rcf-lite 0.25.0 → 0.27.0

package/blueprints/deploy-hetzner-server/contributions/requirements/deploy-hetzner-server-req-005.json

@@ -2,7 +2,7 @@
   "reqId": "deploy-hetzner-server-REQ-005",
   "prdId": "PRD-001",
   "title": "Snapshot cadence elicited (weekly default, daily and off alternatives), snapshot-on-demand fires a tagged snapshot",
-  "description": "The applying project elicits a snapshot cadence per ADR-3802 with an enum of weekly (recommended default), daily and off. The value lives on hetzner/servers/name.json as snapshotCadence. When the cadence is non-off, a scheduled snapshot runner in the applying project fires the snapshot verb on the provisioner facade against every server whose cadence matches, and tags each snapshot with the server name and wall-clock time. A snapshot-on-demand verb on the provisioner fires the same shape without a schedule. Under provisioningTool=hcloud the facade shells to hcloud image create-image and tags via hcloud image update; under raw-api it posts to POST /servers/{id}/actions/create_image and PATCH /images/{id}. The hetznerSnapshotTaken lifecycle event carries snapshot id and wall-clock time. Hetzner-managed backups are a separately elicited paid opt-in (approximately 20 percent of monthly server price per https://docs.hetzner.com/cloud/servers/backups-snapshots/overview) and compose with the scheduled snapshot runner.",
+  "description": "The applying project elicits a snapshot cadence per ADR-3802 with an enum of weekly (recommended default), daily and off. The value lives on hetzner/servers/name.json as snapshotCadence. When the cadence is non-off, a scheduled snapshot runner in the applying project fires the snapshot verb on the provisioner facade against every server whose cadence matches, and tags each snapshot with the server name and wall-clock time. A snapshot-on-demand verb on the provisioner fires the same shape without a schedule. Under provisioningTool=hcloud the facade shells to hcloud image create-image and tags via hcloud image update; under raw-api it posts to POST /servers/{id}/actions/create_image and PATCH /images/{id}. The hetznerSnapshotTaken lifecycle event carries snapshot id and wall-clock time. Hetzner-managed backups are a separately elicited paid opt-in (approximately 20 percent of monthly server price per https://docs.hetzner.com/cloud/servers/backups-snapshots/overview) and compose with the scheduled snapshot runner. Hetzner-managed backups are elicited true or false: false is the shipped default (the scheduled snapshot runner carries the recovery-point objective through Hetzner Cloud snapshots); true opts in to Hetzner-managed backups per ADR-3802 (paid, approximately 20 percent of monthly server price).",
   "category": "functional",
   "domain": "platform",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-3802-deploy-hetzner-server-snapshot-cadence",
+    "field": "decision.cadenceEnum"
+  }
 }

package/blueprints/deploy-hetzner-server/contributions/requirements/deploy-hetzner-server-req-006.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+    "field": "responsibilities.lifecycleEvents"
+  }
 }

package/blueprints/deploy-hetzner-server/contributions/schemas/hetzner-server.schema.json

@@ -31,7 +31,7 @@
     "location": {
       "type": "string",
       "enum": ["fsn1", "nbg1", "hel1", "ash", "hil"],
-      "description": "Hetzner data centre location. fsn1 is the shipped default per Baz ruling 2026-09-07 09:50Z on the Q2 ratification."
+      "description": "Hetzner data centre location. fsn1 is the shipped default per maintainer ruling 2026-09-07 09:50Z on the Q2 ratification."
     },
     "image": {
       "type": "string",

package/blueprints/deploy-hetzner-server/contributions/templates/cloud-init.yaml.tmpl

