rcf-lite 0.24.0 → 0.26.0

package/blueprints/deploy-hetzner-server/guide/deploy-hetzner-server.md

@@ -0,0 +1,180 @@
+# deploy-hetzner-server guide
+
+Practical guide for the operator applying `deploy-hetzner-server`
+v1.0.0. Covers manifest authoring, the two provisioner paths, the
+hardening baseline, snapshot posture, elicitation shortcuts, and
+the runtime probe rig.
+
+## Prerequisites
+
+- A Hetzner Cloud project and API token. The token binds to one
+  project; a fresh throwaway project keeps the blast radius small
+  during onboarding.
+- `hcloud` on `PATH` when `provisioning-tool` is `hcloud`. Install:
+  Homebrew `brew install hcloud` on macOS, or download the OS/arch
+  tarball from https://github.com/hetznercloud/cli/releases/latest,
+  verify against `checksums.txt`, drop the binary on `PATH`. Skip
+  the install when `provisioning-tool` is `raw-api`; the provisioner
+  reaches the REST API directly.
+- `security-secrets-management` applied so the facade reads
+  `HETZNER_ACCOUNT_API_KEY` from the operator's vault of choice.
+
+## Authoring `hetzner/servers/<name>.json`
+
+Every server declaration lives at
+`hetzner/servers/<server-name>.json` and validates against the
+shipped `hetzner-server.schema.json`. The fixture manifest at
+`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/hetzner/servers/ci-throwaway.json`
+is the canonical example. Copy it and edit:
+
+```jsonc
+{
+  "name": "ops-01",
+  "serverType": "cx33",
+  "location": "fsn1",
+  "image": "ubuntu-24.04",
+  "sshKeyIds": ["dave-ed25519", "baz-yubikey"],
+  "networkId": null,
+  "firewallId": null,
+  "cloudInitPath": "hetzner/servers/rendered/ops-01.cloud-init.yaml",
+  "labels": {
+    "role": "ops-host",
+    "blueprint": "deploy-hetzner-server"
+  },
+  "firewallRules": [
+    { "name": "ssh", "protocol": "tcp", "port": 22, "direction": "in", "sourceIps": ["203.0.113.0/24"] },
+    { "name": "http", "protocol": "tcp", "port": 80, "direction": "in", "sourceIps": ["0.0.0.0/0", "::/0"] },
+    { "name": "https", "protocol": "tcp", "port": 443, "direction": "in", "sourceIps": ["0.0.0.0/0", "::/0"] }
+  ],
+  "snapshotCadence": "weekly",
+  "hetznerManagedBackups": false
+}
+```
+
+The manifest-schema-validate probe refuses on missing required
+fields and on a rule set that opens 22 to `0.0.0.0/0`.
+
+## Rendering cloud-init
+
+Point `cloudInitPath` at a rendered file the provisioner uploads
+with `--user-data-from-file`. The fixture renderer at
+`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/src/cloud-init-renderer.mjs`
+consumes the shipped template with two placeholders:
+
+- `{{name}}` (the manifest name)
+- `{{sshAuthorizedKeysBlock}}` (the ssh-authorized_keys entries per
+  `sshKeyIds`)
+
+An applying project runs the renderer at manifest edit time (a git
+pre-commit hook, or a `pnpm build:cloud-init` script) and commits
+the rendered YAML alongside the manifest.
+
+## Six hardening baseline blocks (ADR-3804)
+
+The rendered YAML lands the six blocks per the estate baseline at
+`operator/knowledge/systems/environments/hetzner-cloud/overview.md`
+Security posture baseline and the Debian unattended-upgrades wiki
+at https://wiki.debian.org/UnattendedUpgrades.
+
+1. SSH key-only. `PasswordAuthentication no`.
+2. Root disabled. `PermitRootLogin no`.
+3. UFW default-deny incoming. `ufw allow 22/tcp 80/tcp 443/tcp`.
+4. DOCKER-USER iptables chain. Drops non-conforming egress from
+   containers before Docker rules apply.
+5. fail2ban SSH jail on port 22. `maxretry 5`, `bantime 3600`.
+6. `unattended-upgrades` on for security-only updates
+   (`Unattended-Upgrade::Automatic-Reboot "false"`).
+
+Deviation costs an ADR at the applying project level; the shipped
+lint refuses on drift.
+
+## When to reach for hcloud vs raw-api
+
+- `hcloud` (default). Choose it when the operator laptop and CI
+  runner can install the binary. Small, self-documenting, JSON
+  output on `--output json`; the vendor updates it in step with the
+  API. Docs: https://github.com/hetznercloud/cli.
+- `raw-api`. Choose it when a container base image cannot install
+  `hcloud` (Alpine minimal builds, a locked-down runtime). The
+  provisioner reaches the REST endpoints directly per
+  https://docs.hetzner.cloud/. Vendor SLAs cover the API; the local
+  CLI is a convenience layer.
+
+The facade shape is identical on both paths so switching is a one
+elicit change.
+
+## When to reach for `cx23` vs `cx33`
+
+- `cx23` (default). Two vCPU, 4 GB RAM, 40 GB SSD. Approximately
+  EUR 4.15/month. Fine for the docker-compose stack that ops-01
+  runs (fewer than ten containers, each below 300 MB RSS).
+- `cx33`. Two vCPU, 8 GB RAM, 80 GB SSD. Approximately EUR
+  7.99/month. Reach when the compose stack holds a Postgres, a
+  Grafana, or any container that regularly touches 1 GB RSS.
+- `cx43`. Four vCPU, 16 GB RAM. Reach for a home for the
+  `platform-cloudflare-durable-objects` self-hosted mode or a
+  Postgres + Grafana + Loki triad.
+- `cpx*`. AMD EPYC. Faster per vCPU; slightly more expensive.
+- `cax*`. ARM64. Choose when every runtime component has an ARM
+  build (Node, Postgres, cloudflared, most caddy modules do).
+
+Vendor pricing:
+https://docs.hetzner.com/cloud/servers/overview.
+
+## Snapshot cadence choices (ADR-3802)
+
+- `weekly` (default). One snapshot every Sunday at 02:00 local. On
+  a `cx23`, adds approximately EUR 0.005/month in snapshot storage.
+- `daily`. Higher recovery-point objective. On a `cx23`, adds
+  approximately EUR 0.035/month.
+- `off`. No automatic snapshot. Choose only when Hetzner-managed
+  backups are opted-in AND the application layer takes its own
+  logical backups on cadence.
+
+Hetzner-managed backups are a separately elicited paid opt-in at
+approximately 20 percent of monthly server price (on a `cx23`,
+approximately EUR 0.80/month). They compose with the scheduled
+snapshot runner; both fire independently.
+Vendor pricing:
+https://docs.hetzner.com/cloud/servers/backups-snapshots/overview.
+
+## Snapshot-on-demand
+
+Fire a snapshot manually from the applying project's CLI:
+
+```
+node ./scripts/snapshot.mjs --server ops-01
+```
+
+The script imports the provisioner facade, calls `takeSnapshot`,
+and emits `hetznerSnapshotTaken` on the injected sink. The account-
+bound probe `real-account-snapshot-on-demand` covers the same shape.
+
+## The shared throwaway-server fixture
+
+Every real-account probe runs against a throwaway `cx23` in `fsn1`
+provisioned from the fixture manifest. Fixture location:
+`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/`. Cost
+ceiling: EUR 0.006/hour per run; destroy runs in `always()`; nightly
+`sweep-orphans` cron collects any leak on a 60-minute label-age
+cutoff.
+
+Round-7 T-2 (`platform-docker-compose-host`) and T-3
+(`edge-cloudflare-tunnel`) EXTEND this fixture rather than shipping
+a second copy. T-2 mounts the docker + compose verbs on the same
+throwaway server after cloud-init seals the baseline; T-3 mounts
+`cloudflared` on the runtime T-2 stands up.
+
+## Standards trace
+
+Every URL fetched 200 in the ratifying pass before the T-1 PR.
+
+- Hetzner Cloud API https://docs.hetzner.cloud/
+- Hetzner Cloud CLI https://github.com/hetznercloud/cli
+- Hetzner Cloud servers overview https://docs.hetzner.com/cloud/servers/overview
+- Hetzner Cloud firewalls overview https://docs.hetzner.com/cloud/firewalls/overview/
+- Hetzner Cloud backups-and-snapshots overview https://docs.hetzner.com/cloud/servers/backups-snapshots/overview
+- Hetzner Cloud networks overview https://docs.hetzner.com/cloud/networks/overview/
+- Hetzner community basic-cloud-config tutorial https://community.hetzner.com/tutorials/basic-cloud-config
+- cloud-init https://cloudinit.readthedocs.io/en/latest/
+- Debian unattended-upgrades wiki https://wiki.debian.org/UnattendedUpgrades

package/blueprints/edge-cloudflare-access/docs/topics.md

@@ -46,7 +46,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
@@ -55,6 +55,9 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 US 34101-34109 sit at the LOW end of the 34101-34899 band on purpose (watchpost run-4 lesson). ADR/TAC suffixes for this blueprint use the 3501-3599 block, continuing the shelf pattern.
 

package/blueprints/edge-cloudflare-rate-limiting/docs/topics.md

@@ -5,6 +5,9 @@ This file is the edge-cloudflare-rate-limiting half of the cross-blueprint contr
 ## Global ADR topics this blueprint contributes (exact strings)
 
 | Topic string | edge-cloudflare-rate-limiting contribution | Origin | Composition note |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 |---|---|---|---|
 | `edgeThrottleContract` | ADR-3701-edge-cloudflare-rate-limiting-throttle-contract | Minted by this blueprint. Names the wire-shape contract for the project-wide edge throttle; the shipped answer is Cloudflare WAF rate-limiting rules per `https://developers.cloudflare.com/waf/rate-limiting-rules/`. | The one project-wide decision on the edge throttle at the shipped-shape boundary. A future non-Cloudflare sibling (Fastly rate-limits, Vercel Edge Config throttles) would contribute the same topic string with a different answer, forcing a DELIBERATE conflict the operator resolves with a project-level ADR. |
 
@@ -46,7 +49,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/edge-cloudflare-tunnel/CHANGELOG.md

@@ -0,0 +1,23 @@
+# edge-cloudflare-tunnel CHANGELOG
+
+## 1.0.1 - 2026-09-08
+
+H-2 hardening train (`h2-cf-platform-probe-integrity`): probe-integrity patch. No capability change.
+
+- Replaced the warn-on-env-set stub in `real-account-connector-healthy.mjs` with a real cloudflared connector-health driver via the new cf-edge shim (`packages/rcf-lite/test/fixtures/cf-edge/h2-cf-tunnel-shim.mjs`). With both `CI_HAS_CLOUDFLARE_ACCOUNT` and `CI_HAS_HETZNER_ACCOUNT` set, the driver provisions the throwaway server through the hetzner fixture surface (H-1 territory, consumed as-is), runs `cloudflared tunnel info <name>` via the shim, asserts healthy connector count, captures the `tunnelConnectorUp` event, and always tears the server down. Env-absent branch keeps pass-with-skip. Env-present-with-fixture-failure yields FAIL with a pointer to the fixture step, never warn.
+- Replaced both warn-on-env-set stubs in `real-account-tunnel-hostname-routes.mjs` with real drivers. Public-hostname sub-case: undici fetch against the scratch subdomain via the shim's `fetchTunnelHostname` seam, activated on `CI_HAS_CLOUDFLARE_ACCOUNT`. Access-gated sub-case: two-identity HS256 JWT check, activated only when `CI_HAS_CLOUDFLARE_ACCESS` is ALSO set (amendment 4). Env-absent branch keeps pass-with-skip. A pass is no longer reachable from `CI_HAS_CLOUDFLARE_ACCOUNT` presence alone.
+- Converted the credentials-placeholder-read-failed branch in `manifest-schema-validate.mjs::eventSecrecyScan` from warn to fail with a pointer to the exact fixture path (`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/*/credentials/probe.json.example`) and the setup requirement (must exist and parse as JSON).
+- Added the cf-edge tunnel shim (`packages/rcf-lite/test/fixtures/cf-edge/h2-cf-tunnel-shim.mjs`) with five seams: `provisionScratchServer`, `destroyScratchServer`, `cloudflaredTunnelInfo`, `fetchTunnelHostname`, `mintScratchIdentity`. The shim reads `H2_CF_TUNNEL_SHIM_MODE` and `H2_CF_TUNNEL_HOSTNAME_SHIM_MODE` for synthetic-mode branches; the probe bodies hold zero `SIMULATE_` token references.
+- Tunnel symbolic-anchor ruling (task C4): the `AC-tunnel-*` symbolic ids on the five tunnel probes ARE the shipped AC ids in the `US-39101..US-39108` contribution band, so no re-anchor was performed. Full mapping in the H-2 PR body.
+
+## 1.0.0 - 2026-09-08
+
+Initial release. Round-7 T-3 of the Hetzner spec at `projects/blueprint-library/specs/hetzner-round-7-spec-2026-09-07.md`.
+
+- Mints capability `tunnelBridge` and global topic `edgeIngressBridge`.
+- Five REQs, eight USs, three TACs, three ADRs; five Node-only probes.
+- Extends the shared throwaway-Hetzner-server fixture with a cloudflared connector in both runtime shapes (compose-service alongside the T-2 web and caddy services when `containerHost` is applied; systemd-unit for a bare `cloudHost`) and both hostname modes (access-gated when `zeroTrustGate` is applied; public-hostname when absent) plus five `run-<probe>.mjs` delegate shims.
+- manifest-schema-validate carries five fixture-side mutation switches (`SIMULATE_MANIFEST_INVALID_TUNNEL_ID`, `SIMULATE_MANIFEST_CREDENTIALS_INLINE`, `SIMULATE_MANIFEST_MISSING_CATCHALL`, `SIMULATE_ORIGIN_PORT_OPEN`, `SIMULATE_EVENT_SECRECY_LEAK`); cloudflared-config-lint carries `SIMULATE_INGRESS_INVALID` and runs `cloudflared tunnel ingress validate` via the `cloudflare/cloudflared:2026.8.3` container when a local binary is not on PATH; aud-presence-check carries `SIMULATE_AUD_DROP`.
+- Mutation-discipline (T-2 gate ruling carried forward): every `SIMULATE_*` switch lives in the fixture-side delegate shim; the probe modules read only `RCF_LITE_T3_FIXTURE_ROOT` and never branch on being under mutation.
+- Connector-runtime choice elicited via `connector-runtime` (compose-service default when `containerHost` applied; systemd-unit alternative for bare `cloudHost`, per the vendor cloudflared as-a-service local-configuration-file docs); hostname-mode discovered (not elicited) from `appliedCapabilities` via the sidecar per ADR-4003.
+- Consumers: `w-2026-09-06-dave-010` follow-on (make the librarian API and workspace viewer reachable without Mullvad) is the estate consumer; blueprint acceptance never depends on that consumer, and the ops-01 migration mints as its own work item.

package/blueprints/edge-cloudflare-tunnel/README.md

@@ -0,0 +1,257 @@
+# edge-cloudflare-tunnel
+
+Round-7 T-3 core blueprint on the rcf-lite shelf. Bridges a service on a
+`cloudHost` (bare, systemd shape) or a `containerHost` (compose-service
+shape) to the Cloudflare edge through a Cloudflare Tunnel, with no
+public origin ports. When applied alongside `edge-cloudflare-access`
+(via the `zeroTrustGate` capability) the tunnel binds an Access AUD;
+when applied without it the tunnel serves in public-hostname mode.
+
+- Slug: `edge-cloudflare-tunnel`
+- Version: `1.0.0`
+- Category: `edge`
+- Capabilities: `["tunnelBridge"]`
+- Mints global topic: `edgeIngressBridge`
+- Contribution count: 5 REQs, 8 USs, 3 TACs, 3 ADRs, 5 probes
+- Consumers: ops-01 has no consumer today (SSH is the only inbound path). Estate consumer is the follow-on make-the-librarian-API-and-workspace-viewer-reachable-without-Mullvad work that `w-2026-09-06-dave-010` is expected to green-light. Blueprint acceptance never depends on that consumer; the ops-01 migration mints as a separate work item at that point (`w-2026-09-07-dave-004`).
+
+## Five REQs
+
+| Id | Contract |
+|---|---|
+| edge-cloudflare-tunnel-REQ-001 | Connector install shape switches on applied `containerHost` (compose-service default; systemd-unit for bare `cloudHost`); `cloudflaredReady` fires on boot with connector id, region and version metadata. |
+| edge-cloudflare-tunnel-REQ-002 | Tunnel manifest schema at `cloudflare/tunnels/<name>.yaml` (uuid tunnel id, `credentialsFile.secretRef` reference, ingress rules with catch-all `http_status:404`). |
+| edge-cloudflare-tunnel-REQ-003 | No public origin ports on the host; T-1 firewall stays closed on 80/443 unless a reverse proxy is applied; manifest refuses ingress rules whose service URL binds to a host public interface. |
+| edge-cloudflare-tunnel-REQ-004 | Access-gated composition: `zeroTrustGate` applied attaches `originRequest.access.aud`; absent omits the block and serves in public-hostname mode. |
+| edge-cloudflare-tunnel-REQ-005 | Credentials-file discipline (host mode 0o400, referenced via `secretRef`, not committed, grep-refuse, no leak in event bodies). |
+
+## Connector runtime shapes
+
+The connector runtime is elicited via `connector-runtime` (ADR-4002) with
+`recommendedDefault: compose-service`.
+
+- **compose-service** (default when `containerHost` is applied). The
+  cloudflared container ships alongside the applying project services on
+  the same web-net network. No host ports; restart `unless-stopped`;
+  logging driver aligned with the T-2 compose-host log-driver elicit.
+  Fixture: `packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/compose-service/`.
+- **systemd-unit** (alternative for a bare `cloudHost`). The cloudflared
+  binary is installed via the vendor package per the cloudflared
+  as-a-service documented systemd unit and runs as a systemd service
+  reading the local configuration file. Fixture:
+  `packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/systemd-unit/`.
+
+When to reach for which: pick compose-service when the project already
+runs docker compose on the host (natural home, same log driver, same
+restart discipline); pick systemd-unit when the host runs bare and there
+is no compose stack to add a service to (or when the project deliberately
+keeps cloudflared outside the compose lifecycle for boot ordering).
+
+## Tunnel manifest shape
+
+The manifest lives at `cloudflare/tunnels/<name>.yaml` under the
+applying project. The shipped JSON schema
+(`contributions/probes/tunnel-manifest.schema.json`) requires:
+
+- `tunnel`: uuid-shaped Cloudflare Tunnel id.
+- `credentialsFile.secretRef`: reference into `security-secrets-management`
+  (never a literal path or JSON body inline).
+- `ingress`: array of `{ hostname?, service, originRequest? }`. The last
+  entry MUST be a catch-all `service: http_status:404`. When the
+  Access-gated shape is applied every non-catch-all rule attaches
+  `originRequest.access.aud` with the AUD from the sidecar.
+
+Example (compose-service, public-hostname mode):
+
+```yaml
+tunnel: 00000000-0000-4000-8000-0000000012ab
+credentialsFile:
+  secretRef: hq-estate/CLOUDFLARE_TUNNEL_CREDENTIALS_MY_PROJECT
+ingress:
+  - hostname: my-app.example.com
+    service: http://web:8080
+  - service: http_status:404
+```
+
+Example (Access-gated shape adds one block per non-catch-all rule):
+
+```yaml
+ingress:
+  - hostname: my-app.example.com
+    service: http://web:8080
+    originRequest:
+      access:
+        aud: AUD-example-cloudflare-team
+        teamName: my-team
+        required: true
+  - service: http_status:404
+```
+
+## Credentials-file discipline
+
+The tunnel credentials JSON file lands on the host at mode 0o400 (owner
+read only). The manifest references it as a `credentialsFile.secretRef`;
+the fixture placeholder at
+`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/*/credentials/probe.json.example`
+documents the pattern. The credentials file MUST NOT be committed to
+the applying project tree; a grep across the working tree for the
+tunnel id and account tag literals refuses on any tracked file. Every
+`cloudflaredReady`, `tunnelConnectorUp` and `ingressRuleReloaded` event
+body carries metadata only; the event-secrecy scan refuses on a body
+that mentions the credentials literal.
+
+Rotate credentials by rewriting the secret pointed to by `secretRef`
+and re-applying; the connector reloads on the next boot cycle.
+
+## Composition point (Access-gated vs public-hostname)
+
+The hostname mode is discovered from the applied capability set (not
+elicited; see ADR-4003). The blueprint reads the sidecar at
+`rcf/blueprints/edge-cloudflare-tunnel.applied.json` and inspects
+`appliedCapabilities`.
+
+- When `zeroTrustGate` is present (i.e. `edge-cloudflare-access` v1.0.0
+  is applied on the same project), every ingress rule attaches
+  `originRequest.access.aud` and cloudflared refuses at the edge any
+  request without a valid Access JWT for that AUD.
+- When `zeroTrustGate` is absent, the block is omitted and the tunnel
+  serves in public-hostname mode (open ingress on the public hostname;
+  authorization is whatever the origin service itself carries).
+
+The `aud-presence-check` probe refuses when the gated variant drifts to
+omit the AUD block (defensive against silent degradation).
+
+Graceful degrade: when Access is not applied (T-4 absent from
+`origin/main` or the applying project simply does not want the gate),
+the blueprint still ships in public-hostname mode. The probe assertion
+runs on both fixture variants so the shape flip is proven on every
+reviewer boot.
+
+## No-public-ports rule
+
+The T-1 firewall on a `cloudHost` allows 22 unconditionally and 80/443
+only when a reverse proxy is applied. A project applying only T-1 plus
+T-3 (no reverse proxy) declares zero 80/443 rules; the tunnel is the
+sole path from the edge to the origin. The manifest schema refuses
+ingress rules whose service URL binds to `0.0.0.0`, a non-loopback
+numeric IP, or an unresolvable shape.
+
+## Elicited parameters
+
+- `tunnel-name` (string; default `probe`): the Cloudflare Tunnel name
+  and the manifest filename under `cloudflare/tunnels/<name>.yaml`.
+- `cloudflare-zone-secret` (string; default `hq-estate/CLOUDFLARE_ZONE_ID`):
+  `security-secrets-management` reference to the Cloudflare zone the
+  tunnel serves under.
+- `public-hostname-template` (string; default `<service>.<zone>`):
+  template for the public hostname, expanded per ingress rule.
+- `ingress-rules` (string; default `[]`): ingress rules array (hostname
+  + service URL pairs).
+- `access-aud` (string; default empty): Access AUD tag for the gated
+  shape. Presence toggles the gated shape when `zeroTrustGate` is
+  applied.
+- `connector-runtime` (enum: `compose-service`, `systemd-unit`; default
+  `compose-service`): the connector runtime per ADR-4002.
+
+## Companions
+
+- `suggestedCompanions[logging]`: every `cloudflaredReady`,
+  `tunnelConnectorUp`, `tunnelConnectorDown`, `ingressRuleReloaded` and
+  `accessGateRefused` event writes through the applied logger.
+- `suggestedCompanions[errorHandling]`: a cloudflared exit, a JWT-check
+  failure, an ingress-rule schema violation, a hostname-DNS-route API
+  refusal constructs an internal error record.
+
+`providesRoles: []`.
+
+## Five probes
+
+Every probe writes its report envelope to
+`.rcf/reports/blueprints/edge-cloudflare-tunnel/<probe-name>.json`
+under the repo root.
+
+- **manifest-schema-validate** (local). Anchors AC-tunnel-manifestSchema,
+  AC-tunnel-noPublicOrigin, AC-tunnel-credentialsDiscipline. `accountBound: false`.
+  Ajv-free walker over the shipped JSON schema; runs on all four
+  variants; refuses on `SIMULATE_MANIFEST_INVALID_TUNNEL_ID`,
+  `SIMULATE_MANIFEST_CREDENTIALS_INLINE`, `SIMULATE_MANIFEST_MISSING_CATCHALL`,
+  `SIMULATE_ORIGIN_PORT_OPEN`, `SIMULATE_EVENT_SECRECY_LEAK`.
+- **cloudflared-config-lint** (local). Anchors AC-tunnel-hostnameRoutes.
+  `accountBound: false`. Runs `cloudflared tunnel --config <path> ingress validate`
+  via a local binary or the vendor container image
+  `cloudflare/cloudflared:2026.8.3`; refuses on `SIMULATE_INGRESS_INVALID`.
+- **aud-presence-check** (local). Anchors AC-tunnel-accessGated,
+  AC-tunnel-accessGatedRefuse. `accountBound: false`. Reads the sidecar
+  and the paired manifests; asserts the shape flips correctly; refuses
+  on `SIMULATE_AUD_DROP` when the gated fixture drifts to open ingress.
+- **real-account-connector-healthy** (account-bound). Anchors
+  AC-tunnel-connectorHealthy. `accountBound: true` on
+  `CI_HAS_CLOUDFLARE_ACCOUNT` AND `CI_HAS_HETZNER_ACCOUNT`. Without
+  both, records `accountBoundSkipped: true` and the aggregate flips to
+  `pass`.
+- **real-account-tunnel-hostname-routes** (account-bound). Anchors
+  AC-tunnel-hostnameRoutes (public sub-case) and AC-tunnel-accessGated
+  (gated sub-case). `accountBound: true`. The public-hostname sub-case
+  runs on `CI_HAS_CLOUDFLARE_ACCOUNT` + `CI_HAS_HETZNER_ACCOUNT`; the
+  access-gated sub-case adds `CI_HAS_CLOUDFLARE_ACCESS` per the round-7
+  Q4 ratification. Sub-cases skip independently.
+
+The delegate shims at
+`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/run-<probe>.mjs`
+read the `SIMULATE_*` env vars and prepare mutated inputs in a scratch
+dir; the probe modules never read a `SIMULATE_` env var and never
+branch on being under mutation.
+
+## Two fixture variants times two hostname modes
+
+The fixture lives under
+`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/`:
+
+- `compose-service/compose-fragment.yaml`: the cloudflared compose
+  service alongside the T-2 web and caddy services.
+- `systemd-unit/cloudflared.service`: the systemd unit per the vendor
+  as-a-service docs.
+- `<runtime>/cloudflare/tunnels/public-hostname.yaml`: manifest without
+  the AUD block.
+- `<runtime>/cloudflare/tunnels/access-gated.yaml`: manifest with the
+  AUD block on every non-catch-all rule.
+- `<runtime>/credentials/probe.json.example`: placeholder credentials
+  documenting the 0o400 mode discipline.
+- `sidecars/access-gated.applied.json`: `appliedCapabilities` includes
+  `zeroTrustGate`.
+- `sidecars/public-hostname.applied.json`: `appliedCapabilities`
+  excludes `zeroTrustGate`.
+
+Reviewer boot (mocked, no account) from the fixture directory:
+
+```
+cd packages/rcf-lite/test/fixtures/hetzner-throwaway-server
+node ./run-tunnel-manifest-schema-validate.mjs && node ./run-cloudflared-config-lint.mjs && node ./run-aud-presence-check.mjs
+```
+
+Reviewer boot (real account, throwaway server): set
+`CI_HAS_CLOUDFLARE_ACCOUNT=true` and `CI_HAS_HETZNER_ACCOUNT=true`
+(and `CI_HAS_CLOUDFLARE_ACCESS=true` for the gated sub-case) with the
+account tokens loaded via `security-secrets-management`, then invoke the
+two `run-real-account-*.mjs` scripts.
+
+## Composition on the shelf
+
+Consumes:
+- `platform-docker-compose-host` v1.0.0 (`containerHost` capability) for
+  the compose-service runtime path.
+- `deploy-hetzner-server` v1.0.0 (`cloudHost` capability) for the bare
+  systemd-unit runtime path.
+- `security-secrets-management` v1.0.1 (`secretsProvider` capability) for
+  the tunnel credentials `secretRef`.
+- Optionally `edge-cloudflare-access` v1.0.0 (`zeroTrustGate` capability)
+  for the Access-gated shape.
+
+Provides:
+- `tunnelBridge` (declared under `capabilities` on `blueprint.json`).
+- New global topic `edgeIngressBridge` on ADR-4001 (scope global).
+
+Conflict-by-design with future non-Cloudflare siblings on the
+`edgeIngressBridge` topic: Tailscale Funnel, Fly.io proxy, etc.
+would contribute the same topic string with a different mechanism.
+Round 7 ships only the Cloudflare Tunnel provider.