rcf-lite 0.26.0 → 0.27.0

package/blueprints/deploy-hetzner-server/CHANGELOG.md

@@ -1,6 +1,20 @@
+# Changelog
+
+## 1.1.2 (register patch, 2026-09-10)
+
+- Register: neutral wording on the ADR-3801 consequences field (closes F-1) and the shared throwaway-server fixture paragraph in README (closes F-2); no capability change.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 - 2026-09-09
+
+Adds deliveredBy on REQ-001, REQ-002 and REQ-004. Adds ownerRef on AC-37102-1 (manifest schema), AC-37105-1 (cloud-init template) and AC-37106-1 (firewall shape). Adds runtime-clause naming the cloudHost applied capability on REQ-001. Adds disposition to every AC. Adds provisioner-failure and idempotency ACs across the family: US-37101 (AC-37101-2 credential missing, AC-37101-3 dependency not ready, AC-37101-4 repeat-boot idempotency, per section 7a worked example), US-37102 (AC-37102-2 malformed manifest, AC-37102-3 firewall opens ssh to 0.0.0.0/0), US-37103 (AC-37103-2 provisioner failure surfaces, AC-37103-3 repeat-apply idempotency), US-37104 (AC-37104-2 malformed template refusal), US-37106 (AC-37106-2 firewall applied at provision time), US-37107 (AC-37107-2 scheduled snapshot per elicited cadence, with off suppression), US-37108 (AC-37108-2 snapshot-on-demand upstream failure), US-37109 (AC-37109-2 secret exclusion by source-tree grep, AC-37109-3 event fires once per lifecycle moment).
+
 ## 1.0.1
 
-H-1 hardening patch train (round-7 real-account gate d-2026-09-08-010 defect list). Fixes nine real-path defects in the shared throwaway-Hetzner-server fixture at packages/rcf-lite/test/fixtures/hetzner-throwaway-server/ so the three T-1 real-account probes return aggregateVerdict pass on a live Hetzner Cloud project unpatched, and destroy plus sweep-orphans never leak a server. Every existing v1.0.0 contribution id byte-identical apart from the cloud-init template bodies (baseline unchanged; adds a NOPASSWD sudoers.d fragment for the deploy user) and the three T-1 mocked probe bodies (mutation-purity clean plus a new rendered-file assertion).
+Round-7 real-account gate hardening patch train. Fixes nine real-path defects in the shared throwaway-Hetzner-server fixture at packages/rcf-lite/test/fixtures/hetzner-throwaway-server/ so the three real-account probes return aggregateVerdict pass on a live Hetzner Cloud project unpatched, and destroy plus sweep-orphans never leak a server. Every existing v1.0.0 contribution id byte-identical apart from the cloud-init template bodies (baseline unchanged; adds a NOPASSWD sudoers.d fragment for the deploy user) and the three mocked probe bodies (mutation-purity clean plus a new rendered-file assertion).
 
 Defect list fixed:
 
@@ -13,11 +27,11 @@ Defect list fixed:
 - (7) contributions/templates/cloud-init.yaml.tmpl adds a write_files sudoers.d fragment at /etc/sudoers.d/90-deploy-nopasswd (mode 0440) that grants NOPASSWD to the deploy user, so the sudoed baseline checks (cloud-init status --wait, ufw status, iptables -L, systemctl is-active fail2ban) never block on a tty prompt.
 - (9) provision.mjs reads an env override RCF_LITE_CI_SSH_KEY_NAME (per-key comma-separated) for the manifest sshKeyIds, with the manifest value staying the default when the override is unset. Documented in the fixture README.
 
-Also: the three T-1 mocked probe modules (cloud-init-render-lint, manifest-schema-validate, hcloud-dry-run-mock) no longer read any process.env.SIMULATE_ switch inside the probe body per the H-1 mutation-purity gate row. The switches live entirely inside fixture-side files (src/cloud-init-renderer.mjs, src/hcloud-mock.mjs, src/provisioner-facade.mjs and the fixture-side run-manifest-schema-validate.mjs shim) and alter INPUT only. The hcloud-dry-run-mock probe now consumes the SAME rendered cloud-init file the real path consumes (renderer writes it, both the mock and real path read it) and asserts an ssh public-key line under the deploy user plus a NOPASSWD directive naming that user (H-1 REQ-145 / AC-14501-1). Report envelopes under .rcf/reports/blueprints/deploy-hetzner-server/ regenerated from the real run.
+Also: the three mocked probe modules (cloud-init-render-lint, manifest-schema-validate, hcloud-dry-run-mock) no longer read any process.env.SIMULATE_ switch inside the probe body per the mutation-purity gate row. The switches live entirely inside fixture-side files (src/cloud-init-renderer.mjs, src/hcloud-mock.mjs, src/provisioner-facade.mjs and the fixture-side run-manifest-schema-validate.mjs shim) and alter INPUT only. The hcloud-dry-run-mock probe now consumes the SAME rendered cloud-init file the real path consumes (renderer writes it, both the mock and real path read it) and asserts an ssh public-key line under the deploy user plus a NOPASSWD directive naming that user (REQ-145 / AC-14501-1). Report envelopes under .rcf/reports/blueprints/deploy-hetzner-server/ regenerated from the real run.
 
