rcf-lite 0.26.0 → 0.27.0

package/blueprints/platform-cloudflare-kv/contributions/user-stories/platform-cloudflare-kv-us-31111.json

@@ -0,0 +1,89 @@
+{
+  "usId": "platform-cloudflare-kv-US-31111",
+  "prdId": "PRD-001",
+  "reqId": "platform-cloudflare-kv-REQ-007",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Pre-ready facade calls queue behind facadeReady; sink events emit in causal per-operation order",
+  "asA": "developer wiring domain code that may issue a get or put before the facade ready-check has resolved",
+  "iWant": "the facade to queue pre-ready calls and drain them in issue-order after ready() resolves, and to emit sink events in the same order the operations completed",
+  "soThat": "no vendor put/get lands on an unbound binding, and a downstream logging companion observes a causal per-key event ordering",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-31111-1",
+      "description": "Two facade.get calls issued BEFORE ready() has resolved settle in issue order after ready() completes. Neither returns a vendor error; both fire kvMiss (empty store) in issue order; a facadeReady event fires before both kvMiss records on the sink.",
+      "given": "a facade instantiated with an in-memory KV driver whose ready-check is artificially delayed by 25ms",
+      "when": "facade.get(\"a\") and facade.get(\"b\") are called synchronously before ready() has resolved",
+      "then": "the calls settle after ready() completes, both return no-value results with source origin, and the sink shows facadeReady, kvMiss(\"a\"), kvMiss(\"b\") in that order",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3201-platform-cloudflare-kv-facade",
+        "field": "responsibilities.facadeReady"
+      }
+    },
+    {
+      "id": "AC-31111-2",
+      "description": "A pre-ready call whose subsequent ready-check throws is rejected with a named error kind (KV_FACADE_NOT_READY) and no sink record is emitted for that call; a subsequent successful facade re-instantiation opens cleanly and the queue does not leak across instances.",
+      "given": "a facade instantiated with a KV driver whose list(limit:1) ready-check throws",
+      "when": "facade.get(\"a\") is called before ready() has resolved",
+      "then": "the call rejects with KV_FACADE_NOT_READY and no sink record is emitted for the failed call",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3201-platform-cloudflare-kv-facade",
+        "field": "responsibilities.facadeReady"
+      }
+    },
+    {
+      "id": "AC-31111-3",
+      "description": "Two facade.put calls issued in order on the same key emit kvWrite records in the same issue order on the sink; interleaved put and get calls on the same key emit kvWrite/kvHit records in the exact interleaving observed on the driver.",
+      "given": "a facade instantiated with an in-memory KV driver and a ready() completed",
+      "when": "facade.put(k, v1), facade.put(k, v2) and facade.get(k) are called in that order",
+      "then": "the sink observes kvWrite(k, v1), kvWrite(k, v2), kvHit(k, v2) in issue order",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3203-platform-cloudflare-kv-event-sink",
+        "field": "responsibilities.whitelist"
+      }
+    },
+    {
+      "id": "AC-31111-4",
+      "description": "Strict FIFO drain: 10 facade.get calls on distinct keys issued BEFORE ready() has resolved drain in exact issue order after ready() completes. The sink records 10 kvMiss records whose keys equal the issue-order sequence exactly (no reorder, no skips). facadeReady precedes every kvMiss.",
+      "given": "a facade with an artificially delayed ready-check and 10 get calls on keys k0..k9",
+      "when": "ready() resolves",
+      "then": "the sink records facadeReady, kvMiss(k0), kvMiss(k1)..kvMiss(k9) in that exact order",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3201-platform-cloudflare-kv-facade",
+        "field": "responsibilities.facadeReady"
+      }
+    },
+    {
+      "id": "AC-31111-5",
+      "description": "Post-ready no queue: after ready() has resolved, a facade.get call invokes the underlying driver directly (no queue). A test that increments a per-call counter on the driver observes counter=1 immediately after the call, not after a next tick.",
+      "given": "a facade after ready() has resolved",
+      "when": "facade.get(k) is called",
+      "then": "the driver counter increments in the same microtask (no queue interposed)",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3201-platform-cloudflare-kv-facade",
+        "field": "responsibilities.facadeReady"
+      }
+    }
+  ],
+  "tacIds": [
+    "TAC-3201-platform-cloudflare-kv-facade",
+    "TAC-3203-platform-cloudflare-kv-event-sink"
+  ],
+  "createdAt": "2026-09-09T20:25:00.000Z",
+  "updatedAt": "2026-09-09T22:00:00.000Z"
+}

package/blueprints/platform-cloudflare-kv/docs/topics.md

@@ -67,7 +67,7 @@ ADR/TAC suffixes for this blueprint use the 3201-3299 block, continuing the shel
 
 - Reuse `keyValueStoreContract` exactly as spelled here when your blueprint holds an opinion on the key-value-store contract at the facade boundary; contribute your own scope:global ADR on that string and let composition surface the pairing.
 - A future non-KV adapter (a Redis-shape store, a strong-consistency Durable Objects cell for a single-owner use case) mints on demand; each claims `keyValueStoreContract` and conflicts by design.
-- Consumer blueprints reading the `keyValueStore` capability declared on `blueprint.json` per section 6a of `blueprint-authoring.md` obtain the facade at apply time via the T-5 visual-round capability-declaration mechanism.
+- Consumer blueprints reading the `keyValueStore` capability declared on `blueprint.json` per section 6a of `blueprint-authoring.md` obtain the facade at apply time via the visual-round capability-declaration mechanism.
 
 ## Deliberate-conflict statement
 

package/blueprints/platform-cloudflare-kv/guide/platform-cloudflare-kv.md

@@ -27,7 +27,7 @@ KV is NOT the shipped answer when:
 - The value is mutated by concurrent writers who each expect their
   write to win in a total order.
 
-Those three cases point at Durable Objects: the round-6 T-3 sibling
+Those three cases point at Durable Objects: the sibling
 `platform-cloudflare-durable-objects` is the shipped answer for
 strong-consistency needs.
 
@@ -58,7 +58,7 @@ project cannot ship a sub-second TTL.
 - Reads dominate writes AND a global staleness ceiling of a few
   seconds is acceptable AND writes come from few writers -> `platform-cloudflare-kv`.
 - Reads mix with writes AND every read must reflect the most recent
-  write AND one key has one authoritative owner -> `platform-cloudflare-durable-objects` (round-6 T-3).
+  write AND one key has one authoritative owner -> `platform-cloudflare-durable-objects`.
 - Row-shaped relational data with SQL semantics ->
   `persistence-data-postgres` or `persistence-data-d1` (via
   `persistenceStore`).

package/blueprints/platform-docker-compose-host/CHANGELOG.md

@@ -1,12 +1,46 @@
 # platform-docker-compose-host CHANGELOG
 
+## 1.1.2 - 2026-09-10
+
+Register patch.
+
+- Neutral register in README fixture-extension prose (F-2).
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 - 2026-09-09
+
+### Added
+
+- `platform-docker-compose-host-REQ-007` (`must`): the Docker Engine installation follows the elicited apt channel (`stable` or `test`) with the installed repository source as the observable oracle. Closes criterion a on the previously unbacked `docker-engine-channel` elicit (F-1).
+- `platform-docker-compose-host-US-38110` traces REQ-007; two ACs (happy-path per-channel installation, refusal on unsupported channel value); each carries `disposition`, and the vendor-fact AC carries `vendorCitation` to the Docker Engine install-on-Ubuntu documentation verified 2026-09-09.
+
+### Changed
+
+- `REQ-001` extended to name the elicited `compose-file-location` alternative (`compose/compose.yaml`) alongside the shipped `repo-root` default; closes criterion a on the previously unbacked alternative branch (F-2).
+- `REQ-003` extended to name every elicited healthcheck kind (`http`, `tcp`, `command`); previously only the `http` shape was named.
+- `REQ-005` extended to name the `reverse-proxy=none` topology explicitly (the lint now refuses ANY proxy service block or reload verb when `none` is elicited); closes criterion a on the previously unbacked `none` branch (F-3).
+- Every existing REQ carries a `deliveredBy` link into a TAC or ADR (six links). Every existing AC carries `disposition`. `rcf define blueprint lint-consistency` reports zero pass-1 and pass-2 findings.
+
+### Added (criterion b completion, second pass 2026-09-09)
+
+- Elicited `healthcheck-timeout-seconds` added to `blueprint.json` (default 30, floor 5, ceiling 300); REQ-003 description extended to name the elicited answer, closing criterion a on the previously-unbacked healthcheck-timeout branch (F-4).
+- Every story on this blueprint now reaches the section 7a AC-set-sufficiency floor. 35 new hand-authored ACs cover the documented failure paths named in the guide and TAC records, per-story range 4-6 (from the 1-2 shipped in the first 1.1.0 pass): US-38101 gains five ACs (network drift closing F-9 first, volume drift closing F-9 second, image drift closing F-9 third, .env drift closing F-9 fourth, compose-file-location branch); US-38102 gains four ACs (SSM integration closing F-10 first, file-based fallback closing F-10 second, wrong-mode secret closing F-10 third, orphan top-level secret); US-38103 gains four ACs (wrong-mode probe closing F-10, orphan-secret probe closing F-10, plaintext in .env, clean-pass baseline); US-38104 gains four ACs (healthcheck-timeout elicit AC closing F-4, tcp kind closing F-6, command kind closing F-6, http kind closing F-6); US-38105 gains three ACs (real-account timeout, teardown discipline, dependency ordering); US-38106 gains three ACs (long-running policy classification closing F-7 first, job policy classification closing F-7 second, missing restart field); US-38107 gains three ACs (Traefik topology closing F-5 first, none topology closing F-5 second, read-only bind-mount); US-38108 gains three ACs (Traefik reload verb closing F-5, none topology no-op, reload window too short); US-38109 gains three ACs (journald marker probe closing F-8 first, loki marker probe closing F-8 second, missing logging block); US-38110 gains three ACs (sources file content, keyring presence, idempotent install). Every new AC carries `disposition`, most carry `ownerRef` into the owning TAC, and vendor-fact ACs carry `vendorCitation` (Docker Engine install, compose healthcheck reference, compose secrets reference, compose logging reference, Caddy docs, Traefik docs, journald docs, Loki docs) with today's verifiedOn date.
+- `rcf define blueprint lint-consistency` still reports zero pass-1 and pass-2 findings. Blueprint stays at v1.1.0 on the same unreleased minor.
+
+### Fixed (review fix pass, 2026-09-09)
+
+- Register sweep: every `blueprint.json` elicit prompt, guide passage, README row, ADR title/context/decision and probe comment on the blueprint has "a platform reverse-proxy decision", "a development host", "an internal ops host", "round-7 tunnel" and "hetzner-round-7-spec-2026-09-07.md" neutralised to concept ("a platform decision", "a common Linux-host baseline that already runs Caddy", "a Cloudflare-tunnel sibling"). CHANGELOG entries keep internal provenance (review F-3).
+
 ## 1.0.0 - 2026-09-08
 
-Initial release. Round-7 T-2 of the Hetzner spec at `projects/blueprint-library/specs/hetzner-round-7-spec-2026-09-07.md`.
+Initial release. Hetzner blueprint per the Hetzner host specification.
 
