rcf-lite 0.26.0 → 0.27.0

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38101.json

@@ -13,12 +13,83 @@
       "id": "AC-composeHost-topologyValid",
       "description": "The applied compose.yaml at the repo root declares (a) every entry under services: as exactly one image running one container, (b) at least one named network under top-level networks:, (c) at least one named volume under top-level volumes:, and (d) non-secret configuration values are loaded from a colocated .env file rather than inlined as service environment entries.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-38101-2",
+      "description": "F-9 layout-drift network removed: SIMULATE_LAYOUT_DRIFT_NETWORK=true strips a service's referenced network out of the top-level networks: block in compose.yaml. The compose-config-lint probe (docker compose config) FAILS naming the network reference and the referring service; the fixture assertion catches \"network <name> is not defined\" in the stderr.",
+      "given": "a fixture compose.yaml with SIMULATE_LAYOUT_DRIFT_NETWORK=true stripping a networks entry",
+      "when": "docker compose config runs",
+      "then": "the compose config command exits non-zero naming the missing network and the referring service",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3901-platform-docker-compose-host-compose-layout",
+        "field": "responsibilities.namedNetworks"
+      }
+    },
+    {
+      "id": "AC-38101-3",
+      "description": "F-9 layout-drift volume removed: SIMULATE_LAYOUT_DRIFT_VOLUME=true strips a service's referenced volume out of the top-level volumes: block. docker compose config exits non-zero naming the missing volume and the referring service.",
+      "given": "a fixture compose.yaml with SIMULATE_LAYOUT_DRIFT_VOLUME=true stripping a volumes entry",
+      "when": "docker compose config runs",
+      "then": "compose config exits non-zero naming the missing volume and referring service",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3901-platform-docker-compose-host-compose-layout",
+        "field": "responsibilities.namedVolumes"
+      }
+    },
+    {
+      "id": "AC-38101-4",
+      "description": "F-9 layout-drift image absent: SIMULATE_LAYOUT_DRIFT_IMAGE=true removes the image field from a service. docker compose config exits non-zero naming the service (compose refuses a service without an image or build directive).",
+      "given": "a fixture compose.yaml with SIMULATE_LAYOUT_DRIFT_IMAGE=true removing the image field",
+      "when": "docker compose config runs",
+      "then": "compose config exits non-zero naming the service",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3901-platform-docker-compose-host-compose-layout",
+        "field": "responsibilities.servicePerContainer"
+      }
+    },
+    {
+      "id": "AC-38101-5",
+      "description": "F-9 layout-drift .env removed: SIMULATE_LAYOUT_DRIFT_ENV=true removes the .env file colocated with compose.yaml. A shell probe asserts either (a) the .env file is present in the fixture directory, OR (b) if absent, no service references an env_file directive that points at it; the additional assertion refuses on a compose.yaml that references .env when the file is absent.",
+      "given": "a fixture with SIMULATE_LAYOUT_DRIFT_ENV=true removing the .env file",
+      "when": "the fixture assertion runs",
+      "then": "the assertion FAILS naming the missing .env when a service references it via env_file",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3901-platform-docker-compose-host-compose-layout",
+        "field": "responsibilities.dotenv"
+      }
+    },
+    {
+      "id": "AC-38101-6",
+      "description": "Compose file location: with elicited compose-file-location=repo-root, the applied compose.yaml lives at <repo>/compose.yaml; a fixture assertion greps the applied tree and refuses if the file is anywhere else. With compose-file-location=compose/compose.yaml, the file lives at <repo>/compose/compose.yaml; the assertion mirrors the check.",
+      "given": "an applied fixture with a chosen compose-file-location value",
+      "when": "the location assertion runs",
+      "then": "the compose.yaml lives at exactly the elicited location and nowhere else",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3901-platform-docker-compose-host-compose-layout",
+        "field": "responsibilities.composeFileLocation"
+      }
     }
   ],
   "tacIds": [
     "TAC-3901-platform-docker-compose-host-compose-layout"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38102.json

@@ -13,12 +13,77 @@
       "id": "AC-composeHost-secretShape",
       "description": "The applied compose.yaml declares at least one secret under the top-level secrets: key with a file: source and references it from the consuming service through the service-level secrets: array. The mounted secret file lands at mode 0o400 inside the container.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-38102-2",
+      "description": "F-10 security-secrets-management integration: when the applied project has security-secrets-management applied (per the companion), a top-level secret's file: source resolves through the companion's vault-fetch script rather than a plain file path. A fixture with SIMULATE_SSM_APPLIED=true rewrites the source to a script call and asserts the mounted content still lands at 0o400 inside the container.",
+      "given": "a fixture with SIMULATE_SSM_APPLIED=true routing the secret file source through the companion",
+      "when": "the mount is observed inside the container",
+      "then": "the file at /run/secrets/<name> has content and mode 0o400",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3902-platform-docker-compose-host-secrets-mount",
+        "field": "responsibilities.ssmIntegration"
+      },
+      "vendorCitation": {
+        "url": "https://docs.docker.com/compose/how-tos/use-secrets/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-38102-3",
+      "description": "F-10 file-based fallback: when security-secrets-management is NOT applied, the fallback path lands the secret in secrets/<name> under the applying repo with a .gitignore line naming the file. A fixture assertion greps .gitignore for \"secrets/<name>\" and asserts the entry is present; SIMULATE_SECRETS_UNIGNORED=true removes the .gitignore line and the assertion FAILS naming the unignored file.",
+      "given": "a fixture without SSM applied, with a secret at secrets/<name>",
+      "when": "the .gitignore assertion runs",
+      "then": "the .gitignore contains a line matching \"secrets/<name>\"; SIMULATE_SECRETS_UNIGNORED=true trips the assertion",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3902-platform-docker-compose-host-secrets-mount",
+        "field": "responsibilities.fallback"
+      }
+    },
+    {
+      "id": "AC-38102-4",
+      "description": "F-10 wrong mode: SIMULATE_WRONG_MODE_SECRET=true mounts the secret with mode: 0o644 in the service-level secrets: block (a compose-supported permissions override). The compose-config-lint probe FAILS naming the service and the wrong mode; the lint asserts every mounted secret carries mode 0o400 or the compose default (which resolves to 0o400).",
+      "given": "a fixture with SIMULATE_WRONG_MODE_SECRET=true setting mode: 0o644 on a service-mounted secret",
+      "when": "the compose-config-lint probe runs",
+      "then": "the lint FAILS naming the service and the disallowed mode",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3902-platform-docker-compose-host-secrets-mount",
+        "field": "responsibilities.mountMode"
+      },
+      "vendorCitation": {
+        "url": "https://docs.docker.com/compose/how-tos/use-secrets/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-38102-5",
+      "description": "Unreferenced top-level secret: a top-level secrets: block whose entry no service references is a defect (an orphan secret file that lands nowhere). The compose-config-lint FAILS naming the orphan secret; SIMULATE_ORPHAN_SECRET=true adds an entry no service consumes and the lint catches it.",
+      "given": "a fixture with SIMULATE_ORPHAN_SECRET=true adding an unreferenced top-level secret",
+      "when": "the lint runs",
+      "then": "the lint FAILS naming the orphan secret",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3902-platform-docker-compose-host-secrets-mount",
+        "field": "responsibilities.serviceReference"
+      }
     }
   ],
   "tacIds": [
     "TAC-3902-platform-docker-compose-host-secrets-mount"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38103.json

@@ -13,12 +13,69 @@
       "id": "AC-composeHost-secretsAreFiles",
       "description": "The secrets-as-files-scan probe walks compose.yaml plus every referenced service config file in the applied fixture and asserts (a) no line contains the applied plaintext token pattern (literal name plus literal value), (b) every declared secret in the compose secrets: key has a file: source, and (c) SIMULATE_PLAINTEXT_SECRET=true writes a plaintext literal into compose.yaml and the probe FAILS naming the file and the literal.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-38103-2",
+      "description": "F-10 wrong-mode probe: SIMULATE_WRONG_MODE_SECRET=true sets the service-level secrets mode to 0o644. The secrets-as-files-scan probe FAILS naming the service and the mode value; the probe pattern matches the compose mode: field in the service secrets block.",
+      "given": "a fixture with SIMULATE_WRONG_MODE_SECRET=true",
+      "when": "the probe runs",
+      "then": "aggregateVerdict is \"fail\" naming the service and the disallowed mode",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3902-platform-docker-compose-host-secrets-mount",
+        "field": "responsibilities.mountMode"
+      }
+    },
+    {
+      "id": "AC-38103-3",
+      "description": "F-10 orphan-secret probe: SIMULATE_ORPHAN_SECRET=true adds a top-level secret entry no service references. The secrets-as-files-scan probe FAILS naming the orphan secret; the probe walks the compose service list and matches every top-level secret against a service-level secrets: array entry.",
+      "given": "a fixture with SIMULATE_ORPHAN_SECRET=true",
+      "when": "the probe runs",
+      "then": "aggregateVerdict is \"fail\" naming the orphan secret",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3902-platform-docker-compose-host-secrets-mount",
+        "field": "responsibilities.serviceReference"
+      }
+    },
+    {
+      "id": "AC-38103-4",
+      "description": "Plaintext secret in .env: SIMULATE_PLAINTEXT_SECRET_IN_ENV=true writes a token literal (e.g. HCLOUD_TOKEN=... with a real-shaped value) into .env; the secrets-as-files-scan probe walks compose.yaml AND .env AND every referenced service config, and FAILS naming the .env file and the line number carrying the token pattern.",
+      "given": "a fixture with SIMULATE_PLAINTEXT_SECRET_IN_ENV=true writing a token into .env",
+      "when": "the probe runs",
+      "then": "aggregateVerdict is \"fail\" naming .env and the line with the token pattern",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3902-platform-docker-compose-host-secrets-mount",
+        "field": "responsibilities.grepRefuse"
+      }
+    },
+    {
+      "id": "AC-38103-5",
+      "description": "Clean fixture passes with zero findings: the shipped cf fixture (no SIMULATE_* flags) passes the secrets-as-files-scan with zero findings; the probe report aggregates to pass and lists the files scanned (compose.yaml plus every service-referenced config).",
+      "given": "the shipped fixture with no simulate switches",
+      "when": "the probe runs",
+      "then": "aggregateVerdict is \"pass\" with zero findings and the scanned-files list",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3902-platform-docker-compose-host-secrets-mount",
+        "field": "responsibilities.grepRefuse"
+      }
     }
   ],
   "tacIds": [
     "TAC-3902-platform-docker-compose-host-secrets-mount"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38104.json

@@ -13,12 +13,85 @@
       "id": "AC-composeHost-healthcheckLint",
       "description": "The compose-config-lint probe shells to docker compose config against the applied compose.yaml, asserts exit 0, and additionally asserts every HTTP-terminating service declares a healthcheck: block. SIMULATE_MISSING_HEALTHCHECK=true strips the block from the web service and the probe FAILS naming the service.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-38104-2",
+      "description": "F-4 healthcheck-timeout-seconds elicit: with the elicited answer set to 45 (default 30, floor 5, ceiling 300), the applied compose.yaml healthcheck: block on every HTTP-terminating service carries timeout: 45s. The compose-config-lint asserts (a) every healthcheck: block declares a timeout field, (b) the value equals the elicited answer with the \"s\" suffix, and (c) SIMULATE_MISSING_TIMEOUT=true strips the timeout field from the web service and the lint FAILS naming the service.",
+      "given": "an applied fixture with healthcheck-timeout-seconds=45",
+      "when": "the compose-config-lint runs and SIMULATE_MISSING_TIMEOUT=true trips",
+      "then": "the shipped path shows timeout: 45s on every healthcheck block; the mutation FAILS naming the web service",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3903-platform-docker-compose-host-healthcheck-lint",
+        "field": "responsibilities.healthcheckTimeout"
+      },
+      "vendorCitation": {
+        "url": "https://docs.docker.com/reference/compose-file/services/#healthcheck",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-38104-3",
+      "description": "F-6 tcp kind: with elicited healthcheck-default-kind=tcp, the applied healthcheck: test field for a database or plain-socket service carries CMD [\"nc\", \"-z\", \"127.0.0.1\", \"<port>\"] where <port> is the service's declared listen port. docker compose config exits 0; SIMULATE_TCP_MISSING_PORT=true omits the port arg and the lint FAILS naming the service.",
+      "given": "an applied fixture with healthcheck-default-kind=tcp",
+      "when": "docker compose config runs and SIMULATE_TCP_MISSING_PORT=true trips",
+      "then": "the shipped path shows CMD [\"nc\", \"-z\", ...]; the mutation FAILS naming the service",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3903-platform-docker-compose-host-healthcheck-lint",
+        "field": "responsibilities.healthcheckKind"
+      },
+      "vendorCitation": {
+        "url": "https://docs.docker.com/reference/compose-file/services/#healthcheck",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-38104-4",
+      "description": "F-6 command kind: with elicited healthcheck-default-kind=command, the applied healthcheck: test field carries a CMD array whose first element is a shell binary (e.g. \"sh\") and whose subsequent elements are the operator-supplied test string. docker compose config exits 0; SIMULATE_COMMAND_EMPTY=true sets an empty command string and the lint FAILS naming the service.",
+      "given": "an applied fixture with healthcheck-default-kind=command and an operator-supplied test string",
+      "when": "docker compose config runs and SIMULATE_COMMAND_EMPTY=true trips",
+      "then": "the shipped path shows the CMD array; the mutation FAILS naming the empty command",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3903-platform-docker-compose-host-healthcheck-lint",
+        "field": "responsibilities.healthcheckKind"
+      },
+      "vendorCitation": {
+        "url": "https://docs.docker.com/reference/compose-file/services/#healthcheck",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-38104-5",
+      "description": "F-6 http kind (default): with elicited healthcheck-default-kind=http (default), the applied healthcheck: test carries CMD [\"wget\", \"--quiet\", \"--spider\", \"http://localhost:<port>/health\"] where <port> is the declared listen port. docker compose config exits 0; SIMULATE_HTTP_MISSING_PATH=true removes the /health path and the lint FAILS naming the service.",
+      "given": "an applied fixture with healthcheck-default-kind=http",
+      "when": "docker compose config runs and SIMULATE_HTTP_MISSING_PATH=true trips",
+      "then": "the shipped path shows CMD [\"wget\",\"--quiet\",\"--spider\",\"http://localhost:<port>/health\"]; the mutation FAILS",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3903-platform-docker-compose-host-healthcheck-lint",
+        "field": "responsibilities.healthcheckKind"
+      },
+      "vendorCitation": {
+        "url": "https://docs.docker.com/reference/compose-file/services/#healthcheck",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-3903-platform-docker-compose-host-healthcheck-lint"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38105.json

@@ -13,7 +13,54 @@
       "id": "AC-composeHost-upClean",
       "description": "The real-account-minimal-stack-up probe, when CI_HAS_HETZNER_ACCOUNT is set, scps the compose.yaml to the throwaway server, runs docker compose up -d --wait, asserts every declared service reaches healthy inside the elicited timeout, and tears the stack plus the server down in always(). Without CI_HAS_HETZNER_ACCOUNT the probe records accountBoundSkipped: true and the aggregate flips to pass.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-38105-2",
+      "description": "Real-account timeout: with docker compose up -d --wait invoked with a timeout that expires before every service reaches healthy, the real-account-minimal-stack-up probe FAILS naming the service that did not reach healthy and quoting the observed docker compose error output. Tear-down still runs in always().",
+      "given": "a real-account probe run against a fixture whose web service delays past the timeout",
+      "when": "docker compose up -d --wait exits with a timeout error",
+      "then": "aggregateVerdict is \"fail\" naming the unhealthy service; the always() block tears the stack down",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3903-platform-docker-compose-host-healthcheck-lint",
+        "field": "responsibilities.healthcheckTimeout"
+      }
+    },
+    {
+      "id": "AC-38105-3",
+      "description": "Teardown discipline: the probe tears down (docker compose down -v AND the throwaway server destroy) inside an always() block that runs whether the assertion passed or failed. A probe test that asserts a fixture failure still leaves zero long-lived resources on the account; a subsequent hcloud server list on the same account returns no leftover throwaway server.",
+      "given": "a real-account probe that fails on the healthcheck assertion",
+      "when": "the probe teardown runs",
+      "then": "docker compose down -v runs and the throwaway server is destroyed; hcloud server list shows no leftover",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3901-platform-docker-compose-host-compose-layout",
+        "field": "responsibilities.teardown"
+      }
+    },
+    {
+      "id": "AC-38105-4",
+      "description": "Dependency ordering: a service with depends_on: <parent>: {condition: service_healthy} waits for the parent healthcheck to reach healthy before compose starts it. The compose-config-lint asserts this shape on the fixture (a \"web\" service depends_on \"db\" with condition service_healthy); SIMULATE_MISSING_DEPENDS_ON=true removes the depends_on and the lint FAILS naming the missing dependency.",
+      "given": "a fixture with a web service depending on a db service under condition service_healthy",
+      "when": "the compose-config-lint runs and SIMULATE_MISSING_DEPENDS_ON=true trips",
+      "then": "the shipped path passes; the mutation FAILS naming the missing dependency",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3903-platform-docker-compose-host-healthcheck-lint",
+        "field": "responsibilities.dependsOn"
+      },
+      "vendorCitation": {
+        "url": "https://docs.docker.com/reference/compose-file/services/#healthcheck",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
@@ -21,5 +68,5 @@
     "TAC-3903-platform-docker-compose-host-healthcheck-lint"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38106.json

@@ -13,12 +13,55 @@
       "id": "AC-composeHost-restartClassification",
       "description": "The compose-config-lint probe asserts every service in the compose.yaml declares a restart policy AND every declared value is one of unless-stopped or on-failure. SIMULATE_UNCLASSIFIED_RESTART=true sets restart: always on the web service and the probe FAILS naming the service and the disallowed value.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-38106-2",
+      "description": "F-7 long-running policy: a service classified kind: long-running (a labels: com.stravica.service-kind: long-running convention on the fixture) must declare restart: unless-stopped. SIMULATE_JOB_POLICY_ON_LONG_RUNNING=true sets restart: on-failure on a long-running service and the compose-config-lint FAILS naming the service and the disallowed pairing.",
+      "given": "a fixture with a long-running service labelled com.stravica.service-kind: long-running",
+      "when": "SIMULATE_JOB_POLICY_ON_LONG_RUNNING=true sets restart: on-failure",
+      "then": "the lint FAILS naming the service and the pairing \"long-running + on-failure\"",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3903-platform-docker-compose-host-healthcheck-lint",
+        "field": "responsibilities.restartClassification"
+      }
+    },
+    {
+      "id": "AC-38106-3",
+      "description": "F-7 job policy: a service classified kind: job must declare restart: on-failure. SIMULATE_LONG_RUNNING_POLICY_ON_JOB=true sets restart: unless-stopped on a job and the lint FAILS naming the service and the disallowed pairing.",
+      "given": "a fixture with a job labelled com.stravica.service-kind: job",
+      "when": "SIMULATE_LONG_RUNNING_POLICY_ON_JOB=true sets restart: unless-stopped",
+      "then": "the lint FAILS naming the service and the pairing \"job + unless-stopped\"",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3903-platform-docker-compose-host-healthcheck-lint",
+        "field": "responsibilities.restartClassification"
+      }
+    },
+    {
+      "id": "AC-38106-4",
+      "description": "Missing restart field: SIMULATE_MISSING_RESTART=true removes the restart field from a service. The compose-config-lint FAILS naming the service; every service must declare a restart policy per REQ-004.",
+      "given": "a fixture with SIMULATE_MISSING_RESTART=true",
+      "when": "the lint runs",
+      "then": "the lint FAILS naming the service with no restart policy",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3903-platform-docker-compose-host-healthcheck-lint",
+        "field": "responsibilities.restartClassification"
+      }
     }
   ],
   "tacIds": [
     "TAC-3903-platform-docker-compose-host-healthcheck-lint"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38107.json

@@ -13,12 +13,59 @@
       "id": "AC-composeHost-reverseProxyArtefactValid",
       "description": "The applied fixture ships caddy/Caddyfile under a caddy/ directory, the compose file bind-mounts it read-only into the caddy service, and the caddyfile-validate probe shells to caddy validate against the file (using the caddy:2 container image when a local caddy binary is not on PATH) and asserts exit 0. SIMULATE_INVALID_CADDYFILE=true writes an invalid directive and the probe FAILS naming the line. Skipped when the applied reverseProxy is not caddy.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-38107-2",
+      "description": "F-5 Traefik topology: with reverseProxy=traefik, the applied fixture ships traefik/traefik.yaml bind-mounted read-only into the traefik service. The reverse-proxy validate probe reaches for the traefik binary (a `traefik healthcheck --ping` style check) or the traefik:v3 container; SIMULATE_INVALID_TRAEFIK=true injects an invalid directive and the probe FAILS naming the file and the line number.",
+      "given": "a fixture with reverseProxy=traefik and traefik/traefik.yaml bind-mounted read-only",
+      "when": "the validate probe runs and SIMULATE_INVALID_TRAEFIK=true trips",
+      "then": "the shipped path validates; the mutation FAILS naming the invalid line",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3904-platform-docker-compose-host-reverse-proxy-artefact",
+        "field": "responsibilities.validate"
+      },
+      "vendorCitation": {
+        "url": "https://doc.traefik.io/traefik/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-38107-3",
+      "description": "F-5 none topology: with reverseProxy=none, the applied fixture MUST NOT ship a caddy/ or traefik/ directory. A fixture assertion greps the applied tree and refuses if either directory is present. SIMULATE_CADDY_UNDER_NONE=true adds a caddy/Caddyfile and the assertion FAILS naming the disallowed directory.",
+      "given": "a fixture with reverseProxy=none and SIMULATE_CADDY_UNDER_NONE=true adding caddy/",
+      "when": "the fixture assertion walks the applied tree",
+      "then": "the assertion FAILS naming caddy/ as the disallowed directory under reverseProxy=none",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3904-platform-docker-compose-host-reverse-proxy-artefact",
+        "field": "responsibilities.noneTopology"
+      }
+    },
+    {
+      "id": "AC-38107-4",
+      "description": "Read-only bind-mount: the reverse-proxy config bind-mount in compose.yaml carries the read-only flag (\":ro\" suffix on the volume string, or read_only: true on the long-form). The compose-config-lint asserts the flag; SIMULATE_WRITEABLE_MOUNT=true removes it and the lint FAILS naming the service.",
+      "given": "a fixture with the reverse-proxy config bind-mounted read-only",
+      "when": "the lint runs and SIMULATE_WRITEABLE_MOUNT=true trips",
+      "then": "the shipped path passes; the mutation FAILS naming the writable mount",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3904-platform-docker-compose-host-reverse-proxy-artefact",
+        "field": "responsibilities.readOnlyMount"
+      }
     }
   ],
   "tacIds": [
     "TAC-3904-platform-docker-compose-host-reverse-proxy-artefact"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38108.json

@@ -13,12 +13,59 @@
       "id": "AC-composeHost-zeroDowntimeReload",
       "description": "The real-account-reload-burst probe, when CI_HAS_HETZNER_ACCOUNT is set, runs undici GETs against the proxy service on the throwaway server while docker compose exec caddy caddy reload runs, asserts every request returns a 2xx status inside the elicited window (10 s default), asserts no dropped connection, and tears the stack down in always(). Without CI_HAS_HETZNER_ACCOUNT the probe records accountBoundSkipped: true and the aggregate flips to pass.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-38108-2",
+      "description": "F-5 Traefik reload verb: with reverseProxy=traefik, the reload-burst probe issues the Traefik documented reload verb (docker compose kill -s USR1 traefik) while an undici burst hits the proxy. The probe asserts every request returns 2xx inside the elicited reload-window-seconds. SIMULATE_MISSING_TRAEFIK_KILL=true skips the kill and the probe still asserts no non-2xx (reload without kill is a no-op for Traefik).",
+      "given": "a fixture with reverseProxy=traefik and CI_HAS_HETZNER_ACCOUNT=true",
+      "when": "the probe issues the reload verb and the burst",
+      "then": "every response is 2xx inside the elicited window; the probe passes",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3904-platform-docker-compose-host-reverse-proxy-artefact",
+        "field": "responsibilities.reloadVerb"
+      },
+      "vendorCitation": {
+        "url": "https://doc.traefik.io/traefik/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-38108-3",
+      "description": "F-5 none topology reload is a no-op: with reverseProxy=none, the reload-burst probe records \"reverseProxy=none: not applicable\" and aggregates to pass without attempting a reload. A CI_HAS_HETZNER_ACCOUNT=true run under reverseProxy=none still exits 0 with the \"not applicable\" record.",
+      "given": "a fixture with reverseProxy=none",
+      "when": "the reload-burst probe runs",
+      "then": "the probe records \"not applicable\" and aggregateVerdict is \"pass\"",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3904-platform-docker-compose-host-reverse-proxy-artefact",
+        "field": "responsibilities.noneTopology"
+      }
+    },
+    {
+      "id": "AC-38108-4",
+      "description": "Reload window shorter than reload duration: SIMULATE_SHORT_RELOAD_WINDOW=true sets the elicited reload-window-seconds to 1 (below the actual reload duration on the throwaway server, typically 2-3 seconds). The probe FAILS naming the observed dropped or non-2xx count and the elapsed millis outside the window.",
+      "given": "a fixture with SIMULATE_SHORT_RELOAD_WINDOW=true and a reload-window-seconds=1",
+      "when": "the reload-burst probe runs",
+      "then": "the probe FAILS naming dropped or non-2xx count and the observed elapsed millis",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3904-platform-docker-compose-host-reverse-proxy-artefact",
+        "field": "responsibilities.reloadWindow"
+      }
     }
   ],
   "tacIds": [
     "TAC-3904-platform-docker-compose-host-reverse-proxy-artefact"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }