rcf-lite 0.25.0 → 0.27.0

package/blueprints/object-storage-s3/README.md

@@ -1,6 +1,6 @@
 # object-storage-s3
 
-Object storage on the S3 API, accessed through a store facade that is the sole reader of the S3 client. Cloudflare R2 is the first adapter, MinIO is the local dev target, any S3-compatible remote (AWS S3, Backblaze B2, Wasabi, self-hosted) composes cleanly. Ships put / get / delete / list, presigned GET URLs with a bounded TTL, and multipart-upload above an elicited threshold, plus a lifecycle-event sink with a metadata-only field discipline. Refuses composition without `security-secrets-management` applied (Baz decision 6): the credential pair is a `secretRef`, never a value.
+Object storage on the S3 API, accessed through a store facade that is the sole reader of the S3 client. Cloudflare R2 is the first adapter, MinIO is the local dev target, any S3-compatible remote (AWS S3, Backblaze B2, Wasabi, self-hosted) composes cleanly. Ships put / get / delete / list, presigned GET URLs with a bounded TTL, and multipart-upload above an elicited threshold, plus a lifecycle-event sink with a metadata-only field discipline. Refuses composition without `security-secrets-management` applied: the credential pair is a `secretRef`, never a value.
 
 ## What this blueprint gives you
 
@@ -19,12 +19,14 @@ Object storage on the S3 API, accessed through a store facade that is the sole r
 | REQ-004 | Multipart-upload above the ADR-2903 threshold (default 8 MiB); abort-on-failure with no orphan in-flight uploads. |
 | REQ-005 | Four lifecycle events with metadata-only fields; event-secrecy probe asserts against a PII fixture. |
 | REQ-006 | Credential-pair discipline via `security-secrets-management`; refuses composition without with stable message id `object-storage-s3-no-secrets`. |
+| REQ-101 (v1.1.0) | Hetzner Object Storage adapter: endpoint-shape helper composes `<bucket>.<location>.your-objectstorage.com` from an elicited bucket and location; MinIO and R2 paths unchanged. |
 
 ## The three TACs
 
 - **TAC-2901 facade**: the object-storage S3 facade module.
 - **TAC-2902 multipart uploader**: initiate/part-upload/complete with abort-on-failure.
 - **TAC-2903 event sink**: metadata-only lifecycle event contract.
+- **TAC-2904 Hetzner endpoint helper (v1.1.0)**: sole composer of `<bucket>.<location>.your-objectstorage.com`; enum-refuses unknown location codes.
 
 ## The four ADRs
 
@@ -32,10 +34,19 @@ Object storage on the S3 API, accessed through a store facade that is the sole r
 - **ADR-2902 presigned URL TTL**: default 15 minutes, floor 1 minute; elicited ceiling. Standards trace clause: generic enterprise practice.
 - **ADR-2903 multipart threshold**: default 8 MiB, elicited. Standards trace clause: generic enterprise practice.
 - **ADR-2904 object storage contract** (scope: global, topic `objectStorageContract`): S3 API as the shipped shape; conflicts by design with future non-S3-shape siblings. Standards trace clause: AWS S3 API and R2 S3-compatibility notes.
+- **ADR-2905 Hetzner Object Storage provider (v1.1.0)**: recognises `hetznerObjectStorage` as a shipped provider value under the shipped S3-API facade; endpoint pattern `<bucket>.<location>.your-objectstorage.com` composed via TAC-2904; MinIO and R2 paths unchanged. Standards trace clause: Hetzner Object Storage S3 compatibility documented endpoint shape.
 
 ## Elicited parameters
 
-Endpoint URL (R2 `https://<account-id>.r2.cloudflarestorage.com`, AWS S3 `https://s3.<region>.amazonaws.com`, MinIO `http://localhost:9000`, any S3-compatible remote); bucket name; credential-pair reference via `security-secrets-management` (never value); adapter (`awsSdk` or `aws4fetch`); presigned-URL default TTL (default 15 minutes); presigned-URL ceiling (elicited, no shipped default, S3 API 7-day outer bound); multipart-upload threshold (default 8 MiB); force path style (`true` for MinIO, `false` for AWS/R2 with virtual-hosted style); server-side encryption default (`sseNone` on R2 per the R2 compatibility notes; `sseS3` on AWS S3 when the operator elicits it).
+Endpoint URL (R2 `https://<account-id>.r2.cloudflarestorage.com`, AWS S3 `https://s3.<region>.amazonaws.com`, MinIO `http://localhost:9000`, Hetzner Object Storage `https://<bucket>.<location>.your-objectstorage.com` composed from a bucket and location via the v1.1.0 helper, any S3-compatible remote); bucket name; credential-pair reference via `security-secrets-management` (never value); adapter (`awsSdk` or `aws4fetch`); presigned-URL default TTL (default 15 minutes); presigned-URL ceiling (elicited, no shipped default, S3 API 7-day outer bound); multipart-upload threshold (default 8 MiB); force path style (`true` for MinIO, `false` for AWS/R2 and Hetzner Object Storage with virtual-hosted style); server-side encryption default (`sseNone` on R2 per the R2 compatibility notes; `sseS3` on AWS S3 when the operator elicits it).
+
+## Hetzner Object Storage adapter (v1.1.0)
+
+Since v1.1.0 the blueprint recognises `hetznerObjectStorage` as a shipped provider value under the existing S3-API facade contract. Hetzner Object Storage is S3-compatible per https://docs.hetzner.com/storage/object-storage/overview; the endpoint follows the vendor-documented pattern `<bucket>.<location>.your-objectstorage.com`. Three location codes are shipped: `fsn1` (Falkenstein), `hel1` (Helsinki), `nbg1` (Nuremberg), matching the same page. A project applying the blueprint with the Hetzner provider elicits the bucket and location; a small helper (`composeHetznerEndpoint`, TAC-2904) composes the https endpoint URL and hands it to the shipped facade unchanged. `region` defaults to `auto` (matching the R2 shape); `forcePathStyle` defaults to `false` (virtual-hosted-style, matching R2 and AWS S3). The Cloudflare R2 real-account smoke stays gated on `CI_HAS_CLOUDFLARE_ACCOUNT` and does not read the new env vars; the MinIO local emulator flow stays byte-identical. Reach for Hetzner over R2 for a European storage region with a different egress-pricing profile; reach for R2 for the zero-egress-fee posture; reach for MinIO for local dev without any account.
+
+Runtime dependency: none added. The shipped `@aws-sdk/client-s3` client signs and speaks the S3 wire protocol against the composed Hetzner endpoint unchanged.
+
+A new Node-only probe `hetzner-object-storage-round-trip.mjs` binds AC-28110-1: with `CI_HAS_HETZNER_OBJECT_STORAGE` set (plus `HETZNER_OBJECT_STORAGE_ACCESS_KEY_ID`, `HETZNER_OBJECT_STORAGE_SECRET_ACCESS_KEY`, `HETZNER_OBJECT_STORAGE_BUCKET`, `HETZNER_OBJECT_STORAGE_LOCATION`) it round-trips a byte-equal 1 KiB payload against a real Hetzner Object Storage bucket; without the env var it records `accountBoundSkipped: true` per spec section 3.5.
 
 ## Companions
 
@@ -44,7 +55,7 @@ Endpoint URL (R2 `https://<account-id>.r2.cloudflarestorage.com`, AWS S3 `https:
 
 ## Composition and conflicts
 
-Consumes `security-secrets-management` v1.0.1+ for the credential pair. Declares `requiresAppliedCapabilities: {capabilities: ["secretsProvider"], allowSkipFlag: "allow-no-secrets-yet", refusalMessageId: "object-storage-s3-no-secrets"}` per the T-5 capability mechanism (visual round spec 5.5.1). The apply verb refuses on a project without `secretsProvider` (exit 3, stderr carries `[object-storage-s3-no-secrets]` as the first-line tag and names the required capability, the shipped predecessor, and the override flag). `--allow-no-secrets-yet` overrides for a scaffolding pass and records a `notes` line on `rcf/blueprints/object-storage-s3.applied.json` for later reconciliation. Contributes ADR-2904 as `scope: global` on new topic `objectStorageContract`; future `object-storage-native-gcs` or `object-storage-native-azure` siblings would conflict here by design. `capabilities: ["objectStorage"]`; `providesRoles: []`.
+Consumes `security-secrets-management` v1.0.1+ for the credential pair. Declares `requiresAppliedCapabilities: {capabilities: ["secretsProvider"], allowSkipFlag: "allow-no-secrets-yet", refusalMessageId: "object-storage-s3-no-secrets"}` per the capability mechanism. The apply verb refuses on a project without `secretsProvider` (exit 3, stderr carries `[object-storage-s3-no-secrets]` as the first-line tag and names the required capability, the shipped predecessor, and the override flag). `--allow-no-secrets-yet` overrides for a scaffolding pass and records a `notes` line on `rcf/blueprints/object-storage-s3.applied.json` for later reconciliation. Contributes ADR-2904 as `scope: global` on new topic `objectStorageContract`; future `object-storage-native-gcs` or `object-storage-native-azure` siblings would conflict here by design. `capabilities: ["objectStorage"]`; `providesRoles: []`.
 
 ## The six probes
 
@@ -58,6 +69,7 @@ Each probe is a Node module under `contributions/probes/` exporting the round-5
 | `multipart-upload` | AC-28104-1, AC-28104-2 | 10 MiB payload above the 8 MiB threshold round-trips byte-equal via multipart; no orphan in-flight uploads after complete; abort-on-failure with `SIMULATE_PART_UPLOAD_FAIL=true`. | false |
 | `event-secrecy` | AC-28105-1 | Every event record carries only whitelisted metadata fields; no PII fixture text; no forbidden field name. | false |
 | `r2-real-account-smoke` | AC-28108-1 | Real R2 round-trip when `CI_HAS_CLOUDFLARE_ACCOUNT` is set; records `accountBoundSkipped: true` when it is not. | true |
+| `hetzner-object-storage-round-trip` (v1.1.0) | AC-28110-1 | Composes `<bucket>.<location>.your-objectstorage.com` via `composeHetznerEndpoint`; real Hetzner Object Storage round-trip when `CI_HAS_HETZNER_OBJECT_STORAGE` is set; records `accountBoundSkipped: true` when it is not. | true |
 
 ## How to run the probes locally
 
@@ -73,6 +85,7 @@ node ../../../../blueprints/object-storage-s3/contributions/probes/run-presigned
 node ../../../../blueprints/object-storage-s3/contributions/probes/run-multipart-upload.mjs
 node ../../../../blueprints/object-storage-s3/contributions/probes/run-event-secrecy.mjs
 node ../../../../blueprints/object-storage-s3/contributions/probes/run-r2-real-account-smoke.mjs
+node ../../../../blueprints/object-storage-s3/contributions/probes/run-hetzner-object-storage-round-trip.mjs
 docker compose down -v
 ```
 

package/blueprints/object-storage-s3/blueprint.json

@@ -1,10 +1,14 @@
 {
   "slug": "object-storage-s3",
-  "version": "1.0.0",
+  "version": "1.2.2",
   "category": "object-storage",
-  "capabilities": ["objectStorage"],
+  "capabilities": [
+    "objectStorage"
+  ],
   "requiresAppliedCapabilities": {
-    "capabilities": ["secretsProvider"],
+    "capabilities": [
+      "secretsProvider"
+    ],
     "allowSkipFlag": "allow-no-secrets-yet",
     "refusalMessageId": "object-storage-s3-no-secrets"
   },
@@ -19,23 +23,91 @@
     }
   ],
   "contributions": [
-    { "id": "object-storage-s3-REQ-001", "kind": "req", "path": "requirements/object-storage-s3-req-001.json" },
-    { "id": "object-storage-s3-REQ-002", "kind": "req", "path": "requirements/object-storage-s3-req-002.json" },
-    { "id": "object-storage-s3-REQ-003", "kind": "req", "path": "requirements/object-storage-s3-req-003.json" },
-    { "id": "object-storage-s3-REQ-004", "kind": "req", "path": "requirements/object-storage-s3-req-004.json" },
-    { "id": "object-storage-s3-REQ-005", "kind": "req", "path": "requirements/object-storage-s3-req-005.json" },
-    { "id": "object-storage-s3-REQ-006", "kind": "req", "path": "requirements/object-storage-s3-req-006.json" },
-    { "id": "object-storage-s3-US-28101", "kind": "us", "path": "user-stories/object-storage-s3-us-28101.json" },
-    { "id": "object-storage-s3-US-28102", "kind": "us", "path": "user-stories/object-storage-s3-us-28102.json" },
-    { "id": "object-storage-s3-US-28103", "kind": "us", "path": "user-stories/object-storage-s3-us-28103.json" },
-    { "id": "object-storage-s3-US-28104", "kind": "us", "path": "user-stories/object-storage-s3-us-28104.json" },
-    { "id": "object-storage-s3-US-28105", "kind": "us", "path": "user-stories/object-storage-s3-us-28105.json" },
-    { "id": "object-storage-s3-US-28106", "kind": "us", "path": "user-stories/object-storage-s3-us-28106.json" },
-    { "id": "object-storage-s3-US-28107", "kind": "us", "path": "user-stories/object-storage-s3-us-28107.json" },
-    { "id": "object-storage-s3-US-28108", "kind": "us", "path": "user-stories/object-storage-s3-us-28108.json" },
-    { "id": "TAC-2901-object-storage-s3-facade", "kind": "tac", "path": "tacs/tac-2901-object-storage-s3-facade.json" },
-    { "id": "TAC-2902-object-storage-s3-multipart-uploader", "kind": "tac", "path": "tacs/tac-2902-object-storage-s3-multipart-uploader.json" },
-    { "id": "TAC-2903-object-storage-s3-event-sink", "kind": "tac", "path": "tacs/tac-2903-object-storage-s3-event-sink.json" },
+    {
+      "id": "object-storage-s3-REQ-001",
+      "kind": "req",
+      "path": "requirements/object-storage-s3-req-001.json"
+    },
+    {
+      "id": "object-storage-s3-REQ-002",
+      "kind": "req",
+      "path": "requirements/object-storage-s3-req-002.json"
+    },
+    {
+      "id": "object-storage-s3-REQ-003",
+      "kind": "req",
+      "path": "requirements/object-storage-s3-req-003.json"
+    },
+    {
+      "id": "object-storage-s3-REQ-004",
+      "kind": "req",
+      "path": "requirements/object-storage-s3-req-004.json"
+    },
+    {
+      "id": "object-storage-s3-REQ-005",
+      "kind": "req",
+      "path": "requirements/object-storage-s3-req-005.json"
+    },
+    {
+      "id": "object-storage-s3-REQ-006",
+      "kind": "req",
+      "path": "requirements/object-storage-s3-req-006.json"
+    },
+    {
+      "id": "object-storage-s3-US-28101",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28101.json"
+    },
+    {
+      "id": "object-storage-s3-US-28102",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28102.json"
+    },
+    {
+      "id": "object-storage-s3-US-28103",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28103.json"
+    },
+    {
+      "id": "object-storage-s3-US-28104",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28104.json"
+    },
+    {
+      "id": "object-storage-s3-US-28105",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28105.json"
+    },
+    {
+      "id": "object-storage-s3-US-28106",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28106.json"
+    },
+    {
+      "id": "object-storage-s3-US-28107",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28107.json"
+    },
+    {
+      "id": "object-storage-s3-US-28108",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28108.json"
+    },
+    {
+      "id": "TAC-2901-object-storage-s3-facade",
+      "kind": "tac",
+      "path": "tacs/tac-2901-object-storage-s3-facade.json"
+    },
+    {
+      "id": "TAC-2902-object-storage-s3-multipart-uploader",
+      "kind": "tac",
+      "path": "tacs/tac-2902-object-storage-s3-multipart-uploader.json"
+    },
+    {
+      "id": "TAC-2903-object-storage-s3-event-sink",
+      "kind": "tac",
+      "path": "tacs/tac-2903-object-storage-s3-event-sink.json"
+    },
     {
       "id": "ADR-2901-object-storage-s3-adapter",
       "kind": "adr",
@@ -67,6 +139,76 @@
       "scope": "global",
       "topic": "objectStorageContract",
       "standardsTraceClause": "AWS S3 API and Cloudflare R2 S3-compatibility notes"
+    },
+    {
+      "id": "object-storage-s3-REQ-101",
+      "kind": "req",
+      "path": "requirements/object-storage-s3-req-101.json"
+    },
+    {
+      "id": "object-storage-s3-US-28110",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28110.json"
+    },
+    {
+      "id": "TAC-2904-object-storage-s3-hetzner-endpoint-helper",
+      "kind": "tac",
+      "path": "tacs/tac-2904-object-storage-s3-hetzner-endpoint-helper.json"
+    },
+    {
+      "id": "ADR-2905-object-storage-s3-hetzner-object-storage-provider",
+      "kind": "adr",
+      "path": "adrs/adr-2905-object-storage-s3-hetzner-object-storage-provider.json",
+      "recommendedDefault": false,
+      "elicited": true,
+      "standardsTraceClause": "Hetzner Object Storage S3 compatibility documented endpoint shape"
+    }
+  ],
+  "elicits": [
+    {
+      "id": "s3-endpoint-url",
+      "prompt": "S3-compatible endpoint URL: an AWS S3 URL, a Cloudflare R2 URL, a MinIO URL, or any S3-compatible remote (including Hetzner Object Storage under the endpoint-shape helper). The facade opens the client against this at boot.",
+      "kind": "string",
+      "default": "https://s3.amazonaws.com"
+    },
+    {
+      "id": "s3-bucket-name",
+      "prompt": "Bucket name the facade opens against. The applied project asserts a real bucket at apply; the facade dereferences the elicited value once at boot.",
+      "kind": "string",
+      "default": "app-bucket"
+    },
+    {
+      "id": "s3-adapter",
+      "prompt": "S3 client adapter per ADR-2901. aws-sdk-client-s3 is the AWS SDK v3 client for Node targets; aws4fetch is the small SigV4 fetch adapter for Workers targets.",
+      "kind": "enum",
+      "options": [
+        "aws-sdk-client-s3",
+        "aws4fetch"
+      ],
+      "default": "aws-sdk-client-s3"
+    },
+    {
+      "id": "presigned-ttl-ceiling-seconds",
+      "prompt": "Ceiling on the TTL a presignGetUrl verb may accept, in seconds. Floor is 60 seconds; default cap is 3600 seconds; the shipped default TTL is 900 seconds per ADR-2902.",
+      "kind": "string",
+      "default": "3600"
+    },
+    {
+      "id": "multipart-threshold-bytes",
+      "prompt": "Payload size at or above which the put path switches to multipart-upload. Default 8388608 bytes (8 MiB) per ADR-2903.",
+      "kind": "string",
+      "default": "8388608"
+    },
+    {
+      "id": "hetzner-location-code",
+      "prompt": "Hetzner Object Storage location code per the Hetzner storage overview: fsn1 Falkenstein, hel1 Helsinki, nbg1 Nuremberg. Only meaningful when the endpoint composes through the Hetzner endpoint-shape helper (TAC-2904).",
+      "kind": "enum",
+      "options": [
+        "fsn1",
+        "hel1",
+        "nbg1"
+      ],
+      "default": "fsn1"
     }
   ]
 }

package/blueprints/object-storage-s3/contributions/adrs/adr-2905-object-storage-s3-hetzner-object-storage-provider.json

@@ -0,0 +1,30 @@
+{
+  "adrId": "ADR-2905-object-storage-s3-hetzner-object-storage-provider",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.1.0",
+  "status": "accepted",
+  "title": "Hetzner Object Storage as a shipped provider value under the object-storage-s3 v1.0.0 facade; endpoint pattern <bucket>.<location>.your-objectstorage.com per the Hetzner storage overview; MinIO and R2 paths unchanged",
+  "context": "The object-storage-s3 v1.0.0 blueprint shipped Cloudflare R2 (production first-target on the shipped adapter shape), AWS S3 (interop first-class through the same wire protocol), MinIO (local emulator for dev), and any other S3-compatible endpoint (Backblaze B2 in S3-compat mode, Wasabi, self-hosted) as providers a project can point at by pasting an endpoint URL into the elicited endpointUrl parameter on the facade. Hetzner Object Storage is S3-compatible per https://docs.hetzner.com/storage/object-storage/overview (fetched 2026-09-08 200) and reads through the shipped facade without a client change, but its endpoint URL is derived from two elicited values (a bucket name and a location code in {fsn1, hel1, nbg1}) rather than pasted in whole; the vendor pattern is <bucket>.<location>.your-objectstorage.com per the same page. A follow-up minor bump adds the Hetzner Object Storage provider value by shipping an endpoint-shape helper (TAC-2904) that composes the vendor pattern from those two elicited values and hands the composed https URL to the facade unchanged. No topic conflict is raised because the objectStorageContract topic (ADR-2904, scope global) names the wire-shape contract as the S3 API, and Hetzner Object Storage speaks that contract per the overview.",
+  "decision": "The shipped v1.1.0 object-storage-s3 blueprint recognises hetznerObjectStorage as a shipped provider value alongside R2, AWS, MinIO. A project applying object-storage-s3 with the Hetzner provider elicits a bucket name and a location code in {fsn1, hel1, nbg1}, and the shipped endpoint-shape helper (TAC-2904, composeHetznerEndpoint) composes https://<bucket>.<location>.your-objectstorage.com verbatim per https://docs.hetzner.com/storage/object-storage/overview. The composed URL feeds the shipped facade (TAC-2901) through the existing endpointUrl parameter; no facade shape moves, no runtime dependency lands in the applying project, no re-signing surface is added (the S3 client's SigV4 signing works unchanged against the composed endpoint). Region defaults to auto (matching the R2 shape); forcePathStyle defaults to false (matching R2 and AWS S3 with virtual-hosted-style buckets). A new Node-only probe hetzner-object-storage-round-trip.mjs binds to AC-28110-1: with CI_HAS_HETZNER_OBJECT_STORAGE the probe round-trips a byte-equal 1 KiB payload against a real bucket, without it the probe records accountBoundSkipped true per spec section 3.5. The MinIO local emulator and R2 real-account smoke stay byte-identical and keep their v1.0.0 acceptance shape.",
+  "consequences": "A project that outgrows the MinIO local emulator or wants a European storage location with lower egress costs than R2 or AWS S3 picks hetznerObjectStorage at apply time and the shipped facade routes through the composed endpoint unchanged. Standards trace clause: Hetzner Object Storage S3 compatibility documented endpoint shape (https://docs.hetzner.com/storage/object-storage/overview) enumerates the endpoint pattern and the three location codes fsn1, hel1, nbg1. The provider list is not exhaustive; a future v1.2.0 minor could add another S3-compatible provider under the same shape by shipping another endpoint helper. The shipped R2 real-account smoke stays gated on CI_HAS_CLOUDFLARE_ACCOUNT and does not read CI_HAS_HETZNER_OBJECT_STORAGE; the two smokes skip independently. rcf-lite package version does NOT bump for this follow-up (spec section 8): the blueprint bumps 1.0.0 -> 1.1.0 and ships as its own sequential PR post-round-7.",
+  "alternativesConsidered": [
+    {
+      "name": "Extend ADR-2901 alternativesConsidered instead of shipping a sibling ADR",
+      "summary": "Mutate the shipped v1.0.0 ADR-2901 body to enumerate Hetzner Object Storage as a fourth alternative under the SDK-adapter axis.",
+      "reasonNotChosen": "ADR-2901's alternativesConsidered axis is client-choice (AWS SDK v3 vs aws4fetch vs hand-rolled SigV4), not provider-choice. Hetzner Object Storage is a provider under the shipped AWS SDK v3 adapter; mutating ADR-2901 would mis-scope the alternative. The additive-only discipline of a minor bump prefers a sibling ADR that references ADR-2901 by id over a mutation of the shipped body."
+    },
+    {
+      "name": "Ship the Hetzner Object Storage endpoint as a documented example on the freeform endpointUrl only, without a helper module",
+      "summary": "Document the endpoint pattern in the guide and let the applying project paste https://<bucket>.<location>.your-objectstorage.com into endpointUrl by hand.",
+      "reasonNotChosen": "A hand-composed endpoint is a shape a project can mis-key silently (a missing dot before your-objectstorage.com, a bucket-shaped hostname prefix that a linter cannot flag). The endpoint-shape helper turns the vendor convention into a mechanical composition with an enum-checked location code and a probe that asserts the composed value against the vendor pattern. The helper is 20 lines of code and lives inside the applying project; the trade-off is one small module for a mechanically-checked correctness gain."
+    },
+    {
+      "name": "Mint a separate object-storage-hetzner blueprint slug",
+      "summary": "Ship a fresh blueprint object-storage-hetzner v1.0.0 with the Hetzner-shaped facade instead of extending object-storage-s3.",
+      "reasonNotChosen": "Hetzner Object Storage speaks the S3 wire protocol per the vendor overview; a separate slug would duplicate the whole object-storage-s3 facade contract and split the shelf on a provider axis rather than a contract axis. The objectStorageContract global-ADR topic already names the wire-shape contract as the S3 API; adding a provider value under that contract stays additive."
+    }
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/object-storage-s3/contributions/probes/hetzner-object-storage-round-trip.mjs

@@ -0,0 +1,136 @@
+/**
+ * Hetzner Object Storage round-trip probe.
+ *
+ * Composes the vendor-documented endpoint pattern
+ * <bucket>.<location>.your-objectstorage.com through the fixture-side
+ * hetzner-endpoint helper (TAC-2904; sole composer of the pattern),
+ * opens the shipped v1.0.0 facade (TAC-2901 over @aws-sdk/client-s3
+ * per ADR-2901) against the composed endpoint, puts a 1 KiB payload,
+ * gets it back byte-equal, deletes the scratch object, and asserts
+ * every lifecycle event record carries only whitelisted metadata
+ * fields per the fixture-side whitelist.
+ *
+ * accountBound: true. Skipped in CI without CI_HAS_HETZNER_OBJECT_STORAGE
+ * per hetzner-round-7-spec-2026-09-07 section 3.5 and section 5.4.
+ *
+ * Dependency-load discipline: the fixture-side facade module
+ * `object-store.mjs` imports `@aws-sdk/client-s3`, which is a
+ * fixture-scoped dependency installed by `npm install` inside the
+ * fixture directory (documented in the fixture README). To keep the
+ * accountBoundSkipped path loadable without that fixture install
+ * (surface inspection under `node --test`, tools that walk the probe
+ * module for its `accountBound` flag), the SDK-touching imports are
+ * DYNAMIC and gated on the CI_HAS_HETZNER_OBJECT_STORAGE env var.
+ *
+ * Mutation-purity discipline (per the operator estate hard gate row 2026-09-08): this
+ * module reads NO SIMULATE_ variable. Every fixture-side mutation
+ * hook (SIMULATE_HETZNER_ENDPOINT_MISSHAPEN,
+ * SIMULATE_HETZNER_EVENT_LEAK) lives in
+ * packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/hetzner-endpoint.mjs
+ * and alters the INPUT the probe assembles (the composed URL or the
+ * event-record payload).
+ *
+ * Anchors AC-28110-1 (label AC-hetznerObjectStorage-endpointRoundTrip).
+ */
+
+import { probeKey } from './probe-utils.mjs';
+
+export const accountBound = true;
+
+const VENDOR_PATTERN = /^https:\/\/[^./]+\.(fsn1|hel1|nbg1)\.your-objectstorage\.com$/;
+
+export default async function runProbe() {
+  if (!process.env.CI_HAS_HETZNER_OBJECT_STORAGE) {
+    return [{
+      anchorAcId: 'AC-28110-1',
+      verdict: 'pass',
+      detail: 'accountBound: skipped (no CI_HAS_HETZNER_OBJECT_STORAGE)',
+      accountBoundSkipped: true,
+    }];
+  }
+
+  // Dynamic imports so the accountBoundSkipped path above loads
+  // without the fixture-scoped @aws-sdk/client-s3 dependency.
+  const {
+    composeHetznerEndpoint,
+    hetznerCredentialsFromEnv,
+    makeHetznerEventDecorator,
+    assertMetadataOnlyEventRecords,
+    HETZNER_EVENT_WHITELIST,
+  } = await import('../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/hetzner-endpoint.mjs');
+  const { createObjectStore } = await import('../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/object-store.mjs');
+
+  const { accessKeyId, secretAccessKey, bucket, location } = hetznerCredentialsFromEnv();
+  if (!accessKeyId || !secretAccessKey || !bucket || !location) {
+    return [{
+      anchorAcId: 'AC-28110-1',
+      verdict: 'fail',
