuse otherwise (AC-37107-1)."
+  ],
+  "internalStructure": "One JSON Schema file at blueprints/deploy-hetzner-server/contributions/schemas/hetzner-server.schema.json; one shipped example manifest under the shared throwaway-server fixture at packages/rcf-lite/test/fixtures/hetzner-throwaway-server/hetzner/servers/ci-throwaway.json.",
+  "interfaces": [
+    {
+      "name": "hetzner-server.schema.json",
+      "kind": "jsonSchema",
+      "summary": "draft-07 JSON Schema for the Hetzner server manifest."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/tacs/tac-3803-deploy-hetzner-server-cloud-init-template.json

@@ -0,0 +1,26 @@
+{
+  "tacId": "TAC-3803-deploy-hetzner-server-cloud-init-template",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Cloud-init template and render lint",
+  "purpose": "One cloud-init user-data template that renders YAML landing the six hardening baseline blocks per ADR-3804 on every provisioned Hetzner server: SSH key-only, root disabled, UFW default-deny incoming, DOCKER-USER iptables chain, fail2ban SSH jail, unattended-upgrades. A local render-lint probe asserts every block appears in the rendered YAML; the SIMULATE_HARDENING_DRIFT mutation removes the unattended-upgrades block and the probe FAILS naming the missing line.",
+  "responsibilities": [
+    "Ship a cloud-init template at contributions/templates/cloud-init.yaml.tmpl that renders the six baseline blocks (AC-37104-1).",
+    "Render deterministically against a manifest via the fixture's cloud-init-renderer.mjs (AC-37104-1).",
+    "Cover the SIMULATE_HARDENING_DRIFT mutation with a probe FAILURE that names the missing line (AC-37104-1).",
+    "Document the runtime ssh baseline check that the account-bound probe drives against the throwaway server (AC-37105-1)."
+  ],
+  "internalStructure": "One template file at blueprints/deploy-hetzner-server/contributions/templates/cloud-init.yaml.tmpl using {{token}} placeholders substituted by the renderer; one renderer module at packages/rcf-lite/test/fixtures/hetzner-throwaway-server/src/cloud-init-renderer.mjs; one probe cloud-init-render-lint.mjs asserts baseline lines.",
+  "interfaces": [
+    {
+      "name": "cloud-init.yaml.tmpl",
+      "kind": "template",
+      "summary": "Cloud-init user-data template with the six baseline blocks and templated substitutions."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/tacs/tac-3804-deploy-hetzner-server-firewall-shape.json

@@ -0,0 +1,25 @@
+{
+  "tacId": "TAC-3804-deploy-hetzner-server-firewall-shape",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Hetzner Cloud firewall rule shape",
+  "purpose": "One canonical firewall rule shape carried inside the server manifest. Rule set: 22 permitted only from a nonempty list of source-prefix ranges (the operator-nominated set; the schema refuses on 0.0.0.0/0 in this list); 80 and 443 permitted from 0.0.0.0/0 for the reverse proxy; all other inbound denied. The provisioner applies the rule set to the server at provision time via hcloud firewall create + apply-to-resource (or the raw-api equivalent).",
+  "responsibilities": [
+    "Define the firewall rule shape as a sub-schema in hetzner-server.schema.json (AC-37106-1).",
+    "Refuse via manifest-schema-validate on a manifest that opens 22 to 0.0.0.0/0 or drops 80/443 (AC-37106-1).",
+    "Enforce that the ssh rule's sourceIps is a nonempty array (AC-37106-1)."
+  ],
+  "internalStructure": "Rule shape lives inside the same hetzner-server.schema.json used by TAC-3802 (properties.firewallRules array items with protocol, port, direction, sourceIps). The applyFirewall verb on the provisioner facade consumes the parsed rule set.",
+  "interfaces": [
+    {
+      "name": "firewallRules sub-schema",
+      "kind": "jsonSchemaFragment",
+      "summary": "Rule-shape invariants inside hetzner-server.schema.json."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/templates/cloud-init.yaml.tmpl