-Chain: HQ hardening block H-1 REQ-145..149 / TS-175..179 / FBS-165..169 / CN-510..519 per HQ chain-block ruling 2026-09-08. Real run under Baz one-off approval 2026-09-08: yes, one-off for round 7 gates; Ensure that after any testing etc the Hertner account leaves NO orphaned resources behind. Leave it in the state it started in.
+Chain: the operator estate hardening block covering REQ-145..149 / TS-175..179 / FBS-165..169 / CN-510..519 per the operator estate chain-block ruling 2026-09-08. Real run under the project maintainer one-off approval 2026-09-08: yes, one-off for round 7 gates; Ensure that after any testing etc the Hertner account leaves NO orphaned resources behind. Leave it in the state it started in.
 
-Defect (8) T-2 and T-3 stub drivers are OUT of scope for H-1 (H-2 owns them).
+Defect (8) container-host and edge-tunnel stub drivers are OUT of scope for the round-7 real-account gate pass (the review train owns them).
 
 # deploy-hetzner-server changelog
 
@@ -47,9 +61,11 @@ paired with a mutation switch that flips the probe to FAIL), plus
 without `CI_HAS_HETZNER_ACCOUNT`).
 
 Mints the shared `hetzner-throwaway-server` fixture under
-`packages/rcf-lite/test/fixtures/` (round-7 T-2 and T-3 EXTEND it,
+`packages/rcf-lite/test/fixtures/` (`platform-docker-compose-host` and `edge-cloudflare-tunnel` EXTEND it,
 they do not ship a second copy).
 
 Trace: hetzner-round-7-spec-2026-09-07.md section 5.1;
-Baz ruling 2026-09-07 09:50Z (decisions 18 through 24 approved as
+maintainer ruling 2026-09-07 09:50Z (decisions 18 through 24 approved as
 recommended, "round 7 - agreee to all").
+
+Review-fix (2026-09-09): Adds three option-binding ACs to close section 7c on the elicits catalogue - provisioning-tool raw-api (AC-37101-5), server-type SKU enum (AC-37103-4 naming every shipped SKU), location enum (AC-37103-5 naming every shipped datacentre). Adds deliveredBy on REQ-003, REQ-005, REQ-006. Sweeps vendorCitation onto fixed ACs resting on vendor facts (AC-37101-2, AC-37105-1, AC-37108-1, AC-37108-2, AC-37108-3).

package/blueprints/deploy-hetzner-server/README.md

@@ -45,7 +45,7 @@ Four ADRs record the load-bearing decisions:
   https://docs.hetzner.com/cloud/servers/backups-snapshots/overview.
 - `ADR-3803` provisioning tool: `hcloud` default, `raw-api`
   alternative, Terraform rejected on second toolchain and state file
-  grounds per Baz ruling 2026-09-07.
+  grounds per maintainer ruling 2026-09-07.
 - `ADR-3804` hardening baseline: the six blocks named below.
 
 ## Two provisioner paths: hcloud and raw-api
@@ -85,7 +85,7 @@ FAILS naming the missing line.
 |---|---|---|
 | `provisioning-tool` | `hcloud`, `raw-api` | `hcloud` (ADR-3803) |
 | `server-type` | `cx23`, `cx33`, `cx43`, `cpx11`..`cpx41`, `cax11`..`cax31` | `cx23` |
-| `location` | `fsn1`, `nbg1`, `hel1`, `ash`, `hil` | `fsn1` (Baz ruling 2026-09-07 09:50Z) |
+| `location` | `fsn1`, `nbg1`, `hel1`, `ash`, `hil` | `fsn1` (maintainer ruling 2026-09-07 09:50Z) |
 | `image` | any Hetzner image slug | `ubuntu-24.04` |
 | `ssh-source-prefixes` | CSV of CIDR ranges | `203.0.113.0/24` (example only; supply the real prefix set) |
 | `firewall-id` | existing firewall id or empty | empty (create from `firewallRules`) |
@@ -149,11 +149,11 @@ Every probe writes its report envelope to
 
 ## Shared throwaway-server fixture
 
-The one new pattern this round. Lives at
+The blueprint ships one new pattern. It lives at
 `packages/rcf-lite/test/fixtures/hetzner-throwaway-server/`; ships
 `provision.mjs`, `destroy.mjs`, `sweep-orphans.mjs`, the mocked hcloud
-shim and the manifest at `hetzner/servers/ci-throwaway.json`. T-2
-(`platform-docker-compose-host`) and T-3 (`edge-cloudflare-tunnel`)
+shim and the manifest at `hetzner/servers/ci-throwaway.json`. Sibling
+`platform-docker-compose-host` and `edge-cloudflare-tunnel` blueprints
 EXTEND the fixture rather than shipping a second copy. Cost ceiling:
 one `cx23` at approximately EUR 0.006/hour per run; destroy runs in
 `always()`; the nightly `sweep-orphans` cron collects any leak with a
@@ -172,13 +172,13 @@ cannot host.
 
 ## Consumers
 
-- ops-01 is the first HQ consumer (`w-2026-09-07-dave-004` migration).
-- Round-7 T-2 `platform-docker-compose-host` composes on
+- ops-host is the first infrastructure consumer (migration path).
+- Round-7 `platform-docker-compose-host` composes on
   `capabilities: [cloudHost]`.
-- Round-7 T-3 `edge-cloudflare-tunnel` composes on `cloudHost` (via
-  the systemd unit shape) or on `containerHost` (via T-2).
+- Round-7 `edge-cloudflare-tunnel` composes on `cloudHost` (via
+  the systemd unit shape) or on `containerHost` (via `platform-docker-compose-host`).
 
-Blueprint acceptance never depends on the ops-01 migration.
+Blueprint acceptance never depends on the ops-host migration.
 
 ## Standards trace
 
@@ -197,6 +197,6 @@ Blueprint acceptance never depends on the ops-01 migration.
 ## Rejected alternatives
 
 - Terraform. Adds a second toolchain and a state file that nobody in
-  the estate needs. Baz ruling 2026-09-07 09:50Z on decision 18.
-- A Load Balancer blueprint. Out of scope for round-7 T-1; may ship as
+  the estate needs. maintainer ruling 2026-09-07 09:50Z.
+- A Load Balancer blueprint. Out of scope for round-7; may ship as
   a follow-up if a second Hetzner consumer needs it.

package/blueprints/deploy-hetzner-server/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "deploy-hetzner-server",
-  "version": "1.0.1",
+  "version": "1.1.2",
   "category": "deploy",
   "capabilities": [
     "cloudHost"
@@ -46,7 +46,7 @@
     },
     {
       "id": "location",
-      "prompt": "Hetzner data centre. fsn1 (Falkenstein) is the shipped default per Baz ruling 2026-09-07 09:50Z on the Q2 ratification.",
+      "prompt": "Hetzner data centre. fsn1 (Falkenstein) is the shipped default per maintainer ruling 2026-09-07 09:50Z on the Q2 ratification.",
       "kind": "enum",
       "options": [
         "fsn1",

package/blueprints/deploy-hetzner-server/contributions/adrs/adr-3801-deploy-hetzner-server-cloud-host-contract.json

@@ -5,9 +5,9 @@
   "version": "1.0.0",
   "status": "accepted",
   "title": "Cloud host contract: Hetzner Cloud VM as the shipped cloudHost shape (scope global, new topic linuxCloudHostContract)",
-  "context": "An applying project needs a first-class Linux VM contract that container-orchestration and edge-ingress consumers (round-7 T-2 platform-docker-compose-host, T-3 edge-cloudflare-tunnel) can compose on. Hetzner Cloud servers plus cloud-init user-data provide the v1.0.0 shape per https://docs.hetzner.cloud/ and https://docs.hetzner.com/cloud/servers/overview. Every applied cloud host needs one project-wide answer to the linuxCloudHostContract topic; a future non-Hetzner sibling (Vultr, DigitalOcean, Fly.io) would contribute the same topic string with a different provider, forcing a DELIBERATE conflict the operator resolves per the round-2 conflict pattern.",
+  "context": "An applying project needs a first-class Linux VM contract that container-orchestration and edge-ingress consumers (round-7 platform-docker-compose-host, edge-cloudflare-tunnel) can compose on. Hetzner Cloud servers plus cloud-init user-data provide the v1.0.0 shape per https://docs.hetzner.cloud/ and https://docs.hetzner.com/cloud/servers/overview. Every applied cloud host needs one project-wide answer to the linuxCloudHostContract topic; a future non-Hetzner sibling (Vultr, DigitalOcean, Fly.io) would contribute the same topic string with a different provider, forcing a DELIBERATE conflict the operator resolves per the round-2 conflict pattern.",
   "decision": "The shipped v1.0.0 default is a Hetzner Cloud server as the linuxCloudHostContract provider. The provisioner reads its shape from the applying manifest at hetzner/servers/name.json (TAC-3802) and creates a matching live server via hcloud CLI verbs (ADR-3803) or the raw Hetzner Cloud API. The linuxCloudHostContract topic scope is global on this blueprint; the topic string is linuxCloudHostContract (lower camelCase, one concept per topic, no version suffix, per the round-2 rules-for-new-topics clause on the shelf registry). Standards trace clause: Hetzner Cloud API server resource and cloud-init user-data contract per hetzner-round-7-spec-2026-09-07.md.",
-  "consequences": "Consumer blueprints that run on a Linux host declare capabilities: [cloudHost] on their applied contract; the round-7 T-2 platform-docker-compose-host reads this capability at apply-time. Rebuild-from-manifest is always possible: the manifest is the source of truth, the live server is derivative. Drift from the shipped manifest to the live server is out of scope for v1.0.0; a later minor may add a drift-audit runner.",
+  "consequences": "Consumer blueprints that run on a Linux host declare capabilities: [cloudHost] on their applied contract; the sibling platform-docker-compose-host blueprint reads this capability at apply-time. Rebuild-from-manifest is always possible: the manifest is the source of truth, the live server is derivative. Drift from the shipped manifest to the live server is out of scope for v1.0.0; a later minor may add a drift-audit runner.",
   "alternativesConsidered": [],
   "createdAt": "2026-09-08T00:00:00.000Z",
   "updatedAt": "2026-09-08T00:00:00.000Z"

package/blueprints/deploy-hetzner-server/contributions/adrs/adr-3803-deploy-hetzner-server-provisioning-tool.json

@@ -5,14 +5,14 @@
   "version": "1.0.0",
   "status": "accepted",
   "title": "Provisioning tool: hcloud CLI default, raw Hetzner Cloud API alternative, Terraform rejected",
-  "context": "An applying project needs a documented answer to how the provisioner shells out to Hetzner Cloud. Options considered: hcloud CLI (small, self-documenting, JSON output on --output json, per https://github.com/hetznercloud/cli); the raw Hetzner Cloud REST API (no CLI dependency, useful when the target host cannot install a binary, per https://docs.hetzner.cloud/); Terraform (declarative, adds a second toolchain and a state file). Baz ruling 2026-09-07 09:50Z on decision 18 of the round-7 summary: hcloud not Terraform. Terraform adds a second toolchain and a state file that nobody in the estate needs.",
+  "context": "An applying project needs a documented answer to how the provisioner shells out to Hetzner Cloud. Options considered: hcloud CLI (small, self-documenting, JSON output on --output json, per https://github.com/hetznercloud/cli); the raw Hetzner Cloud REST API (no CLI dependency, useful when the target host cannot install a binary, per https://docs.hetzner.cloud/); Terraform (declarative, adds a second toolchain and a state file). maintainer ruling 2026-09-07 09:50Z of the round-7 summary: hcloud not Terraform. Terraform adds a second toolchain and a state file that nobody in the estate needs.",
   "decision": "The shipped v1.0.0 default is the hcloud CLI as the provisioning tool. Alternative elicited: raw-api (the provisioner fetches the Hetzner Cloud REST API directly). Terraform is a rejected alternative recorded in the blueprint README section 9 rejected-alternatives. elicited: true. recommendedDefault: hcloud. Standards trace clause: Hetzner Cloud CLI documented resource verbs per hetzner-round-7-spec-2026-09-07.md.",
   "consequences": "The applying project installs the hcloud binary on the operator laptop and every CI runner that provisions. The raw-api fork sits behind the same provisioner facade so no consumer code diverges. The provisioner-facade sole-reader guarantee holds on both paths.",
   "alternativesConsidered": [
     {
       "id": "terraform",
       "summary": "Terraform declaring the Hetzner resources with the hetznercloud provider.",
-      "rejectedBecause": "Adds a second toolchain and a state file. The state file becomes a new source of truth to reconcile with git and with the live account. Baz ruling 2026-09-07 09:50Z."
+      "rejectedBecause": "Adds a second toolchain and a state file. The state file becomes a new source of truth to reconcile with git and with the live account. maintainer ruling 2026-09-07 09:50Z."
     }
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",

package/blueprints/deploy-hetzner-server/contributions/probes/cloud-init-render-lint.mjs

@@ -13,7 +13,7 @@
 // reader of SIMULATE_HARDENING_DRIFT and it mutates INPUT (the
 // rendered YAML) only; the probe then FAILS naming the missing
 // baseline block per hetzner-round-7-spec-2026-09-07.md section 3.4
-// lesson 4. H-1 (2026-09-08).
+// lesson 4.  (2026-09-08).
 
 import { readFile } from 'node:fs/promises';
 import { resolve } from 'node:path';

package/blueprints/deploy-hetzner-server/contributions/probes/hcloud-dry-run-mock.mjs

@@ -1,9 +1,9 @@
-// Probe: hcloud dry-run mock (v1.0.1 mutation-purified per H-1).
+// Probe: hcloud dry-run mock (v1.0.1 mutation-purified per the round-7 hardening pass).
 //
 // anchorAcId: AC-37101-1 (provisioner facade sole reader + provisionerReady
 // on boot; also covers AC-37109-1 event-secrecy across the lifecycle;
-// also covers AC-14501-1 mock-consumes-rendered-file assertions per H-1
-// hardening block REQ-145).
+// also covers AC-14501-1 mock-consumes-rendered-file assertions per
+// the round-7 hardening block REQ-145).
 // accountBound: false.
 //
 // Drives the provisioner facade with the fixture's ci-throwaway manifest
@@ -14,7 +14,7 @@
 // ssh-ed25519/ssh-rsa public-key line under the deploy user plus a
 // NOPASSWD directive naming that user). The rendered-file assertion is
 // what stops a mocked probe from passing while the real path fails on
-// the same artefact (H-1 REQ-145 / AC-14501-1).
+// the same artefact (REQ-145 / AC-14501-1).
 //
 // The probe body reads NO process.env.SIMULATE_ switch. Fixture-side
 // mutations live in src/cloud-init-renderer.mjs, src/hcloud-mock.mjs
@@ -33,7 +33,7 @@
 //   - the rendered cloud-init file exists under the fixture's rendered
 //     directory and carries at least one ssh-ed25519 or ssh-rsa
 //     authorized-keys line under the deploy user plus a NOPASSWD
-//     directive naming that user (H-1 REQ-145 / AC-14501-1).
+//     directive naming that user (REQ-145 / AC-14501-1).
 