 - Mints capability `containerHost` and global topic `containerHostContract`.
 - Six REQs, nine USs, four TACs, four ADRs; five Node-only probes.
 - Extends the shared throwaway-Hetzner-server fixture with a minimal compose stack (`compose.yaml`, `caddy/Caddyfile`, `secrets/web-token` file mount, `src/serve.mjs` healthchecked stub) plus five `run-<probe>.mjs` delegate shims.
 - Compose-config-lint carries four mutation switches (`SIMULATE_MISSING_HEALTHCHECK`, `SIMULATE_UNCLASSIFIED_RESTART`, `SIMULATE_UNCLASSIFIED_LOG_DRIVER`, `SIMULATE_EVENT_SECRECY_LEAK`); secrets-as-files-scan carries `SIMULATE_PLAINTEXT_SECRET`; caddyfile-validate carries `SIMULATE_INVALID_CADDYFILE` and runs `caddy validate` via the `caddy:2` container when a local `caddy` binary is not on PATH.
-- Reverse-proxy choice elicited via `reverse-proxy` (caddy default per Baz decision 19; traefik and none alternatives); Coolify rejected verbatim per Baz decision 20; log driver elicited via `log-driver` (journald default; loki opt-in).
-- Consumers: `w-2026-09-07-dave-004` migrates the ops-01 remote-library compose stack onto this contract after 0.25.0 ships; blueprint acceptance never depends on that migration.
+- Reverse-proxy choice elicited via `reverse-proxy` (caddy default per a platform reverse-proxy decision; traefik and none alternatives); Coolify rejected verbatim per a platform reverse-proxy decision; log driver elicited via `log-driver` (journald default; loki opt-in).
+- Consumers: a follow-up work item migrates an internal ops host's remote-library compose stack onto this contract after 0.25.0 ships; blueprint acceptance never depends on that migration.

package/blueprints/platform-docker-compose-host/README.md

@@ -4,7 +4,7 @@ A container-orchestration facade over docker compose running on a Linux `cloudHo
 
 ## What it commits
 
-Six REQs, nine USs, four TACs, four ADRs and five Node-only probes. Round-7 T-2 of the Hetzner spec at `projects/blueprint-library/specs/hetzner-round-7-spec-2026-09-07.md`.
+Six REQs, nine USs, four TACs, four ADRs and five Node-only probes. Ships the containerHostContract topic on top of a cloudHost provider.
 
 | REQ | Contract |
 |---|---|
@@ -26,7 +26,7 @@ Six REQs, nine USs, four TACs, four ADRs and five Node-only probes. Round-7 T-2
 
 ## Elicits (via `elicits[]`)
 
-- `reverse-proxy`: `caddy` (default per Baz decision 19, matches dev-01 and ops-01) | `traefik` (alternative for docker-label auto-discovery) | `none` (alternative for projects fronted only by the round-7 tunnel).
+- `reverse-proxy`: `caddy` (the shipped default, matching a common Linux-host baseline that already runs Caddy) | `traefik` (alternative for docker-label auto-discovery) | `none` (alternative for projects fronted only by a Cloudflare-tunnel sibling).
 - `docker-engine-channel`: `stable` (default) | `test`.
 - `compose-file-location`: `repo-root` (default) | `compose/compose.yaml`.
 - `healthcheck-default-kind`: `http` (default) | `tcp` | `command`.
@@ -35,9 +35,9 @@ Six REQs, nine USs, four TACs, four ADRs and five Node-only probes. Round-7 T-2
 
 ## ADR shape
 
-- ADR-3901 container host contract: scope `global` on new topic `containerHostContract`; standards trace clause `Docker Compose file reference AND Docker Engine install-on-Ubuntu docs per hetzner-round-7-spec-2026-09-07.md`.
-- ADR-3902 reverse proxy: elicited, `caddy` default; standards trace clause `Caddy docs AND Traefik docs per hetzner-round-7-spec-2026-09-07.md`.
-- ADR-3903 reject Coolify: decision quoted verbatim from Baz ruling 20 ("reject; it shadows what the blueprints contract and adds its own DB and UI as a second source of state"); standards trace clause `generic enterprise practice`.
+- ADR-3901 container host contract: scope `global` on new topic `containerHostContract`; standards trace clause `Docker Compose file reference AND Docker Engine install-on-Ubuntu docs`.
+- ADR-3902 reverse proxy: elicited, `caddy` default; standards trace clause `Caddy docs AND Traefik docs`.
+- ADR-3903 reject Coolify: rejected by platform decision ("it shadows what the blueprints contract and adds its own DB and UI as a second source of state"); standards trace clause `generic enterprise practice`.
 - ADR-3904 log driver: elicited, `journald` default; standards trace clause `generic enterprise practice`.
 
 ## Probes
@@ -68,9 +68,9 @@ CI_HAS_HETZNER_ACCOUNT=true HCLOUD_TOKEN=$HETZNER_ACCOUNT_API_KEY node ./run-rea
 
 ## Fixture extension path
 
-Round-7 T-1 (`deploy-hetzner-server`) minted the shared fixture at `packages/rcf-lite/test/fixtures/hetzner-throwaway-server/`. T-2 EXTENDS that fixture, never duplicates it: `compose.yaml`, `caddy/Caddyfile`, `secrets/web-token`, `src/serve.mjs` and five `run-<probe>.mjs` delegate shims land alongside T-1's `provision.mjs`/`destroy.mjs`/`sweep-orphans.mjs`. T-3 (`edge-cloudflare-tunnel`) extends the same fixture further; consumers of that fixture see one folder, one manifest, three tracks worth of runtime.
+The `deploy-hetzner-server` sibling minted the shared fixture at `packages/rcf-lite/test/fixtures/hetzner-throwaway-server/`. This blueprint EXTENDS that fixture, never duplicates it: `compose.yaml`, `caddy/Caddyfile`, `secrets/web-token`, `src/serve.mjs` and five `run-<probe>.mjs` delegate shims land alongside the hetzner blueprint's `provision.mjs`/`destroy.mjs`/`sweep-orphans.mjs`. The `edge-cloudflare-tunnel` sibling extends the same fixture further; consumers of that fixture see one folder, one manifest, three tracks worth of runtime.
 
 ## When to reach for this blueprint
 
-- Any project running a containerised stack on a `cloudHost` (T-1 `deploy-hetzner-server` provides the shipped v1.0.0 provider).
+- Any project running a containerised stack on a `cloudHost` (`deploy-hetzner-server` provides the shipped v1.0.0 provider).
 - Any project that wants secrets as file mounts (not environment literals), healthchecks that gate boot, a checked-in reverse-proxy artefact, and a log driver on the elicited sink.

package/blueprints/platform-docker-compose-host/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "platform-docker-compose-host",
-  "version": "1.0.0",
+  "version": "1.1.2",
   "category": "platform",
   "capabilities": [
     "containerHost"
@@ -18,7 +18,7 @@
   "elicits": [
     {
       "id": "reverse-proxy",
-      "prompt": "Reverse proxy in front of the compose services. caddy is the shipped default per Baz decision 19 (matches dev-01 and ops-01); traefik is the alternative for docker-label auto-discovery; none is the alternative for projects fronted only by the round-7 tunnel.",
+      "prompt": "Reverse proxy in front of the compose services. caddy is the shipped default (a platform decision matching a common Linux-host baseline that already runs Caddy); traefik is the alternative for docker-label auto-discovery; none is the alternative for projects fronted only by a Cloudflare-tunnel sibling.",
       "kind": "enum",
       "options": [
         "caddy",
@@ -58,9 +58,15 @@
       ],
       "default": "http"
     },
+    {
+      "id": "healthcheck-timeout-seconds",
+      "prompt": "Elicited healthcheck timeout in seconds (per REQ-003 the stack is not considered up until every declared service reaches healthy inside this window; docker compose up -d --wait respects the compose healthcheck timeout: field). Default 30, floor 5, ceiling 300.",
+      "kind": "string",
+      "default": "30"
+    },
     {
       "id": "log-driver",
-      "prompt": "Container log driver per ADR-3904. journald is the shipped default matching the Debian 12 and Ubuntu 24.04 baseline T-1 sets up; loki is the opt-in alternative when the project runs Grafana.",
+      "prompt": "Container log driver per ADR-3904. journald is the shipped default matching the Debian 12 and Ubuntu 24.04 baseline the deploy-hetzner-server cloud-init sets up; loki is the opt-in alternative when the project runs Grafana.",
       "kind": "enum",
       "options": [
         "journald",
@@ -106,6 +112,11 @@
       "kind": "req",
       "path": "requirements/platform-docker-compose-host-req-006.json"
     },
+    {
+      "id": "platform-docker-compose-host-REQ-007",
+      "kind": "req",
+      "path": "requirements/platform-docker-compose-host-req-007.json"
+    },
     {
       "id": "platform-docker-compose-host-US-38101",
       "kind": "us",
@@ -151,6 +162,11 @@
       "kind": "us",
       "path": "user-stories/platform-docker-compose-host-us-38109.json"
     },
+    {
+      "id": "platform-docker-compose-host-US-38110",
+      "kind": "us",
+      "path": "user-stories/platform-docker-compose-host-us-38110.json"
+    },
     {
       "id": "TAC-3901-platform-docker-compose-host-compose-layout",
       "kind": "tac",
@@ -179,7 +195,7 @@
       "topic": "containerHostContract",
       "recommendedDefault": true,
       "elicited": false,
-      "standardsTraceClause": "Docker Compose file reference AND Docker Engine install-on-Ubuntu docs per hetzner-round-7-spec-2026-09-07.md"
+      "standardsTraceClause": "Docker Compose file reference AND Docker Engine install-on-Ubuntu docs"
     },
     {
       "id": "ADR-3902-platform-docker-compose-host-reverse-proxy",
@@ -187,7 +203,7 @@
       "path": "adrs/adr-3902-platform-docker-compose-host-reverse-proxy.json",
       "recommendedDefault": true,
       "elicited": true,
-      "standardsTraceClause": "Caddy docs AND Traefik docs per hetzner-round-7-spec-2026-09-07.md"
+      "standardsTraceClause": "Caddy docs AND Traefik docs"
     },
     {
       "id": "ADR-3903-platform-docker-compose-host-reject-coolify",
@@ -205,5 +221,6 @@
       "elicited": true,
       "standardsTraceClause": "generic enterprise practice"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-10T00:00:00.000Z"
 }

package/blueprints/platform-docker-compose-host/contributions/adrs/adr-3901-platform-docker-compose-host-contract.json

@@ -5,9 +5,9 @@
   "version": "1.0.0",
   "status": "accepted",
   "title": "Container host contract: docker compose as source of truth on a cloudHost (scope global, new topic containerHostContract)",
-  "context": "An applying project running its stack on a Linux cloudHost needs one shipped contract for how services are declared, wired and brought up on a container-orchestration surface. Round-7 T-2 mints the containerHostContract topic on this ADR. Docker Compose is the shipped v1.0.0 surface (compose.yaml as source of truth, healthchecks required, secrets as files, restart discipline, reverse-proxy as artefact). Every applied container host needs one project-wide answer to the containerHostContract topic; a future non-compose sibling (Docker Swarm, Nomad) would contribute the same topic string with a different mechanism, forcing a DELIBERATE conflict the operator resolves per the round-2 conflict pattern. Standards trace clause: Docker Compose file reference AND Docker Engine install-on-Ubuntu docs per hetzner-round-7-spec-2026-09-07.md.",
-  "decision": "The shipped v1.0.0 default is docker compose on a cloudHost as the containerHostContract provider. A canonical compose.yaml at the repo root drives docker compose up on the applied cloudHost (T-1 deploy-hetzner-server); healthchecks refuse at docker compose config on missing; secrets are file mounts; restart policies are unless-stopped or on-failure; the reverse-proxy config is a first-class versioned artefact per TAC-3904. The containerHostContract topic scope is global on this blueprint; the topic string is containerHostContract (lower camelCase, one concept per topic, no version suffix, per the round-2 rules-for-new-topics clause on the shelf registry). Standards trace clause: Docker Compose file reference AND Docker Engine install-on-Ubuntu docs per hetzner-round-7-spec-2026-09-07.md.",
-  "consequences": "Consumer blueprints that ship as containers declare capabilities: [containerHost] on their applied contract; the round-7 T-3 edge-cloudflare-tunnel reads this capability at apply-time to choose the compose-service runtime. Rebuild-from-manifest is always possible: the compose file is the source of truth, the running stack is derivative. Compose is famously many right ways; over-specifying alienates a project with a defensible different shape, so v1.0.0 pins the small load-bearing set (healthchecks, secrets-as-files, restart discipline, reverse-proxy-as-artefact) and leaves everything else to project-owned ADRs.",
+  "context": "An applying project running its stack on a Linux cloudHost needs one shipped contract for how services are declared, wired and brought up on a container-orchestration surface. This ADR mints the containerHostContract topic. Docker Compose is the shipped v1.0.0 surface (compose.yaml as source of truth, healthchecks required, secrets as files, restart discipline, reverse-proxy as artefact). Every applied container host needs one project-wide answer to the containerHostContract topic; a future non-compose sibling (Docker Swarm, Nomad) would contribute the same topic string with a different mechanism, forcing a DELIBERATE conflict the operator resolves per the round-2 conflict pattern. Standards trace clause: Docker Compose file reference AND Docker Engine install-on-Ubuntu docs.",
+  "decision": "The shipped v1.0.0 default is docker compose on a cloudHost as the containerHostContract provider. A canonical compose.yaml at the repo root drives docker compose up on the applied cloudHost (via deploy-hetzner-server); healthchecks refuse at docker compose config on missing; secrets are file mounts; restart policies are unless-stopped or on-failure; the reverse-proxy config is a first-class versioned artefact per TAC-3904. The containerHostContract topic scope is global on this blueprint; the topic string is containerHostContract (lower camelCase, one concept per topic, no version suffix, per the round-2 rules-for-new-topics clause on the shelf registry). Standards trace clause: Docker Compose file reference AND Docker Engine install-on-Ubuntu docs.",
+  "consequences": "Consumer blueprints that ship as containers declare capabilities: [containerHost] on their applied contract; the sibling edge-cloudflare-tunnel reads this capability at apply-time to choose the compose-service runtime. Rebuild-from-manifest is always possible: the compose file is the source of truth, the running stack is derivative. Compose is famously many right ways; over-specifying alienates a project with a defensible different shape, so v1.0.0 pins the small load-bearing set (healthchecks, secrets-as-files, restart discipline, reverse-proxy-as-artefact) and leaves everything else to project-owned ADRs.",
   "alternativesConsidered": [],
   "createdAt": "2026-09-08T00:00:00.000Z",
   "updatedAt": "2026-09-08T00:00:00.000Z"

package/blueprints/platform-docker-compose-host/contributions/adrs/adr-3902-platform-docker-compose-host-reverse-proxy.json

@@ -4,10 +4,10 @@
   "tadId": "TAD-001",
   "version": "1.0.0",
   "status": "accepted",
-  "title": "Reverse proxy choice: caddy default (matches dev-01 and ops-01), traefik alternative for docker-label auto-discovery, none for tunnel-fronted projects (elicited)",
-  "context": "Compose stacks need a reverse-proxy for HTTPS termination and hostname-to-service routing. Caddy is the estate baseline (dev-01 and ops-01 already run it per Baz decision 19 on 2026-09-07 09:50Z). Traefik has a docker-label auto-discovery model some projects prefer. Some projects front their stack only with the round-7 tunnel and skip a reverse proxy inside compose.",
-  "decision": "The reverse-proxy choice is elicited via the reverseProxy parameter. The shipped default is caddy per Baz decision 19. The alternatives are traefik (for projects that want docker-label auto-discovery) and none (for projects fronted only by the round-7 tunnel). Standards trace clause: Caddy docs AND Traefik docs per hetzner-round-7-spec-2026-09-07.md.",
-  "consequences": "A project applying reverseProxy=caddy gets the caddy/Caddyfile artefact and the caddy reload verb. A project applying reverseProxy=traefik gets the traefik/traefik.yaml artefact and the Traefik equivalent reload verb; docker-label auto-discovery is a project-side pattern the guide names. A project applying reverseProxy=none omits the reverse-proxy service and must apply edge-cloudflare-tunnel (T-3) so ingress terminates at the CF edge.",
+  "title": "Reverse proxy choice: caddy default (matching a common Linux-host baseline that already runs Caddy), traefik alternative for docker-label auto-discovery, none for tunnel-fronted projects (elicited)",
+  "context": "Compose stacks need a reverse-proxy for HTTPS termination and hostname-to-service routing. Caddy is the shipped default, matching a common Linux-host baseline that already runs it. Traefik has a docker-label auto-discovery model some projects prefer. Some projects front their stack only with the Cloudflare-tunnel sibling and skip a reverse proxy inside compose.",
+  "decision": "The reverse-proxy choice is elicited via the reverseProxy parameter. The shipped default is caddy. The alternatives are traefik (for projects that want docker-label auto-discovery) and none (for projects fronted only by the Cloudflare-tunnel sibling). Standards trace clause: Caddy docs AND Traefik docs.",
+  "consequences": "A project applying reverseProxy=caddy gets the caddy/Caddyfile artefact and the caddy reload verb. A project applying reverseProxy=traefik gets the traefik/traefik.yaml artefact and the Traefik equivalent reload verb; docker-label auto-discovery is a project-side pattern the guide names. A project applying reverseProxy=none omits the reverse-proxy service and must apply the edge-cloudflare-tunnel sibling so ingress terminates at the CF edge.",
   "alternativesConsidered": [],
   "createdAt": "2026-09-08T00:00:00.000Z",
   "updatedAt": "2026-09-08T00:00:00.000Z"

package/blueprints/platform-docker-compose-host/contributions/adrs/adr-3903-platform-docker-compose-host-reject-coolify.json

@@ -4,8 +4,8 @@
   "tadId": "TAD-001",
   "version": "1.0.0",
   "status": "accepted",
-  "title": "Coolify rejected per Baz decision 20 (it shadows what the blueprints contract and adds its own DB and UI as a second source of state)",
-  "context": "Coolify was proposed as a candidate platform-* sibling in the round-7 proposal. It is a self-hosted PaaS with its own database and UI. Baz decision 20 on 2026-09-07 09:50Z ruled Coolify out for round 7.",
+  "title": "Coolify rejected as a platform decision (it shadows what the blueprints contract and adds its own DB and UI as a second source of state)",
+  "context": "Coolify was proposed as a candidate platform-* sibling. It is a self-hosted PaaS with its own database and UI. A platform decision ruled it out for this shelf release.",
   "decision": "reject; it shadows what the blueprints contract and adds its own DB and UI as a second source of state.",
   "consequences": "No platform-coolify-host blueprint is scoped in round 7 and no reserved slot is allocated. A future platform-coolify-host sibling mints on operator demand under a fresh scope PR. The standards trace clause on the contribution entry is generic enterprise practice; no vendor-doc URL is claimed for the reject decision.",
   "alternativesConsidered": [],

package/blueprints/platform-docker-compose-host/contributions/adrs/adr-3904-platform-docker-compose-host-log-driver.json

@@ -5,8 +5,8 @@
   "version": "1.0.0",
   "status": "accepted",
   "title": "Log driver: journald default matching Debian 12 and Ubuntu 24.04 baseline; loki opt-in when the project runs Grafana (elicited)",
-  "context": "Containers write stdout and stderr to a log driver. Debian 12 and Ubuntu 24.04 (the T-1 cloud-init baseline) ship journald. Grafana users on the estate reach for loki as a native sink. A one-choice hard-code loses either journald parity with the OS or loki when the operator runs Grafana.",
-  "decision": "The log driver is elicited via the log-driver parameter. The shipped default is journald matching the Debian 12 and Ubuntu 24.04 baselines T-1 sets up. The alternative is loki, opted into when the applying project runs Grafana. When observability-logging is applied, the compose file wires the elicited driver to that companion. Standards trace clause: generic enterprise practice.",
+  "context": "Containers write stdout and stderr to a log driver. Debian 12 and Ubuntu 24.04 (the deploy-hetzner-server cloud-init baseline) ship journald. Grafana users on the estate reach for loki as a native sink. A one-choice hard-code loses either journald parity with the OS or loki when the operator runs Grafana.",
+  "decision": "The log driver is elicited via the log-driver parameter. The shipped default is journald matching the Debian 12 and Ubuntu 24.04 baselines the deploy-hetzner-server cloud-init sets up. The alternative is loki, opted into when the applying project runs Grafana. When observability-logging is applied, the compose file wires the elicited driver to that companion. Standards trace clause: generic enterprise practice.",
   "consequences": "A project applying log-driver=journald gets the systemd-native path; the journald sink is queried via journalctl. A project applying log-driver=loki targets the Grafana loki endpoint; the observability-logging companion supplies the endpoint address. Neither choice adds a runtime npm dependency. The compose-config-lint refuses on any driver value outside the allowed set.",
   "alternativesConsidered": [],
   "createdAt": "2026-09-08T00:00:00.000Z",

package/blueprints/platform-docker-compose-host/contributions/probes/probe-utils.mjs

