rcf-lite 0.25.0 → 0.27.0

package/blueprints/deploy-cloudflare-workers/contributions/user-stories/deploy-cloudflare-workers-us-12114.json

@@ -16,12 +16,27 @@
       "when": "the applied sidecar records the operator's answers and a wrangler.toml is generated",
       "then": "appliedElicitations.assets-directory equals ./public; the generated wrangler.toml carries [assets] directory = \"./public\" and no run_worker_first field; the manifest carries no pages_build_output_dir field",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-12114-2",
+      "description": "Malformed assets-directory refusal. Given the elicited assets-directory answer that names a path outside the Worker source root (an absolute path, or a path with .. segments), when the deploy adapter validates the elicited answer, then the adapter refuses with a named error kind (invalidAssetsDirectory), the wrangler manifest is not rendered, and no upload runs.",
+      "given": "assets-directory answer names a path outside the Worker source root",
+      "when": "the deploy adapter validates",
+      "then": "the adapter refuses with invalidAssetsDirectory; no manifest is rendered; no upload runs",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1302-deploy-cloudflare-workers-wrangler-manifest",
+        "field": "responsibilities.assets"
+      },
+      "disposition": "template"
     }
   ],
   "tacIds": [
     "TAC-1302-deploy-cloudflare-workers-wrangler-manifest"
   ],
   "createdAt": "2026-09-07T00:00:00Z",
-  "updatedAt": "2026-09-07T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-cloudflare-workers/contributions/user-stories/deploy-cloudflare-workers-us-12115.json

@@ -12,16 +12,31 @@
     {
       "id": "AC-12115-1",
       "description": "The guide file blueprints/deploy-cloudflare-workers/guide/deploy-cloudflare-workers.md gains one new section titled Workers-with-static-assets: the SPA-on-Workers shape. The section carries the verbatim Cloudflare Pages landing-page quote (Workers supports most Pages use cases and offers a broader feature set. It is Cloudflare's primary platform for building applications. Start new projects with Workers.), the two elicit signatures (assets-directory string default empty; run-worker-first boolean default false), a copy-paste wrangler.toml snippet showing the [assets] block with directory and the run_worker_first hint, and a link to the Cloudflare migrate-from-Pages guide at https://developers.cloudflare.com/workers/static-assets/migration-guides/migrate-from-pages/. The Cloudflare Workers static-assets doc at https://developers.cloudflare.com/workers/static-assets/ is cited in the same section. Both URLs return HTTP 200 at gate time.",
-      "given": "the updated guide file on the T-0 branch",
+      "given": "the updated guide file on the branch",
       "when": "a reader opens the guide and grep locates the section heading, the verbatim quote and the two URLs",
       "then": "the section heading appears once; the verbatim landing-page quote appears once; both Cloudflare URLs appear at least once each; a curl -fsSI on each URL returns HTTP 200",
       "testable": true,
-      "scope": "library"
+      "scope": "library",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-12115-2",
+      "description": "One-line note: this story is documentation-only. The mechanism (guide prose linking Cloudflare's migrate-from-Pages walkthrough) has no documented failure path in the blueprint's own guide or TAC records, per section 7a; a broken link is a doc-drift finding surfaced by the shipped link-check probe rather than a mechanism failure.",
+      "given": "guide prose linking Cloudflare's migrate-from-Pages walkthrough",
+      "when": "the shipped link-check probe runs",
+      "then": "a broken link is surfaced as a doc-drift finding; there is no additional mechanism failure path to bind",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1302-deploy-cloudflare-workers-wrangler-manifest",
+        "field": "responsibilities.assets"
+      },
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-1302-deploy-cloudflare-workers-wrangler-manifest"
   ],
   "createdAt": "2026-09-07T00:00:00Z",
-  "updatedAt": "2026-09-07T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-cloudflare-workers/docs/topics.md

@@ -46,7 +46,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/deploy-cloudflare-workers/guide/deploy-cloudflare-workers.md

@@ -80,7 +80,12 @@ Cloudflare's own Pages landing page states, verbatim (fetched 2026-09-06): "Work
 The bump adds two elicits on the top-level `elicits[]` block:
 
 - `assets-directory` (kind `string`, default empty): the path (relative to the Worker source root) whose files Cloudflare serves at the edge as static assets. An empty answer keeps the bare-Worker shape (no `[assets]` block on the generated `wrangler.toml`); a non-empty answer emits `[assets] directory = "<answered path>"`.
-- `run-worker-first` (kind `boolean`, default `false`): the SPA fallback discipline. A truthy answer emits `run_worker_first = true` under the `[assets]` block; a falsy or unanswered answer omits the field, leaving Cloudflare's runtime to serve a matching static asset before the Worker fetch handler runs. The elicit is only meaningful when `assets-directory` is non-empty (a Worker with no assets has nothing to serve first); the loader-side `when-elicitedNonEmpty` predicate the spec calls for is a mechanism follow-up, so the elicit fires unconditionally today.
+- `run-worker-first` (kind `string`, default `"false"`): the SPA fallback discipline. The Cloudflare Workers static-assets binding page (https://developers.cloudflare.com/workers/static-assets/binding/, verified 2026-09-09) accepts two shapes on this field, and the elicit reflects both:
+
+  - **Boolean shape**: answer `"true"` (emits `run_worker_first = true`, Worker runs first for every request; right for a SPA whose Worker owns arbitrary routing or whose auth middleware must gate every path a static file could shadow) or `"false"` / empty (omits the field, Cloudflare's runtime serves a matching static asset before the Worker runs).
