rcf-lite 0.25.0 → 0.26.0

package/CHANGELOG.md

@@ -6,6 +6,31 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.26.0] - 2026-09-09
+
+rcf-lite 0.26.0 is a hardening and authoring release. The Cloudflare-platform blueprints on the shelf pick up real-account probe drivers with positive evidence and one shared account-token env matrix, the blueprint authoring standard gains three new sections (7c REQ-layer sufficiency, 7d positive-evidence verification, 7e single-definition ownership) plus RULE 16 for the managed agent block, and `rcf define blueprint` gains a `lint-consistency` verb, a per-slug disposition ledger, an apply-time disposition prompt and an identity-register field on the seeded profile. The schema floor moves to `@stravica-ai/rcf-schemas` 0.6.2. Nothing here is breaking.
+
+### Added
+
+- **Blueprint chain-consistency lint verb: `rcf define blueprint lint-consistency <source>` (PR #183).** Two passes over one blueprint's own JSON and markdown. Pass 1 checks single-definition ownership: HTTP-header and env-var casing drift between an owning TAC's interfaces, internal structure, responsibilities or purpose and any other artefact, plus an `undeclaredRestatement` finding when an AC restates a token owned by a TAC interface without an `ownerRef.tacId` reference. Pass 2 checks REQ delivery: `reqNoDelivery` when a REQ description carries a promise phrase (must, requires, guarantees, ceiling, never, invariant, on boot, at boot, event) without a `deliveredBy` link into a TAC or ADR, and `reqDeliveryNotCarried` when the named TAC or field is absent or does not appear in the TAC's responsibilities or interfaces. Exit 0 on clean, exit 3 on unsuppressed findings, exit 2 on usage error. `--json` emits the envelope `{ blueprint, findings[], verdict, passCounts }`. Pass-1 findings are suppressible via a `## Known chain-consistency-lint suppressions` section on the blueprint README (one row per finding id with a one-sentence reason); pass-2 findings are not suppressible. A soft-mode CI lint step runs the verb across the shelf so authoring drift surfaces on every PR without blocking the merge yet.
+- **Per-slug disposition ledger and `rcf define blueprint dispositions <slug> [--json]` verb (PR #183).** A ledger file at `rcf/blueprints/<slug>.disposition.json` sits alongside the existing applied sidecar and carries one record per contributed AC with an `action` (`pending-disposition`, `pending-operator`, `accepted`, `adjusted`, `dropped`, `escalated-as-defect`), optional `reason`, `resolvedAt`, `resolvedBy`, `escalatedAt`, `escalatedToOperator`, `defectUrl`, and an optional `sourceDisposition` of `fixed` or `template`. Written on a fresh `rcf define blueprint add`; a re-apply leaves an existing ledger byte-identical so operator edits are never clobbered. The read-only `dispositions` verb prints one line per record with action, reason and resolution timestamp, or the raw ledger with `--json`. Exit 0 always; a missing ledger is a legitimate zero state. Schema follow-up: a `$defs/blueprintDispositionLedger` shape lands on `@stravica-ai/rcf-schemas` in a later release; for now the writer guards the record shape inline.
+- **Apply-time disposition prompt (PR #183).** After a fresh `rcf define blueprint add` the CLI prints a canonical prompt naming the newly initialised ledger and the disposition vocabulary, so an operator lands on the ledger before the next verify. Suppressible with `--no-disposition-prompt`.
+- **Identity register field on the seeded profile (PR #183).** The identity seed template gains a `## Register` section under `## Working preferences` with the three-value vocabulary (`productOwner`, `engineer`, `unstated`) seeded to `unstated`. Register capture stays a managed-block flow, so `cli/init.js` is unchanged; existing projects pick up the field on the next `rcf doctor --fix` sweep of the managed block.