+      detail: 'CI_HAS_HETZNER_OBJECT_STORAGE set but one or more required env vars missing (HETZNER_OBJECT_STORAGE_ACCESS_KEY_ID, HETZNER_OBJECT_STORAGE_SECRET_ACCESS_KEY, HETZNER_OBJECT_STORAGE_BUCKET, HETZNER_OBJECT_STORAGE_LOCATION)',
+    }];
+  }
+
+  const results = [];
+  let endpoint;
+  try {
+    endpoint = composeHetznerEndpoint({ bucket, location });
+  } catch (err) {
+    return [{
+      anchorAcId: 'AC-28110-1',
+      verdict: 'fail',
+      detail: `endpoint composition threw on field ${err.field || 'unknown'}: ${err.message}`,
+    }];
+  }
+  if (!VENDOR_PATTERN.test(endpoint)) {
+    return [{
+      anchorAcId: 'AC-28110-1',
+      verdict: 'fail',
+      detail: `composed endpoint does not match vendor pattern <bucket>.<location>.your-objectstorage.com; got ${endpoint}; missing subdomain: your-objectstorage.com`,
+    }];
+  }
+
+  const events = [];
+  const store = createObjectStore({
+    endpointUrl: endpoint,
+    bucket,
+    credentialsRef: { accessKeyId, secretAccessKey },
+    region: 'auto',
+    forcePathStyle: false,
+    onEvent: (e) => events.push(makeHetznerEventDecorator({
+      event: e.event,
+      ts: e.ts,
+      endpointHost: e.endpointHost,
+      bucketName: e.bucketName,
+      location,
+      key: e.key,
+      size: e.size,
+      contentType: e.contentType,
+    })),
+  });
+  const key = probeKey('probe/hetzner-smoke');
+  const body = Buffer.alloc(1024, 0x48);
+  try {
+    await store.ready();
+    await store.putObject(key, 'application/octet-stream', body);
+    const got = await store.getObject(key);
+    const roundTripEqual = got.body.length === 1024 && got.body.equals(body);
+    results.push({
+      anchorAcId: 'AC-28110-1',
+      verdict: roundTripEqual ? 'pass' : 'fail',
+      detail: roundTripEqual
+        ? `Hetzner Object Storage round-trip byte-equal against ${endpoint} bucket=${bucket} location=${location}`
+        : `Hetzner Object Storage round-trip failed byte equality; expected 1024 bytes got ${got.body.length}`,
+    });
+    const evAssertion = assertMetadataOnlyEventRecords(events);
+    results.push({
+      anchorAcId: 'AC-28110-1',
+      verdict: evAssertion.pass ? 'pass' : 'fail',
+      detail: evAssertion.pass
+        ? `every lifecycle event carries only whitelisted fields (${[...HETZNER_EVENT_WHITELIST].join(',')})`
+        : `event-secrecy leak: forbidden fields present ${evAssertion.leaked.join(',')}`,
+    });
+  } finally {
+    try { await store.deleteObject(key); } catch { /* teardown best effort */ }
+    await store.close();
+  }
+  return results;
+}

package/blueprints/object-storage-s3/contributions/probes/run-hetzner-object-storage-round-trip.mjs

@@ -0,0 +1,11 @@
+/**
+ * Shim: run hetzner-object-storage-round-trip against the extended
+ * infra-s3-and-queue fixture and write
+ * .rcf/reports/blueprints/object-storage-s3/hetzner-object-storage-round-trip.json.
+ */
+
+import runProbe from './hetzner-object-storage-round-trip.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 's3', image: 'hetzner-object-storage-cloud', healthy: true };
+runShim('hetzner-object-storage-round-trip', engine, runProbe);

package/blueprints/object-storage-s3/contributions/requirements/object-storage-s3-req-001.json

@@ -2,7 +2,7 @@
   "reqId": "object-storage-s3-REQ-001",
   "prdId": "PRD-001",
   "title": "One facade module is the sole reader of the S3 client and opens on boot",
-  "description": "The application accesses object storage through a single facade module in the project's source tree that is the ONLY module in the tree that imports the S3 client (either @aws-sdk/client-s3 on Node targets or aws4fetch on Workers targets per ADR-2901). Every other module that touches object storage imports the facade and calls its named domain verbs; no other module holds the raw S3 client, an S3Client instance, or an aws4fetch AwsClient instance. On process boot, the facade opens the client against the elicited endpoint URL and bucket name, and once the first successful ready-check completes, emits a facadeReady lifecycle event carrying endpoint host and bucket name. The endpoint URL (a Cloudflare R2 URL, an AWS S3 URL, a MinIO URL, or any S3-compatible remote) and the bucket name are elicited at apply time.",
+  "description": "The application accesses object storage through a single facade module in the project's source tree that is the ONLY module in the tree that imports the S3 client (either @aws-sdk/client-s3 on Node targets or aws4fetch on Workers targets per ADR-2901). Every other module that touches object storage imports the facade and calls its named domain verbs; no other module holds the raw S3 client, an S3Client instance, or an aws4fetch AwsClient instance. On process boot, the facade opens the client against the elicited endpoint URL and bucket name, and once the first successful ready-check completes, emits a facadeReady lifecycle event carrying endpoint host and bucket name. The endpoint URL (a Cloudflare R2 URL, an AWS S3 URL, a MinIO URL, or any S3-compatible remote) and the bucket name are elicited at apply time. This blueprint declares the objectStorage applied capability at runtime: the facade module is the sole channel through which consumer code sees the S3-shaped store, and any downstream blueprint whose requiresAppliedCapabilities lists objectStorage is satisfied by an applied object-storage-s3 pinning the facade to its client and the elicited endpoint URL and bucket name. The s3-endpoint-url and s3-bucket-name are elicited at apply time and dereferenced once at boot. The s3-adapter is elicited between aws-sdk-client-s3 (AWS SDK v3 client for Node targets) and aws4fetch (small SigV4 fetch adapter for Workers targets). The presigned-ttl-ceiling-seconds is elicited within the ADR-2902 default cap.",
   "category": "functional",
   "domain": "object-storage",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-2901-object-storage-s3-facade",
+    "field": "responsibilities.facade"
+  }
 }

package/blueprints/object-storage-s3/contributions/requirements/object-storage-s3-req-002.json

@@ -2,7 +2,7 @@
   "reqId": "object-storage-s3-REQ-002",
   "prdId": "PRD-001",
   "title": "Put, get, delete, list contract on typed keys",
-  "description": "The facade exposes named domain verbs (putObject, getObject, deleteObject, listObjects) that take a typed key (a project-defined key namespace, not a raw string on the public surface where a typed alternative fits), a content-type string on put, and return either the object body (get), a boolean success (put, delete), or a paginated key listing (list). Every read and write goes through the S3 client's public request surface; no facade verb accepts a raw request object or a general-purpose passthrough from consumer code. The put verb emits objectPut with key, size, contentType, timestamp; the delete verb emits objectDeleted with key, timestamp.",
+  "description": "The facade exposes named domain verbs (putObject, getObject, deleteObject, listObjects) that take a typed key (a project-defined key namespace, not a raw string on the public surface where a typed alternative fits), a content-type string on put, and return either the object body (get), a boolean success (put, delete), or a paginated key listing (list). Every read and write goes through the S3 client's public request surface; no facade verb accepts a raw request object or a general-purpose passthrough from consumer code. The put verb emits objectPut with key, size, contentType, timestamp; the delete verb emits objectDeleted with key, timestamp. Keys reach the facade as strings; the facade validates them at the boundary against a shipped key-shape check: reject empty keys, keys with a leading slash, keys that contain the literal traversal segments \"..\" or \"//\", and keys longer than 1024 bytes. The applying project may layer a stricter project-typed key on top of the string, but the facade's public verbs accept the shape-validated string as the primitive.",
   "category": "functional",
   "domain": "object-storage",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-2901-object-storage-s3-facade",
+    "field": "responsibilities.crudVerbs"
+  }
 }

package/blueprints/object-storage-s3/contributions/requirements/object-storage-s3-req-003.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-2901-object-storage-s3-facade",
+    "field": "interfaces.store.verbs"
+  }
 }

package/blueprints/object-storage-s3/contributions/requirements/object-storage-s3-req-004.json

@@ -2,7 +2,7 @@
   "reqId": "object-storage-s3-REQ-004",
   "prdId": "PRD-001",
   "title": "Multipart-upload contract above an elicited threshold",
-  "description": "For payloads above the elicited threshold (default 8 MiB per ADR-2903), the facade's put path switches transparently to multipart-upload: initiate multipart upload, part-upload each chunk with a stable part number and returned ETag, complete-multipart-upload with the ordered part list. A part-upload failure aborts the in-flight upload (AbortMultipartUpload) before propagating the error; leaving an incomplete multipart upload behind is not the shipped path. On completion the objectPut lifecycle event fires with the final total size. Multipart re-upload semantics (per the R2 doc, a re-upload to the same part number replaces the previous with loss-on-fail) is a documented gotcha named in the README; the multipart-upload probe asserts an end-to-end round-trip of at least 10 MiB.",
+  "description": "For payloads above the elicited threshold (default 8 MiB per ADR-2903), the facade's put path switches transparently to multipart-upload: initiate multipart upload, part-upload each chunk with a stable part number and returned ETag, complete-multipart-upload with the ordered part list. A part-upload failure aborts the in-flight upload (AbortMultipartUpload) before propagating the error; leaving an incomplete multipart upload behind is not the shipped path. On completion the objectPut lifecycle event fires with the final total size. Multipart re-upload semantics (per the R2 doc, a re-upload to the same part number replaces the previous with loss-on-fail) is a documented gotcha named in the README; the multipart-upload probe asserts an end-to-end round-trip of at least 10 MiB. The multipart-threshold-bytes is elicited at apply time (default 8388608, 8 MiB, per ADR-2903); at or above the threshold the facade's put path switches to multipart-upload.",
   "category": "functional",
   "domain": "object-storage",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-2902-object-storage-s3-multipart-uploader",
+    "field": "responsibilities.multipart"
+  }
 }

package/blueprints/object-storage-s3/contributions/requirements/object-storage-s3-req-005.json

@@ -2,7 +2,7 @@
   "reqId": "object-storage-s3-REQ-005",
   "prdId": "PRD-001",
   "title": "Lifecycle events at four moments with metadata-only fields",
-  "description": "The facade emits four lifecycle events on the injected event sink: facadeReady (endpoint host, bucket name, timestamp), objectPut (key, size, contentType, timestamp), objectDeleted (key, timestamp), presignedIssued (key, ttl, timestamp). No event record carries object body bytes, no body checksum, no user id fields beyond what appears in the key itself, no PII drawn from the object body, and no adapter internal state. The event sink is a synchronous callback the operator wires; the facade never invokes it with domain-row values or authentication tokens. TAC-2903 realises the event-sink contract; the event-secrecy probe asserts field-level whitelist compliance against a PII fixture.",
+  "description": "The facade emits four lifecycle events on the injected event sink: facadeReady (endpoint host, bucket name, ts), objectPut (key, size, contentType, ts), objectDeleted (key, ts), presignedIssued (key, ttl, ts). No event record carries object body bytes, no body checksum, no user id fields beyond what appears in the key itself, no PII drawn from the object body, and no adapter internal state. The event sink is a synchronous callback the operator wires; the facade never invokes it with domain-row values or authentication tokens. TAC-2903 realises the event-sink contract; the event-secrecy probe asserts field-level whitelist compliance against a PII fixture.",
   "category": "functional",
   "domain": "object-storage",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-2903-object-storage-s3-event-sink",
+    "field": "responsibilities.lifecycle"
+  }
 }

package/blueprints/object-storage-s3/contributions/requirements/object-storage-s3-req-006.json

@@ -2,7 +2,7 @@
   "reqId": "object-storage-s3-REQ-006",
   "prdId": "PRD-001",
   "title": "Credential-pair discipline via security-secrets-management; refuses composition without",
-  "description": "The credential pair (accessKeyId, secretAccessKey) required to sign S3 requests is a secretRef value delegated to security-secrets-management: an opaque string agreed between object-storage-s3 and security-secrets-management naming the secret entry, never the credential value itself. The apply verb refuses composition on a project that has NOT applied security-secrets-management with exit code 3 and the stable message id object-storage-s3-no-secrets on stderr, per infra round 5 spec section 5.2 (Baz decision 6). The refusal names the required predecessor blueprint (security-secrets-management) and the override flag (--allow-no-secrets-yet). The override records a note on the applied blueprint's source.notes so rcf define validate can later flag the surface as not-yet-activated. The compose-test path checks the pair through the applied secrets facade before the object-store facade opens.",
+  "description": "The credential pair (accessKeyId, secretAccessKey) required to sign S3 requests is a secretRef value delegated to security-secrets-management: an opaque string agreed between object-storage-s3 and security-secrets-management naming the secret entry, never the credential value itself. The apply verb refuses composition on a project that has NOT applied security-secrets-management with exit code 3 and the stable message id object-storage-s3-no-secrets on stderr, per infra round 5 spec section 5.2 (maintainer decision). The refusal names the required predecessor blueprint (security-secrets-management) and the override flag (--allow-no-secrets-yet). The override records a note on the applied blueprint's source.notes so rcf define validate can later flag the surface as not-yet-activated. The compose-test path checks the pair through the applied secrets facade before the object-store facade opens. The facade factory accepts only the opaque secretRef and a resolver callback: the applying project passes an unresolved secretRef ({ id, provider }) plus a resolver that dereferences it inside the facade module. The factory refuses a plain { accessKeyId, secretAccessKey } object at the boundary; the resolver runs once per boot inside the module and never leaks the resolved pair beyond the S3 client construction call.",
   "category": "security",
   "domain": "object-storage",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-2901-object-storage-s3-facade",
+    "field": "responsibilities.credential"
+  }
 }

package/blueprints/object-storage-s3/contributions/requirements/object-storage-s3-req-101.json

@@ -0,0 +1,22 @@
+{
+  "reqId": "object-storage-s3-REQ-101",
+  "prdId": "PRD-001",
+  "title": "Hetzner Object Storage adapter: endpoint-shape helper composes <bucket>.<location>.your-objectstorage.com from an elicited bucket and location code",
+  "description": "The object-storage-s3 v1.1.0 minor bump adds a Hetzner Object Storage provider value under the shipped S3-API facade contract without changing the outward facade shape. The Hetzner Object Storage endpoint follows the vendor-documented pattern <bucket>.<location>.your-objectstorage.com per https://docs.hetzner.com/storage/object-storage/overview; a project applying the blueprint elicits a bucket name and a location code (fsn1 for Falkenstein, hel1 for Helsinki, nbg1 for Nuremberg per the same overview page) and the adapter composes the https endpoint URL through a single helper module. The helper is the sole composer of the vendor pattern for this provider so a project cannot accidentally construct an invalid endpoint by hand-concatenating the parts; the composed endpoint feeds the shipped S3 client (@aws-sdk/client-s3 on Node targets per ADR-2901) unchanged. The v1.0.0 Cloudflare R2, AWS S3 and MinIO paths stay byte-identical: the endpoint URL parameter on the facade remains freeform, and only projects that elicit hetznerObjectStorage as the provider consume the helper.",
+  "category": "functional",
+  "domain": "object-storage",
+  "priority": "must",
+  "rationale": "A single helper module for the Hetzner Object Storage endpoint pattern turns a documented vendor convention into a mechanical composition that the applied project cannot mis-shape by editing a config file. Reading the endpoint pattern from bucket plus location, in code, makes the composition observable to the probe (which asserts the composed value against the vendor pattern) and gives the mutation-purity switch a fixture-side seam (SIMULATE_HETZNER_ENDPOINT_MISSHAPEN alters the composed bucket segment on the INPUT side; the probe module never reads a SIMULATE_ variable and the composition module always composes correctly). The Cloudflare R2, AWS S3 and MinIO providers keep their v1.0.0 shape because their endpoint URLs are already documented on their own pages and each project applying those providers pastes the endpoint URL through the elicited freeform parameter; Hetzner Object Storage differs only in that the endpoint is derived from two elicited values rather than one pasted URL.",
+  "tags": [
+    "blueprint:object-storage-s3",
+    "category:07-hetzner-object-storage-adapter"
+  ],
+  "version": "1.1.0",
+  "status": "approved",
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-2904-object-storage-s3-hetzner-endpoint-helper",
+    "field": "responsibilities.composeEndpoint"
+  }
+}