@@ -13,7 +13,7 @@
 // - real-account-* probes call the fixture's provision.mjs, drive docker
 //   compose over ssh against the throwaway server, and tear down in
 //   always(). Without CI_HAS_HETZNER_ACCOUNT they record accountBoundSkipped:
-//   true and the aggregate flips to pass per hetzner-round-7-spec section 3.5.
+//   true and the aggregate flips to pass per the real-account gate contract, section 3.5.
 
 import { mkdir, writeFile, readFile } from 'node:fs/promises';
 import { dirname, resolve, join } from 'node:path';

package/blueprints/platform-docker-compose-host/contributions/probes/real-account-minimal-stack-up.mjs

@@ -9,7 +9,7 @@
 // asserts every declared service reaches healthy inside the elicited
 // timeout, tears the stack down and destroys the server in always().
 // Without CI_HAS_HETZNER_ACCOUNT the probe records accountBoundSkipped:
-// true and the aggregate flips to pass per hetzner-round-7-spec section 3.5.
+// true and the aggregate flips to pass per the real-account gate contract, section 3.5.
 
 import { runShim, accountBoundSkippedResult } from './probe-utils.mjs';
 
@@ -26,8 +26,7 @@ export default async function runProbe() {
   // Real-account path (not run in this environment; requires a Hetzner
   // token via the fixture's provision.mjs and ssh access to the created
   // server). The full driver lives with the round-close real-account
-  // gate work item; see hetzner-round-7-spec-2026-09-07 section 3.3 and
-  // the T-2 followup w-2026-09-08-dave-001.
+  // gate work item, per the real-account gate contract, section 3.3.
   results.push({
     anchorAcId, verdict: 'warn',
     detail: 'CI_HAS_HETZNER_ACCOUNT is set but the driver is not wired in this environment; run against the throwaway server via the round-close real-account gate',

package/blueprints/platform-docker-compose-host/contributions/probes/real-account-reload-burst.mjs

@@ -3,7 +3,7 @@
 // anchorAcId: AC-composeHost-zeroDowntimeReload.
 // accountBound: true.
 //
-// On the shared throwaway-Hetzner-server fixture with the T-2 compose
+// On the shared throwaway-Hetzner-server fixture with the container-host compose
 // stack running: fires an undici burst against the caddy service while
 // docker compose exec caddy caddy reload runs. Asserts every request
 // returns a 2xx status inside the elicited reload window (10 s default)

package/blueprints/platform-docker-compose-host/contributions/requirements/platform-docker-compose-host-req-001.json

@@ -2,7 +2,7 @@
   "reqId": "platform-docker-compose-host-REQ-001",
   "prdId": "PRD-001",
   "title": "The compose.yaml at the applying repo root is the single-source runtime topology, with service-per-container, named networks and volumes, and .env for non-secret config",
-  "description": "The applying project runs its containerised services from a single compose.yaml at the repo root. Every entry under services: is one image running as one container (service-per-container). Networks and volumes are declared with explicit names under the top-level networks: and volumes: keys. Non-secret configuration values live in a colocated .env file loaded by compose, never inlined into service environment blocks. The container host reads compose.yaml as the topology source of truth and refuses to bring the stack up on layout drift.",
+  "description": "The applying project runs its containerised services from a single compose.yaml at the repo root. Every entry under services: is one image running as one container (service-per-container). Networks and volumes are declared with explicit names under the top-level networks: and volumes: keys. Non-secret configuration values live in a colocated .env file loaded by compose, never inlined into service environment blocks. The container host reads compose.yaml as the topology source of truth and refuses to bring the stack up on layout drift. The compose.yaml location is elicited (compose-file-location): the shipped default is the repo-root path; the alternative compose/compose.yaml is chosen when the project already owns a repo-root compose.yaml for another purpose. Both branches must (must) point docker compose config at the elicited file, and the layout invariants (service-per-container, named networks and volumes, .env-backed non-secret config) hold regardless of which location the elicit resolves. The blueprint declares the containerHost capability token: every downstream blueprint that selects containerHost expects the layout invariants this REQ names.",
   "category": "functional",
   "domain": "platform",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T20:35:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3901-platform-docker-compose-host-compose-layout",
+    "field": "responsibilities.topology"
+  }
 }

package/blueprints/platform-docker-compose-host/contributions/requirements/platform-docker-compose-host-req-002.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T20:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3902-platform-docker-compose-host-secrets-mount",
+    "field": "responsibilities.secrets"
+  }
 }

package/blueprints/platform-docker-compose-host/contributions/requirements/platform-docker-compose-host-req-003.json

@@ -2,7 +2,7 @@
   "reqId": "platform-docker-compose-host-REQ-003",
   "prdId": "PRD-001",
   "title": "Every HTTP-terminating compose service declares a healthcheck; docker compose config refuses on missing",
-  "description": "Every service under services: whose image terminates HTTP declares a healthcheck: block. The compose-config-lint refuses at docker compose config time on any HTTP-terminating service missing the block, naming the service. Healthcheck defaults per service kind are elicited (http default, tcp and command alternatives). The stack is not considered up until every declared service reaches healthy inside the elicited timeout.",
+  "description": "Every service under services: whose image terminates HTTP declares a healthcheck: block. The compose-config-lint refuses at docker compose config time on any HTTP-terminating service missing the block, naming the service. Healthcheck defaults per service kind are elicited (http default, tcp and command alternatives). The stack is not considered up until every declared service reaches healthy inside the elicited timeout (the healthcheck-timeout-seconds answer; default 30, floor 5, ceiling 300). The applied healthcheck kind is elicited per service default (healthcheck-default-kind): http covers the common web service, tcp covers a database or plain socket service (a TCP connect to a named port must (must) succeed inside the healthcheck window), and command lets the operator supply a bespoke test string. Each kind must (must) refuse on a missing block or an invalid target and pass on a bound target within the same docker compose config gate.",
   "category": "functional",
   "domain": "platform",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3903-platform-docker-compose-host-healthcheck-lint",
+    "field": "responsibilities.healthcheck"
+  }
 }

package/blueprints/platform-docker-compose-host/contributions/requirements/platform-docker-compose-host-req-004.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T20:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3903-platform-docker-compose-host-healthcheck-lint",
+    "field": "responsibilities.restart"
+  }
 }

package/blueprints/platform-docker-compose-host/contributions/requirements/platform-docker-compose-host-req-005.json

@@ -2,7 +2,7 @@
   "reqId": "platform-docker-compose-host-REQ-005",
   "prdId": "PRD-001",
   "title": "Zero-downtime reverse-proxy reload via bind-mounted config artefact; verb per proxy; no non-2xx or dropped connection inside the elicited window",
-  "description": "The reverse-proxy config file (caddy/Caddyfile when reverseProxy=caddy, traefik/traefik.yaml when reverseProxy=traefik) is a first-class checked-in artefact. The compose runtime bind-mounts the artefact read-only into the proxy service. The reload verb is docker compose exec caddy caddy reload for Caddy, or the documented Traefik equivalent. During the elicited reload window (10 s default) a client burst against the proxy sees no non-2xx and no dropped connection.",
+  "description": "The reverse-proxy config file (caddy/Caddyfile when reverseProxy=caddy, traefik/traefik.yaml when reverseProxy=traefik) is a first-class checked-in artefact. The compose runtime bind-mounts the artefact read-only into the proxy service. The reload verb is docker compose exec caddy caddy reload for Caddy, or the documented Traefik equivalent. During the elicited reload window (10 s default) a client burst against the proxy sees no non-2xx and no dropped connection. The elicited reverse-proxy=none branch is a legal topology (used when the project is fronted only by an upstream tunnel or an off-host proxy): no reverse-proxy service or config artefact ships, and the compose lint refuses ANY proxy service block or reload verb when none is elicited. In none mode, ingress reaches the compose services directly through the elicited tunnel target and the reload window becomes a no-op. The elicited reload-window-seconds answer bounds the zero-downtime reload gate; the shipped default is 10 seconds.",
   "category": "functional",
   "domain": "platform",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T20:35:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3904-platform-docker-compose-host-reverse-proxy-artefact",
+    "field": "responsibilities.reload"
+  }
 }

package/blueprints/platform-docker-compose-host/contributions/requirements/platform-docker-compose-host-req-006.json

@@ -2,7 +2,7 @@
   "reqId": "platform-docker-compose-host-REQ-006",
   "prdId": "PRD-001",
   "title": "Log shipping to the elicited observability-logging sink: journald default matching Debian 12 and Ubuntu 24.04 baseline; loki opt-in when the project runs Grafana",
-  "description": "Every container writes stdout and stderr through the elicited log driver. Journald is the shipped default matching the Debian 12 and Ubuntu 24.04 baselines T-1 cloud-init sets up. Loki is the opt-in alternative when the applying project runs Grafana. When observability-logging is applied, the compose file wires the elicited driver to that companion. The compose-config-lint asserts every service declares a logging driver whose value is one of journald or loki.",
+  "description": "Every container writes stdout and stderr through the elicited log driver. Journald is the shipped default matching the Debian 12 and Ubuntu 24.04 baselines the deploy-hetzner-server cloud-init sets up. Loki is the opt-in alternative when the applying project runs Grafana. When observability-logging is applied, the compose file wires the elicited driver to that companion. The compose-config-lint asserts every service declares a logging driver whose value is one of journald or loki.",
   "category": "functional",
   "domain": "platform",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T20:00:00.000Z",
+  "deliveredBy": {
+    "adrId": "ADR-3904-platform-docker-compose-host-log-driver",
+    "field": "decision.logDriver"
+  }
 }

package/blueprints/platform-docker-compose-host/contributions/requirements/platform-docker-compose-host-req-007.json

@@ -0,0 +1,22 @@
+{
+  "reqId": "platform-docker-compose-host-REQ-007",
+  "prdId": "PRD-001",
+  "title": "Docker Engine installation follows the elicited apt channel: stable (shipped default) or test (pre-release verification)",
+  "description": "The applying project elicits an apt channel for Docker Engine per the Docker Engine install-on-Ubuntu docs (docker-engine-channel): stable is the shipped default and installs from the stable repository; test is the pre-release channel and installs from the test repository. The installer script MUST (must) resolve the elicited channel into the apt sources entry and the observable installed repository/package source; on any other elicited value the installer refuses with a named error kind. Nightly builds documented separately by the vendor are out of scope for the elicit and are not offered here.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "rationale": "Closes criterion a on the docker-engine-channel elicit (F-1); the previously silent stable/test option now traces through a must-level requirement.",
+  "tags": [
+    "blueprint:platform-docker-compose-host",
+    "category:007-docker-engine-channel"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-09T20:20:00.000Z",
+  "updatedAt": "2026-09-09T20:20:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3901-platform-docker-compose-host-compose-layout",
+    "field": "responsibilities.topology"
+  }
+}