+  - **Array-of-patterns shape**: answer a JSON literal such as `["/api/*", "!/api/docs/*"]` (emits `run_worker_first = ["/api/*", "!/api/docs/*"]`, Worker runs first only on matched routes; glob `*` for deep matching; leading `!` for negatives; negatives take precedence over non-negatives; at most 100 entries per the vendor page). Right for a mixed SPA-plus-API deploy where auth must gate the API surface without stealing every static-asset request from the edge.
+
+  The elicit is only meaningful when `assets-directory` is non-empty (a Worker with no assets has nothing to serve first); the loader-side `when-elicitedNonEmpty` predicate the spec calls for is a mechanism follow-up, so the elicit fires unconditionally today.
 
 Copy-paste `wrangler.toml` snippet for the ratified shape:
 
@@ -94,6 +99,6 @@ directory = "./dist"
 run_worker_first = true
 ```
 
-The `[assets]` block and Pages' `pages_build_output_dir` field are mutually exclusive per Cloudflare's static-assets doc; the T-0 probe `assets-manifest-scan.mjs` (`accountBound: false`, `anchorAcId: AC-12113-1`) refuses on a manifest that carries both. A project on the bare-Worker shape (no static assets served at the edge) leaves both elicits unanswered and the probe reports the bare shape as passing.
+The `[assets]` block and Pages' `pages_build_output_dir` field are mutually exclusive per Cloudflare's static-assets doc; the probe `assets-manifest-scan.mjs` (`accountBound: false`, `anchorAcId: AC-12113-1`) refuses on a manifest that carries both. A project on the bare-Worker shape (no static assets served at the edge) leaves both elicits unanswered and the probe reports the bare shape as passing.
 
 Migrating from Cloudflare Pages: read Cloudflare's own walkthrough at `https://developers.cloudflare.com/workers/static-assets/migration-guides/migrate-from-pages/`, apply this blueprint at v1.2.0 with `assets-directory` set to the build-output directory the Pages project pointed at (typically `./dist`, `./build`, or `./public`), pick `run-worker-first` per the project's routing shape, and drop the Pages workflow. The Workers-with-static-assets shape covers the SPA and API surfaces the Pages workflow covered; the promote and rollback verbs on this blueprint carry through unchanged.

package/blueprints/deploy-hetzner-server/CHANGELOG.md

@@ -1,3 +1,38 @@
+# Changelog
+
+## 1.1.2 (register patch, 2026-09-10)
+
+- Register: neutral wording on the ADR-3801 consequences field (closes F-1) and the shared throwaway-server fixture paragraph in README (closes F-2); no capability change.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 - 2026-09-09
+
+Adds deliveredBy on REQ-001, REQ-002 and REQ-004. Adds ownerRef on AC-37102-1 (manifest schema), AC-37105-1 (cloud-init template) and AC-37106-1 (firewall shape). Adds runtime-clause naming the cloudHost applied capability on REQ-001. Adds disposition to every AC. Adds provisioner-failure and idempotency ACs across the family: US-37101 (AC-37101-2 credential missing, AC-37101-3 dependency not ready, AC-37101-4 repeat-boot idempotency, per section 7a worked example), US-37102 (AC-37102-2 malformed manifest, AC-37102-3 firewall opens ssh to 0.0.0.0/0), US-37103 (AC-37103-2 provisioner failure surfaces, AC-37103-3 repeat-apply idempotency), US-37104 (AC-37104-2 malformed template refusal), US-37106 (AC-37106-2 firewall applied at provision time), US-37107 (AC-37107-2 scheduled snapshot per elicited cadence, with off suppression), US-37108 (AC-37108-2 snapshot-on-demand upstream failure), US-37109 (AC-37109-2 secret exclusion by source-tree grep, AC-37109-3 event fires once per lifecycle moment).
+
+## 1.0.1
+
+Round-7 real-account gate hardening patch train. Fixes nine real-path defects in the shared throwaway-Hetzner-server fixture at packages/rcf-lite/test/fixtures/hetzner-throwaway-server/ so the three real-account probes return aggregateVerdict pass on a live Hetzner Cloud project unpatched, and destroy plus sweep-orphans never leak a server. Every existing v1.0.0 contribution id byte-identical apart from the cloud-init template bodies (baseline unchanged; adds a NOPASSWD sudoers.d fragment for the deploy user) and the three mocked probe bodies (mutation-purity clean plus a new rendered-file assertion).
+
+Defect list fixed:
+
+- (1) provision.mjs reads snake_case fields off the hcloud server create response (public_net.ipv4.ip, datacenter.location.name, server_type.name). v1.0.0 read camelCase and threw on every real-account provision, so destroy.mjs could not find the server to tear down.
+- (2) provision.mjs renders the cloud-init user-data via src/cloud-init-renderer.mjs before hcloud server create fires and writes it to hetzner/servers/rendered/<name>.cloud-init.yaml. v1.0.0 expected a file that no shipped code wrote; every provision failed on missing user-data.
+- (3) src/cloud-init-renderer.mjs resolves each ssh key name to its .publicKey via hcloud ssh-key describe --output json and inlines the material into ssh_authorized_keys under the deploy user. v1.0.0 inlined the key NAME and the deploy user had no working authorized_keys entry.
+- (4) destroy.mjs and sweep-orphans.mjs never pass --output json to a hcloud <resource> delete verb (the delete verbs reject the flag with unknown flag: --output). The tolerant JSON parser accepts arrays, objects and the delete verbs short informational text output.
+- (5) src/snapshot-verb.mjs shells hcloud server create-image --type snapshot --description <label> <server-id> and recovers the created snapshot id via hcloud image list --type=snapshot --output json by matching the serverName label. v1.0.0 called a non-existent hcloud image create-image verb.
+- (6) src/ssh-baseline-check.mjs polls port 22 open and a trivial ssh true exec (bounded up to 6 minutes) before firing the six baseline checks. v1.0.0 spawned ssh immediately after provision and every check timed out on connection refused because cloud-init had not finished.
+- (7) contributions/templates/cloud-init.yaml.tmpl adds a write_files sudoers.d fragment at /etc/sudoers.d/90-deploy-nopasswd (mode 0440) that grants NOPASSWD to the deploy user, so the sudoed baseline checks (cloud-init status --wait, ufw status, iptables -L, systemctl is-active fail2ban) never block on a tty prompt.
+- (9) provision.mjs reads an env override RCF_LITE_CI_SSH_KEY_NAME (per-key comma-separated) for the manifest sshKeyIds, with the manifest value staying the default when the override is unset. Documented in the fixture README.
+
+Also: the three mocked probe modules (cloud-init-render-lint, manifest-schema-validate, hcloud-dry-run-mock) no longer read any process.env.SIMULATE_ switch inside the probe body per the mutation-purity gate row. The switches live entirely inside fixture-side files (src/cloud-init-renderer.mjs, src/hcloud-mock.mjs, src/provisioner-facade.mjs and the fixture-side run-manifest-schema-validate.mjs shim) and alter INPUT only. The hcloud-dry-run-mock probe now consumes the SAME rendered cloud-init file the real path consumes (renderer writes it, both the mock and real path read it) and asserts an ssh public-key line under the deploy user plus a NOPASSWD directive naming that user (REQ-145 / AC-14501-1). Report envelopes under .rcf/reports/blueprints/deploy-hetzner-server/ regenerated from the real run.
+
+Chain: the operator estate hardening block covering REQ-145..149 / TS-175..179 / FBS-165..169 / CN-510..519 per the operator estate chain-block ruling 2026-09-08. Real run under the project maintainer one-off approval 2026-09-08: yes, one-off for round 7 gates; Ensure that after any testing etc the Hertner account leaves NO orphaned resources behind. Leave it in the state it started in.
+
+Defect (8) container-host and edge-tunnel stub drivers are OUT of scope for the round-7 real-account gate pass (the review train owns them).
+
 # deploy-hetzner-server changelog
 
 ## 1.0.0
@@ -26,9 +61,11 @@ paired with a mutation switch that flips the probe to FAIL), plus
 without `CI_HAS_HETZNER_ACCOUNT`).
 
 Mints the shared `hetzner-throwaway-server` fixture under
-`packages/rcf-lite/test/fixtures/` (round-7 T-2 and T-3 EXTEND it,
+`packages/rcf-lite/test/fixtures/` (`platform-docker-compose-host` and `edge-cloudflare-tunnel` EXTEND it,
 they do not ship a second copy).
 
 Trace: hetzner-round-7-spec-2026-09-07.md section 5.1;
-Baz ruling 2026-09-07 09:50Z (decisions 18 through 24 approved as
+maintainer ruling 2026-09-07 09:50Z (decisions 18 through 24 approved as
 recommended, "round 7 - agreee to all").
+
+Review-fix (2026-09-09): Adds three option-binding ACs to close section 7c on the elicits catalogue - provisioning-tool raw-api (AC-37101-5), server-type SKU enum (AC-37103-4 naming every shipped SKU), location enum (AC-37103-5 naming every shipped datacentre). Adds deliveredBy on REQ-003, REQ-005, REQ-006. Sweeps vendorCitation onto fixed ACs resting on vendor facts (AC-37101-2, AC-37105-1, AC-37108-1, AC-37108-2, AC-37108-3).

package/blueprints/deploy-hetzner-server/README.md

@@ -45,7 +45,7 @@ Four ADRs record the load-bearing decisions:
   https://docs.hetzner.com/cloud/servers/backups-snapshots/overview.
 - `ADR-3803` provisioning tool: `hcloud` default, `raw-api`
   alternative, Terraform rejected on second toolchain and state file
-  grounds per Baz ruling 2026-09-07.
+  grounds per maintainer ruling 2026-09-07.
 - `ADR-3804` hardening baseline: the six blocks named below.
 
 ## Two provisioner paths: hcloud and raw-api
@@ -85,7 +85,7 @@ FAILS naming the missing line.
 |---|---|---|
 | `provisioning-tool` | `hcloud`, `raw-api` | `hcloud` (ADR-3803) |
 | `server-type` | `cx23`, `cx33`, `cx43`, `cpx11`..`cpx41`, `cax11`..`cax31` | `cx23` |
-| `location` | `fsn1`, `nbg1`, `hel1`, `ash`, `hil` | `fsn1` (Baz ruling 2026-09-07 09:50Z) |
+| `location` | `fsn1`, `nbg1`, `hel1`, `ash`, `hil` | `fsn1` (maintainer ruling 2026-09-07 09:50Z) |
 | `image` | any Hetzner image slug | `ubuntu-24.04` |
 | `ssh-source-prefixes` | CSV of CIDR ranges | `203.0.113.0/24` (example only; supply the real prefix set) |
 | `firewall-id` | existing firewall id or empty | empty (create from `firewallRules`) |
@@ -149,11 +149,11 @@ Every probe writes its report envelope to
 
 ## Shared throwaway-server fixture
 
-The one new pattern this round. Lives at
+The blueprint ships one new pattern. It lives at
 `packages/rcf-lite/test/fixtures/hetzner-throwaway-server/`; ships
 `provision.mjs`, `destroy.mjs`, `sweep-orphans.mjs`, the mocked hcloud
-shim and the manifest at `hetzner/servers/ci-throwaway.json`. T-2
-(`platform-docker-compose-host`) and T-3 (`edge-cloudflare-tunnel`)
+shim and the manifest at `hetzner/servers/ci-throwaway.json`. Sibling
+`platform-docker-compose-host` and `edge-cloudflare-tunnel` blueprints
 EXTEND the fixture rather than shipping a second copy. Cost ceiling:
 one `cx23` at approximately EUR 0.006/hour per run; destroy runs in
 `always()`; the nightly `sweep-orphans` cron collects any leak with a
@@ -172,13 +172,13 @@ cannot host.
 
 ## Consumers
 
-- ops-01 is the first HQ consumer (`w-2026-09-07-dave-004` migration).
-- Round-7 T-2 `platform-docker-compose-host` composes on
+- ops-host is the first infrastructure consumer (migration path).
+- Round-7 `platform-docker-compose-host` composes on
   `capabilities: [cloudHost]`.
-- Round-7 T-3 `edge-cloudflare-tunnel` composes on `cloudHost` (via
-  the systemd unit shape) or on `containerHost` (via T-2).
+- Round-7 `edge-cloudflare-tunnel` composes on `cloudHost` (via
+  the systemd unit shape) or on `containerHost` (via `platform-docker-compose-host`).
 
-Blueprint acceptance never depends on the ops-01 migration.
+Blueprint acceptance never depends on the ops-host migration.
 
 ## Standards trace
 
@@ -197,6 +197,6 @@ Blueprint acceptance never depends on the ops-01 migration.
 ## Rejected alternatives
 
 - Terraform. Adds a second toolchain and a state file that nobody in
-  the estate needs. Baz ruling 2026-09-07 09:50Z on decision 18.
-- A Load Balancer blueprint. Out of scope for round-7 T-1; may ship as
+  the estate needs. maintainer ruling 2026-09-07 09:50Z.
+- A Load Balancer blueprint. Out of scope for round-7; may ship as
   a follow-up if a second Hetzner consumer needs it.

package/blueprints/deploy-hetzner-server/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "deploy-hetzner-server",
-  "version": "1.0.0",
+  "version": "1.1.2",
   "category": "deploy",
   "capabilities": [
     "cloudHost"
@@ -46,7 +46,7 @@
     },
     {
       "id": "location",
-      "prompt": "Hetzner data centre. fsn1 (Falkenstein) is the shipped default per Baz ruling 2026-09-07 09:50Z on the Q2 ratification.",
+      "prompt": "Hetzner data centre. fsn1 (Falkenstein) is the shipped default per maintainer ruling 2026-09-07 09:50Z on the Q2 ratification.",
       "kind": "enum",
       "options": [
         "fsn1",

package/blueprints/deploy-hetzner-server/contributions/adrs/adr-3801-deploy-hetzner-server-cloud-host-contract.json

@@ -5,9 +5,9 @@
   "version": "1.0.0",
   "status": "accepted",
   "title": "Cloud host contract: Hetzner Cloud VM as the shipped cloudHost shape (scope global, new topic linuxCloudHostContract)",
-  "context": "An applying project needs a first-class Linux VM contract that container-orchestration and edge-ingress consumers (round-7 T-2 platform-docker-compose-host, T-3 edge-cloudflare-tunnel) can compose on. Hetzner Cloud servers plus cloud-init user-data provide the v1.0.0 shape per https://docs.hetzner.cloud/ and https://docs.hetzner.com/cloud/servers/overview. Every applied cloud host needs one project-wide answer to the linuxCloudHostContract topic; a future non-Hetzner sibling (Vultr, DigitalOcean, Fly.io) would contribute the same topic string with a different provider, forcing a DELIBERATE conflict the operator resolves per the round-2 conflict pattern.",
+  "context": "An applying project needs a first-class Linux VM contract that container-orchestration and edge-ingress consumers (round-7 platform-docker-compose-host, edge-cloudflare-tunnel) can compose on. Hetzner Cloud servers plus cloud-init user-data provide the v1.0.0 shape per https://docs.hetzner.cloud/ and https://docs.hetzner.com/cloud/servers/overview. Every applied cloud host needs one project-wide answer to the linuxCloudHostContract topic; a future non-Hetzner sibling (Vultr, DigitalOcean, Fly.io) would contribute the same topic string with a different provider, forcing a DELIBERATE conflict the operator resolves per the round-2 conflict pattern.",
   "decision": "The shipped v1.0.0 default is a Hetzner Cloud server as the linuxCloudHostContract provider. The provisioner reads its shape from the applying manifest at hetzner/servers/name.json (TAC-3802) and creates a matching live server via hcloud CLI verbs (ADR-3803) or the raw Hetzner Cloud API. The linuxCloudHostContract topic scope is global on this blueprint; the topic string is linuxCloudHostContract (lower camelCase, one concept per topic, no version suffix, per the round-2 rules-for-new-topics clause on the shelf registry). Standards trace clause: Hetzner Cloud API server resource and cloud-init user-data contract per hetzner-round-7-spec-2026-09-07.md.",
-  "consequences": "Consumer blueprints that run on a Linux host declare capabilities: [cloudHost] on their applied contract; the round-7 T-2 platform-docker-compose-host reads this capability at apply-time. Rebuild-from-manifest is always possible: the manifest is the source of truth, the live server is derivative. Drift from the shipped manifest to the live server is out of scope for v1.0.0; a later minor may add a drift-audit runner.",
+  "consequences": "Consumer blueprints that run on a Linux host declare capabilities: [cloudHost] on their applied contract; the sibling platform-docker-compose-host blueprint reads this capability at apply-time. Rebuild-from-manifest is always possible: the manifest is the source of truth, the live server is derivative. Drift from the shipped manifest to the live server is out of scope for v1.0.0; a later minor may add a drift-audit runner.",
   "alternativesConsidered": [],
   "createdAt": "2026-09-08T00:00:00.000Z",
   "updatedAt": "2026-09-08T00:00:00.000Z"

package/blueprints/deploy-hetzner-server/contributions/adrs/adr-3803-deploy-hetzner-server-provisioning-tool.json