@@ -0,0 +1,113 @@
+#cloud-config
+# deploy-hetzner-server v1.0.0 cloud-init user-data template.
+# Six-block hardening baseline per ADR-3804 (Debian unattended-upgrades wiki
+# and the estate baseline at
+# operator/knowledge/systems/environments/hetzner-cloud/overview.md
+# Security posture baseline). Placeholders in {{double-brace}} form are
+# substituted by the fixture's cloud-init-renderer.mjs against the applying
+# manifest.
+
+hostname: {{name}}
+
+# Block 1: SSH key-only. Password auth disabled at the sshd level too.
+users:
+  - name: deploy
+    groups: [sudo]
+    shell: /bin/bash
+    lock_passwd: true
+    ssh_authorized_keys:
+{{sshAuthorizedKeysBlock}}
+
+# Block 2: root disabled (PermitRootLogin no).
+# Block 1 continued: PasswordAuthentication no.
+write_files:
+  # Block 1 continued: NOPASSWD sudo for the deploy user (mode 0440,
+  # visudo-shaped fragment). Baseline hardening requires the deploy
+  # user to run sudoed baseline checks without a tty; the write_files
+  # entry ships the fragment in the same posture as the sshd config.
+  - path: /etc/sudoers.d/90-deploy-nopasswd
+    permissions: '0440'
+    content: |
+      # deploy-hetzner-server v1.0.1 hardening: passwordless sudo for
+      # the deploy user so the ssh baseline checks (cloud-init status
+      # --wait, ufw status, iptables -L, systemctl is-active fail2ban)
+      # never block on a tty prompt.
+      deploy ALL=(ALL) NOPASSWD:ALL
+  - path: /etc/ssh/sshd_config.d/hardening.conf
+    permissions: '0644'
+    content: |
+      # deploy-hetzner-server v1.0.0 hardening (baseline blocks 1 and 2).
+      PermitRootLogin no
+      PasswordAuthentication no
+      KbdInteractiveAuthentication no
+      ChallengeResponseAuthentication no
+  # Block 4: DOCKER-USER iptables chain drops non-conforming egress.
+  - path: /etc/iptables/rules.v4.d/docker-user.rules
+    permissions: '0644'
+    content: |
+      # deploy-hetzner-server v1.0.0 hardening baseline block 4:
+      # DOCKER-USER iptables chain wired to drop non-conforming egress.
+      *filter
+      :DOCKER-USER - [0:0]
+      -A DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
+      -A DOCKER-USER -j DROP
+      COMMIT
+  # Block 5: fail2ban SSH jail.
+  - path: /etc/fail2ban/jail.d/sshd.conf
+    permissions: '0644'
+    content: |
+      # deploy-hetzner-server v1.0.0 hardening baseline block 5:
+      # fail2ban SSH jail on port 22.
+      [sshd]
+      enabled = true
+      port = 22
+      maxretry = 5
+      findtime = 600
+      bantime = 3600
+  # Block 6: unattended-upgrades on (security updates).
+  - path: /etc/apt/apt.conf.d/50unattended-upgrades
+    permissions: '0644'
+    content: |
+      // deploy-hetzner-server v1.0.0 hardening baseline block 6:
+      // unattended-upgrades on for security updates
+      // per https://wiki.debian.org/UnattendedUpgrades
+      Unattended-Upgrade::Origins-Pattern {
+        "origin=Debian,codename=${distro_codename},label=Debian-Security";
+        "origin=Ubuntu,archive=${distro_codename}-security";
+      };
+      Unattended-Upgrade::Automatic-Reboot "false";
+  - path: /etc/apt/apt.conf.d/20auto-upgrades
+    permissions: '0644'
+    content: |
+      APT::Periodic::Update-Package-Lists "1";
+      APT::Periodic::Unattended-Upgrade "1";
+
+# Package install: ufw for block 3, fail2ban for block 5.
+# unattended-upgrades ships in the ubuntu-24.04 base image (v1.0.1 fix:
+# was in packages: v1.0.0 which caused a spurious NoNewestVersion line).
+# iptables-persistent conflicts with ufw on ubuntu-24.04 noble (ufw
+# Breaks: iptables-persistent), so we DO NOT install it; the DOCKER-USER
+# chain is loaded in runcmd via iptables directly (block 4 stays valid
+# for the running boot; reboot-persistence for the chain is a follow-up
+# item outside the H-1 hardening scope).
+packages:
+  - ufw
+  - fail2ban
+
+runcmd:
+  # Block 3: UFW default-deny incoming, allow 22 80 443.
+  - ufw default deny incoming
+  - ufw default allow outgoing
+  - ufw allow 22/tcp
+  - ufw allow 80/tcp
+  - ufw allow 443/tcp
+  - ufw --force enable
+  - systemctl reload ssh || systemctl restart ssh
+  - systemctl enable --now fail2ban
+  - systemctl enable --now unattended-upgrades
+  # Block 4 runtime: create the DOCKER-USER chain directly via iptables
+  # (v1.0.1 fix: iptables-persistent conflicts with ufw on Ubuntu 24.04
+  # noble; iptables itself is preinstalled, so the chain lands cleanly).
+  - iptables -N DOCKER-USER 2>/dev/null || true
+  - iptables -A DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
+  - iptables -A DOCKER-USER -j DROP

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37101.json

@@ -0,0 +1,24 @@
+{
+  "usId": "deploy-hetzner-server-US-37101",
+  "prdId": "PRD-001",
+  "reqId": "deploy-hetzner-server-REQ-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "The provisioner opens on boot as the sole token reader and emits provisionerReady",
+  "asA": "developer whose project provisions a Hetzner Cloud VM as its cloudHost",
+  "iWant": "one provisioner facade module to be the sole reader of HETZNER_ACCOUNT_API_KEY and to emit provisionerReady on boot with a metadata-only payload",
+  "soThat": "the token has one auditable seam and the observability sink surfaces boot ordering without ever carrying the secret",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-37101-1",
+      "description": "On process boot the provisioner facade opens against the token, and (a) only the provisioner module reads HETZNER_ACCOUNT_API_KEY (grep across the fixture source refuses any other reader), (b) provisionerReady fires on the injected event sink with a payload of exactly {tool, apiHost}.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3801-deploy-hetzner-server-provisioner"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37102.json

@@ -0,0 +1,24 @@
+{
+  "usId": "deploy-hetzner-server-US-37102",
+  "prdId": "PRD-001",
+  "reqId": "deploy-hetzner-server-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "hetzner/servers/name.json manifests validate against the shipped JSON Schema",
+  "asA": "developer whose project holds Hetzner server declarations in git",
+  "iWant": "every hetzner/servers/name.json file to validate against a shipped draft-07 JSON Schema naming type, location, image, sshKeyIds, firewallId, networkId, cloudInitPath, labels, firewallRules and snapshotCadence",
+  "soThat": "the operator has a stable declarative source of truth and manifest defects surface locally before they reach the API",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-37102-1",
+      "description": "manifest-schema-validate.mjs asserts every hetzner/servers/*.json under the shared throwaway-server fixture validates against blueprints/deploy-hetzner-server/contributions/schemas/hetzner-server.schema.json and carries every required field; a mutation SIMULATE_MANIFEST_INVALID=true replaces location with an unknown token and the probe FAILS naming the offending field.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3802-deploy-hetzner-server-manifest-schema"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37103.json

@@ -0,0 +1,25 @@
+{
+  "usId": "deploy-hetzner-server-US-37103",
+  "prdId": "PRD-001",
+  "reqId": "deploy-hetzner-server-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Manifest applies: the provisioner creates a matching live server and fires hetznerServerProvisioned",
+  "asA": "developer whose project provisions a Hetzner Cloud VM from git-managed manifests",
+  "iWant": "applying the provisioner to read each manifest under hetzner/servers/, create a matching live Hetzner Cloud server, and emit hetznerServerProvisioned with id, primaryIpv4, location and serverType",
+  "soThat": "the manifest is the source of truth for what actually exists in the project",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-37103-1",
+      "description": "The real-account-throwaway-server-provision probe (accountBound: true, skipped without CI_HAS_HETZNER_ACCOUNT) applies the ci-throwaway.json manifest via provision.mjs, asserts (a) hcloud server list --output json shows the new server whose id is written to the fixture scratch file, (b) hetznerServerProvisioned fired with id, primaryIpv4, location=fsn1, serverType=cx23; teardown via destroy.mjs runs regardless of probe verdict.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3801-deploy-hetzner-server-provisioner",
+    "TAC-3802-deploy-hetzner-server-manifest-schema"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37104.json

@@ -0,0 +1,24 @@
+{
+  "usId": "deploy-hetzner-server-US-37104",
+  "prdId": "PRD-001",
+  "reqId": "deploy-hetzner-server-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Cloud-init template renders the six hardening baseline blocks",
+  "asA": "developer whose project provisions Hetzner servers that face the public internet",
+  "iWant": "the shipped cloud-init template to render YAML that lands SSH key-only, root disabled, UFW default-deny incoming, DOCKER-USER iptables chain, fail2ban SSH jail and unattended-upgrades on every server",
+  "soThat": "I inherit the six-block hardening baseline declaratively without hand-authoring per host",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-37104-1",
+      "description": "cloud-init-render-lint.mjs renders the template with the fixture manifest and asserts each of the six baseline blocks (SSH key-only, root disabled, UFW default-deny incoming, DOCKER-USER iptables chain, fail2ban SSH jail, unattended-upgrades) appears in the rendered YAML by grep; a mutation SIMULATE_HARDENING_DRIFT=true removes the unattended-upgrades block and the probe FAILS with a message naming the missing line.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3803-deploy-hetzner-server-cloud-init-template"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37105.json

@@ -0,0 +1,24 @@
+{
+  "usId": "deploy-hetzner-server-US-37105",
+  "prdId": "PRD-001",
+  "reqId": "deploy-hetzner-server-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Provisioned server is hardened at runtime as the rendered cloud-init promised",
+  "asA": "operator running Hetzner servers provisioned by this blueprint",
+  "iWant": "the running server to refuse root ssh, refuse password auth, run UFW default-deny incoming, hold the DOCKER-USER chain and run unattended-upgrades",
+  "soThat": "I can trust the cloud-init contract without ssh-in-and-check on every server",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-37105-1",
+      "description": "real-account-cloud-init-hardened.mjs (accountBound: true, skipped without CI_HAS_HETZNER_ACCOUNT) waits for cloud-init status --wait on the throwaway server, then ssh-checks the six baseline blocks and asserts each check passes; failure names the missing block. Teardown via destroy.mjs runs regardless.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3803-deploy-hetzner-server-cloud-init-template"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37106.json

@@ -0,0 +1,25 @@
+{
+  "usId": "deploy-hetzner-server-US-37106",
+  "prdId": "PRD-001",
+  "reqId": "deploy-hetzner-server-REQ-004",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Firewall rule shape restricts SSH to nominated prefixes, permits 80/443, denies all else",
+  "asA": "operator running Hetzner servers that face the public internet",
+  "iWant": "the firewall rule set carried in hetzner/servers/name.json to permit 22 only from an operator-nominated set of source-prefix ranges, permit 80 and 443 from any source for the reverse proxy, and deny all other inbound; the provisioner applies the rules at provision time",
+  "soThat": "I inherit a documented least-privilege firewall shape on every server without opening ssh to the world",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-37106-1",
+      "description": "manifest-schema-validate.mjs asserts every fixture manifest carries a firewallRules array matching the shape (22 permitted only from a nonempty list of source-prefix ranges with no 0.0.0.0/0; 80 and 443 permitted from 0.0.0.0/0; no other inbound rule); an induced defect (a manifest that opens 22 to 0.0.0.0/0) FAILS schema validation with a message naming the offending rule.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3802-deploy-hetzner-server-manifest-schema",
+    "TAC-3804-deploy-hetzner-server-firewall-shape"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37107.json

@@ -0,0 +1,24 @@
+{
+  "usId": "deploy-hetzner-server-US-37107",
+  "prdId": "PRD-001",
+  "reqId": "deploy-hetzner-server-REQ-005",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Snapshot cadence is elicited (weekly default, daily and off alternatives) and validated on the manifest",
+  "asA": "operator whose project takes recovery-point snapshots on Hetzner Cloud",
+  "iWant": "the elicited snapshot cadence value on hetzner/servers/name.json to match the shipped enum {weekly, daily, off}, with weekly the recommended default per ADR-3802",
+  "soThat": "I have one project-wide answer for how often each server snapshots",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-37107-1",
+      "description": "manifest-schema-validate.mjs asserts every fixture manifest carries snapshotCadence with a value in the shipped enum {weekly, daily, off}; a manifest missing the field FAILS schema validation naming the missing field.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3802-deploy-hetzner-server-manifest-schema"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37108.json