+- **Blueprint authoring standard sections 7c, 7d, 7e (PR #182).** Section 7c (REQ-layer sufficiency): every capability token declared on `blueprint.json:capabilities[]` and every option value on `elicits[]` is backed by at least one must-priority requirement; a blueprint without an `elicits` key is legal only when no apply-time answer is named anywhere in the requirements, guide or TAC records. Section 7d (positive-evidence verification): every verification artefact asserts positive evidence of the property it exists to protect (a request id, a response body excerpt, a created-then-deleted resource id in an inventory diff, or a real deploy record), never the absence of a previously seen bad signature; env vars are declared on the fixture, and `accountBoundSkipped: true` is legal only when the account env is unset and paired with an exact non-empty `reason`. Section 7e (single-definition ownership and authoring order): every named contract is defined exactly once in one owning artefact (TAC for wire shapes and interfaces, ADR for behaviour decisions, REQ for externally promised properties with a `deliveredBy` link into the delivering TAC or ADR); US, AC and guide reference the owner rather than restating it, and authoring order follows. RULE 16 lands in `guidance/managed/agent-instructions-block.md` so applying agents inherit both disciplines from the managed block on the next `rcf doctor --fix` sweep.
+- **Ten new blueprint-authoring-checklist rows in section 6 (PR #182).** Three rows from section 7c, five from section 7d, two from section 7e; the block hash and the `harness-template.md` fragment regenerate via `scripts/gen-managed-artefacts.mjs`.
+- **Positive-evidence remap at record composition (PR #182).** `packages/rcf-lite/src/browser-verify/manifest-writer.js:composeBrowserVerificationRecord` remaps a `checks[]` or `preChecks[]` record with `verdict: 'pass'` and neither an `evidence` field nor `accountBoundSkipped: true` (with a non-empty `reason`) to `verdict: 'fail'` with `detail: 'positive-evidence-missing'`. The remap fires at record composition so the composed record is what the manifest carries and the fail surfaces at the ship gate. `pack-runner.js` carries `evidence`, `accountBoundSkipped` and `reason` through from each check's and pre-check's `run` outcome so the composer sees the fields.
+- **H-2 Cloudflare-platform probe integrity (PR #179).** The Cloudflare-platform blueprints on the shelf (`platform-cloudflare-kv`, `platform-cloudflare-durable-objects`, `messaging-queue-cloudflare`, `edge-cloudflare-tunnel`) pick up real-account probe drivers that assert positive evidence: KV re-anchor and observability on cache-aside miss/hit, DO storage round-trip with anchor coverage, queue real concurrency with dead-letter observation, tunnel connector health and hostname routing. The `packages/rcf-lite/test/fixtures/cf-platform/` fixture README gains a "Declared env vars" section naming the first-tier `CI_HAS_CLOUDFLARE_ACCOUNT` gate and the four second-tier variables the account-bound branches read (`CF_ACCOUNT_ID`, `CF_API_TOKEN`, `CF_KV_NAMESPACE_ID`, `CF_WORKER_NAME`), so a runner without those env vars sees clean `accountBoundSkipped: true` rows with a stated reason rather than a silent pass.
+
+### Changed
+
+- **Schema floor: `@stravica-ai/rcf-schemas` 0.6.1 to 0.6.2.** No new required fields on shipped artefacts; picks up the shape work that supports the disposition-ledger record and the identity-register field.
+
+#### Also in this release
+
+- **`object-storage-s3` v1.0.0 to v1.1.0 (PR #177).** The Hetzner Object Storage adapter lands as the follow-up sibling to the R2 first adapter shipped in 0.23.0, per the 0.25.0 headline. The blueprint bumps but the rcf-lite package version does not bump for this alone; it rides along in this release.
+- **`deploy-hetzner-server` v1.0.0 to v1.0.1 (PR #178).** Real-path fix for the cloud-init render path resolution so an applied project on Node 24 finds the template through the resolved module directory rather than the workspace-relative path.
+- **Blueprint authoring notes on AC sufficiency and fixed-vs-template dispositions (PRs #180, #181).** Two docs-only additions to `packages/rcf-lite/docs/blueprint-authoring.md` that pair with the section 7c and disposition-ledger work: how many ACs are enough for a given US, and how a contributed AC's `sourceDisposition` reads as `fixed` (delivered verbatim) or `template` (adjusted at apply time).
+
 ## [0.25.0] - 2026-09-08
 
 rcf-lite 0.25.0 opens the Hetzner line with three blueprints in one round: a Hetzner Cloud server as the shipped Linux VM shape with the estate hardening baseline and a snapshot cadence, a docker-compose platform on top with healthchecks, secrets as file mounts and a first-class reverse-proxy artefact, and a Cloudflare Tunnel bridge that composes with Access when Zero Trust is applied and drops to public-hostname mode when it is not. Every real-account probe across the round ships accountBoundSkipped pending the Hetzner and Cloudflare token vault ruling; the local probes carry the ship-time verdicts. The follow-up Hetzner Object Storage adapter ships as a sequential PR under `object-storage-s3` v1.1.0 after this release; the rcf-lite package version does not bump for it.

package/blueprints/application-account-settings/docs/topics.md

@@ -26,7 +26,7 @@ The blueprint claims no new global topics at v1.0.0. Account-settings is a consu
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/application-admin-console/docs/topics.md

@@ -26,7 +26,7 @@ The blueprint claims no new global topics at v1.0.0. The console is a consumer o
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/application-api-rest/docs/topics.md

@@ -49,7 +49,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/application-charts/docs/topics.md

@@ -25,7 +25,7 @@ The blueprint claims no new global topics at v1.0.0. The chart-component contrac
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/application-dashboard/docs/topics.md

@@ -25,7 +25,7 @@ The blueprint claims no new global topics at v1.0.0. The dashboard-shell contrac
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/application-datatable/docs/topics.md

@@ -24,7 +24,7 @@ The blueprint claims no new global topics at v1.0.0. The datatable shell is a ge
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/application-empty-error-states/docs/topics.md

@@ -25,7 +25,7 @@ The blueprint claims no new global topics at v1.0.0. Every ADR (HTTP status cont
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/application-error-handling/docs/topics.md

@@ -31,7 +31,7 @@
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/application-file-upload/docs/topics.md

@@ -26,7 +26,7 @@ The blueprint claims no new global topics at v1.0.0. Every ADR (transport branch
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/application-forms-wizard/docs/topics.md

@@ -25,7 +25,7 @@ The blueprint claims no new global topics at v1.0.0. Every ADR (navigation postu
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorage` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorage` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/application-notifications-in-app/docs/topics.md

@@ -28,7 +28,7 @@ The `application-notifications-` prefix is reserved for the sibling channel blue
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/application-onboarding-tour/docs/topics.md

@@ -24,7 +24,7 @@ The blueprint claims no new global topics at v1.0.0. Onboarding-tour is a consum
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/application-spa/docs/topics.md

@@ -54,7 +54,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/delivery-ci-workflows/docs/topics.md

@@ -60,7 +60,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/deploy-cloudflare-workers/docs/topics.md

@@ -46,7 +46,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/deploy-hetzner-server/CHANGELOG.md

@@ -1,3 +1,24 @@
+## 1.0.1
+
+H-1 hardening patch train (round-7 real-account gate d-2026-09-08-010 defect list). Fixes nine real-path defects in the shared throwaway-Hetzner-server fixture at packages/rcf-lite/test/fixtures/hetzner-throwaway-server/ so the three T-1 real-account probes return aggregateVerdict pass on a live Hetzner Cloud project unpatched, and destroy plus sweep-orphans never leak a server. Every existing v1.0.0 contribution id byte-identical apart from the cloud-init template bodies (baseline unchanged; adds a NOPASSWD sudoers.d fragment for the deploy user) and the three T-1 mocked probe bodies (mutation-purity clean plus a new rendered-file assertion).
+
+Defect list fixed:
+
+- (1) provision.mjs reads snake_case fields off the hcloud server create response (public_net.ipv4.ip, datacenter.location.name, server_type.name). v1.0.0 read camelCase and threw on every real-account provision, so destroy.mjs could not find the server to tear down.
+- (2) provision.mjs renders the cloud-init user-data via src/cloud-init-renderer.mjs before hcloud server create fires and writes it to hetzner/servers/rendered/<name>.cloud-init.yaml. v1.0.0 expected a file that no shipped code wrote; every provision failed on missing user-data.
+- (3) src/cloud-init-renderer.mjs resolves each ssh key name to its .publicKey via hcloud ssh-key describe --output json and inlines the material into ssh_authorized_keys under the deploy user. v1.0.0 inlined the key NAME and the deploy user had no working authorized_keys entry.
+- (4) destroy.mjs and sweep-orphans.mjs never pass --output json to a hcloud <resource> delete verb (the delete verbs reject the flag with unknown flag: --output). The tolerant JSON parser accepts arrays, objects and the delete verbs short informational text output.
+- (5) src/snapshot-verb.mjs shells hcloud server create-image --type snapshot --description <label> <server-id> and recovers the created snapshot id via hcloud image list --type=snapshot --output json by matching the serverName label. v1.0.0 called a non-existent hcloud image create-image verb.
+- (6) src/ssh-baseline-check.mjs polls port 22 open and a trivial ssh true exec (bounded up to 6 minutes) before firing the six baseline checks. v1.0.0 spawned ssh immediately after provision and every check timed out on connection refused because cloud-init had not finished.
+- (7) contributions/templates/cloud-init.yaml.tmpl adds a write_files sudoers.d fragment at /etc/sudoers.d/90-deploy-nopasswd (mode 0440) that grants NOPASSWD to the deploy user, so the sudoed baseline checks (cloud-init status --wait, ufw status, iptables -L, systemctl is-active fail2ban) never block on a tty prompt.
+- (9) provision.mjs reads an env override RCF_LITE_CI_SSH_KEY_NAME (per-key comma-separated) for the manifest sshKeyIds, with the manifest value staying the default when the override is unset. Documented in the fixture README.
+
+Also: the three T-1 mocked probe modules (cloud-init-render-lint, manifest-schema-validate, hcloud-dry-run-mock) no longer read any process.env.SIMULATE_ switch inside the probe body per the H-1 mutation-purity gate row. The switches live entirely inside fixture-side files (src/cloud-init-renderer.mjs, src/hcloud-mock.mjs, src/provisioner-facade.mjs and the fixture-side run-manifest-schema-validate.mjs shim) and alter INPUT only. The hcloud-dry-run-mock probe now consumes the SAME rendered cloud-init file the real path consumes (renderer writes it, both the mock and real path read it) and asserts an ssh public-key line under the deploy user plus a NOPASSWD directive naming that user (H-1 REQ-145 / AC-14501-1). Report envelopes under .rcf/reports/blueprints/deploy-hetzner-server/ regenerated from the real run.
+
+Chain: HQ hardening block H-1 REQ-145..149 / TS-175..179 / FBS-165..169 / CN-510..519 per HQ chain-block ruling 2026-09-08. Real run under Baz one-off approval 2026-09-08: yes, one-off for round 7 gates; Ensure that after any testing etc the Hertner account leaves NO orphaned resources behind. Leave it in the state it started in.
+
+Defect (8) T-2 and T-3 stub drivers are OUT of scope for H-1 (H-2 owns them).
+
 # deploy-hetzner-server changelog
 