@@ -21,6 +21,18 @@ users:
 # Block 2: root disabled (PermitRootLogin no).
 # Block 1 continued: PasswordAuthentication no.
 write_files:
+  # Block 1 continued: NOPASSWD sudo for the deploy user (mode 0440,
+  # visudo-shaped fragment). Baseline hardening requires the deploy
+  # user to run sudoed baseline checks without a tty; the write_files
+  # entry ships the fragment in the same posture as the sshd config.
+  - path: /etc/sudoers.d/90-deploy-nopasswd
+    permissions: '0440'
+    content: |
+      # deploy-hetzner-server v1.0.1 hardening: passwordless sudo for
+      # the deploy user so the ssh baseline checks (cloud-init status
+      # --wait, ufw status, iptables -L, systemctl is-active fail2ban)
+      # never block on a tty prompt.
+      deploy ALL=(ALL) NOPASSWD:ALL
   - path: /etc/ssh/sshd_config.d/hardening.conf
     permissions: '0644'
     content: |
@@ -70,13 +82,17 @@ write_files:
       APT::Periodic::Update-Package-Lists "1";
       APT::Periodic::Unattended-Upgrade "1";
 
-# Package install: ufw for block 3, fail2ban for block 5,
-# unattended-upgrades for block 6, iptables-persistent for block 4.
+# Package install: ufw for block 3, fail2ban for block 5.
+# unattended-upgrades ships in the ubuntu-24.04 base image (v1.0.1 fix:
+# was in packages: v1.0.0 which caused a spurious NoNewestVersion line).
+# iptables-persistent conflicts with ufw on ubuntu-24.04 noble (ufw
+# Breaks: iptables-persistent), so we DO NOT install it; the DOCKER-USER
+# chain is loaded in runcmd via iptables directly (block 4 stays valid
+# for the running boot; reboot-persistence for the chain is a follow-up
+# item outside the round-7 hardening scope).
 packages:
   - ufw
   - fail2ban
-  - unattended-upgrades
-  - iptables-persistent
 
 runcmd:
   # Block 3: UFW default-deny incoming, allow 22 80 443.
@@ -89,5 +105,9 @@ runcmd:
   - systemctl reload ssh || systemctl restart ssh
   - systemctl enable --now fail2ban
   - systemctl enable --now unattended-upgrades
-  # Load the DOCKER-USER iptables rules on boot.
-  - iptables-restore -n < /etc/iptables/rules.v4.d/docker-user.rules
+  # Block 4 runtime: create the DOCKER-USER chain directly via iptables
+  # (v1.0.1 fix: iptables-persistent conflicts with ufw on Ubuntu 24.04
+  # noble; iptables itself is preinstalled, so the chain lands cleanly).
+  - iptables -N DOCKER-USER 2>/dev/null || true
+  - iptables -A DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
+  - iptables -A DOCKER-USER -j DROP

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37101.json

@@ -13,12 +13,73 @@
       "id": "AC-37101-1",
       "description": "On process boot the provisioner facade opens against the token, and (a) only the provisioner module reads HETZNER_ACCOUNT_API_KEY (grep across the fixture source refuses any other reader), (b) provisionerReady fires on the injected event sink with a payload of exactly {tool, apiHost}.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-37101-2",
+      "description": "Credential missing. Given HETZNER_ACCOUNT_API_KEY unset in the applied secrets facade, when the provisioner facade opens on process boot, then the facade refuses with a named error kind (missingProvisionerToken), no provisionerReady event fires on the sink, and the error record carries no token substring.",
+      "given": "HETZNER_ACCOUNT_API_KEY unset in the applied secrets facade",
+      "when": "the provisioner opens on process boot",
+      "then": "the facade refuses with the named error kind missingProvisionerToken; no provisionerReady fires; the error record carries no token substring",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://docs.hetzner.cloud/#authentication",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-37101-3",
+      "description": "Dependency not ready. Given the elicited provisioning-tool is hcloud and hcloud is absent from PATH on the process shell, when the provisioner opens on process boot, then the facade refuses with a named error kind (missingProvisionerTool) and no provisionerReady fires.",
+      "given": "provisioning-tool = hcloud and hcloud absent from PATH",
+      "when": "the provisioner opens on process boot",
+      "then": "the facade refuses with the named error kind missingProvisionerTool; no provisionerReady fires",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-37101-4",
+      "description": "Repeat boot idempotency. Given a completed first boot of the provisioner facade, when the process boots a second time against the same token and elicited configuration, then the facade opens again and provisionerReady fires once per boot with the same payload shape ({tool, apiHost}); no accumulator or side-channel state drifts across boots.",
+      "given": "a completed first boot with provisionerReady already fired",
+      "when": "the process boots a second time against the same token and elicited configuration",
+      "then": "the facade opens again; provisionerReady fires once per boot with the same {tool, apiHost} payload shape; no state drifts across boots",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-37101-5",
+      "description": "Provisioning tool raw-api. Given the elicited provisioning-tool answers raw-api, when the provisioner opens on process boot, then the facade constructs a fetch-based HTTP client against https://api.hetzner.cloud/v1 with Bearer HETZNER_ACCOUNT_API_KEY on every request (no hcloud binary invocation; grep across the fixture source refuses any child_process.execFile / spawn of hcloud); the provisionerReady payload carries tool='raw-api' and apiHost='api.hetzner.cloud'; a subsequent createServer verb issues one POST https://api.hetzner.cloud/v1/servers with the JSON body per the Hetzner Cloud API server-create schema.",
+      "given": "provisioning-tool = raw-api",
+      "when": "the provisioner opens on process boot",
+      "then": "the facade uses fetch against api.hetzner.cloud/v1 with Bearer auth; no hcloud spawn; provisionerReady carries tool='raw-api' and apiHost='api.hetzner.cloud'; createServer POSTs /v1/servers with the documented JSON body",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "template"
     }
   ],
   "tacIds": [
     "TAC-3801-deploy-hetzner-server-provisioner"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37102.json

@@ -13,12 +13,45 @@
       "id": "AC-37102-1",
       "description": "manifest-schema-validate.mjs asserts every hetzner/servers/*.json under the shared throwaway-server fixture validates against blueprints/deploy-hetzner-server/contributions/schemas/hetzner-server.schema.json and carries every required field; a mutation SIMULATE_MANIFEST_INVALID=true replaces location with an unknown token and the probe FAILS naming the offending field.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3802-deploy-hetzner-server-manifest-schema",
+        "field": "interfaces.hetzner-server.schema.json"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-37102-2",
+      "description": "Malformed manifest refusal. Given a hetzner/servers/*.json file with a required field missing (for example serverType omitted), when the schema validator runs, then the probe FAILS with a message that names the offending file and the missing required field; the provisioner facade refuses to apply the manifest.",
+      "given": "a hetzner/servers/*.json with a required field omitted",
+      "when": "manifest-schema-validate.mjs runs against the fixture set",
+      "then": "the probe FAILS naming the offending file and the missing required field; the provisioner refuses to apply",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3802-deploy-hetzner-server-manifest-schema",
+        "field": "interfaces.hetzner-server.schema.json"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-37102-3",
+      "description": "Boundary refusal: firewall rule opens ssh to 0.0.0.0/0. Given a manifest whose firewallRules ssh entry carries sourceIps including 0.0.0.0/0, when the schema validator runs, then the probe FAILS naming the ssh rule with the specific 0.0.0.0/0 offence; the provisioner refuses to apply.",
+      "given": "a manifest whose firewallRules ssh entry carries sourceIps including 0.0.0.0/0",
+      "when": "manifest-schema-validate.mjs runs",
+      "then": "the probe FAILS naming the ssh rule and the 0.0.0.0/0 offence; the provisioner refuses to apply",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3804-deploy-hetzner-server-firewall-shape",
+        "field": "interfaces.firewallRules"
+      },
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-3802-deploy-hetzner-server-manifest-schema"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37103.json

@@ -13,7 +13,64 @@
       "id": "AC-37103-1",
       "description": "The real-account-throwaway-server-provision probe (accountBound: true, skipped without CI_HAS_HETZNER_ACCOUNT) applies the ci-throwaway.json manifest via provision.mjs, asserts (a) hcloud server list --output json shows the new server whose id is written to the fixture scratch file, (b) hetznerServerProvisioned fired with id, primaryIpv4, location=fsn1, serverType=cx23; teardown via destroy.mjs runs regardless of probe verdict.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-37103-2",
+      "description": "Provisioner failure surfaces (upstream non-2xx). Given the hetzner API returns a non-2xx response (for example 429 rate-limited on the account) during a createServer call, when provision.mjs runs, then the facade catches the failure, emits provisionerFailed with { verb: \"createServer\", apiStatus, retryable: boolean } on the event sink, no hetznerServerProvisioned fires, and no orphan server survives on the account after the run.",
+      "given": "the hetzner API returns 429 on createServer",
+      "when": "provision.mjs runs the fixture manifest",
+      "then": "the facade emits provisionerFailed with { verb, apiStatus, retryable }; no hetznerServerProvisioned fires; no orphan server survives after the run",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-37103-3",
+      "description": "Repeat-apply idempotency. Given a manifest already applied once and matching a live server on the account, when provision.mjs runs the same manifest a second time, then the facade emits no second hetznerServerProvisioned, the run exits zero, and the live server id remains unchanged; a subsequent destroy tears the single server down.",
+      "given": "a manifest already applied once against a live matching server",
+      "when": "provision.mjs runs the same manifest again",
+      "then": "no second hetznerServerProvisioned fires; the run exits zero; the live server id remains unchanged",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-37103-4",
+      "description": "Server-type elicit accepts every shipped SKU. Given the elicited server-type answers one of { cx23, cx33, cx43, cpx11, cpx21, cpx31, cpx41, cax11, cax21, cax31 }, when the manifest applies, then the createServer call carries `\"server_type\": \"<answer>\"` verbatim in the JSON body (raw-api mode) or `--type <answer>` on the hcloud CLI (hcloud mode) and the hetznerServerProvisioned event's serverType field equals the answer; a value outside the enum refuses at manifest load with an unknownServerType error kind and no createServer call is issued.",
+      "given": "server-type answered one of the ten shipped SKUs",
+      "when": "provision.mjs runs the manifest",
+      "then": "createServer carries the answer verbatim (server_type JSON field or hcloud --type flag); hetznerServerProvisioned.serverType equals the answer; a value outside the enum refuses with unknownServerType and no createServer fires",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-37103-5",
+      "description": "Location elicit accepts every shipped datacentre. Given the elicited location answers one of { fsn1, nbg1, hel1, ash, hil }, when the manifest applies, then the createServer call carries `\"location\": \"<answer>\"` verbatim in the JSON body (raw-api mode) or `--location <answer>` on the hcloud CLI (hcloud mode) and the hetznerServerProvisioned event's location field equals the answer; a value outside the enum refuses at manifest load with an unknownLocation error kind and no createServer call is issued.",
+      "given": "location answered one of the five shipped datacentre codes",
+      "when": "provision.mjs runs the manifest",
+      "then": "createServer carries the answer verbatim (location JSON field or hcloud --location flag); hetznerServerProvisioned.location equals the answer; a value outside the enum refuses with unknownLocation and no createServer fires",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "template"
     }
   ],
   "tacIds": [
@@ -21,5 +78,5 @@
     "TAC-3802-deploy-hetzner-server-manifest-schema"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37104.json

@@ -13,12 +13,41 @@
       "id": "AC-37104-1",
       "description": "cloud-init-render-lint.mjs renders the template with the fixture manifest and asserts each of the six baseline blocks (SSH key-only, root disabled, UFW default-deny incoming, DOCKER-USER iptables chain, fail2ban SSH jail, unattended-upgrades) appears in the rendered YAML by grep; a mutation SIMULATE_HARDENING_DRIFT=true removes the unattended-upgrades block and the probe FAILS with a message naming the missing line.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-37104-2",
+      "description": "Malformed template refusal. Given the cloud-init template with a placeholder tag left unclosed or misspelled, when cloud-init-render-lint.mjs renders it, then the probe FAILS naming the malformed placeholder; no rendered YAML is written to disk.",
+      "given": "a cloud-init template with a malformed placeholder",
+      "when": "cloud-init-render-lint.mjs runs",
+      "then": "the probe FAILS naming the malformed placeholder; no rendered YAML is written",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3803-deploy-hetzner-server-cloud-init-template",
+        "field": "interfaces.cloud-init.yaml.tmpl"
+      },
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-37104-3",
+      "description": "Fixture renderer refuses on unknown placeholder. Given the fixture renderer given a template with an unknown placeholder tag (a tag not in the two-placeholder shape {{name}} and {{sshAuthorizedKeysBlock}}), when the renderer runs, then it refuses with a named error kind (unknownPlaceholder); no rendered YAML is written to disk.",
+      "given": "a template with an unknown placeholder tag",
+      "when": "the fixture renderer runs",
+      "then": "the renderer refuses with unknownPlaceholder; no rendered YAML is written",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3803-deploy-hetzner-server-cloud-init-template",
+        "field": "interfaces.cloud-init.yaml.tmpl"
+      },
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-3803-deploy-hetzner-server-cloud-init-template"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37105.json

@@ -13,12 +13,35 @@
       "id": "AC-37105-1",
       "description": "real-account-cloud-init-hardened.mjs (accountBound: true, skipped without CI_HAS_HETZNER_ACCOUNT) waits for cloud-init status --wait on the throwaway server, then ssh-checks the six baseline blocks and asserts each check passes; failure names the missing block. Teardown via destroy.mjs runs regardless.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3803-deploy-hetzner-server-cloud-init-template",
+        "field": "interfaces.cloud-init.yaml.tmpl"
+      },
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://cloudinit.readthedocs.io/en/latest/topics/format.html",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-37105-2",
+      "description": "Cloud-init timeout surfaces as a probe failure. Given the cloud-init boot process exceeds the vendor timeout (approximately 10 minutes), when cloud-init status --wait returns a non-done status, then the probe FAILS naming the non-done status; the throwaway server is torn down via destroy.mjs regardless.",
+      "given": "cloud-init boot exceeds the vendor timeout",
+      "when": "cloud-init status --wait returns non-done",
+      "then": "the probe FAILS naming the non-done status; teardown via destroy.mjs runs regardless",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3803-deploy-hetzner-server-cloud-init-template",
+        "field": "interfaces.cloud-init.yaml.tmpl"
+      },
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-3803-deploy-hetzner-server-cloud-init-template"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37106.json

@@ -13,7 +13,40 @@
       "id": "AC-37106-1",
       "description": "manifest-schema-validate.mjs asserts every fixture manifest carries a firewallRules array matching the shape (22 permitted only from a nonempty list of source-prefix ranges with no 0.0.0.0/0; 80 and 443 permitted from 0.0.0.0/0; no other inbound rule); an induced defect (a manifest that opens 22 to 0.0.0.0/0) FAILS schema validation with a message naming the offending rule.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3804-deploy-hetzner-server-firewall-shape",
+        "field": "interfaces.firewallRules"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-37106-2",
+      "description": "Firewall applied at provision time. Given a manifest carrying the shape-valid firewallRules array, when the provisioner runs createServer + applyFirewall, then hcloud firewall list --output json shows a firewall bound to the new server whose rules match the manifest shape (ssh restricted, 80/443 open, all else denied); a mutation SIMULATE_FIREWALL_DRIFT=true edits one rule out-of-band and the probe FAILS naming the drifted rule.",
+      "given": "a manifest with shape-valid firewallRules and no pre-existing firewall bound",
+      "when": "the provisioner runs against the throwaway account",
+      "then": "hcloud firewall list shows the bound firewall matching the manifest; a drift mutation FAILS the probe naming the drifted rule",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3804-deploy-hetzner-server-firewall-shape",
+        "field": "interfaces.firewallRules"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-37106-3",
+      "description": "Reuse existing firewall-id path. Given the elicited firewall-id names an existing Hetzner Cloud firewall id, when the provisioner runs createServer, then it attaches the existing firewall (no new firewall is created), and hcloud firewall list --output json shows no duplicate; a mutation that supplies a firewall-id absent from the account FAILS provision with a named error kind (missingFirewallId).",
+      "given": "firewall-id names an existing account firewall id",
+      "when": "the provisioner runs createServer",
+      "then": "the existing firewall attaches; no new firewall is created; the missing-id mutation FAILS provision with missingFirewallId",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "template"
     }
   ],
   "tacIds": [
@@ -21,5 +54,5 @@
     "TAC-3804-deploy-hetzner-server-firewall-shape"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37107.json

@@ -13,12 +13,41 @@
       "id": "AC-37107-1",
       "description": "manifest-schema-validate.mjs asserts every fixture manifest carries snapshotCadence with a value in the shipped enum {weekly, daily, off}; a manifest missing the field FAILS schema validation naming the missing field.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-37107-2",
+      "description": "Scheduled snapshot fires per elicited cadence. Given snapshotCadence = weekly and hetznerManagedBackups = false, when the scheduled snapshot runner ticks past the weekly boundary against the throwaway server, then hcloud image list --type=snapshot --output json shows a fresh snapshot tagged with the server name and current wall-clock time; hetznerScheduledSnapshotTaken fires on the event sink with snapshot id, cadence and time. A mutation snapshotCadence = off suppresses the scheduled run and asserts no new snapshot appears.",
+      "given": "snapshotCadence = weekly, hetznerManagedBackups = false, throwaway server present",
+      "when": "the scheduled snapshot runner ticks past the weekly boundary",
+      "then": "hcloud image list --type=snapshot shows a fresh tagged snapshot; hetznerScheduledSnapshotTaken fires with snapshot id, cadence, time; snapshotCadence=off produces no new snapshot",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-37107-3",
+      "description": "Enum drift refusal on snapshot-cadence. Given a manifest snapshotCadence value outside the shipped enum {weekly, daily, off}, when manifest-schema-validate.mjs runs, then the probe FAILS naming the offending value and the shipped enum; the provisioner refuses to apply the manifest.",
+      "given": "snapshotCadence value outside {weekly, daily, off}",
+      "when": "manifest-schema-validate.mjs runs",
+      "then": "the probe FAILS naming the offending value and the shipped enum; the provisioner refuses to apply",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3802-deploy-hetzner-server-manifest-schema",
+        "field": "interfaces.hetzner-server.schema.json"
+      },
+      "disposition": "template"
     }
   ],
   "tacIds": [
     "TAC-3802-deploy-hetzner-server-manifest-schema"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37108.json

@@ -13,12 +13,53 @@
       "id": "AC-37108-1",
       "description": "real-account-snapshot-on-demand.mjs (accountBound: true, skipped without CI_HAS_HETZNER_ACCOUNT) fires the snapshot verb on the throwaway server, then asserts hcloud image list --type=snapshot --output json shows a snapshot tagged with the server name and current wall-clock time; hetznerSnapshotTaken event carries snapshot id and time. Teardown via destroy.mjs.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://docs.hetzner.cloud/#images-create-image-from-a-server",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-37108-2",
+      "description": "Snapshot-on-demand upstream failure. Given the hetzner API returns a non-2xx response on hcloud image create-image (for example 429 rate-limited or 503 upstream), when the snapshot-on-demand verb runs, then the facade emits provisionerFailed with { verb: \"createImage\", apiStatus, retryable } on the event sink and no hetznerSnapshotTaken fires; no orphan snapshot resource remains on the account.",
+      "given": "the hetzner API returns 429 or 503 on hcloud image create-image",
+      "when": "the snapshot-on-demand verb runs",
+      "then": "the facade emits provisionerFailed with { verb, apiStatus, retryable }; no hetznerSnapshotTaken fires; no orphan snapshot remains",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://docs.hetzner.cloud/#errors",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-37108-3",
+      "description": "Snapshot payload shape check. Given a successful snapshot-on-demand, when the hetznerSnapshotTaken event record is inspected, then the record carries exactly { serverName, snapshotId, ts } (ts is wall-clock milliseconds since epoch) and no additional field; a mutation SIMULATE_SNAPSHOT_EVENT_LEAK=true injects a token substring into the record and the sink observer FAILS.",
+      "given": "a successful snapshot-on-demand event fired",
+      "when": "the record is inspected",
+      "then": "the record carries exactly {serverName, snapshotId, ts} and no additional field; the leak mutation FAILS",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://docs.hetzner.cloud/#images-create-image-from-a-server",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-3801-deploy-hetzner-server-provisioner"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37109.json

@@ -13,12 +13,41 @@
       "id": "AC-37109-1",
       "description": "hcloud-dry-run-mock.mjs drives every lifecycle event through the facade against a mocked hcloud shim; the accumulated event stream carries only the metadata fields named on REQ-006; a mutation SIMULATE_EVENT_SECRECY_LEAK=true injects the token into the hetznerServerProvisioned payload and the probe FAILS with a defensive-fake finding naming the leaked field.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-37109-2",
+      "description": "Secret exclusion by grep-across-source. Given the fixture provisioner source and the fixture renderer source (per TAC-3803), when a source-tree scan searches every onEvent call site and every event-record construction site for the substring HETZNER_ACCOUNT_API_KEY and any ssh key body, then no match is found; a mutation SIMULATE_EVENT_TOKEN_LEAK=true adds the token into an event field and the probe FAILS naming the leaked field.",
+      "given": "the fixture provisioner and renderer source, and the four documented lifecycle events",
+      "when": "a source-tree grep runs across every event-record construction site",
+      "then": "no HETZNER_ACCOUNT_API_KEY or ssh-key-body match is found; the mutation FAILS naming the leaked field",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-37109-3",
+      "description": "Event fires once per lifecycle moment (repeat-run idempotency). Given a completed provision and a completed destroy, when the run replays a second time against the same manifest and account, then hetznerServerProvisioned fires once per successful create and hetznerServerDestroyed fires once per successful destroy; no duplicate event fires for a run whose upstream call did not change resource state.",
+      "given": "a completed provision + destroy cycle",
+      "when": "the run replays a second time against the same manifest and account",
+      "then": "each lifecycle event fires exactly once per successful state change; no duplicate event fires on a no-op call",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "template"
     }
   ],
   "tacIds": [
     "TAC-3801-deploy-hetzner-server-provisioner"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-hetzner-server/docs/topics.md

@@ -25,7 +25,7 @@ to `deploy-hetzner-server` v1.0.0.
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
@@ -44,5 +44,5 @@ The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authorin
 
 - `security-secrets-management` (v1.0.1): the provisioner facade reads `HETZNER_ACCOUNT_API_KEY` through the applied secrets facade. The facade is the sole reader; every other module in the applying project imports the facade and never dereferences the token.
 - `deploy-cloudflare-workers` (v1.2.0): sibling in the `deploy-*` family. The family enforces one-target-per-project at apply time (a project applying both refuses with `deploy-family-multiple-targets`).
-- Round-7 T-2 `platform-docker-compose-host`: composes on `capabilities: [cloudHost]`; ships the compose runtime on the Hetzner host this blueprint provisions.
-- Round-7 T-3 `edge-cloudflare-tunnel`: composes on `cloudHost` (systemd unit shape) or on `containerHost` (compose service shape); either shape bridges the Hetzner host to the Cloudflare edge without opening origin ports.
+- round-7 `platform-docker-compose-host`: composes on `capabilities: [cloudHost]`; ships the compose runtime on the Hetzner host this blueprint provisions.
+- round-7 `edge-cloudflare-tunnel`: composes on `cloudHost` (systemd unit shape) or on `containerHost` (compose service shape); either shape bridges the Hetzner host to the Cloudflare edge without opening origin ports.