@@ -0,0 +1,24 @@
+{
+  "usId": "deploy-hetzner-server-US-37108",
+  "prdId": "PRD-001",
+  "reqId": "deploy-hetzner-server-REQ-005",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Snapshot-on-demand fires a tagged snapshot and emits hetznerSnapshotTaken",
+  "asA": "operator whose project needs an on-demand recovery point at any moment",
+  "iWant": "the snapshot-on-demand verb on the provisioner to shell to hcloud image create-image (or the raw-api equivalent) and tag the snapshot with server name and wall-clock time; hetznerSnapshotTaken carries snapshot id and time",
+  "soThat": "I have a documented on-demand recovery point at any moment without a manual dashboard visit",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-37108-1",
+      "description": "real-account-snapshot-on-demand.mjs (accountBound: true, skipped without CI_HAS_HETZNER_ACCOUNT) fires the snapshot verb on the throwaway server, then asserts hcloud image list --type=snapshot --output json shows a snapshot tagged with the server name and current wall-clock time; hetznerSnapshotTaken event carries snapshot id and time. Teardown via destroy.mjs.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3801-deploy-hetzner-server-provisioner"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37109.json

@@ -0,0 +1,24 @@
+{
+  "usId": "deploy-hetzner-server-US-37109",
+  "prdId": "PRD-001",
+  "reqId": "deploy-hetzner-server-REQ-006",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Four lifecycle events fire with metadata-only payloads and no event body carries a secret",
+  "asA": "operator whose observability sink carries the Hetzner lifecycle trail",
+  "iWant": "the provisioner facade to fire the four lifecycle events (provisionerReady, hetznerServerProvisioned, hetznerSnapshotTaken, hetznerServerDestroyed) with metadata-only payloads and no secret content",
+  "soThat": "the observability sink carries the operational trail without ever leaking a token or an ssh key",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-37109-1",
+      "description": "hcloud-dry-run-mock.mjs drives every lifecycle event through the facade against a mocked hcloud shim; the accumulated event stream carries only the metadata fields named on REQ-006; a mutation SIMULATE_EVENT_SECRECY_LEAK=true injects the token into the hetznerServerProvisioned payload and the probe FAILS with a defensive-fake finding naming the leaked field.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3801-deploy-hetzner-server-provisioner"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/docs/topics.md

@@ -0,0 +1,48 @@
+# deploy-hetzner-server topics
+
+Shelf registry of global ADR topics and shelf-band anchors relevant
+to `deploy-hetzner-server` v1.0.0.
+
+## Global topics minted by this blueprint
+
+| Topic | ADR | Meaning |
+|---|---|---|
+| `linuxCloudHostContract` | `ADR-3801` | The Hetzner Cloud VM as the shipped `cloudHost` shape. A future non-Hetzner sibling (Vultr, DigitalOcean, Fly.io) contributes the same topic string with a different provider and forces a deliberate conflict per the round-2 pattern. |
+| `snapshotAndBackupCadence` | `ADR-3802` | Weekly snapshot as the shipped default, daily and off alternatives, Hetzner-managed backups as an elicited paid opt-in at approximately 20 percent of monthly server price. |
+
+## Shelf id band and suffix block
+
+| Blueprint | US band | ADR/TAC suffix block | Status | Global topics |
+|---|---|---|---|---|
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
+
+The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
+
+## Cross-references
+
+- `security-secrets-management` (v1.0.1): the provisioner facade reads `HETZNER_ACCOUNT_API_KEY` through the applied secrets facade. The facade is the sole reader; every other module in the applying project imports the facade and never dereferences the token.
+- `deploy-cloudflare-workers` (v1.2.0): sibling in the `deploy-*` family. The family enforces one-target-per-project at apply time (a project applying both refuses with `deploy-family-multiple-targets`).
+- Round-7 T-2 `platform-docker-compose-host`: composes on `capabilities: [cloudHost]`; ships the compose runtime on the Hetzner host this blueprint provisions.
+- Round-7 T-3 `edge-cloudflare-tunnel`: composes on `cloudHost` (systemd unit shape) or on `containerHost` (compose service shape); either shape bridges the Hetzner host to the Cloudflare edge without opening origin ports.