 ## 1.0.0

package/blueprints/deploy-hetzner-server/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "deploy-hetzner-server",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "category": "deploy",
   "capabilities": [
     "cloudHost"

package/blueprints/deploy-hetzner-server/contributions/probes/cloud-init-render-lint.mjs

@@ -7,9 +7,13 @@
 // via the fixture's src/cloud-init-renderer.mjs. Asserts the six hardening
 // baseline blocks appear in the rendered YAML.
 //
-// SIMULATE_HARDENING_DRIFT=true removes the unattended-upgrades write-file
-// block from the rendered YAML; the probe FAILS naming the missing line
-// per hetzner-round-7-spec-2026-09-07.md section 3.4 lesson 4.
+// Purity: the probe reads only the shipped template and the fixture
+// manifest; no process.env.SIMULATE_ switch is read here. The
+// fixture-side renderer at src/cloud-init-renderer.mjs is the sole
+// reader of SIMULATE_HARDENING_DRIFT and it mutates INPUT (the
+// rendered YAML) only; the probe then FAILS naming the missing
+// baseline block per hetzner-round-7-spec-2026-09-07.md section 3.4
+// lesson 4. H-1 (2026-09-08).
 
 import { readFile } from 'node:fs/promises';
 import { resolve } from 'node:path';
@@ -23,7 +27,11 @@ export default async function runProbe() {
   const manifestPath = resolve(FIXTURE_DIR, 'hetzner/servers/ci-throwaway.json');
   const { renderCloudInit, BASELINE_BLOCKS } = await import(rendererPath);
   const manifest = JSON.parse(await readFile(manifestPath, 'utf8'));
-  const rendered = await renderCloudInit(manifest);
+  // In-process render only; pass explicit stub public-key material so
+  // the renderer never shells to hcloud (mock path stays hermetic).
+  const rendered = await renderCloudInit(manifest, {
+    publicKeys: ['ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFakePubKeyForRenderLintHardeningH1 rcf-lite-ci-mock'],
+  });
   const missing = [];
   const present = [];
   for (const block of BASELINE_BLOCKS) {
@@ -58,7 +66,6 @@ export default async function runProbe() {
       renderedByteLength: rendered.length,
       presentBlocks: present,
       missingBlocks: missing.map((m) => m.id),
-      mutationActive: process.env.SIMULATE_HARDENING_DRIFT === 'true',
     },
   };
 }

package/blueprints/deploy-hetzner-server/contributions/probes/hcloud-dry-run-mock.mjs

@@ -1,11 +1,26 @@
-// Probe: hcloud dry-run mock.
+// Probe: hcloud dry-run mock (v1.0.1 mutation-purified per H-1).
 //
 // anchorAcId: AC-37101-1 (provisioner facade sole reader + provisionerReady
-// on boot; also covers AC-37109-1 event-secrecy across the lifecycle).
+// on boot; also covers AC-37109-1 event-secrecy across the lifecycle;
+// also covers AC-14501-1 mock-consumes-rendered-file assertions per H-1
+// hardening block REQ-145).
 // accountBound: false.
 //
 // Drives the provisioner facade with the fixture's ci-throwaway manifest
-// against the mocked hcloud shim (src/hcloud-mock.mjs). Asserts:
+// against the mocked hcloud shim (src/hcloud-mock.mjs) and consumes the
+// SAME rendered cloud-init user-data file the real path consumes (the
+// fixture renderer writes it under hetzner/servers/rendered/ before the
+// facade is exercised, and this probe reads it back and asserts an
+// ssh-ed25519/ssh-rsa public-key line under the deploy user plus a
+// NOPASSWD directive naming that user). The rendered-file assertion is
+// what stops a mocked probe from passing while the real path fails on
+// the same artefact (H-1 REQ-145 / AC-14501-1).
+//
+// The probe body reads NO process.env.SIMULATE_ switch. Fixture-side
+// mutations live in src/cloud-init-renderer.mjs, src/hcloud-mock.mjs
+// and src/provisioner-facade.mjs and alter INPUT only.
+//
+// Assertions:
 //   - the facade opens on ready() and fires provisionerReady with a
 //     metadata-only payload {tool, apiHost}.
 //   - createServer parses the mocked JSON stdout and emits
@@ -15,17 +30,14 @@
 //   - destroyServer fires hetznerServerDestroyed with the id.
 //   - no event body across the run carries the token, an ssh private-key
 //     marker, or the rendered user-data bytes (event-secrecy check).
-//
-// Mutations:
-//   SIMULATE_JSON_PARSE_STRIP=true has hcloud-mock.mjs return non-JSON
-//   stdout so JSON.parse throws and the probe FAILS.
-//   SIMULATE_EVENT_SECRECY_LEAK=true has provisioner-facade.mjs inject
-//   the token into the hetznerServerProvisioned payload; the event-
-//   secrecy scan FAILS with a defensive-fake finding.
+//   - the rendered cloud-init file exists under the fixture's rendered
+//     directory and carries at least one ssh-ed25519 or ssh-rsa
+//     authorized-keys line under the deploy user plus a NOPASSWD
+//     directive naming that user (H-1 REQ-145 / AC-14501-1).
 
-import { readFile } from 'node:fs/promises';
-import { resolve } from 'node:path';
-import { FIXTURE_DIR } from './probe-utils.mjs';
+import { readFile, access } from 'node:fs/promises';
+import { relative, resolve } from 'node:path';
+import { FIXTURE_DIR, PROJECT_ROOT } from './probe-utils.mjs';
 
 export const anchorAcId = 'AC-37101-1';
 export const accountBound = false;
@@ -36,9 +48,47 @@ const PRIVATE_KEY_MARKER = 'BEGIN OPENSSH PRIVATE KEY';
 
 export default async function runProbe() {
   const facadePath = resolve(FIXTURE_DIR, 'src/provisioner-facade.mjs');
+  const rendererPath = resolve(FIXTURE_DIR, 'src/cloud-init-renderer.mjs');
   const manifestPath = resolve(FIXTURE_DIR, 'hetzner/servers/ci-throwaway.json');
   const { createProvisionerFacade, createEventLog } = await import(facadePath);
+  const { renderCloudInitToFile } = await import(rendererPath);
   const manifest = JSON.parse(await readFile(manifestPath, 'utf8'));
+  const results = [];
+
+  // Render the cloud-init to disk with a fixture-side stubbed public
+  // key (the mock path never calls hcloud ssh-key describe); the real
+  // path resolves the material via hcloud and writes to the same
+  // location. Both consume the same file shape.
+  const publicKeys = ['ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFakePubKeyForMockedRunHardeningH1 rcf-lite-ci-mock'];
+  const { renderedPath, rendered } = await renderCloudInitToFile(manifest, { publicKeys });
+
+  // H-1 REQ-145 / AC-14501-1: assert the rendered file carries an
+  // ssh-ed25519 or ssh-rsa line for the deploy user AND a NOPASSWD
+  // directive naming that user. This assertion is what breaks the
+  // "mock passes while real path fails on the same artefact" class.
+  const renderedFromDisk = await readFile(renderedPath, 'utf8');
+  const sshKeyLine = /(ssh-ed25519|ssh-rsa)\s+/i.test(renderedFromDisk);
+  const nopasswdLine = /deploy\s+ALL\s*=\s*\(ALL\)\s+NOPASSWD/i.test(renderedFromDisk);
+  if (!sshKeyLine) {
+    results.push({
+      anchorAcId: 'AC-14501-1',
+      verdict: 'fail',
+      detail: `rendered cloud-init at ${relative(PROJECT_ROOT, renderedPath)} carries no ssh-ed25519 or ssh-rsa authorized-keys line for the deploy user; the real path would provision a server with an unusable authorized_keys entry.`,
+    });
+  } else if (!nopasswdLine) {
+    results.push({
+      anchorAcId: 'AC-14501-1',
+      verdict: 'fail',
+      detail: `rendered cloud-init at ${relative(PROJECT_ROOT, renderedPath)} carries no NOPASSWD directive for the deploy user; the six sudoed baseline checks would block on a tty prompt.`,
+    });
+  } else {
+    results.push({
+      anchorAcId: 'AC-14501-1',
+      verdict: 'pass',
+      detail: `rendered cloud-init at ${relative(PROJECT_ROOT, renderedPath)} carries an ssh public-key line for the deploy user (byteLength ${rendered.length}) and a NOPASSWD sudoers directive for that user; the mock and the real path consume the same artefact.`,
+    });
+  }
+
   const { events, eventSink } = createEventLog();
   const facade = createProvisionerFacade({
     token: TOKEN,
@@ -46,7 +96,6 @@ export default async function runProbe() {
     apiHost: 'https://api.hetzner.cloud/v1',
     eventSink,
   });
-  const results = [];
   try {
     await facade.ready();
     const server = await facade.createServer(manifest);
@@ -86,7 +135,7 @@ export default async function runProbe() {
       results.push({
         anchorAcId: 'AC-37109-1',
         verdict: 'fail',
-        detail: `event-secrecy leak: ${leaks.map((l) => `${l.event} carries ${l.marker}`).join('; ')} (defensive-fake finding; check for a SIMULATE_EVENT_SECRECY_LEAK mutation).`,
+        detail: `event-secrecy leak: ${leaks.map((l) => `${l.event} carries ${l.marker}`).join('; ')} (defensive-fake finding; check for a SIMULATE_EVENT_SECRECY_LEAK mutation in the fixture-side facade shim).`,
       });
     } else {
       results.push({
@@ -99,7 +148,7 @@ export default async function runProbe() {
     results.push({
       anchorAcId: 'AC-37101-1',
       verdict: 'fail',
-      detail: `provisioner facade lifecycle threw: ${err.message} (probable cause: mocked hcloud stdout is not JSON; check for a SIMULATE_JSON_PARSE_STRIP mutation).`,
+      detail: `provisioner facade lifecycle threw: ${err.message} (probable cause: mocked hcloud stdout is not JSON; check for a SIMULATE_JSON_PARSE_STRIP mutation in the fixture-side mock shim).`,
     });
   }
   return {
@@ -107,10 +156,9 @@ export default async function runProbe() {
     extra: {
       eventCount: events.length,
       events: events.map((e) => ({ event: e.event, keys: Object.keys(e).sort() })),
-      mutations: {
-        jsonParseStrip: process.env.SIMULATE_JSON_PARSE_STRIP === 'true',
-        eventSecrecyLeak: process.env.SIMULATE_EVENT_SECRECY_LEAK === 'true',
-      },
+      renderedPath: relative(PROJECT_ROOT, renderedPath),
+      renderedByteLength: rendered.length,
+      renderedAssertions: { sshKeyLine, nopasswdLine },
     },
   };
 }

package/blueprints/deploy-hetzner-server/contributions/probes/manifest-schema-validate.mjs

@@ -9,9 +9,14 @@
 // validator ships with the probe so the shelf gains no runtime dependency
 // on ajv or similar. See validate() at the bottom.
 //
-// SIMULATE_MANIFEST_INVALID=true replaces the manifest's location with an
-// unknown token and the probe FAILS naming the offending field per
-// hetzner-round-7-spec-2026-09-07.md section 3.4 lesson 4.
+// Purity: the probe reads only the manifest dir and the shipped schema;
+// no process.env.SIMULATE_ switch is read here. The fixture-side shim
+// packages/rcf-lite/test/fixtures/hetzner-throwaway-server/
+// run-manifest-schema-validate.mjs is the sole reader of
+// SIMULATE_MANIFEST_INVALID and it mutates INPUT (a temp manifest dir
+// pointed at via RCF_FIXTURE_MANIFEST_DIR) only; the probe then FAILS
+// naming the offending field per hetzner-round-7-spec-2026-09-07.md
+// section 3.4 lesson 4. H-1 (2026-09-08).
 
 import { readFile } from 'node:fs/promises';
 import { readManifestFiles, SCHEMA_PATH } from './probe-utils.mjs';
@@ -32,7 +37,6 @@ export default async function runProbe() {
     };
   }
   const results = [];
-  const mutationActive = process.env.SIMULATE_MANIFEST_INVALID === 'true';
   for (const f of files) {
     let doc;
     try {
@@ -45,7 +49,6 @@ export default async function runProbe() {
       });
       continue;
     }
-    if (mutationActive) doc = { ...doc, location: 'mars1' };
     const errors = validate(schema, doc, `#/${f.name}`);
     if (errors.length > 0) {
       for (const e of errors) {
@@ -69,7 +72,6 @@ export default async function runProbe() {
     extra: {
       manifestCount: files.length,
       manifestNames: files.map((f) => f.name),
-      mutationActive,
     },
   };
 }

package/blueprints/deploy-hetzner-server/contributions/probes/probe-utils.mjs

@@ -21,7 +21,13 @@ export const FIXTURE_DIR = resolve(
   PROJECT_ROOT,
   'packages/rcf-lite/test/fixtures/hetzner-throwaway-server',
 );
-export const MANIFEST_DIR = resolve(FIXTURE_DIR, 'hetzner/servers');
+// Config override, not a mutation switch: the fixture-side shim for
+// manifest-schema-validate may write a mutated copy to a scratch dir
+// and point MANIFEST_DIR at it via RCF_FIXTURE_MANIFEST_DIR so the
+// probe stays SIMULATE-free (H-1 mutation-purity gate row, 2026-09-08).
+export const MANIFEST_DIR = process.env.RCF_FIXTURE_MANIFEST_DIR
+  ? resolve(process.env.RCF_FIXTURE_MANIFEST_DIR)
+  : resolve(FIXTURE_DIR, 'hetzner/servers');
 export const SCHEMA_PATH = resolve(HERE, '..', 'schemas', 'hetzner-server.schema.json');
 export const REPORT_DIR = resolve(
   PROJECT_ROOT,

package/blueprints/deploy-hetzner-server/contributions/probes/real-account-cloud-init-hardened.mjs

@@ -45,11 +45,12 @@ export default async function runProbe() {
         })),
       };
     }
+    const blocks = report.checks.filter((c) => c.verdict === 'pass').map((c) => c.id);
     return {
       results: [{
         anchorAcId,
         verdict: 'pass',
-        detail: `cloud-init status --wait completed on server ${provisioned.id}; all six ssh baseline checks passed.`,
+        detail: `cloud-init reached terminal state on server ${provisioned.id} (cloud-init status --wait exit ${report.cloudInit ? report.cloudInit.code : 'skipped'}); six baseline hardening blocks observed: ${blocks.join(', ')}.`,
       }],
       extra: report,
     };

package/blueprints/deploy-hetzner-server/contributions/templates/cloud-init.yaml.tmpl

@@ -21,6 +21,18 @@ users:
 # Block 2: root disabled (PermitRootLogin no).
 # Block 1 continued: PasswordAuthentication no.
 write_files:
+  # Block 1 continued: NOPASSWD sudo for the deploy user (mode 0440,
+  # visudo-shaped fragment). Baseline hardening requires the deploy
+  # user to run sudoed baseline checks without a tty; the write_files
+  # entry ships the fragment in the same posture as the sshd config.
+  - path: /etc/sudoers.d/90-deploy-nopasswd
+    permissions: '0440'
+    content: |
+      # deploy-hetzner-server v1.0.1 hardening: passwordless sudo for
+      # the deploy user so the ssh baseline checks (cloud-init status
+      # --wait, ufw status, iptables -L, systemctl is-active fail2ban)
+      # never block on a tty prompt.
+      deploy ALL=(ALL) NOPASSWD:ALL
   - path: /etc/ssh/sshd_config.d/hardening.conf
     permissions: '0644'
     content: |
@@ -70,13 +82,17 @@ write_files:
       APT::Periodic::Update-Package-Lists "1";
       APT::Periodic::Unattended-Upgrade "1";
 