@@ -5,14 +5,14 @@
   "version": "1.0.0",
   "status": "accepted",
   "title": "Provisioning tool: hcloud CLI default, raw Hetzner Cloud API alternative, Terraform rejected",
-  "context": "An applying project needs a documented answer to how the provisioner shells out to Hetzner Cloud. Options considered: hcloud CLI (small, self-documenting, JSON output on --output json, per https://github.com/hetznercloud/cli); the raw Hetzner Cloud REST API (no CLI dependency, useful when the target host cannot install a binary, per https://docs.hetzner.cloud/); Terraform (declarative, adds a second toolchain and a state file). Baz ruling 2026-09-07 09:50Z on decision 18 of the round-7 summary: hcloud not Terraform. Terraform adds a second toolchain and a state file that nobody in the estate needs.",
+  "context": "An applying project needs a documented answer to how the provisioner shells out to Hetzner Cloud. Options considered: hcloud CLI (small, self-documenting, JSON output on --output json, per https://github.com/hetznercloud/cli); the raw Hetzner Cloud REST API (no CLI dependency, useful when the target host cannot install a binary, per https://docs.hetzner.cloud/); Terraform (declarative, adds a second toolchain and a state file). maintainer ruling 2026-09-07 09:50Z of the round-7 summary: hcloud not Terraform. Terraform adds a second toolchain and a state file that nobody in the estate needs.",
   "decision": "The shipped v1.0.0 default is the hcloud CLI as the provisioning tool. Alternative elicited: raw-api (the provisioner fetches the Hetzner Cloud REST API directly). Terraform is a rejected alternative recorded in the blueprint README section 9 rejected-alternatives. elicited: true. recommendedDefault: hcloud. Standards trace clause: Hetzner Cloud CLI documented resource verbs per hetzner-round-7-spec-2026-09-07.md.",
   "consequences": "The applying project installs the hcloud binary on the operator laptop and every CI runner that provisions. The raw-api fork sits behind the same provisioner facade so no consumer code diverges. The provisioner-facade sole-reader guarantee holds on both paths.",
   "alternativesConsidered": [
     {
       "id": "terraform",
       "summary": "Terraform declaring the Hetzner resources with the hetznercloud provider.",
-      "rejectedBecause": "Adds a second toolchain and a state file. The state file becomes a new source of truth to reconcile with git and with the live account. Baz ruling 2026-09-07 09:50Z."
+      "rejectedBecause": "Adds a second toolchain and a state file. The state file becomes a new source of truth to reconcile with git and with the live account. maintainer ruling 2026-09-07 09:50Z."
     }
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",

package/blueprints/deploy-hetzner-server/contributions/probes/cloud-init-render-lint.mjs

@@ -7,9 +7,13 @@
 // via the fixture's src/cloud-init-renderer.mjs. Asserts the six hardening
 // baseline blocks appear in the rendered YAML.
 //
-// SIMULATE_HARDENING_DRIFT=true removes the unattended-upgrades write-file
-// block from the rendered YAML; the probe FAILS naming the missing line
-// per hetzner-round-7-spec-2026-09-07.md section 3.4 lesson 4.
+// Purity: the probe reads only the shipped template and the fixture
+// manifest; no process.env.SIMULATE_ switch is read here. The
+// fixture-side renderer at src/cloud-init-renderer.mjs is the sole
+// reader of SIMULATE_HARDENING_DRIFT and it mutates INPUT (the
+// rendered YAML) only; the probe then FAILS naming the missing
+// baseline block per hetzner-round-7-spec-2026-09-07.md section 3.4
+// lesson 4.  (2026-09-08).
 
 import { readFile } from 'node:fs/promises';
 import { resolve } from 'node:path';
@@ -23,7 +27,11 @@ export default async function runProbe() {
   const manifestPath = resolve(FIXTURE_DIR, 'hetzner/servers/ci-throwaway.json');
   const { renderCloudInit, BASELINE_BLOCKS } = await import(rendererPath);
   const manifest = JSON.parse(await readFile(manifestPath, 'utf8'));
-  const rendered = await renderCloudInit(manifest);
+  // In-process render only; pass explicit stub public-key material so
+  // the renderer never shells to hcloud (mock path stays hermetic).
+  const rendered = await renderCloudInit(manifest, {
+    publicKeys: ['ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFakePubKeyForRenderLintHardeningH1 rcf-lite-ci-mock'],
+  });
   const missing = [];
   const present = [];
   for (const block of BASELINE_BLOCKS) {
@@ -58,7 +66,6 @@ export default async function runProbe() {
       renderedByteLength: rendered.length,
       presentBlocks: present,
       missingBlocks: missing.map((m) => m.id),
-      mutationActive: process.env.SIMULATE_HARDENING_DRIFT === 'true',
     },
   };
 }

package/blueprints/deploy-hetzner-server/contributions/probes/hcloud-dry-run-mock.mjs

@@ -1,11 +1,26 @@
-// Probe: hcloud dry-run mock.
+// Probe: hcloud dry-run mock (v1.0.1 mutation-purified per the round-7 hardening pass).
 //
 // anchorAcId: AC-37101-1 (provisioner facade sole reader + provisionerReady
-// on boot; also covers AC-37109-1 event-secrecy across the lifecycle).
+// on boot; also covers AC-37109-1 event-secrecy across the lifecycle;
+// also covers AC-14501-1 mock-consumes-rendered-file assertions per
+// the round-7 hardening block REQ-145).
 // accountBound: false.
 //
 // Drives the provisioner facade with the fixture's ci-throwaway manifest
-// against the mocked hcloud shim (src/hcloud-mock.mjs). Asserts:
+// against the mocked hcloud shim (src/hcloud-mock.mjs) and consumes the
+// SAME rendered cloud-init user-data file the real path consumes (the
+// fixture renderer writes it under hetzner/servers/rendered/ before the
+// facade is exercised, and this probe reads it back and asserts an
+// ssh-ed25519/ssh-rsa public-key line under the deploy user plus a
+// NOPASSWD directive naming that user). The rendered-file assertion is
+// what stops a mocked probe from passing while the real path fails on
+// the same artefact (REQ-145 / AC-14501-1).
+//
+// The probe body reads NO process.env.SIMULATE_ switch. Fixture-side
+// mutations live in src/cloud-init-renderer.mjs, src/hcloud-mock.mjs
+// and src/provisioner-facade.mjs and alter INPUT only.
+//
+// Assertions:
 //   - the facade opens on ready() and fires provisionerReady with a
 //     metadata-only payload {tool, apiHost}.
 //   - createServer parses the mocked JSON stdout and emits
@@ -15,17 +30,14 @@
 //   - destroyServer fires hetznerServerDestroyed with the id.
 //   - no event body across the run carries the token, an ssh private-key
 //     marker, or the rendered user-data bytes (event-secrecy check).
-//
-// Mutations:
-//   SIMULATE_JSON_PARSE_STRIP=true has hcloud-mock.mjs return non-JSON
-//   stdout so JSON.parse throws and the probe FAILS.
-//   SIMULATE_EVENT_SECRECY_LEAK=true has provisioner-facade.mjs inject
-//   the token into the hetznerServerProvisioned payload; the event-
-//   secrecy scan FAILS with a defensive-fake finding.
+//   - the rendered cloud-init file exists under the fixture's rendered
+//     directory and carries at least one ssh-ed25519 or ssh-rsa
+//     authorized-keys line under the deploy user plus a NOPASSWD
+//     directive naming that user (REQ-145 / AC-14501-1).
 
-import { readFile } from 'node:fs/promises';
-import { resolve } from 'node:path';
-import { FIXTURE_DIR } from './probe-utils.mjs';
+import { readFile, access } from 'node:fs/promises';
+import { relative, resolve } from 'node:path';
+import { FIXTURE_DIR, PROJECT_ROOT } from './probe-utils.mjs';
 
 export const anchorAcId = 'AC-37101-1';
 export const accountBound = false;
@@ -36,9 +48,47 @@ const PRIVATE_KEY_MARKER = 'BEGIN OPENSSH PRIVATE KEY';
 
 export default async function runProbe() {
   const facadePath = resolve(FIXTURE_DIR, 'src/provisioner-facade.mjs');
+  const rendererPath = resolve(FIXTURE_DIR, 'src/cloud-init-renderer.mjs');
   const manifestPath = resolve(FIXTURE_DIR, 'hetzner/servers/ci-throwaway.json');
   const { createProvisionerFacade, createEventLog } = await import(facadePath);
+  const { renderCloudInitToFile } = await import(rendererPath);
   const manifest = JSON.parse(await readFile(manifestPath, 'utf8'));
+  const results = [];
+
+  // Render the cloud-init to disk with a fixture-side stubbed public
+  // key (the mock path never calls hcloud ssh-key describe); the real
+  // path resolves the material via hcloud and writes to the same
+  // location. Both consume the same file shape.
+  const publicKeys = ['ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFakePubKeyForMockedRunHardeningH1 rcf-lite-ci-mock'];
+  const { renderedPath, rendered } = await renderCloudInitToFile(manifest, { publicKeys });
+
+  //  REQ-145 / AC-14501-1: assert the rendered file carries an
+  // ssh-ed25519 or ssh-rsa line for the deploy user AND a NOPASSWD
+  // directive naming that user. This assertion is what breaks the
+  // "mock passes while real path fails on the same artefact" class.
+  const renderedFromDisk = await readFile(renderedPath, 'utf8');
+  const sshKeyLine = /(ssh-ed25519|ssh-rsa)\s+/i.test(renderedFromDisk);
+  const nopasswdLine = /deploy\s+ALL\s*=\s*\(ALL\)\s+NOPASSWD/i.test(renderedFromDisk);
+  if (!sshKeyLine) {
+    results.push({
+      anchorAcId: 'AC-14501-1',
+      verdict: 'fail',
+      detail: `rendered cloud-init at ${relative(PROJECT_ROOT, renderedPath)} carries no ssh-ed25519 or ssh-rsa authorized-keys line for the deploy user; the real path would provision a server with an unusable authorized_keys entry.`,
+    });
+  } else if (!nopasswdLine) {
+    results.push({
+      anchorAcId: 'AC-14501-1',
+      verdict: 'fail',
+      detail: `rendered cloud-init at ${relative(PROJECT_ROOT, renderedPath)} carries no NOPASSWD directive for the deploy user; the six sudoed baseline checks would block on a tty prompt.`,
+    });
+  } else {
+    results.push({
+      anchorAcId: 'AC-14501-1',
+      verdict: 'pass',
+      detail: `rendered cloud-init at ${relative(PROJECT_ROOT, renderedPath)} carries an ssh public-key line for the deploy user (byteLength ${rendered.length}) and a NOPASSWD sudoers directive for that user; the mock and the real path consume the same artefact.`,
+    });
+  }
+
   const { events, eventSink } = createEventLog();
   const facade = createProvisionerFacade({
     token: TOKEN,
@@ -46,7 +96,6 @@ export default async function runProbe() {
     apiHost: 'https://api.hetzner.cloud/v1',
     eventSink,
   });
-  const results = [];
   try {
     await facade.ready();
     const server = await facade.createServer(manifest);
@@ -86,7 +135,7 @@ export default async function runProbe() {
       results.push({
         anchorAcId: 'AC-37109-1',
         verdict: 'fail',
-        detail: `event-secrecy leak: ${leaks.map((l) => `${l.event} carries ${l.marker}`).join('; ')} (defensive-fake finding; check for a SIMULATE_EVENT_SECRECY_LEAK mutation).`,
+        detail: `event-secrecy leak: ${leaks.map((l) => `${l.event} carries ${l.marker}`).join('; ')} (defensive-fake finding; check for a SIMULATE_EVENT_SECRECY_LEAK mutation in the fixture-side facade shim).`,
       });
     } else {
       results.push({
@@ -99,7 +148,7 @@ export default async function runProbe() {
     results.push({
       anchorAcId: 'AC-37101-1',
       verdict: 'fail',
-      detail: `provisioner facade lifecycle threw: ${err.message} (probable cause: mocked hcloud stdout is not JSON; check for a SIMULATE_JSON_PARSE_STRIP mutation).`,
+      detail: `provisioner facade lifecycle threw: ${err.message} (probable cause: mocked hcloud stdout is not JSON; check for a SIMULATE_JSON_PARSE_STRIP mutation in the fixture-side mock shim).`,
     });
   }
   return {
@@ -107,10 +156,9 @@ export default async function runProbe() {
     extra: {
       eventCount: events.length,
       events: events.map((e) => ({ event: e.event, keys: Object.keys(e).sort() })),
-      mutations: {
-        jsonParseStrip: process.env.SIMULATE_JSON_PARSE_STRIP === 'true',
-        eventSecrecyLeak: process.env.SIMULATE_EVENT_SECRECY_LEAK === 'true',
-      },
+      renderedPath: relative(PROJECT_ROOT, renderedPath),
+      renderedByteLength: rendered.length,
+      renderedAssertions: { sshKeyLine, nopasswdLine },
     },
   };
 }

package/blueprints/deploy-hetzner-server/contributions/probes/manifest-schema-validate.mjs

@@ -9,9 +9,14 @@
 // validator ships with the probe so the shelf gains no runtime dependency
 // on ajv or similar. See validate() at the bottom.
 //
-// SIMULATE_MANIFEST_INVALID=true replaces the manifest's location with an
-// unknown token and the probe FAILS naming the offending field per
-// hetzner-round-7-spec-2026-09-07.md section 3.4 lesson 4.
+// Purity: the probe reads only the manifest dir and the shipped schema;
+// no process.env.SIMULATE_ switch is read here. The fixture-side shim
+// packages/rcf-lite/test/fixtures/hetzner-throwaway-server/
+// run-manifest-schema-validate.mjs is the sole reader of
+// SIMULATE_MANIFEST_INVALID and it mutates INPUT (a temp manifest dir
+// pointed at via RCF_FIXTURE_MANIFEST_DIR) only; the probe then FAILS
+// naming the offending field per hetzner-round-7-spec-2026-09-07.md
+// section 3.4 lesson 4.  (2026-09-08).
 
 import { readFile } from 'node:fs/promises';
 import { readManifestFiles, SCHEMA_PATH } from './probe-utils.mjs';
@@ -32,7 +37,6 @@ export default async function runProbe() {
     };
   }
   const results = [];
-  const mutationActive = process.env.SIMULATE_MANIFEST_INVALID === 'true';
   for (const f of files) {
     let doc;
     try {
@@ -45,7 +49,6 @@ export default async function runProbe() {
       });
       continue;
     }
-    if (mutationActive) doc = { ...doc, location: 'mars1' };
     const errors = validate(schema, doc, `#/${f.name}`);
     if (errors.length > 0) {
       for (const e of errors) {
@@ -69,7 +72,6 @@ export default async function runProbe() {
     extra: {
       manifestCount: files.length,
       manifestNames: files.map((f) => f.name),
-      mutationActive,
     },
   };
 }

package/blueprints/deploy-hetzner-server/contributions/probes/probe-utils.mjs

@@ -21,7 +21,13 @@ export const FIXTURE_DIR = resolve(
   PROJECT_ROOT,
   'packages/rcf-lite/test/fixtures/hetzner-throwaway-server',
 );
-export const MANIFEST_DIR = resolve(FIXTURE_DIR, 'hetzner/servers');
+// Config override, not a mutation switch: the fixture-side shim for
+// manifest-schema-validate may write a mutated copy to a scratch dir
+// and point MANIFEST_DIR at it via RCF_FIXTURE_MANIFEST_DIR so the
+// probe stays SIMULATE-free (mutation-purity gate row, 2026-09-08).
+export const MANIFEST_DIR = process.env.RCF_FIXTURE_MANIFEST_DIR
+  ? resolve(process.env.RCF_FIXTURE_MANIFEST_DIR)
+  : resolve(FIXTURE_DIR, 'hetzner/servers');
 export const SCHEMA_PATH = resolve(HERE, '..', 'schemas', 'hetzner-server.schema.json');
 export const REPORT_DIR = resolve(
   PROJECT_ROOT,

package/blueprints/deploy-hetzner-server/contributions/probes/real-account-cloud-init-hardened.mjs

@@ -45,11 +45,12 @@ export default async function runProbe() {
         })),
       };
     }
+    const blocks = report.checks.filter((c) => c.verdict === 'pass').map((c) => c.id);
     return {
       results: [{
         anchorAcId,
         verdict: 'pass',
-        detail: `cloud-init status --wait completed on server ${provisioned.id}; all six ssh baseline checks passed.`,
+        detail: `cloud-init reached terminal state on server ${provisioned.id} (cloud-init status --wait exit ${report.cloudInit ? report.cloudInit.code : 'skipped'}); six baseline hardening blocks observed: ${blocks.join(', ')}.`,
       }],
       extra: report,
     };

package/blueprints/deploy-hetzner-server/contributions/requirements/deploy-hetzner-server-req-001.json

@@ -2,7 +2,7 @@
   "reqId": "deploy-hetzner-server-REQ-001",
   "prdId": "PRD-001",
   "title": "The provisioner facade is the sole reader of the Hetzner API token and opens on boot with provisionerReady",
-  "description": "The applying project reaches the Hetzner Cloud API through a single provisioner facade module that is the ONLY module holding a reference to the HETZNER_ACCOUNT_API_KEY secret (or the elicited project-scoped alternative). The facade wraps typed verbs (createServer, applyFirewall, takeSnapshot, listSnapshots, destroyServer) and, when provisioningTool=hcloud (default), shells to the hcloud CLI with `--output json`; when provisioningTool=raw-api it fetches the equivalent Hetzner Cloud REST endpoints per https://docs.hetzner.cloud/. On process boot the facade opens against the token via a bounded ready-check and emits a provisionerReady lifecycle event on the injected event sink with a metadata-only payload {tool, apiHost}. No other module reads the token; the injected event sink never carries the token or user-data bodies.",
+  "description": "The applying project reaches the Hetzner Cloud API through a single provisioner facade module that is the ONLY module holding a reference to the HETZNER_ACCOUNT_API_KEY secret (or the elicited project-scoped alternative). The facade wraps typed verbs (createServer, applyFirewall, takeSnapshot, listSnapshots, destroyServer) and, when provisioningTool=hcloud (default), shells to the hcloud CLI with `--output json`; when provisioningTool=raw-api it fetches the equivalent Hetzner Cloud REST endpoints per https://docs.hetzner.cloud/. On process boot the facade opens against the token via a bounded ready-check and emits a provisionerReady lifecycle event on the injected event sink with a metadata-only payload {tool, apiHost}. No other module reads the token; the injected event sink never carries the token or user-data bodies. This blueprint declares the cloudHost applied capability at runtime: the provisioner facade is the sole reader of the Hetzner Cloud API token, and any downstream blueprint whose requiresAppliedCapabilities lists cloudHost is satisfied by an applied deploy-hetzner-server pinning the provisioner module against a real account.",
   "category": "functional",
   "domain": "platform",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+    "field": "responsibilities.provisionerReady"
+  }
 }

package/blueprints/deploy-hetzner-server/contributions/requirements/deploy-hetzner-server-req-002.json

@@ -2,7 +2,7 @@
   "reqId": "deploy-hetzner-server-REQ-002",
   "prdId": "PRD-001",
   "title": "The applying project holds server declarations at hetzner/servers/name.json against a shipped JSON Schema",
-  "description": "The applying project holds every server declaration as one JSON document under hetzner/servers/<name>.json, matching a shipped draft-07 JSON Schema at blueprints/deploy-hetzner-server/contributions/schemas/hetzner-server.schema.json. Required fields: name, serverType (cx23, cx33, and other Hetzner shared-cpu shapes), location (fsn1 default per Baz ruling 2026-09-07 09:50Z; also nbg1, hel1, ash, hil), image (ubuntu-24.04 default), sshKeyIds (nonempty array of Hetzner ssh-key references delegated to security-secrets-management), firewallId (an existing firewall or auto-create), networkId (optional private network), cloudInitPath (relative path to the rendered cloud-init user-data), labels (Hetzner tag map that must include role and blueprint), firewallRules (see REQ-004), snapshotCadence (see REQ-005). The schema refuses on missing required fields and on rule-shape violations (see REQ-004).",
+  "description": "The applying project holds every server declaration as one JSON document under hetzner/servers/<name>.json, matching a shipped draft-07 JSON Schema at blueprints/deploy-hetzner-server/contributions/schemas/hetzner-server.schema.json. Required fields: name, serverType (cx23, cx33, and other Hetzner shared-cpu shapes), location (fsn1 default per maintainer ruling 2026-09-07 09:50Z; also nbg1, hel1, ash, hil), image (ubuntu-24.04 default), sshKeyIds (nonempty array of Hetzner ssh-key references delegated to security-secrets-management), firewallId (an existing firewall or auto-create), networkId (optional private network), cloudInitPath (relative path to the rendered cloud-init user-data), labels (Hetzner tag map that must include role and blueprint), firewallRules (see REQ-004), snapshotCadence (see REQ-005). The schema refuses on missing required fields and on rule-shape violations (see REQ-004). The server-type is elicited on the manifest against the shipped Hetzner Cloud shared-vCPU enum: cx23 (shipped default, Intel), cx33, cx43 (more RAM/vCPU for compose stacks over 1 GB RSS), cpx11/cpx21/cpx31/cpx41 (AMD EPYC, faster per vCPU), and cax11/cax21/cax31 (ARM64 shapes for runtimes that publish ARM builds). The ssh-source-prefixes are elicited as a comma-separated CIDR list permitted on port 22; the manifest schema refuses 0.0.0.0/0. The firewall-id is elicited: an existing Hetzner firewall id reused, or empty to have the provisioner create one from firewallRules.",
   "category": "functional",
   "domain": "platform",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-3802-deploy-hetzner-server-manifest-schema",
+    "field": "responsibilities.hetzner-server"
+  }
 }

package/blueprints/deploy-hetzner-server/contributions/requirements/deploy-hetzner-server-req-003.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-3803-deploy-hetzner-server-cloud-init-template",
+    "field": "responsibilities.hardeningBlocks"
+  }
 }

package/blueprints/deploy-hetzner-server/contributions/requirements/deploy-hetzner-server-req-004.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-3804-deploy-hetzner-server-firewall-shape",
+    "field": "responsibilities.firewallRules"
+  }
 }