rcf-lite 0.26.0 → 0.28.0

package/blueprints/deploy-hetzner-server/CHANGELOG.md

@@ -1,6 +1,111 @@
+## 1.1.17 - 2026-09-12
+
+- Event-correlation fixtures now cover BOTH shipped producers (v1.1.17). The existing positive and negative controls in `deploy-hetzner-server-anatomy.test.js` remain built from the field set the first producer emits (`fixtures/hetzner-throwaway-server/provision.mjs` :77-85, the `{event, id, name, primaryIpv4, location, serverType, ts}` field set). A new positive and negative control pair, alongside the existing pair in the same test, is built from the field set the second producer emits (`fixtures/hetzner-throwaway-server/src/provisioner-facade.mjs` :50, :93-100, the `{event, id, primaryIpv4, location, serverType, labels}` field set, with `labels`, without `name` and `ts`); the negative shares the facade shape with a different top-level `id`. Every control calls `walkRecordRow` end to end and the helper correlates on the event body's own `id` field for both shapes.
+- `blueprint.json` bumps to 1.1.17 with the anatomy pin in lockstep; `updatedAt` refreshed. Family records regenerated through the shipped run path with no account variables set so each carries `version: "1.1.17"` and the repository walk validates all six.
+- Colour on E is unchanged: AMBER on **AC-37101-1**, **AC-37102-1**, **AC-37104-1**, **AC-37106-1**, **AC-37107-1**, **AC-37109-1** and **AC-37109-3**; GREEN on every other shipped AC that a real-account probe observes with an identifier of the required shape present in the record's own engine evidence.
+
+## 1.1.16 - 2026-09-12
+
+- Event-correlation fixtures are exact instances of the shipped `hetznerServerProvisioned` event (v1.1.16). The positive and negative controls in `deploy-hetzner-server-anatomy.test.js` are built from the field set one of the shipped producers emits (`fixtures/hetzner-throwaway-server/provision.mjs` :77-85): every field that producer emits, no invented `detail`, nothing omitted. The negative shares the same shape as the positive with a different top-level `id`, and carries the digits of the row's `evidence.serverId` inside the shipped `name` string field the producer really emits. Every control calls `walkRecordRow` end to end. The second shipped producer (`src/provisioner-facade.mjs` :50, :93-100) emits a different field set (with `labels`, without `name` and `ts`); it is not covered at 1.1.16.
+- `blueprint.json` bumps to 1.1.16 with the anatomy pin in lockstep; `updatedAt` refreshed. Family records regenerated through the shipped run path with no account variables set so each carries `version: "1.1.16"` and the repository walk validates all six.
+- Colour on E is unchanged: AMBER on **AC-37101-1**, **AC-37102-1**, **AC-37104-1**, **AC-37106-1**, **AC-37107-1**, **AC-37109-1** and **AC-37109-3**; GREEN on every other shipped AC that a real-account probe observes with an identifier of the required shape present in the record's own engine evidence.
+
+## 1.1.15 - 2026-09-12
+
+- Split record walker: `walkRepositoryRecords(dir, expectedVersion)` and `walkHandOffRecords(dir)` (v1.1.15). Two functions, two tests, no shared bypass. The repository walk (what CI runs) has NO conditional branch tied to any override: every present record under `.rcf/reports/blueprints/deploy-hetzner-server/` MUST carry `version === blueprint.version` and a missing or different version FAILS with the file named. The hand-off walk runs only when `RCF_LITE_RECORDS_DIR` is set, applies every row validator to the operator-side records, and asserts in its own message that those records predate the version writer (they carry no `version` field, and hand-editing a version into a hand-off record is out). There is no `RCF_LITE_EXPECTED_VERSION` variable anywhere.
+- Event correlation uses the field the shipped producer actually emits (v1.1.15). `hetznerServerProvisioned` (and `hetznerServerDestroyed`) events carry the vendor id on the event body's own top-level `id` field (`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/provision.mjs` and `src/provisioner-facade.mjs`); the walker correlates by exact equality against that field on `event === 'hetznerServerProvisioned' | 'hetznerServerDestroyed'` entries only. A substring over the event `name` or `detail` does NOT correlate, and no invented `serverId` field on an event body is consulted (the producer never emits one).
+- Every negative case invokes the operative walker or helper (v1.1.15). Versionless, wrong-version, non-directory, malformed-JSON, empty / non-array / missing results and stub-row cases each build a scratch directory and call `walkRepositoryRecords`; the event-correlation negative builds a synthetic record with a misleading event trail and calls `walkRecordRow` end to end. No duplicated lambdas, no direct `assert.equal` stand-ins.
+- `blueprint.json` bumps to 1.1.15 with the anatomy pin in lockstep; `updatedAt` refreshed. Family records regenerated through the shipped run path with no account variables set so each carries `version: "1.1.15"` and the repository walk validates all six.
+- Colour on E is unchanged: AMBER on **AC-37101-1**, **AC-37102-1**, **AC-37104-1**, **AC-37106-1**, **AC-37107-1**, **AC-37109-1** and **AC-37109-3**; GREEN on every other shipped AC that a real-account probe observes with an identifier of the required shape present in the record's own engine evidence.
+
+## 1.1.13 - 2026-09-12
+
+- Anatomy per-field validators tightened (v1.1.13). The `exitStatus` and `cloudInit.code` fields on `real-account-cloud-init-hardened / AC-37105-1` must each equal exactly 0; `baselineChecks` accepts only `true`, `"pass"` or `"ok"` per entry (boolean `false`, the string `"fail"`, an empty status, a missing id and every other shape FAIL); `postCreateSnapshotIds` and `postTeardownSnapshotIds` reject `NaN`, `Infinity`, `-Infinity`, zero and negative integers alongside every non-vendor-id shape. Identifier presence is checked by shape (`serverId` and `snapshotId` are positive integers or non-empty numeric strings; a Docker `containerId` is 64-hex) and by presence in the record's own engine evidence, not by string echo.
+- Cloud-init both-zero cross-field added (v1.1.13). When both `exitStatus` and `cloudInit` are present in the row's evidence tree, BOTH must be exactly 0. A row that carries `{exitStatus: 0, cloudInit: {code: 137}}` (or the mirror) FAILS - the anyOf letters through on `exitStatus` alone, but the contradictory `cloudInit.code` exposes an unclean run. Rows that carry only one of the two continue to pass on the anyOf as before, so the shipped happy-path record shape is unaffected. A synthetic negative case in `packages/rcf-lite/test/blueprint/deploy-hetzner-server-anatomy.test.js` proves both directions and the accepted `exitStatus === 0 AND cloudInit.code === 0` case.
+- Snapshot inventory cross-field from v1.1.12 stays in force: a passing `real-account-snapshot-on-demand / AC-37108-1` row MUST carry `snapshotId` inside `postCreateSnapshotIds` AND MUST NOT carry it inside `postTeardownSnapshotIds`.
+- Anatomy record walk rejects empty result sets (v1.1.13). A present record whose `results` is absent, not an array, or an empty array FAILS - a record that carries a probeName but no rows attests to nothing. The v1.1.12 malformed-row rejection (evidence / limitation / reason / `notObservableHere.ac` markers) stays in force. `no local records` remains the only permitted early-return, and only when the directory itself has no record files.
+- Anatomy walkers accept an optional records-directory override (v1.1.13): with `RCF_LITE_RECORDS_DIR` set the walker reads `<dir>/deploy-hetzner-server/*.json` instead of the tree default. CI never sets this variable; the operator-side evidence walk uses it.
+- Family records regenerated (v1.1.13). Every shipped probe on this blueprint (`cloud-init-render-lint`, `hcloud-dry-run-mock`, `manifest-schema-validate`, `real-account-cloud-init-hardened`, `real-account-snapshot-on-demand`, `real-account-throwaway-server-provision`) was run through its run-shim with NO account variables set: offline / mock probes wrote `conformanceOnly` rows anchored to their shipped ACs, and each real-account probe wrote its single-variable `accountBoundSkipped` row naming `CI_HAS_HETZNER_ACCOUNT`. Six record files live under `.rcf/reports/blueprints/deploy-hetzner-server/`; every row is one the current probe wrote at the current version and the strict walker validates all of them.
+- Colour on E is unchanged: AMBER on **AC-37101-1**, **AC-37102-1**, **AC-37104-1**, **AC-37106-1**, **AC-37107-1**, **AC-37109-1** and **AC-37109-3**; GREEN on every other shipped AC that a real-account probe observes with an identifier of the required shape present in the record's own engine evidence.
+
+## 1.1.12 - 2026-09-12
+
+- Anatomy per-field validators tightened (v1.1.12) with explicit `NaN`, `Infinity`, `-Infinity` and negative-value negative cases for every numeric field. `exitStatus` must equal exactly 0 (a non-zero exit or a non-integer value FAILS); `cloudInit.code` must equal exactly 0; `baselineChecks` rejects a boolean `false` verdict and the string `"fail"` (only `true`, `"pass"` and `"ok"` are accepted); and `postCreateSnapshotIds` / `postTeardownSnapshotIds` reject `NaN`, `Infinity`, `-Infinity` and negative integers alongside the earlier non-conformant shapes.
+- Snapshot inventory cross-field rule added (v1.1.12): a passing `real-account-snapshot-on-demand / AC-37108-1` row MUST carry `snapshotId` inside `postCreateSnapshotIds` AND MUST NOT carry it inside `postTeardownSnapshotIds`. A synthetic negative case in `packages/rcf-lite/test/blueprint/deploy-hetzner-server-anatomy.test.js` proves both halves fail with the appropriate error.
+- Anatomy record walk no longer skips malformed rows as `stubs` (v1.1.12). Every row of every present local record is validated: a row lacking evidence, a `limitation`, a skip `reason` and a `notObservableHere.ac` marker FAILS. A paired synthetic negative case proves the walker rejects a stub row without touching `.rcf/reports/`. `no local records` remains the only permitted early-return, and only when the directory itself has no record files.
+- Colour on E is unchanged: AMBER on **AC-37101-1**, **AC-37102-1**, **AC-37104-1**, **AC-37106-1**, **AC-37107-1**, **AC-37109-1** and **AC-37109-3**; GREEN on every other shipped AC that a real-account probe observes with an identifier of the required shape present in the record's own engine evidence.
+
+## 1.1.11 - 2026-09-11
+
+- Anatomy applies row-specific value validators (v1.1.11) instead of null/undefined presence checks alone. `real-account-throwaway-server-provision` requires a documentation-range-shaped `primaryIpv4` and a vendor-listed `location`; `real-account-cloud-init-hardened` requires a non-empty `baselineChecks` array whose entries each carry a non-empty `id` and a `verdict`/`status`, and at least one of an integer `exitStatus` or a `cloudInit` object with a numeric `code`; `real-account-snapshot-on-demand` requires a non-empty vendor-id array for `postCreateSnapshotIds` and a vendor-id array (possibly empty, once the snapshot is destroyed) for `postTeardownSnapshotIds`. Empty strings, empty arrays, `false`, `NaN` and malformed values now FAIL; one negative-proof test per validator is added to `packages/rcf-lite/test/blueprint/deploy-hetzner-server-anatomy.test.js`.
+- Unmapped offline / mock probes (`hcloud-dry-run-mock`, `manifest-schema-validate`, `cloud-init-render-lint`) MUST NOT emit `accountBoundSkipped` rows: they have no declared gate variable to skip on, so only `conformanceOnly` rows are permitted. `assertRowsCarry7dShape` now refuses a skip row from any unmapped probe; the change is proved by a paired negative / positive test.
+- Anatomy synthetic fixtures carry unmistakably synthetic vendor-id integers (`424242`, `424243`, `4242424`) and a documentation-range `primaryIpv4` (`198.51.100.10`, RFC 5737 TEST-NET-3). No live-account identifiers appear in branch source.
+- Anatomy walks any records under `.rcf/reports/blueprints/deploy-hetzner-server/`. Every walkable counting row is validated against the per-probe map, and its mapped identifier must appear in the record's own inventory or event trail (`serverId` in `eventTrail` / `postRunInventory` / `postTeardownServerIds` / `teardown`; `snapshotId` in `postCreateSnapshotIds`); when the directory is empty or absent the walk reports `no local records` and passes.
+- Colour on E is unchanged: AMBER on **AC-37101-1**, **AC-37102-1**, **AC-37104-1**, **AC-37106-1**, **AC-37107-1**, **AC-37109-1** and **AC-37109-3**; GREEN on every other shipped AC that a real-account probe observes with a vendor-minted identifier.
+
+## 1.1.10 - 2026-09-11
+
+- Anatomy assertions are now driven by a per-probe requirement map (`PROBE_REQUIREMENTS` in `packages/rcf-lite/test/blueprint/deploy-hetzner-server-anatomy.test.js`). For each counting probe on this blueprint, the map declares the row's required vendor-minted identifier (with a shape check: `serverId` and `snapshotId` are vendor integers or non-empty numeric strings; a Docker `containerId` is a 64-character hex string) plus every required row-specific observation. `real-account-throwaway-server-provision` requires `primaryIpv4` and `location`; `real-account-cloud-init-hardened` requires `baselineChecks` and one of `exitStatus` or `cloudInit` (the live record carries the exit status under `cloudInit.code`); `real-account-snapshot-on-demand` requires `postCreateSnapshotIds` and `postTeardownSnapshotIds`.
+- Observation lookup traverses the whole evidence tree, so a required field nested under (for example) `evidence.cloudInit` or an array entry still counts. Any counting row that misses one of the required fields FAILS; a counting row from an offline or mock probe not declared in the map (`hcloud-dry-run-mock`, `manifest-schema-validate`, `cloud-init-render-lint`) FAILS on the spot - those probes may emit only skip / conformanceOnly / notObservableHere rows. Eight negative-proof tests in the same file demonstrate the failure modes (missing observation, cross-probe combination, non-vendor identifier value, unmapped probe with a counting row, and nested-field deep search).
+- Colour on E is unchanged: AMBER on **AC-37101-1**, **AC-37102-1**, **AC-37104-1**, **AC-37106-1**, **AC-37107-1**, **AC-37109-1** and **AC-37109-3**; GREEN on every other shipped AC that a real-account probe observes with a vendor-minted identifier.
+
+## 1.1.9 - 2026-09-11
+
+- Ruling for this family, final: a counting row is a LIVE row whose identifier is a value the vendor API minted for the row (server id, snapshot id, firewall id, image id, vendor request id, or the 64-hex Docker container id from `docker inspect`) AND whose derived observation is row-specific (per the per-probe observation fields named on the anatomy test). Mock and offline rows carry no vendor-minted identifier by nature and are always `conformanceOnly` de-claims. There is no supplied/echo path for this family: a value the probe supplied is not evidence the engine echoed it back with vendor-minted state.
+- `hcloud-dry-run-mock` rows for AC-37101-1 (sole-reader source scan and provisionerReady shape) and AC-37109-1 (event-secrecy substring scan and payload-key allow-list) are now `conformanceOnly` with `anchorAcId: null` and a `limitation` string beginning with the shipped AC id. Both checks stay on the row as derived context, and the verdict still gates on their outcome. Neither AC has a live observing probe on this blueprint, so both are AMBER on E.
+- Anatomy identifier set (both blueprints) is narrowed to `serverId`, `snapshotId`, `firewallId`, `imageId`, `containerId`, `vendorRequestId`, `requestId`. Generic `id` and `resourceId`, and any `supplied<Name>` / `echoed<Name>` pair, are dropped from the identifier set. The derived-observation set is narrowed to the row-specific fields each counting probe carries (provision: `primaryIpv4`, `location`; cloud-init hardened: `exitStatus` and `baselineChecks`; snapshot on demand: `postCreateSnapshotIds` and `postTeardownSnapshotIds`; minimal-stack-up: `observedNames` / `healthcheckKeys` and `observedSecretModes` / `mode`; reload-burst: `total`, `twoXx`, `drops`, `overlapCount`, `clockDomain`). Generic `observed`, `port`, `protocol`, `direction` fields are dropped.
+- Colour on E: AMBER on **AC-37101-1**, **AC-37102-1**, **AC-37104-1**, **AC-37106-1**, **AC-37107-1**, **AC-37109-1** and **AC-37109-3** (the offline mock and validator rows on this branch are `conformanceOnly` de-claims; no live probe on this blueprint carries a positive observation of these ACs). GREEN on every other shipped AC that a real-account probe observes with a vendor-minted identifier.
+- The mock-purity test title retained for its chain pointer in `packages/rcf-lite/rcf/test-suites/ts-175.json` is left in place; every other anatomy title is a plain descriptive string. Future work covers the ts-175 pointer rework.
+
+## 1.1.8 - 2026-09-11
+
+- Anatomy identifier rule tightened: an identifier is a value the engine or vendor minted (server id, snapshot id, firewall id, image id, engine request id, or the 64-hex Docker container id from `docker inspect`). A sha256 hash the probe itself computes over an artefact it read is NO LONGER accepted as an identifier - it is a derived-by-the-probe checksum, not an engine echo - and `contentSha256` is removed from the identifier set on both anatomy tests. Context/input fields (`expected`, `engineNote`, `event`, `service`, `path`, `source`, event names, manifest names, container names Compose chose) no longer satisfy the derived-observation half either.
+- Offline probes (`manifest-schema-validate`, `cloud-init-render-lint`, `caddyfile-validate`, `compose-config-lint`, `secrets-as-files-scan`) carry no engine-minted identifier by nature: every result row is a `conformanceOnly` de-claim with `anchorAcId: null` and a `limitation` string beginning with a shipped AC id and naming the live probe (or the missing observation) the offline check does not observe. The hash of the artefact the row observed and the validator output stay on the row as derived context.
+- Colour on E remains AMBER on `deploy-hetzner-server` (AC-37109-3 has no live once-per-lifecycle observation on this blueprint) and AMBER on every offline-only AC on `platform-docker-compose-host` where the live observation lives on `real-account-minimal-stack-up` or `real-account-reload-burst`.
+- The mock-purity test title retained for its chain pointer in `packages/rcf-lite/rcf/test-suites/ts-175.json` is left in place; every other anatomy title is a plain descriptive string. Future work covers the ts-175 pointer rework.
+
+## 1.1.7 - 2026-09-11
+
+- Anatomy assertions on both blueprints moved from key-name allow-lists towards a semantic rule: every result row's evidence must carry an engine-minted identifier (a vendor / resource id, engine request id, or a 64-hex Docker container id from `docker inspect`) AND a derived observation (body excerpt, status code, observed mode, engine timestamp, non-zero count, or structured engine-returned object). Event names, file paths, service names, manifest names, resource names the probe chose, and probe inputs are derived context, not identity. Note: at 1.1.7 the anatomy still accepted a probe-computed `contentSha256` as identity on offline validators; 1.1.8 removes that acceptance and 1.1.9 further removes the supplied/echo pair path.
+- `hcloud-dry-run-mock` AC-37101-1 row (offline mock-path) carried `tool` and `apiHost` echoed by the facade on the `provisionerReady` event body as derived context, and the AC-37109-1 lifecycle-scan row carried `serverId` and `snapshotId` from the events being scanned. 1.1.9 reclassifies both AC-37101-1 and AC-37109-1 rows as `conformanceOnly` de-claims (offline mock ids are not vendor-minted).
+- `manifest-schema-validate` and `cloud-init-render-lint` were extended to carry a deterministic sha256 of the manifest or rendered cloud-init on every row as derived context. Note: 1.1.8 reclassifies these rows as `conformanceOnly` (see above); the hash remains on the row as context.
+- `hcloud-dry-run-mock` mock-path rows for `AC-37103-1`, `AC-37108-1` and `AC-37109-3` are `conformanceOnly` with `anchorAcId: null` and a shipped-AC limitation. `AC-37103-1` and `AC-37108-1` are also observed live on `real-account-throwaway-server-provision` and `real-account-snapshot-on-demand` respectively. `AC-37109-3` has no live observing probe on this blueprint; its shipped colour is AMBER until a live once-per-lifecycle observation is added.
+
+## 1.1.6 - 2026-09-11
+
+- `createProvisionerFacade` in `src/provisioner-facade.mjs` now defaults the `token` parameter to `process.env.HETZNER_ACCOUNT_API_KEY`, making the facade module the sole non-comment reader of that operator variable across the fixture `.mjs`/`.js` source. Callers that inject an explicit token override the default; the mock probe still passes a synthetic literal.
+- `hcloud-dry-run-mock` observes BOTH clauses of AC-37101-1 in a SINGLE result row: the source-tree grep confirms exactly one non-comment reader inside `src/provisioner-facade.mjs` (the row FAILS on zero readers, and FAILS on any reader outside that file), and the `provisionerReady` event fires with the metadata-only `{tool, apiHost}` payload; extra keys on the event body also FAIL the row.
+- Mock-path rows that observe the shape of `hetznerServerProvisioned` and `hetznerSnapshotTaken` are `anchorAcId: null`, `conformanceOnly: true`, with a `limitation` string starting with the shipped AC id and naming the live probe that observes the AC. The `hetznerServerDestroyed` mock-path row is `conformanceOnly` on `AC-37109-3` (once-per-lifecycle); no live observing probe is credited on this row, so `deploy-hetzner-server` is AMBER on `AC-37109-3` until a live observation is added. `notObservableHere` is not used on these rows: the ACs are process/live-observable, not shelf-only, so the browser-only marker does not apply.
+- The `hetznerServerDestroyed` mock-path row carries `wallClockTime` and `payloadKeys` in evidence alongside the destroyed id.
+- AC-37109-1 event-secrecy scan carries a payload-key allow-list per event (subset of the REQ-006 named metadata set). A lifecycle event whose payload carries a key outside the allow-list FAILS the row alongside the token / ssh-key / user-data substring scan.
+- `real-account-cloud-init-hardened` FAILS the row when the post-teardown `hcloud server list` call throws.
+- Real-account provision and snapshot probes observe lifecycle events (`hetznerServerProvisioned`, `hetznerSnapshotTaken`) via an injected `eventSink`; `snapshot-verb.mjs` emits `hetznerSnapshotTaken` only after the vendor list call confirms the id landed.
+- `real-account-throwaway-server-provision` FAILS the row when `hcloud server list` after provision or after teardown throws.
+- Firewall validation binds each rule name to its required protocol/direction/port and refuses duplicate names.
+- `destroy.mjs` propagates a snapshot-list failure before deletion rather than swallowing it as an empty list.
+- Every result row on every probe carries an `evidence` object with BOTH a non-empty identifier (vendor id, event name, artefact path, or resource name) AND a non-empty observation (excerpt, statusCode, mode, wallClockTime, vendor-return value, non-zero count, or derived structured observation).
+- Skip helpers `firstTierGateSkipResult` and `secondTierMissingSkipResult` name exactly one variable in `reason` and distinguish `unset` from `set-but-not-true (observed value ...)`; anatomy asserts the reason is one of the declared gate variables in the fixture README env-vars section.
+- `probe-utils.mjs` accepts `RCF_REPORT_DIR_OVERRIDE` so local runs write to a scratch directory and the tracked `.rcf/reports/` stays byte-identical to `origin/main`.
+- Anatomy test titles are plain descriptive strings (blueprint slug + AC id + one-line summary), with one exception: the mock-purity test title retained for its chain pointer so the `testPointer` in `packages/rcf-lite/rcf/test-suites/ts-175.json` stays resolvable; paired `testPointer` fields in `packages/rcf-lite/rcf/test-suites/ts-140.json` are updated in the same commit.
+- Blueprint content otherwise unchanged from 1.1.2 (no ACs, REQs, TACs, ADRs or elicits added or removed).
+
+# Changelog
+
+## 1.1.2 (register patch, 2026-09-10)
+
+- Register: neutral wording on the ADR-3801 consequences field (closes F-1) and the shared throwaway-server fixture paragraph in README (closes F-2); no capability change.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 - 2026-09-09
+
+Adds deliveredBy on REQ-001, REQ-002 and REQ-004. Adds ownerRef on AC-37102-1 (manifest schema), AC-37105-1 (cloud-init template) and AC-37106-1 (firewall shape). Adds runtime-clause naming the cloudHost applied capability on REQ-001. Adds disposition to every AC. Adds provisioner-failure and idempotency ACs across the family: US-37101 (AC-37101-2 credential missing, AC-37101-3 dependency not ready, AC-37101-4 repeat-boot idempotency, per section 7a worked example), US-37102 (AC-37102-2 malformed manifest, AC-37102-3 firewall opens ssh to 0.0.0.0/0), US-37103 (AC-37103-2 provisioner failure surfaces, AC-37103-3 repeat-apply idempotency), US-37104 (AC-37104-2 malformed template refusal), US-37106 (AC-37106-2 firewall applied at provision time), US-37107 (AC-37107-2 scheduled snapshot per elicited cadence, with off suppression), US-37108 (AC-37108-2 snapshot-on-demand upstream failure), US-37109 (AC-37109-2 secret exclusion by source-tree grep, AC-37109-3 event fires once per lifecycle moment).
+
 ## 1.0.1
 
-H-1 hardening patch train (round-7 real-account gate d-2026-09-08-010 defect list). Fixes nine real-path defects in the shared throwaway-Hetzner-server fixture at packages/rcf-lite/test/fixtures/hetzner-throwaway-server/ so the three T-1 real-account probes return aggregateVerdict pass on a live Hetzner Cloud project unpatched, and destroy plus sweep-orphans never leak a server. Every existing v1.0.0 contribution id byte-identical apart from the cloud-init template bodies (baseline unchanged; adds a NOPASSWD sudoers.d fragment for the deploy user) and the three T-1 mocked probe bodies (mutation-purity clean plus a new rendered-file assertion).
+Baseline real-account gate hardening. Fixes nine real-path defects in the shared throwaway-Hetzner-server fixture at packages/rcf-lite/test/fixtures/hetzner-throwaway-server/ so the three real-account probes return aggregateVerdict pass on a live Hetzner Cloud project unpatched, and destroy plus sweep-orphans never leak a server. Every existing v1.0.0 contribution id byte-identical apart from the cloud-init template bodies (baseline unchanged; adds a NOPASSWD sudoers.d fragment for the deploy user) and the three mocked probe bodies (mutation-purity clean plus a new rendered-file assertion).
 
 Defect list fixed:
 
@@ -13,11 +118,11 @@ Defect list fixed:
 - (7) contributions/templates/cloud-init.yaml.tmpl adds a write_files sudoers.d fragment at /etc/sudoers.d/90-deploy-nopasswd (mode 0440) that grants NOPASSWD to the deploy user, so the sudoed baseline checks (cloud-init status --wait, ufw status, iptables -L, systemctl is-active fail2ban) never block on a tty prompt.
 - (9) provision.mjs reads an env override RCF_LITE_CI_SSH_KEY_NAME (per-key comma-separated) for the manifest sshKeyIds, with the manifest value staying the default when the override is unset. Documented in the fixture README.
 
-Also: the three T-1 mocked probe modules (cloud-init-render-lint, manifest-schema-validate, hcloud-dry-run-mock) no longer read any process.env.SIMULATE_ switch inside the probe body per the H-1 mutation-purity gate row. The switches live entirely inside fixture-side files (src/cloud-init-renderer.mjs, src/hcloud-mock.mjs, src/provisioner-facade.mjs and the fixture-side run-manifest-schema-validate.mjs shim) and alter INPUT only. The hcloud-dry-run-mock probe now consumes the SAME rendered cloud-init file the real path consumes (renderer writes it, both the mock and real path read it) and asserts an ssh public-key line under the deploy user plus a NOPASSWD directive naming that user (H-1 REQ-145 / AC-14501-1). Report envelopes under .rcf/reports/blueprints/deploy-hetzner-server/ regenerated from the real run.
+Also: the three mocked probe modules (cloud-init-render-lint, manifest-schema-validate, hcloud-dry-run-mock) no longer read any process.env.SIMULATE_ switch inside the probe body per the mutation-purity gate row. The switches live entirely inside fixture-side files (src/cloud-init-renderer.mjs, src/hcloud-mock.mjs, src/provisioner-facade.mjs and the fixture-side run-manifest-schema-validate.mjs shim) and alter INPUT only. The hcloud-dry-run-mock probe now consumes the SAME rendered cloud-init file the real path consumes (renderer writes it, both the mock and real path read it) and asserts an ssh public-key line under the deploy user plus a NOPASSWD directive naming that user (REQ-145 / AC-14501-1). Report envelopes under .rcf/reports/blueprints/deploy-hetzner-server/ regenerated from the real run.
 
-Chain: HQ hardening block H-1 REQ-145..149 / TS-175..179 / FBS-165..169 / CN-510..519 per HQ chain-block ruling 2026-09-08. Real run under Baz one-off approval 2026-09-08: yes, one-off for round 7 gates; Ensure that after any testing etc the Hertner account leaves NO orphaned resources behind. Leave it in the state it started in.
+Live-account gate carries a resource-hygiene rule: the throwaway server is destroyed at teardown and the account inventory is confirmed clean before the record is written, so a real run leaves the Hetzner account in the state it started in with zero orphaned servers, snapshots or firewalls.
 
-Defect (8) T-2 and T-3 stub drivers are OUT of scope for H-1 (H-2 owns them).
+Defect (8) container-host and edge-tunnel stub drivers are OUT of scope for the shipped real-account gate; a later blueprint release covers them.
 
 # deploy-hetzner-server changelog
 
@@ -47,9 +152,11 @@ paired with a mutation switch that flips the probe to FAIL), plus
 without `CI_HAS_HETZNER_ACCOUNT`).
 
 Mints the shared `hetzner-throwaway-server` fixture under
-`packages/rcf-lite/test/fixtures/` (round-7 T-2 and T-3 EXTEND it,
+`packages/rcf-lite/test/fixtures/` (`platform-docker-compose-host` and `edge-cloudflare-tunnel` EXTEND it,
 they do not ship a second copy).
 
-Trace: hetzner-round-7-spec-2026-09-07.md section 5.1;
-Baz ruling 2026-09-07 09:50Z (decisions 18 through 24 approved as
-recommended, "round 7 - agreee to all").
+Trace: hetzner-shipped-spec-2026-09-07.md section 5.1;
+Approved decisions
+recommended, "shipped - agreee to all").
+
+Follow-on ratification (2026-09-09): Adds three option-binding ACs to close section 7c on the elicits catalogue - provisioning-tool raw-api (AC-37101-5), server-type SKU enum (AC-37103-4 naming every shipped SKU), location enum (AC-37103-5 naming every shipped datacentre). Adds deliveredBy on REQ-003, REQ-005, REQ-006. Sweeps vendorCitation onto fixed ACs resting on vendor facts (AC-37101-2, AC-37105-1, AC-37108-1, AC-37108-2, AC-37108-3).

package/blueprints/deploy-hetzner-server/README.md

@@ -45,7 +45,7 @@ Four ADRs record the load-bearing decisions:
   https://docs.hetzner.com/cloud/servers/backups-snapshots/overview.
 - `ADR-3803` provisioning tool: `hcloud` default, `raw-api`
   alternative, Terraform rejected on second toolchain and state file
-  grounds per Baz ruling 2026-09-07.
+  grounds per maintainer ruling 2026-09-07.
 - `ADR-3804` hardening baseline: the six blocks named below.
 
 ## Two provisioner paths: hcloud and raw-api
@@ -85,7 +85,7 @@ FAILS naming the missing line.
 |---|---|---|
 | `provisioning-tool` | `hcloud`, `raw-api` | `hcloud` (ADR-3803) |
 | `server-type` | `cx23`, `cx33`, `cx43`, `cpx11`..`cpx41`, `cax11`..`cax31` | `cx23` |
-| `location` | `fsn1`, `nbg1`, `hel1`, `ash`, `hil` | `fsn1` (Baz ruling 2026-09-07 09:50Z) |
+| `location` | `fsn1`, `nbg1`, `hel1`, `ash`, `hil` | `fsn1` (maintainer ruling 2026-09-07 09:50Z) |
 | `image` | any Hetzner image slug | `ubuntu-24.04` |
 | `ssh-source-prefixes` | CSV of CIDR ranges | `203.0.113.0/24` (example only; supply the real prefix set) |
 | `firewall-id` | existing firewall id or empty | empty (create from `firewallRules`) |
@@ -149,11 +149,11 @@ Every probe writes its report envelope to
 
 ## Shared throwaway-server fixture
 
-The one new pattern this round. Lives at
+The blueprint ships one new pattern. It lives at
 `packages/rcf-lite/test/fixtures/hetzner-throwaway-server/`; ships
 `provision.mjs`, `destroy.mjs`, `sweep-orphans.mjs`, the mocked hcloud
-shim and the manifest at `hetzner/servers/ci-throwaway.json`. T-2
-(`platform-docker-compose-host`) and T-3 (`edge-cloudflare-tunnel`)
+shim and the manifest at `hetzner/servers/ci-throwaway.json`. Sibling
+`platform-docker-compose-host` and `edge-cloudflare-tunnel` blueprints
 EXTEND the fixture rather than shipping a second copy. Cost ceiling:
 one `cx23` at approximately EUR 0.006/hour per run; destroy runs in
 `always()`; the nightly `sweep-orphans` cron collects any leak with a
@@ -172,13 +172,13 @@ cannot host.
 
 ## Consumers
 
-- ops-01 is the first HQ consumer (`w-2026-09-07-dave-004` migration).
-- Round-7 T-2 `platform-docker-compose-host` composes on
+- ops-host is the first infrastructure consumer (migration path).
+- Round-7 `platform-docker-compose-host` composes on
   `capabilities: [cloudHost]`.
-- Round-7 T-3 `edge-cloudflare-tunnel` composes on `cloudHost` (via
-  the systemd unit shape) or on `containerHost` (via T-2).
+- Round-7 `edge-cloudflare-tunnel` composes on `cloudHost` (via
+  the systemd unit shape) or on `containerHost` (via `platform-docker-compose-host`).
 
-Blueprint acceptance never depends on the ops-01 migration.
+Blueprint acceptance never depends on the ops-host migration.
 
 ## Standards trace
 
@@ -197,6 +197,6 @@ Blueprint acceptance never depends on the ops-01 migration.
 ## Rejected alternatives
 
 - Terraform. Adds a second toolchain and a state file that nobody in
-  the estate needs. Baz ruling 2026-09-07 09:50Z on decision 18.
-- A Load Balancer blueprint. Out of scope for round-7 T-1; may ship as
+  the estate needs. maintainer ruling 2026-09-07 09:50Z.
+- A Load Balancer blueprint. Out of scope for round-7; may ship as
   a follow-up if a second Hetzner consumer needs it.

package/blueprints/deploy-hetzner-server/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "deploy-hetzner-server",
-  "version": "1.0.1",
+  "version": "1.1.17",
   "category": "deploy",
   "capabilities": [
     "cloudHost"
@@ -46,7 +46,7 @@
     },
     {
       "id": "location",
-      "prompt": "Hetzner data centre. fsn1 (Falkenstein) is the shipped default per Baz ruling 2026-09-07 09:50Z on the Q2 ratification.",
+      "prompt": "Hetzner data centre. fsn1 (Falkenstein) is the shipped default per maintainer ruling 2026-09-07 09:50Z on the Q2 ratification.",
       "kind": "enum",
       "options": [
         "fsn1",
@@ -201,7 +201,7 @@
       "topic": "linuxCloudHostContract",
       "recommendedDefault": true,
       "elicited": false,
-      "standardsTraceClause": "Hetzner Cloud API server resource and cloud-init user-data contract per hetzner-round-7-spec-2026-09-07.md"
+      "standardsTraceClause": "Hetzner Cloud API server resource and cloud-init user-data contract per hetzner-baseline-spec-2026-09-07.md"
     },
     {
       "id": "ADR-3802-deploy-hetzner-server-snapshot-cadence",
@@ -211,7 +211,7 @@
       "topic": "snapshotAndBackupCadence",
       "recommendedDefault": true,
       "elicited": true,
-      "standardsTraceClause": "Hetzner Cloud backups-and-snapshots documented pricing and mechanism per hetzner-round-7-spec-2026-09-07.md"
+      "standardsTraceClause": "Hetzner Cloud backups-and-snapshots documented pricing and mechanism per hetzner-baseline-spec-2026-09-07.md"
     },
     {
       "id": "ADR-3803-deploy-hetzner-server-provisioning-tool",
@@ -219,7 +219,7 @@
       "path": "adrs/adr-3803-deploy-hetzner-server-provisioning-tool.json",
       "recommendedDefault": true,
       "elicited": true,
-      "standardsTraceClause": "Hetzner Cloud CLI documented resource verbs per hetzner-round-7-spec-2026-09-07.md"
+      "standardsTraceClause": "Hetzner Cloud CLI documented resource verbs per hetzner-baseline-spec-2026-09-07.md"
     },
     {
       "id": "ADR-3804-deploy-hetzner-server-hardening-baseline",
@@ -227,7 +227,8 @@
       "path": "adrs/adr-3804-deploy-hetzner-server-hardening-baseline.json",
       "recommendedDefault": true,
       "elicited": false,
-      "standardsTraceClause": "Debian unattended-upgrades wiki AND the estate baseline at operator/knowledge/systems/environments/hetzner-cloud/overview.md Security posture baseline per hetzner-round-7-spec-2026-09-07.md"
+      "standardsTraceClause": "Debian unattended-upgrades wiki AND the estate baseline at operator/knowledge/systems/environments/hetzner-cloud/overview.md Security posture baseline per hetzner-baseline-spec-2026-09-07.md"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-12T02:07:23.000Z"
 }

package/blueprints/deploy-hetzner-server/contributions/adrs/adr-3801-deploy-hetzner-server-cloud-host-contract.json

@@ -5,9 +5,9 @@
   "version": "1.0.0",
   "status": "accepted",
   "title": "Cloud host contract: Hetzner Cloud VM as the shipped cloudHost shape (scope global, new topic linuxCloudHostContract)",
-  "context": "An applying project needs a first-class Linux VM contract that container-orchestration and edge-ingress consumers (round-7 T-2 platform-docker-compose-host, T-3 edge-cloudflare-tunnel) can compose on. Hetzner Cloud servers plus cloud-init user-data provide the v1.0.0 shape per https://docs.hetzner.cloud/ and https://docs.hetzner.com/cloud/servers/overview. Every applied cloud host needs one project-wide answer to the linuxCloudHostContract topic; a future non-Hetzner sibling (Vultr, DigitalOcean, Fly.io) would contribute the same topic string with a different provider, forcing a DELIBERATE conflict the operator resolves per the round-2 conflict pattern.",
+  "context": "An applying project needs a first-class Linux VM contract that container-orchestration and edge-ingress consumers (round-7 platform-docker-compose-host, edge-cloudflare-tunnel) can compose on. Hetzner Cloud servers plus cloud-init user-data provide the v1.0.0 shape per https://docs.hetzner.cloud/ and https://docs.hetzner.com/cloud/servers/overview. Every applied cloud host needs one project-wide answer to the linuxCloudHostContract topic; a future non-Hetzner sibling (Vultr, DigitalOcean, Fly.io) would contribute the same topic string with a different provider, forcing a DELIBERATE conflict the operator resolves per the round-2 conflict pattern.",
   "decision": "The shipped v1.0.0 default is a Hetzner Cloud server as the linuxCloudHostContract provider. The provisioner reads its shape from the applying manifest at hetzner/servers/name.json (TAC-3802) and creates a matching live server via hcloud CLI verbs (ADR-3803) or the raw Hetzner Cloud API. The linuxCloudHostContract topic scope is global on this blueprint; the topic string is linuxCloudHostContract (lower camelCase, one concept per topic, no version suffix, per the round-2 rules-for-new-topics clause on the shelf registry). Standards trace clause: Hetzner Cloud API server resource and cloud-init user-data contract per hetzner-round-7-spec-2026-09-07.md.",
-  "consequences": "Consumer blueprints that run on a Linux host declare capabilities: [cloudHost] on their applied contract; the round-7 T-2 platform-docker-compose-host reads this capability at apply-time. Rebuild-from-manifest is always possible: the manifest is the source of truth, the live server is derivative. Drift from the shipped manifest to the live server is out of scope for v1.0.0; a later minor may add a drift-audit runner.",
+  "consequences": "Consumer blueprints that run on a Linux host declare capabilities: [cloudHost] on their applied contract; the sibling platform-docker-compose-host blueprint reads this capability at apply-time. Rebuild-from-manifest is always possible: the manifest is the source of truth, the live server is derivative. Drift from the shipped manifest to the live server is out of scope for v1.0.0; a later minor may add a drift-audit runner.",
   "alternativesConsidered": [],
   "createdAt": "2026-09-08T00:00:00.000Z",
   "updatedAt": "2026-09-08T00:00:00.000Z"

package/blueprints/deploy-hetzner-server/contributions/adrs/adr-3803-deploy-hetzner-server-provisioning-tool.json

@@ -5,14 +5,14 @@
   "version": "1.0.0",
   "status": "accepted",
   "title": "Provisioning tool: hcloud CLI default, raw Hetzner Cloud API alternative, Terraform rejected",
-  "context": "An applying project needs a documented answer to how the provisioner shells out to Hetzner Cloud. Options considered: hcloud CLI (small, self-documenting, JSON output on --output json, per https://github.com/hetznercloud/cli); the raw Hetzner Cloud REST API (no CLI dependency, useful when the target host cannot install a binary, per https://docs.hetzner.cloud/); Terraform (declarative, adds a second toolchain and a state file). Baz ruling 2026-09-07 09:50Z on decision 18 of the round-7 summary: hcloud not Terraform. Terraform adds a second toolchain and a state file that nobody in the estate needs.",
+  "context": "An applying project needs a documented answer to how the provisioner shells out to Hetzner Cloud. Options considered: hcloud CLI (small, self-documenting, JSON output on --output json, per https://github.com/hetznercloud/cli); the raw Hetzner Cloud REST API (no CLI dependency, useful when the target host cannot install a binary, per https://docs.hetzner.cloud/); Terraform (declarative, adds a second toolchain and a state file). maintainer ruling 2026-09-07 09:50Z of the round-7 summary: hcloud not Terraform. Terraform adds a second toolchain and a state file that nobody in the estate needs.",
   "decision": "The shipped v1.0.0 default is the hcloud CLI as the provisioning tool. Alternative elicited: raw-api (the provisioner fetches the Hetzner Cloud REST API directly). Terraform is a rejected alternative recorded in the blueprint README section 9 rejected-alternatives. elicited: true. recommendedDefault: hcloud. Standards trace clause: Hetzner Cloud CLI documented resource verbs per hetzner-round-7-spec-2026-09-07.md.",
   "consequences": "The applying project installs the hcloud binary on the operator laptop and every CI runner that provisions. The raw-api fork sits behind the same provisioner facade so no consumer code diverges. The provisioner-facade sole-reader guarantee holds on both paths.",
   "alternativesConsidered": [
     {
       "id": "terraform",
       "summary": "Terraform declaring the Hetzner resources with the hetznercloud provider.",
-      "rejectedBecause": "Adds a second toolchain and a state file. The state file becomes a new source of truth to reconcile with git and with the live account. Baz ruling 2026-09-07 09:50Z."
+      "rejectedBecause": "Adds a second toolchain and a state file. The state file becomes a new source of truth to reconcile with git and with the live account. maintainer ruling 2026-09-07 09:50Z."
     }
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",

package/blueprints/deploy-hetzner-server/contributions/probes/cloud-init-render-lint.mjs

@@ -1,37 +1,44 @@
-// Probe: cloud-init render lint.
+// Probe: cloud-init render lint (v1.1.8).
 //
-// anchorAcId: AC-37104-1. accountBound: false.
+// This is an offline validator: it renders the shipped cloud-init
+// template locally against the fixture manifest and asserts every
+// baseline block is present. There is no engine-minted identifier
+// on such a row - the sha256 of the rendered text is computed by
+// this probe with Node's `createHash` and therefore does not
+// satisfy the semantic anatomy identifier rule. Every result row
+// is a `conformanceOnly` de-claim naming the shipped AC clause the
+// offline check does not observe; the live observation for
+// AC-37104-1 lives on `real-account-cloud-init-hardened` (six
+// on-server baseline checks after `cloud-init status --wait`).
+// The rendered-text hash and the observed block set stay on the
+// row as derived context.
 //
-// Renders the shipped cloud-init template against the fixture manifest at
-// packages/rcf-lite/test/fixtures/hetzner-throwaway-server/hetzner/servers/ci-throwaway.json
-// via the fixture's src/cloud-init-renderer.mjs. Asserts the six hardening
-// baseline blocks appear in the rendered YAML.
-//
-// Purity: the probe reads only the shipped template and the fixture
-// manifest; no process.env.SIMULATE_ switch is read here. The
-// fixture-side renderer at src/cloud-init-renderer.mjs is the sole
-// reader of SIMULATE_HARDENING_DRIFT and it mutates INPUT (the
-// rendered YAML) only; the probe then FAILS naming the missing
-// baseline block per hetzner-round-7-spec-2026-09-07.md section 3.4
-// lesson 4. H-1 (2026-09-08).
+// accountBound: false. Purity: no process.env.SIMULATE_ switch is
+// read; fixture-side mutations live in the fixture-side renderer.
 
 import { readFile } from 'node:fs/promises';
 import { resolve } from 'node:path';
+import { createHash } from 'node:crypto';
 import { FIXTURE_DIR } from './probe-utils.mjs';
 
-export const anchorAcId = 'AC-37104-1';
+function sha256(text) {
+  return createHash('sha256').update(text, 'utf8').digest('hex');
+}
+
+export const anchorAcId = null;
 export const accountBound = false;
 
+const LIMITATION = 'AC-37104-1: rendered cloud-init template is validated offline for baseline-block presence; the live on-server observation (six baseline checks after cloud-init settles) is carried by real-account-cloud-init-hardened.';
+
 export default async function runProbe() {
   const rendererPath = resolve(FIXTURE_DIR, 'src/cloud-init-renderer.mjs');
   const manifestPath = resolve(FIXTURE_DIR, 'hetzner/servers/ci-throwaway.json');
   const { renderCloudInit, BASELINE_BLOCKS } = await import(rendererPath);
   const manifest = JSON.parse(await readFile(manifestPath, 'utf8'));
-  // In-process render only; pass explicit stub public-key material so
-  // the renderer never shells to hcloud (mock path stays hermetic).
   const rendered = await renderCloudInit(manifest, {
     publicKeys: ['ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFakePubKeyForRenderLintHardeningH1 rcf-lite-ci-mock'],
   });
+  const renderedSha256 = sha256(rendered);
   const missing = [];
   const present = [];
   for (const block of BASELINE_BLOCKS) {
@@ -47,16 +54,34 @@ export default async function runProbe() {
   if (missing.length > 0) {
     for (const m of missing) {
       results.push({
-        anchorAcId,
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: LIMITATION,
         verdict: 'fail',
-        detail: `cloud-init hardening baseline block "${m.label}" is missing from the rendered YAML (missing markers: ${m.missingMarkers.join(', ')}).`,
+        detail: `offline cloud-init render lint: hardening baseline block "${m.label}" is missing from the rendered YAML (missing markers: ${m.missingMarkers.join(', ')}).`,
+        evidence: {
+          renderedSha256,
+          manifestName: manifest.name,
+          missingBlockId: m.id,
+          missingMarkers: m.missingMarkers,
+          renderedByteLength: rendered.length,
+        },
       });
     }
   } else {
     results.push({
-      anchorAcId,
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIMITATION,
       verdict: 'pass',
-      detail: `all ${BASELINE_BLOCKS.length} baseline blocks present in the rendered YAML: ${present.join(', ')}.`,
+      detail: `offline cloud-init render lint: all ${BASELINE_BLOCKS.length} baseline blocks present in the rendered YAML: ${present.join(', ')}.`,
+      evidence: {
+        renderedSha256,
+        manifestName: manifest.name,
+        renderedByteLength: rendered.length,
+        presentBlocks: present,
+        renderHashSample: rendered.slice(0, 120),
+      },
     });
   }
   return {