-# Package install: ufw for block 3, fail2ban for block 5,
-# unattended-upgrades for block 6, iptables-persistent for block 4.
+# Package install: ufw for block 3, fail2ban for block 5.
+# unattended-upgrades ships in the ubuntu-24.04 base image (v1.0.1 fix:
+# was in packages: v1.0.0 which caused a spurious NoNewestVersion line).
+# iptables-persistent conflicts with ufw on ubuntu-24.04 noble (ufw
+# Breaks: iptables-persistent), so we DO NOT install it; the DOCKER-USER
+# chain is loaded in runcmd via iptables directly (block 4 stays valid
+# for the running boot; reboot-persistence for the chain is a follow-up
+# item outside the H-1 hardening scope).
 packages:
   - ufw
   - fail2ban
-  - unattended-upgrades
-  - iptables-persistent
 
 runcmd:
   # Block 3: UFW default-deny incoming, allow 22 80 443.
@@ -89,5 +105,9 @@ runcmd:
   - systemctl reload ssh || systemctl restart ssh
   - systemctl enable --now fail2ban
   - systemctl enable --now unattended-upgrades
-  # Load the DOCKER-USER iptables rules on boot.
-  - iptables-restore -n < /etc/iptables/rules.v4.d/docker-user.rules
+  # Block 4 runtime: create the DOCKER-USER chain directly via iptables
+  # (v1.0.1 fix: iptables-persistent conflicts with ufw on Ubuntu 24.04
+  # noble; iptables itself is preinstalled, so the chain lands cleanly).
+  - iptables -N DOCKER-USER 2>/dev/null || true
+  - iptables -A DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
+  - iptables -A DOCKER-USER -j DROP

package/blueprints/deploy-hetzner-server/docs/topics.md

@@ -25,7 +25,7 @@ to `deploy-hetzner-server` v1.0.0.
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/edge-cloudflare-access/docs/topics.md

@@ -46,7 +46,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/edge-cloudflare-rate-limiting/docs/topics.md

@@ -49,7 +49,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/edge-cloudflare-tunnel/CHANGELOG.md

@@ -1,5 +1,15 @@
 # edge-cloudflare-tunnel CHANGELOG
 
+## 1.0.1 - 2026-09-08
+
+H-2 hardening train (`h2-cf-platform-probe-integrity`): probe-integrity patch. No capability change.
+
+- Replaced the warn-on-env-set stub in `real-account-connector-healthy.mjs` with a real cloudflared connector-health driver via the new cf-edge shim (`packages/rcf-lite/test/fixtures/cf-edge/h2-cf-tunnel-shim.mjs`). With both `CI_HAS_CLOUDFLARE_ACCOUNT` and `CI_HAS_HETZNER_ACCOUNT` set, the driver provisions the throwaway server through the hetzner fixture surface (H-1 territory, consumed as-is), runs `cloudflared tunnel info <name>` via the shim, asserts healthy connector count, captures the `tunnelConnectorUp` event, and always tears the server down. Env-absent branch keeps pass-with-skip. Env-present-with-fixture-failure yields FAIL with a pointer to the fixture step, never warn.
+- Replaced both warn-on-env-set stubs in `real-account-tunnel-hostname-routes.mjs` with real drivers. Public-hostname sub-case: undici fetch against the scratch subdomain via the shim's `fetchTunnelHostname` seam, activated on `CI_HAS_CLOUDFLARE_ACCOUNT`. Access-gated sub-case: two-identity HS256 JWT check, activated only when `CI_HAS_CLOUDFLARE_ACCESS` is ALSO set (amendment 4). Env-absent branch keeps pass-with-skip. A pass is no longer reachable from `CI_HAS_CLOUDFLARE_ACCOUNT` presence alone.
+- Converted the credentials-placeholder-read-failed branch in `manifest-schema-validate.mjs::eventSecrecyScan` from warn to fail with a pointer to the exact fixture path (`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/*/credentials/probe.json.example`) and the setup requirement (must exist and parse as JSON).
+- Added the cf-edge tunnel shim (`packages/rcf-lite/test/fixtures/cf-edge/h2-cf-tunnel-shim.mjs`) with five seams: `provisionScratchServer`, `destroyScratchServer`, `cloudflaredTunnelInfo`, `fetchTunnelHostname`, `mintScratchIdentity`. The shim reads `H2_CF_TUNNEL_SHIM_MODE` and `H2_CF_TUNNEL_HOSTNAME_SHIM_MODE` for synthetic-mode branches; the probe bodies hold zero `SIMULATE_` token references.
+- Tunnel symbolic-anchor ruling (task C4): the `AC-tunnel-*` symbolic ids on the five tunnel probes ARE the shipped AC ids in the `US-39101..US-39108` contribution band, so no re-anchor was performed. Full mapping in the H-2 PR body.
+
 ## 1.0.0 - 2026-09-08
 
 Initial release. Round-7 T-3 of the Hetzner spec at `projects/blueprint-library/specs/hetzner-round-7-spec-2026-09-07.md`.

package/blueprints/edge-cloudflare-tunnel/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "edge-cloudflare-tunnel",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "category": "edge",
   "capabilities": [
     "tunnelBridge"