 import { readFile, access } from 'node:fs/promises';
 import { relative, resolve } from 'node:path';
@@ -62,7 +62,7 @@ export default async function runProbe() {
   const publicKeys = ['ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFakePubKeyForMockedRunHardeningH1 rcf-lite-ci-mock'];
   const { renderedPath, rendered } = await renderCloudInitToFile(manifest, { publicKeys });
 
-  // H-1 REQ-145 / AC-14501-1: assert the rendered file carries an
+  //  REQ-145 / AC-14501-1: assert the rendered file carries an
   // ssh-ed25519 or ssh-rsa line for the deploy user AND a NOPASSWD
   // directive naming that user. This assertion is what breaks the
   // "mock passes while real path fails on the same artefact" class.

package/blueprints/deploy-hetzner-server/contributions/probes/manifest-schema-validate.mjs

@@ -16,7 +16,7 @@
 // SIMULATE_MANIFEST_INVALID and it mutates INPUT (a temp manifest dir
 // pointed at via RCF_FIXTURE_MANIFEST_DIR) only; the probe then FAILS
 // naming the offending field per hetzner-round-7-spec-2026-09-07.md
-// section 3.4 lesson 4. H-1 (2026-09-08).
+// section 3.4 lesson 4.  (2026-09-08).
 
 import { readFile } from 'node:fs/promises';
 import { readManifestFiles, SCHEMA_PATH } from './probe-utils.mjs';

package/blueprints/deploy-hetzner-server/contributions/probes/probe-utils.mjs

@@ -24,7 +24,7 @@ export const FIXTURE_DIR = resolve(
 // Config override, not a mutation switch: the fixture-side shim for
 // manifest-schema-validate may write a mutated copy to a scratch dir
 // and point MANIFEST_DIR at it via RCF_FIXTURE_MANIFEST_DIR so the
-// probe stays SIMULATE-free (H-1 mutation-purity gate row, 2026-09-08).
+// probe stays SIMULATE-free (mutation-purity gate row, 2026-09-08).
 export const MANIFEST_DIR = process.env.RCF_FIXTURE_MANIFEST_DIR
   ? resolve(process.env.RCF_FIXTURE_MANIFEST_DIR)
   : resolve(FIXTURE_DIR, 'hetzner/servers');

package/blueprints/deploy-hetzner-server/contributions/requirements/deploy-hetzner-server-req-001.json

@@ -2,7 +2,7 @@
   "reqId": "deploy-hetzner-server-REQ-001",
   "prdId": "PRD-001",
   "title": "The provisioner facade is the sole reader of the Hetzner API token and opens on boot with provisionerReady",
-  "description": "The applying project reaches the Hetzner Cloud API through a single provisioner facade module that is the ONLY module holding a reference to the HETZNER_ACCOUNT_API_KEY secret (or the elicited project-scoped alternative). The facade wraps typed verbs (createServer, applyFirewall, takeSnapshot, listSnapshots, destroyServer) and, when provisioningTool=hcloud (default), shells to the hcloud CLI with `--output json`; when provisioningTool=raw-api it fetches the equivalent Hetzner Cloud REST endpoints per https://docs.hetzner.cloud/. On process boot the facade opens against the token via a bounded ready-check and emits a provisionerReady lifecycle event on the injected event sink with a metadata-only payload {tool, apiHost}. No other module reads the token; the injected event sink never carries the token or user-data bodies.",
+  "description": "The applying project reaches the Hetzner Cloud API through a single provisioner facade module that is the ONLY module holding a reference to the HETZNER_ACCOUNT_API_KEY secret (or the elicited project-scoped alternative). The facade wraps typed verbs (createServer, applyFirewall, takeSnapshot, listSnapshots, destroyServer) and, when provisioningTool=hcloud (default), shells to the hcloud CLI with `--output json`; when provisioningTool=raw-api it fetches the equivalent Hetzner Cloud REST endpoints per https://docs.hetzner.cloud/. On process boot the facade opens against the token via a bounded ready-check and emits a provisionerReady lifecycle event on the injected event sink with a metadata-only payload {tool, apiHost}. No other module reads the token; the injected event sink never carries the token or user-data bodies. This blueprint declares the cloudHost applied capability at runtime: the provisioner facade is the sole reader of the Hetzner Cloud API token, and any downstream blueprint whose requiresAppliedCapabilities lists cloudHost is satisfied by an applied deploy-hetzner-server pinning the provisioner module against a real account.",
   "category": "functional",
   "domain": "platform",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+    "field": "responsibilities.provisionerReady"
+  }
 }

package/blueprints/deploy-hetzner-server/contributions/requirements/deploy-hetzner-server-req-002.json

@@ -2,7 +2,7 @@
   "reqId": "deploy-hetzner-server-REQ-002",
   "prdId": "PRD-001",
   "title": "The applying project holds server declarations at hetzner/servers/name.json against a shipped JSON Schema",
-  "description": "The applying project holds every server declaration as one JSON document under hetzner/servers/<name>.json, matching a shipped draft-07 JSON Schema at blueprints/deploy-hetzner-server/contributions/schemas/hetzner-server.schema.json. Required fields: name, serverType (cx23, cx33, and other Hetzner shared-cpu shapes), location (fsn1 default per Baz ruling 2026-09-07 09:50Z; also nbg1, hel1, ash, hil), image (ubuntu-24.04 default), sshKeyIds (nonempty array of Hetzner ssh-key references delegated to security-secrets-management), firewallId (an existing firewall or auto-create), networkId (optional private network), cloudInitPath (relative path to the rendered cloud-init user-data), labels (Hetzner tag map that must include role and blueprint), firewallRules (see REQ-004), snapshotCadence (see REQ-005). The schema refuses on missing required fields and on rule-shape violations (see REQ-004).",
+  "description": "The applying project holds every server declaration as one JSON document under hetzner/servers/<name>.json, matching a shipped draft-07 JSON Schema at blueprints/deploy-hetzner-server/contributions/schemas/hetzner-server.schema.json. Required fields: name, serverType (cx23, cx33, and other Hetzner shared-cpu shapes), location (fsn1 default per maintainer ruling 2026-09-07 09:50Z; also nbg1, hel1, ash, hil), image (ubuntu-24.04 default), sshKeyIds (nonempty array of Hetzner ssh-key references delegated to security-secrets-management), firewallId (an existing firewall or auto-create), networkId (optional private network), cloudInitPath (relative path to the rendered cloud-init user-data), labels (Hetzner tag map that must include role and blueprint), firewallRules (see REQ-004), snapshotCadence (see REQ-005). The schema refuses on missing required fields and on rule-shape violations (see REQ-004). The server-type is elicited on the manifest against the shipped Hetzner Cloud shared-vCPU enum: cx23 (shipped default, Intel), cx33, cx43 (more RAM/vCPU for compose stacks over 1 GB RSS), cpx11/cpx21/cpx31/cpx41 (AMD EPYC, faster per vCPU), and cax11/cax21/cax31 (ARM64 shapes for runtimes that publish ARM builds). The ssh-source-prefixes are elicited as a comma-separated CIDR list permitted on port 22; the manifest schema refuses 0.0.0.0/0. The firewall-id is elicited: an existing Hetzner firewall id reused, or empty to have the provisioner create one from firewallRules.",
   "category": "functional",
   "domain": "platform",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-3802-deploy-hetzner-server-manifest-schema",
+    "field": "responsibilities.hetzner-server"
+  }
 }

package/blueprints/deploy-hetzner-server/contributions/requirements/deploy-hetzner-server-req-003.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-3803-deploy-hetzner-server-cloud-init-template",
+    "field": "responsibilities.hardeningBlocks"
+  }
 }

package/blueprints/deploy-hetzner-server/contributions/requirements/deploy-hetzner-server-req-004.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-3804-deploy-hetzner-server-firewall-shape",
+    "field": "responsibilities.firewallRules"
+  }
 }

package/blueprints/deploy-hetzner-server/contributions/requirements/deploy-hetzner-server-req-005.json

@@ -2,7 +2,7 @@
   "reqId": "deploy-hetzner-server-REQ-005",
   "prdId": "PRD-001",
   "title": "Snapshot cadence elicited (weekly default, daily and off alternatives), snapshot-on-demand fires a tagged snapshot",
-  "description": "The applying project elicits a snapshot cadence per ADR-3802 with an enum of weekly (recommended default), daily and off. The value lives on hetzner/servers/name.json as snapshotCadence. When the cadence is non-off, a scheduled snapshot runner in the applying project fires the snapshot verb on the provisioner facade against every server whose cadence matches, and tags each snapshot with the server name and wall-clock time. A snapshot-on-demand verb on the provisioner fires the same shape without a schedule. Under provisioningTool=hcloud the facade shells to hcloud image create-image and tags via hcloud image update; under raw-api it posts to POST /servers/{id}/actions/create_image and PATCH /images/{id}. The hetznerSnapshotTaken lifecycle event carries snapshot id and wall-clock time. Hetzner-managed backups are a separately elicited paid opt-in (approximately 20 percent of monthly server price per https://docs.hetzner.com/cloud/servers/backups-snapshots/overview) and compose with the scheduled snapshot runner.",
+  "description": "The applying project elicits a snapshot cadence per ADR-3802 with an enum of weekly (recommended default), daily and off. The value lives on hetzner/servers/name.json as snapshotCadence. When the cadence is non-off, a scheduled snapshot runner in the applying project fires the snapshot verb on the provisioner facade against every server whose cadence matches, and tags each snapshot with the server name and wall-clock time. A snapshot-on-demand verb on the provisioner fires the same shape without a schedule. Under provisioningTool=hcloud the facade shells to hcloud image create-image and tags via hcloud image update; under raw-api it posts to POST /servers/{id}/actions/create_image and PATCH /images/{id}. The hetznerSnapshotTaken lifecycle event carries snapshot id and wall-clock time. Hetzner-managed backups are a separately elicited paid opt-in (approximately 20 percent of monthly server price per https://docs.hetzner.com/cloud/servers/backups-snapshots/overview) and compose with the scheduled snapshot runner. Hetzner-managed backups are elicited true or false: false is the shipped default (the scheduled snapshot runner carries the recovery-point objective through Hetzner Cloud snapshots); true opts in to Hetzner-managed backups per ADR-3802 (paid, approximately 20 percent of monthly server price).",
   "category": "functional",
   "domain": "platform",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-3802-deploy-hetzner-server-snapshot-cadence",
+    "field": "decision.cadenceEnum"
+  }
 }

package/blueprints/deploy-hetzner-server/contributions/requirements/deploy-hetzner-server-req-006.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+    "field": "responsibilities.lifecycleEvents"
+  }
 }

package/blueprints/deploy-hetzner-server/contributions/schemas/hetzner-server.schema.json

@@ -31,7 +31,7 @@
     "location": {
       "type": "string",
       "enum": ["fsn1", "nbg1", "hel1", "ash", "hil"],
-      "description": "Hetzner data centre location. fsn1 is the shipped default per Baz ruling 2026-09-07 09:50Z on the Q2 ratification."
+      "description": "Hetzner data centre location. fsn1 is the shipped default per maintainer ruling 2026-09-07 09:50Z on the Q2 ratification."
     },
     "image": {
       "type": "string",

package/blueprints/deploy-hetzner-server/contributions/templates/cloud-init.yaml.tmpl

@@ -89,7 +89,7 @@ write_files:
 # Breaks: iptables-persistent), so we DO NOT install it; the DOCKER-USER
 # chain is loaded in runcmd via iptables directly (block 4 stays valid
 # for the running boot; reboot-persistence for the chain is a follow-up
-# item outside the H-1 hardening scope).
+# item outside the round-7 hardening scope).
 packages:
   - ufw
   - fail2ban

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37101.json

@@ -13,12 +13,73 @@
       "id": "AC-37101-1",
       "description": "On process boot the provisioner facade opens against the token, and (a) only the provisioner module reads HETZNER_ACCOUNT_API_KEY (grep across the fixture source refuses any other reader), (b) provisionerReady fires on the injected event sink with a payload of exactly {tool, apiHost}.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-37101-2",
+      "description": "Credential missing. Given HETZNER_ACCOUNT_API_KEY unset in the applied secrets facade, when the provisioner facade opens on process boot, then the facade refuses with a named error kind (missingProvisionerToken), no provisionerReady event fires on the sink, and the error record carries no token substring.",
+      "given": "HETZNER_ACCOUNT_API_KEY unset in the applied secrets facade",
+      "when": "the provisioner opens on process boot",
+      "then": "the facade refuses with the named error kind missingProvisionerToken; no provisionerReady fires; the error record carries no token substring",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://docs.hetzner.cloud/#authentication",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-37101-3",
+      "description": "Dependency not ready. Given the elicited provisioning-tool is hcloud and hcloud is absent from PATH on the process shell, when the provisioner opens on process boot, then the facade refuses with a named error kind (missingProvisionerTool) and no provisionerReady fires.",
+      "given": "provisioning-tool = hcloud and hcloud absent from PATH",
+      "when": "the provisioner opens on process boot",
+      "then": "the facade refuses with the named error kind missingProvisionerTool; no provisionerReady fires",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-37101-4",
+      "description": "Repeat boot idempotency. Given a completed first boot of the provisioner facade, when the process boots a second time against the same token and elicited configuration, then the facade opens again and provisionerReady fires once per boot with the same payload shape ({tool, apiHost}); no accumulator or side-channel state drifts across boots.",
+      "given": "a completed first boot with provisionerReady already fired",
+      "when": "the process boots a second time against the same token and elicited configuration",
+      "then": "the facade opens again; provisionerReady fires once per boot with the same {tool, apiHost} payload shape; no state drifts across boots",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-37101-5",
+      "description": "Provisioning tool raw-api. Given the elicited provisioning-tool answers raw-api, when the provisioner opens on process boot, then the facade constructs a fetch-based HTTP client against https://api.hetzner.cloud/v1 with Bearer HETZNER_ACCOUNT_API_KEY on every request (no hcloud binary invocation; grep across the fixture source refuses any child_process.execFile / spawn of hcloud); the provisionerReady payload carries tool='raw-api' and apiHost='api.hetzner.cloud'; a subsequent createServer verb issues one POST https://api.hetzner.cloud/v1/servers with the JSON body per the Hetzner Cloud API server-create schema.",
+      "given": "provisioning-tool = raw-api",
+      "when": "the provisioner opens on process boot",
+      "then": "the facade uses fetch against api.hetzner.cloud/v1 with Bearer auth; no hcloud spawn; provisionerReady carries tool='raw-api' and apiHost='api.hetzner.cloud'; createServer POSTs /v1/servers with the documented JSON body",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "template"
     }
   ],
   "tacIds": [
     "TAC-3801-deploy-hetzner-server-provisioner"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37102.json

@@ -13,12 +13,45 @@
       "id": "AC-37102-1",
       "description": "manifest-schema-validate.mjs asserts every hetzner/servers/*.json under the shared throwaway-server fixture validates against blueprints/deploy-hetzner-server/contributions/schemas/hetzner-server.schema.json and carries every required field; a mutation SIMULATE_MANIFEST_INVALID=true replaces location with an unknown token and the probe FAILS naming the offending field.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3802-deploy-hetzner-server-manifest-schema",
+        "field": "interfaces.hetzner-server.schema.json"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-37102-2",
+      "description": "Malformed manifest refusal. Given a hetzner/servers/*.json file with a required field missing (for example serverType omitted), when the schema validator runs, then the probe FAILS with a message that names the offending file and the missing required field; the provisioner facade refuses to apply the manifest.",
+      "given": "a hetzner/servers/*.json with a required field omitted",
+      "when": "manifest-schema-validate.mjs runs against the fixture set",
+      "then": "the probe FAILS naming the offending file and the missing required field; the provisioner refuses to apply",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3802-deploy-hetzner-server-manifest-schema",
+        "field": "interfaces.hetzner-server.schema.json"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-37102-3",
+      "description": "Boundary refusal: firewall rule opens ssh to 0.0.0.0/0. Given a manifest whose firewallRules ssh entry carries sourceIps including 0.0.0.0/0, when the schema validator runs, then the probe FAILS naming the ssh rule with the specific 0.0.0.0/0 offence; the provisioner refuses to apply.",
+      "given": "a manifest whose firewallRules ssh entry carries sourceIps including 0.0.0.0/0",
+      "when": "manifest-schema-validate.mjs runs",
+      "then": "the probe FAILS naming the ssh rule and the 0.0.0.0/0 offence; the provisioner refuses to apply",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3804-deploy-hetzner-server-firewall-shape",
+        "field": "interfaces.firewallRules"
+      },
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-3802-deploy-hetzner-server-manifest-schema"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37103.json

@@ -13,7 +13,64 @@
       "id": "AC-37103-1",
       "description": "The real-account-throwaway-server-provision probe (accountBound: true, skipped without CI_HAS_HETZNER_ACCOUNT) applies the ci-throwaway.json manifest via provision.mjs, asserts (a) hcloud server list --output json shows the new server whose id is written to the fixture scratch file, (b) hetznerServerProvisioned fired with id, primaryIpv4, location=fsn1, serverType=cx23; teardown via destroy.mjs runs regardless of probe verdict.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-37103-2",
+      "description": "Provisioner failure surfaces (upstream non-2xx). Given the hetzner API returns a non-2xx response (for example 429 rate-limited on the account) during a createServer call, when provision.mjs runs, then the facade catches the failure, emits provisionerFailed with { verb: \"createServer\", apiStatus, retryable: boolean } on the event sink, no hetznerServerProvisioned fires, and no orphan server survives on the account after the run.",
+      "given": "the hetzner API returns 429 on createServer",
+      "when": "provision.mjs runs the fixture manifest",
+      "then": "the facade emits provisionerFailed with { verb, apiStatus, retryable }; no hetznerServerProvisioned fires; no orphan server survives after the run",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-37103-3",
+      "description": "Repeat-apply idempotency. Given a manifest already applied once and matching a live server on the account, when provision.mjs runs the same manifest a second time, then the facade emits no second hetznerServerProvisioned, the run exits zero, and the live server id remains unchanged; a subsequent destroy tears the single server down.",
+      "given": "a manifest already applied once against a live matching server",
+      "when": "provision.mjs runs the same manifest again",
+      "then": "no second hetznerServerProvisioned fires; the run exits zero; the live server id remains unchanged",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-37103-4",
+      "description": "Server-type elicit accepts every shipped SKU. Given the elicited server-type answers one of { cx23, cx33, cx43, cpx11, cpx21, cpx31, cpx41, cax11, cax21, cax31 }, when the manifest applies, then the createServer call carries `\"server_type\": \"<answer>\"` verbatim in the JSON body (raw-api mode) or `--type <answer>` on the hcloud CLI (hcloud mode) and the hetznerServerProvisioned event's serverType field equals the answer; a value outside the enum refuses at manifest load with an unknownServerType error kind and no createServer call is issued.",
+      "given": "server-type answered one of the ten shipped SKUs",
+      "when": "provision.mjs runs the manifest",
+      "then": "createServer carries the answer verbatim (server_type JSON field or hcloud --type flag); hetznerServerProvisioned.serverType equals the answer; a value outside the enum refuses with unknownServerType and no createServer fires",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-37103-5",
+      "description": "Location elicit accepts every shipped datacentre. Given the elicited location answers one of { fsn1, nbg1, hel1, ash, hil }, when the manifest applies, then the createServer call carries `\"location\": \"<answer>\"` verbatim in the JSON body (raw-api mode) or `--location <answer>` on the hcloud CLI (hcloud mode) and the hetznerServerProvisioned event's location field equals the answer; a value outside the enum refuses at manifest load with an unknownLocation error kind and no createServer call is issued.",
+      "given": "location answered one of the five shipped datacentre codes",
+      "when": "provision.mjs runs the manifest",
+      "then": "createServer carries the answer verbatim (location JSON field or hcloud --location flag); hetznerServerProvisioned.location equals the answer; a value outside the enum refuses with unknownLocation and no createServer fires",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "template"
     }
   ],
   "tacIds": [
@@ -21,5 +78,5 @@
     "TAC-3802-deploy-hetzner-server-manifest-schema"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }