rcf-lite 0.26.0 → 0.28.0

package/blueprints/platform-cloudflare-kv/contributions/user-stories/platform-cloudflare-kv-us-31111.json

@@ -0,0 +1,89 @@
+{
+  "usId": "platform-cloudflare-kv-US-31111",
+  "prdId": "PRD-001",
+  "reqId": "platform-cloudflare-kv-REQ-007",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Pre-ready facade calls queue behind facadeReady; sink events emit in causal per-operation order",
+  "asA": "developer wiring domain code that may issue a get or put before the facade ready-check has resolved",
+  "iWant": "the facade to queue pre-ready calls and drain them in issue-order after ready() resolves, and to emit sink events in the same order the operations completed",
+  "soThat": "no vendor put/get lands on an unbound binding, and a downstream logging companion observes a causal per-key event ordering",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-31111-1",
+      "description": "Two facade.get calls issued BEFORE ready() has resolved settle in issue order after ready() completes. Neither returns a vendor error; both fire kvMiss (empty store) in issue order; a facadeReady event fires before both kvMiss records on the sink.",
+      "given": "a facade instantiated with an in-memory KV driver whose ready-check is artificially delayed by 25ms",
+      "when": "facade.get(\"a\") and facade.get(\"b\") are called synchronously before ready() has resolved",
+      "then": "the calls settle after ready() completes, both return no-value results with source origin, and the sink shows facadeReady, kvMiss(\"a\"), kvMiss(\"b\") in that order",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3201-platform-cloudflare-kv-facade",
+        "field": "responsibilities.facadeReady"
+      }
+    },
+    {
+      "id": "AC-31111-2",
+      "description": "A pre-ready call whose subsequent ready-check throws is rejected with a named error kind (KV_FACADE_NOT_READY) and no sink record is emitted for that call; a subsequent successful facade re-instantiation opens cleanly and the queue does not leak across instances.",
+      "given": "a facade instantiated with a KV driver whose list(limit:1) ready-check throws",
+      "when": "facade.get(\"a\") is called before ready() has resolved",
+      "then": "the call rejects with KV_FACADE_NOT_READY and no sink record is emitted for the failed call",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3201-platform-cloudflare-kv-facade",
+        "field": "responsibilities.facadeReady"
+      }
+    },
+    {
+      "id": "AC-31111-3",
+      "description": "Two facade.put calls issued in order on the same key emit kvWrite records in the same issue order on the sink; interleaved put and get calls on the same key emit kvWrite/kvHit records in the exact interleaving observed on the driver.",
+      "given": "a facade instantiated with an in-memory KV driver and a ready() completed",
+      "when": "facade.put(k, v1), facade.put(k, v2) and facade.get(k) are called in that order",
+      "then": "the sink observes kvWrite(k, v1), kvWrite(k, v2), kvHit(k, v2) in issue order",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3203-platform-cloudflare-kv-event-sink",
+        "field": "responsibilities.whitelist"
+      }
+    },
+    {
+      "id": "AC-31111-4",
+      "description": "Strict FIFO drain: 10 facade.get calls on distinct keys issued BEFORE ready() has resolved drain in exact issue order after ready() completes. The sink records 10 kvMiss records whose keys equal the issue-order sequence exactly (no reorder, no skips). facadeReady precedes every kvMiss.",
+      "given": "a facade with an artificially delayed ready-check and 10 get calls on keys k0..k9",
+      "when": "ready() resolves",
+      "then": "the sink records facadeReady, kvMiss(k0), kvMiss(k1)..kvMiss(k9) in that exact order",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3201-platform-cloudflare-kv-facade",
+        "field": "responsibilities.facadeReady"
+      }
+    },
+    {
+      "id": "AC-31111-5",
+      "description": "Post-ready no queue: after ready() has resolved, a facade.get call invokes the underlying driver directly (no queue). A test that increments a per-call counter on the driver observes counter=1 immediately after the call, not after a next tick.",
+      "given": "a facade after ready() has resolved",
+      "when": "facade.get(k) is called",
+      "then": "the driver counter increments in the same microtask (no queue interposed)",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3201-platform-cloudflare-kv-facade",
+        "field": "responsibilities.facadeReady"
+      }
+    }
+  ],
+  "tacIds": [
+    "TAC-3201-platform-cloudflare-kv-facade",
+    "TAC-3203-platform-cloudflare-kv-event-sink"
+  ],
+  "createdAt": "2026-09-09T20:25:00.000Z",
+  "updatedAt": "2026-09-09T22:00:00.000Z"
+}

package/blueprints/platform-cloudflare-kv/docs/topics.md

@@ -59,7 +59,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 31101-31108 sit at the LOW end of the 31101-31899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from a platform-cloudflare-kv REQ id into the number 31110 would collide against a shipped US-31110; band headroom (31109-31899) leaves that space.
+US 31101-31108 sit at the LOW end of the 31101-31899 band on purpose. A project-side story mechanically derived from a platform-cloudflare-kv REQ id into the number 31110 would collide against a shipped US-31110; band headroom (31109-31899) leaves that space.
 
 ADR/TAC suffixes for this blueprint use the 3201-3299 block, continuing the shelf pattern.
 
@@ -67,7 +67,7 @@ ADR/TAC suffixes for this blueprint use the 3201-3299 block, continuing the shel
 
 - Reuse `keyValueStoreContract` exactly as spelled here when your blueprint holds an opinion on the key-value-store contract at the facade boundary; contribute your own scope:global ADR on that string and let composition surface the pairing.
 - A future non-KV adapter (a Redis-shape store, a strong-consistency Durable Objects cell for a single-owner use case) mints on demand; each claims `keyValueStoreContract` and conflicts by design.
-- Consumer blueprints reading the `keyValueStore` capability declared on `blueprint.json` per section 6a of `blueprint-authoring.md` obtain the facade at apply time via the T-5 visual-round capability-declaration mechanism.
+- Consumer blueprints reading the `keyValueStore` capability declared on `blueprint.json` per section 6a of `blueprint-authoring.md` obtain the facade at apply time via the visual-round capability-declaration mechanism.
 
 ## Deliberate-conflict statement
 

package/blueprints/platform-cloudflare-kv/guide/platform-cloudflare-kv.md

@@ -27,7 +27,7 @@ KV is NOT the shipped answer when:
 - The value is mutated by concurrent writers who each expect their
   write to win in a total order.
 
-Those three cases point at Durable Objects: the round-6 T-3 sibling
+Those three cases point at Durable Objects: the sibling
 `platform-cloudflare-durable-objects` is the shipped answer for
 strong-consistency needs.
 
@@ -58,7 +58,7 @@ project cannot ship a sub-second TTL.
 - Reads dominate writes AND a global staleness ceiling of a few
   seconds is acceptable AND writes come from few writers -> `platform-cloudflare-kv`.
 - Reads mix with writes AND every read must reflect the most recent
-  write AND one key has one authoritative owner -> `platform-cloudflare-durable-objects` (round-6 T-3).
+  write AND one key has one authoritative owner -> `platform-cloudflare-durable-objects`.
 - Row-shaped relational data with SQL semantics ->
   `persistence-data-postgres` or `persistence-data-d1` (via
   `persistenceStore`).

package/blueprints/platform-docker-compose-host/CHANGELOG.md

@@ -1,12 +1,133 @@
+## 1.1.17 - 2026-09-12
+
+- Compose row-walker now ENFORCES the three per-field correlation rules on `walkComposeRecordRow` (v1.1.17): when the record carries `postRunInventory` the row's `evidence.serverId` MUST be present in it (as an id or as an object carrying `.id`); when the record carries `postTeardownServerIds` the id MUST be absent from it (a passing row's server was never in the teardown baseline); when the record carries a `teardown` block that block MUST reference the id via `destroyed` or `provisioned`. Absence of any one of these fields is not a failure. The top-level `serverId` equality remains mandatory. One negative control per field (present-but-wrong: inventory missing the id, teardown-ids including the id, teardown block referencing a different id) calls `walkComposeRecordRow` end to end.
+- `blueprint.json` bumps to 1.1.17 with the anatomy pin in lockstep; `updatedAt` refreshed. Family records regenerated through the shipped run path with no account variables set so each carries `version: "1.1.17"` and the repository walk validates all five.
+- Colour on E is unchanged: AMBER on every AC whose only observation is offline conformanceOnly (`AC-composeHost-healthcheckLint`, `AC-composeHost-secretsAreFiles`, `AC-composeHost-restartClassification`, `AC-composeHost-logDriverClassification`, the reverse-proxy-artefact and read-only-bind-mount clauses of `AC-38107-4` / `AC-composeHost-reverseProxyArtefactValid`); GREEN on `AC-composeHost-upClean`, `AC-composeHost-zeroDowntimeReload` and `AC-composeHost-secretShape`.
+
+## 1.1.16 - 2026-09-12
+
+- Row-walker requires the record's own top-level `serverId` equality (v1.1.16). The Compose row helper now REJECTS a record whose top-level `serverId` is missing or differs from the row's `evidence.serverId`, whatever the event trail carries. `postRunInventory` / `postTeardownServerIds` / `teardown` fields are read as additional correlation surfaces for diagnostic context at 1.1.16 but are not yet enforced; they never substitute for the top-level `serverId` equality. Two negative controls (missing top-level `serverId`, and a top-level `serverId` that differs from the row's `evidence.serverId`) call `walkComposeRecordRow` end to end; the positive control calls the same helper.
+- `blueprint.json` bumps to 1.1.16 with the anatomy pin in lockstep; `updatedAt` refreshed. Family records regenerated through the shipped run path with no account variables set so each carries `version: "1.1.16"` and the repository walk validates all five.
+- Colour on E is unchanged: AMBER on every AC whose only observation is offline conformanceOnly (`AC-composeHost-healthcheckLint`, `AC-composeHost-secretsAreFiles`, `AC-composeHost-restartClassification`, `AC-composeHost-logDriverClassification`, the reverse-proxy-artefact and read-only-bind-mount clauses of `AC-38107-4` / `AC-composeHost-reverseProxyArtefactValid`); GREEN on `AC-composeHost-upClean`, `AC-composeHost-zeroDowntimeReload` and `AC-composeHost-secretShape`.
+
+## 1.1.15 - 2026-09-12
+
+- Split record walker: `walkRepositoryRecords(dir, expectedVersion)` and `walkHandOffRecords(dir)` (v1.1.15). Two functions, two tests, no shared bypass. The repository walk (what CI runs) has NO conditional branch tied to any override: every present record under `.rcf/reports/blueprints/platform-docker-compose-host/` MUST carry `version === blueprint.version` and a missing or different version FAILS with the file named. The hand-off walk runs only when `RCF_LITE_RECORDS_DIR` is set, applies every row validator to the operator-side records, and asserts in its own message that those records predate the version writer (they carry no `version` field, and hand-editing a version into a hand-off record is out). There is no `RCF_LITE_EXPECTED_VERSION` variable anywhere.
+- Event correlation refuses events (v1.1.15). The Compose shipped stack driver (`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/src/compose-stack-driver.mjs`) records events as `{event, at, detail}` and emits NO identifier field on the event body. The walker therefore correlates a `serverId` row against the record's own top-level `serverId` field (where the live record states it) plus `postRunInventory` / `postTeardownServerIds` / `teardown` inventory surfaces; a substring over the event body does NOT count and an invented `serverId` field on an event body is not consulted. The `containerId` correlation rule (v1.1.13) stays in force: only ENGINE evidence keyed by the id under `observedSecretModes.observations` counts.
+- Every negative case invokes the operative walker or helper (v1.1.15). Versionless, wrong-version, non-directory, malformed-JSON, empty / non-array / missing results and stub-row cases each build a scratch directory and call `walkRepositoryRecords`; the identifier-correlation negative builds a synthetic record whose top-level `serverId` differs from the row's `evidence.serverId` and calls `walkComposeRecordRow` end to end. No duplicated lambdas, no direct `assert.equal` stand-ins.
+- `blueprint.json` bumps to 1.1.15 with the anatomy pin in lockstep; `updatedAt` refreshed. Family records regenerated through the shipped run path with no account variables set so each carries `version: "1.1.15"` and the repository walk validates all five.
+- Colour on E is unchanged: AMBER on every AC whose only observation is offline conformanceOnly (`AC-composeHost-healthcheckLint`, `AC-composeHost-secretsAreFiles`, `AC-composeHost-restartClassification`, `AC-composeHost-logDriverClassification`, the reverse-proxy-artefact and read-only-bind-mount clauses of `AC-38107-4` / `AC-composeHost-reverseProxyArtefactValid`); GREEN on `AC-composeHost-upClean`, `AC-composeHost-zeroDowntimeReload` and `AC-composeHost-secretShape`.
+
+## 1.1.13 - 2026-09-12
+
+- Anatomy per-field validators tightened (v1.1.13). The `mode` field on `real-account-minimal-stack-up` secret rows must equal the exact string that `docker exec stat -c %a` prints for owner-read-only permissions - a single recorded value. Every other octal (including four-digit spellings, and "600", "640", "644", "755", "000", "040", "444") and every non-octal input ("", "abc", "9", "400 ", "4000", " 400") FAILS.
+- Reload-burst window rule extended (v1.1.13). The counting `real-account-reload-burst / AC-composeHost-zeroDowntimeReload` row now REQUIRES four positive finite-integer millisecond timestamps under `evidence.burst`: `burstStartedAt`, `burstEndedAt`, `reloadStartedAt`, `reloadEndedAt`. The cross-field rule asserts `burstEndedAt > burstStartedAt`, `reloadEndedAt > reloadStartedAt`, and the reload interval sitting wholly inside the burst interval (`burstStartedAt <= reloadStartedAt AND reloadEndedAt <= burstEndedAt`). Missing endpoints, `NaN`, `Infinity`, `-Infinity`, zero, negatives, non-integer floats, string values, degenerate intervals and reload windows straddling the burst boundary all FAIL. The counter cross-field from v1.1.12 (`total > 0`, `drops === 0`, `twoXx === total`, `overlapCount > 0`) and `clockDomain === "server"` remain in force.
+- Walker `containerId` correlation is now identifier-only (v1.1.13). The 64-hex `containerId` on a counting row counts only when the record's `observedSecretModes.observations` tree carries an entry keyed by the same id - that entry is populated by `docker inspect --format {{.Id}}` and `docker exec stat`, engine evidence keyed by the id. A `containerName` present in the compose services listing or in `observedNames` is NOT identifier evidence; a row whose only correlation is a name match FAILS the walker. A synthetic negative case in the anatomy test proves it in-memory without touching `.rcf/reports/`.
+- Anatomy record walk rejects empty result sets (v1.1.13). A present record whose `results` is absent, not an array, or an empty array FAILS - a record that carries a probeName but no rows attests to nothing. The v1.1.12 malformed-row rejection (evidence / limitation / reason / `notObservableHere.ac` markers) stays in force. `no local records` remains the only permitted early-return, and only when the directory itself has no record files.
+- Anatomy walkers accept an optional records-directory override (v1.1.13): with `RCF_LITE_RECORDS_DIR` set the walker reads `<dir>/platform-docker-compose-host/*.json` instead of the tree default. CI never sets this variable; the operator-side evidence walk uses it. Anatomy synthetic fixtures for reload-burst keep the v1.1.12 counters (`total: 4242`, `twoXx: 4242`, `drops: 0`, `overlapCount: 42`, `reloadDurationMs: 424`) and gain synthetic window timestamps (`burstStartedAt: 1000`, `burstEndedAt: 11000`, `reloadStartedAt: 2000`, `reloadEndedAt: 3000`); live server-clock epochs never appear in branch source.
+- Family records regenerated (v1.1.13). Every shipped probe on this blueprint (`caddyfile-validate`, `compose-config-lint`, `secrets-as-files-scan`, `real-account-minimal-stack-up`, `real-account-reload-burst`) was run through its run-shim with NO account variables set: offline probes wrote `conformanceOnly` rows anchored to their shipped ACs, and each real-account probe wrote its single-variable `accountBoundSkipped` row naming `CI_HAS_HETZNER_ACCOUNT`. Five record files live under `.rcf/reports/blueprints/platform-docker-compose-host/`; every row is one the current probe wrote at the current version and the strict walker validates all of them.
+- Colour on E is unchanged: AMBER on every AC whose only observation is offline conformanceOnly (`AC-composeHost-healthcheckLint`, `AC-composeHost-secretsAreFiles`, `AC-composeHost-restartClassification`, `AC-composeHost-logDriverClassification`, the reverse-proxy-artefact and read-only-bind-mount clauses of `AC-38107-4` / `AC-composeHost-reverseProxyArtefactValid`); GREEN on `AC-composeHost-upClean`, `AC-composeHost-zeroDowntimeReload` and `AC-composeHost-secretShape`.
+
+## 1.1.12 - 2026-09-12
+
+- Anatomy per-field validators tightened (v1.1.12) with explicit `NaN`, `Infinity`, `-Infinity` and negative-value negative cases for every numeric field. The counter cross-field on `real-account-reload-burst / AC-composeHost-zeroDowntimeReload` requires `total > 0`, `drops === 0`, `twoXx === total` and `overlapCount > 0`, and `clockDomain` must equal `"server"`.
+- Anatomy record walk no longer skips malformed rows as `stubs` (v1.1.12). Every row of every present local record is validated: a row lacking evidence, a `limitation`, a skip `reason` and a `notObservableHere.ac` marker FAILS. A paired synthetic negative case proves the walker rejects a stub row without touching `.rcf/reports/`. `no local records` remains the only permitted early-return, and only when the directory itself has no record files. Stale local record artefacts under `.rcf/reports/blueprints/platform-docker-compose-host/` that predated the current per-probe validator schema have been removed from the branch tree so the strict walker returns cleanly.
+- Anatomy synthetic burst counters for `real-account-reload-burst` land on `total: 4242`, `twoXx: 4242`, `drops: 0`, `overlapCount: 42`, `reloadDurationMs: 424` in branch source. Live server-clock epochs never appear in the branch tree.
+- The `mode` validator on `real-account-minimal-stack-up` secret rows accepts only the exact recorded mode value that `docker exec stat -c %a` prints for owner-read-only permissions, and rejects every other octal spelling; a paired negative case proves the rejection.
+- Colour on E is unchanged: AMBER on every AC whose only observation is offline conformanceOnly (`AC-composeHost-healthcheckLint`, `AC-composeHost-secretsAreFiles`, `AC-composeHost-restartClassification`, `AC-composeHost-logDriverClassification`, the reverse-proxy-artefact and read-only-bind-mount clauses of `AC-38107-4` / `AC-composeHost-reverseProxyArtefactValid`); GREEN on `AC-composeHost-upClean`, `AC-composeHost-zeroDowntimeReload` and `AC-composeHost-secretShape`.
+
+## 1.1.11 - 2026-09-11
+
+- Anatomy applies row-specific value validators (v1.1.11) instead of null/undefined presence checks alone. `real-account-minimal-stack-up`'s upClean row requires a non-empty `observedSecretModes` whose entries each carry a 3- or 4-digit octal `mode`, and at least one of a non-empty-string `observedNames` or `healthcheckKeys` array; the secretShape row requires an octal `mode`. `real-account-reload-burst` requires non-negative integer counters `total`, `twoXx`, `drops` and `overlapCount` with `twoXx <= total` and `drops === total - twoXx`, and `clockDomain === "server"`. Empty strings, empty arrays, `false`, `NaN`, negative counters and inconsistent totals now FAIL; one negative-proof test per validator is added to `packages/rcf-lite/test/blueprint/platform-docker-compose-host-anatomy.test.js`.
+- Unmapped offline probes (`caddyfile-validate`, `compose-config-lint`, `secrets-as-files-scan`) MUST NOT emit `accountBoundSkipped` rows: they have no declared gate variable to skip on, so only `conformanceOnly` rows are permitted. `assertRowsCarry7dShape` now refuses a skip row from any unmapped probe; the change is proved by a paired negative / positive test.
+- Anatomy synthetic fixtures carry unmistakably synthetic vendor-id integers (`424245`, `424246`) and a 64-character synthetic hex `containerId` (`deadbeef` repeated eight times). No live-account identifiers appear in branch source.
+- Anatomy walks any records under `.rcf/reports/blueprints/platform-docker-compose-host/`. Every walkable counting row is validated against the per-probe map, and its mapped identifier must appear in the record's own inventory or event trail (`serverId` in `eventTrail` / `postRunInventory` / `postTeardownServerIds` / `teardown`; `containerId` in the record's `observedSecretModes` tree or via a `containerName` present in the compose `services` / `observedNames` listing); when the directory is empty or absent the walk reports `no local records` and passes.
+- Colour on E is unchanged: AMBER on every AC whose only observation is offline conformanceOnly (`AC-composeHost-healthcheckLint`, `AC-composeHost-secretsAreFiles`, `AC-composeHost-restartClassification`, `AC-composeHost-logDriverClassification`, the reverse-proxy-artefact and read-only-bind-mount clauses of `AC-38107-4` / `AC-composeHost-reverseProxyArtefactValid`); GREEN on `AC-composeHost-upClean`, `AC-composeHost-zeroDowntimeReload` and `AC-composeHost-secretShape`.
+
+## 1.1.10 - 2026-09-11
+
+- Anatomy assertions are now driven by a per-probe requirement map (`PROBE_REQUIREMENTS` in `packages/rcf-lite/test/blueprint/platform-docker-compose-host-anatomy.test.js`). For each counting probe on this blueprint, the map declares the row's required vendor-minted identifier (with a shape check: `serverId` is a vendor integer or non-empty numeric string; the Docker `containerId` is a 64-character hex string) plus every required row-specific observation. `real-account-minimal-stack-up`'s upClean row requires the 64-hex `containerId` (nested under `evidence.observedSecretModes.observations[].containerId` on the live record), `observedSecretModes`, and one of `observedNames` or `healthcheckKeys`; the secretShape row requires the top-level 64-hex `containerId` and the observed `mode`. `real-account-reload-burst` requires the full tuple `total`, `twoXx`, `drops` and `overlapCount` (all nested under `evidence.burst` on the live record) plus `clockDomain === "server"`.
+- Observation lookup traverses the whole evidence tree, so a required field nested under `evidence.burst` or `evidence.observedSecretModes.observations` still counts. Any counting row that misses one of the required fields FAILS; a counting row from an offline probe not declared in the map (`caddyfile-validate`, `compose-config-lint`, `secrets-as-files-scan`) FAILS on the spot - those probes may emit only skip / conformanceOnly / notObservableHere rows. Nine negative-proof tests in the same file demonstrate the failure modes (missing observation, cross-probe combination, non-hex64 `containerId`, `clockDomain` other than `"server"`, unmapped probe with a counting row, and nested-field deep search).
+- Colour on E is unchanged: AMBER on every AC whose only observation is offline conformanceOnly (`AC-composeHost-healthcheckLint`, `AC-composeHost-secretsAreFiles`, `AC-composeHost-restartClassification`, `AC-composeHost-logDriverClassification`, the reverse-proxy-artefact and read-only-bind-mount clauses of `AC-38107-4` / `AC-composeHost-reverseProxyArtefactValid`); GREEN on `AC-composeHost-upClean`, `AC-composeHost-zeroDowntimeReload` and `AC-composeHost-secretShape`.
+
+## 1.1.9 - 2026-09-11
+
+- Ruling for this family, final: a counting row is a LIVE row whose identifier is a value the vendor API minted for the row (server id, snapshot id, firewall id, image id, vendor request id, or the 64-hex Docker container id from `docker inspect`) AND whose derived observation is row-specific (per the per-probe observation fields named on the anatomy test). Mock and offline rows carry no vendor-minted identifier by nature and are always `conformanceOnly` de-claims. There is no supplied/echo path for this family.
+- Anatomy identifier set is narrowed to `serverId`, `snapshotId`, `firewallId`, `imageId`, `containerId`, `vendorRequestId`, `requestId`. Generic `id` and `resourceId`, and any `supplied<Name>` / `echoed<Name>` pair, are dropped. The derived-observation set is narrowed to the row-specific fields each counting probe carries (minimal-stack-up: `observedNames` / `healthcheckKeys` for healthy services and `observedSecretModes` / `mode` for the in-container mode; reload-burst: `total`, `twoXx`, `drops`, `overlapCount`, `clockDomain`). Generic `observed`, `port`, `protocol`, `direction` fields are dropped.
+- Colour on E: AMBER on every AC whose only observation is offline conformanceOnly (`AC-composeHost-healthcheckLint`, `AC-composeHost-secretsAreFiles`, `AC-composeHost-restartClassification`, `AC-composeHost-logDriverClassification`, the reverse-proxy-artefact and read-only-bind-mount clauses of `AC-38107-4` / `AC-composeHost-reverseProxyArtefactValid`); GREEN on the live-observed clauses (`AC-composeHost-upClean` with the applied stack, `AC-composeHost-zeroDowntimeReload` with the on-server burst carrying `clockDomain="server"`, `AC-composeHost-secretShape` with the in-container mode observation on the 64-hex containerId). AC-composeHost-healthcheckLint is AMBER because its only observing row is offline `compose-config-lint`; the applied-stack `docker compose ps` observation lands on `AC-composeHost-upClean`, not `healthcheckLint`.
+
+## 1.1.8 - 2026-09-11
+
+- Anatomy identifier rule tightened: an identifier is a value the engine or vendor minted (server id, snapshot id, firewall id, image id, engine request id, or the 64-hex Docker container id from `docker inspect`). A sha256 hash the probe itself computes over an artefact it read is NO LONGER accepted as an identifier - it is a derived-by-the-probe checksum, not an engine echo - and `contentSha256` is removed from the identifier set. A container NAME Compose chose (for example `rcf-lite-throwaway-web`) is NO LONGER accepted as `containerId`; the 64-hex id from `docker inspect --format '{{.Id}}'` is what satisfies the identifier rule. Context/input fields (`expected`, `engineNote`, `event`, `service`, `path`, `source`, event names, manifest names, container names) no longer satisfy the derived-observation half either.
+- Offline probes (`caddyfile-validate`, `compose-config-lint`, `secrets-as-files-scan`) carry no engine-minted identifier by nature: every result row is a `conformanceOnly` de-claim with `anchorAcId: null` and a `limitation` string beginning with a shipped AC id and naming the live probe (or the missing observation) the offline check does not observe. The hash of the observed artefact and the validator output stay on the row as derived context. The stale header comment on `secrets-as-files-scan` referring to `notObservableHere.ac` is replaced with the current `conformanceOnly` explanation.
+- `real-account-minimal-stack-up` secret-mode row records the 64-hex `containerId` from `docker inspect --format '{{.Id}}'` (retrieved by the compose-stack driver after the stack is up); the Compose service name is kept as `containerName` derived context.
+
+## 1.1.7 - 2026-09-11
+
+- Anatomy assertions moved from key-name allow-lists towards a semantic rule: every result row's evidence must carry an engine-minted identifier (a vendor / resource id, engine request id, or a 64-hex Docker container id from `docker inspect`) AND a derived observation (excerpt, statusCode, mode, wallClockTime, non-zero count, or structured engine-returned object). Event names, file paths, service names, manifest names, resource names, and probe inputs are derived context, not identity. Note: at 1.1.7 the anatomy still accepted a probe-computed `contentSha256` as identity on offline validators and stored a Compose-chosen container NAME under `containerId` on the live secret-mode row; 1.1.8 removes both, and 1.1.9 further removes the supplied/echo pair path.
+- `caddyfile-validate`, `compose-config-lint` and `secrets-as-files-scan` were extended to carry a deterministic sha256 of the observed artefact on every row as derived context. Note: 1.1.8 reclassifies these rows as `conformanceOnly` (see above); the hash remains on the row as context.
+- The `real-account-reload-burst` record now carries `clockDomain: "server"` in the burst evidence body: the probe copies the fixture's `clockDomain` return field verbatim, and the regenerated live record includes it.
+
+## 1.1.6 - 2026-09-11
+
+- `real-account-reload-burst` overlap proof runs in ONE clock domain: the on-server undici burst script itself spawns `sudo docker compose exec -T caddy caddy reload --config /etc/caddy/Caddyfile` after a small warm-up and stamps every observation (burst start, each request `startedAt`/`endedAt`, reload start, reload end) from the server's own `Date.now()`. The runner receives one JSON blob and does NO rebase from the ssh call time. Overlap and burst-window containment are computed from server-clock stamps directly. The probe copies the fixture's `clockDomain: 'server'` return field into the burst evidence object; the regenerated live record on this branch carries that field.
+- Compose YAML parser in `probe-utils.mjs` now preserves fields on a list-item object after its first `key: value` line. The long-form service-level secret entry (whose `source`, `target` and `mode` fields sit on distinct list-item lines) parses as one `{source, target, mode}` object, so `secrets-as-files-scan` records the mode declared in `compose.yaml` for the `web-token` reference (previously read `unset`).
+- Compose-stack driver default `--wait-timeout` for `docker compose up -d --wait` is the shipped elicited `healthcheck-timeout-seconds` value (30). `COMPOSE_UP_TIMEOUT_SECONDS` is declared in the fixture README env-var section as the optional override for the account-bound branch.
+- `real-account-minimal-stack-up` observes the in-container mode of every mounted secret with `sudo docker exec <container> stat -c %a /run/secrets/<name>` and records one row per secret anchored to AC-composeHost-secretShape (a mode other than `400` FAILS the row); it also FAILS if a top-level secret has no consuming service.
+- `secrets-as-files-scan` no longer assumes an unset service-level `mode` means `0o400`. The mode row is `anchorAcId: null`, `conformanceOnly: true`, with a `limitation` string that starts with `AC-composeHost-secretShape` and names the process-level observation on the real-account probe; the row does NOT use `notObservableHere` (the AC is process-observable via `docker exec stat`, not shelf-only). The offline scan continues to FAIL on undeclared secrets, on environment references bypassing service-level secrets, on orphan top-level secrets, and on plaintext-literal hits across compose.yaml, .env and every service's bind-mount source.
+- Vendor references named at the module level: Docker Engine convenience install script (`https://docs.docker.com/engine/install/ubuntu/` verifiedOn 2026-09-11), Ubuntu 24.04 `nodejs` apt package (`https://packages.ubuntu.com/noble/nodejs` verifiedOn 2026-09-11), Docker Compose secret file mode default (`https://docs.docker.com/reference/compose-file/secrets/` verifiedOn 2026-09-11).
+- Anchor detail prefixes: every `AC-composeHost-*` prefix carries the first eight words of the AC or REQ text it anchors.
+- Anatomy assertions are strict inline: identity fields come from a fixed set (vendor / resource ids, event names, artefact paths, resource names) and observation fields come from a fixed set (excerpts, mode, statusCode, wallClockTime, vendor-return values, non-zero counts, structured derived observations). `notObservableHere` is reserved for browser-only ACs and this blueprint has none, so any `notObservableHere` row FAILS. `conformanceOnly` rows must carry a `limitation` string whose first token is a shipped AC id.
+- Invented anchor fallbacks removed: `probe-utils.emptyResultsFail` and the `runShim` error branch no longer synthesise `anchorAcId: 'unknown'`.
+- Skip helpers name exactly one variable in `reason` and distinguish `unset` from `set-but-not-true (observed value ...)`. Anatomy asserts the reason is one of the declared gate variables in the fixture README env-vars section.
+- `probe-utils.mjs` accepts `RCF_REPORT_DIR_OVERRIDE` so local runs write to a scratch directory and the tracked `.rcf/reports/` stays byte-identical to `origin/main`.
+- Fixture `compose.yaml` declares the `web-token` service-level secret in long form (source, target and mode fields on distinct list-item lines) and the compose-stack driver `chmod 400`s the shipped `secrets/web-token` on the throwaway server after rsync but before `docker compose up -d`. Docker Compose (non-Swarm) mounts a compose secret with the source file's host mode, so both the long-form `mode:` declaration and the host-side chmod are required for AC-composeHost-secretShape "mounted at 0o400" to be observed in-container.
+- `compose-config-lint` docker-engine wrap row carries `file: 'compose.yaml'` in evidence; the missing-healthcheck failure row carries `missingServices` / `expected: 'healthcheck block'` / `observed: 'absent'` so the anatomy identifier-plus-observation check is satisfied on every branch of the probe.
+- Anatomy test regex for the compose secret matches the long-form declaration; anatomy test titles are plain descriptive strings (blueprint slug + AC id + one-line summary), and paired `testPointer` fields in `packages/rcf-lite/rcf/test-suites/ts-150.json` are updated in the same commit.
+
 # platform-docker-compose-host CHANGELOG
 
+## 1.1.2 - 2026-09-10
+
+Register patch.
+
+- Neutral register in README fixture-extension prose (F-2).
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 - 2026-09-09
+
+### Added
+
+- `platform-docker-compose-host-REQ-007` (`must`): the Docker Engine installation follows the elicited apt channel (`stable` or `test`) with the installed repository source as the observable oracle. Closes criterion a on the previously unbacked `docker-engine-channel` elicit (F-1).
+- `platform-docker-compose-host-US-38110` traces REQ-007; two ACs (happy-path per-channel installation, refusal on unsupported channel value); each carries `disposition`, and the vendor-fact AC carries `vendorCitation` to the Docker Engine install-on-Ubuntu documentation verified 2026-09-09.
+
+### Changed
+
+- `REQ-001` extended to name the elicited `compose-file-location` alternative (`compose/compose.yaml`) alongside the shipped `repo-root` default; closes criterion a on the previously unbacked alternative branch (F-2).
+- `REQ-003` extended to name every elicited healthcheck kind (`http`, `tcp`, `command`); previously only the `http` shape was named.
+- `REQ-005` extended to name the `reverse-proxy=none` topology explicitly (the lint now refuses ANY proxy service block or reload verb when `none` is elicited); closes criterion a on the previously unbacked `none` branch (F-3).
+- Every existing REQ carries a `deliveredBy` link into a TAC or ADR (six links). Every existing AC carries `disposition`. `rcf define blueprint lint-consistency` reports zero pass-1 and pass-2 findings.
+
+### Added
+
+- Elicited `healthcheck-timeout-seconds` added to `blueprint.json` (default 30, floor 5, ceiling 300); REQ-003 description extended to name the elicited answer, closing criterion a on the previously-unbacked healthcheck-timeout branch (F-4).
+- Every story on this blueprint now reaches the section 7a AC-set-sufficiency floor. 35 new hand-authored ACs cover the documented failure paths named in the guide and TAC records, per-story range 4-6: US-38101 gains five ACs (network drift closing the first gap, volume drift closing the second gap, image drift closing the third gap, .env drift closing the fourth gap, compose-file-location branch); US-38102 gains four ACs (SSM integration closing the first gap, file-based fallback closing the second gap, wrong-mode secret closing the third gap, orphan top-level secret); US-38103 gains four ACs (wrong-mode probe, orphan-secret probe, plaintext in .env, clean-pass baseline); US-38104 gains four ACs (healthcheck-timeout elicit AC, tcp kind, command kind, http kind); US-38105 gains three ACs (real-account timeout, teardown discipline, dependency ordering); US-38106 gains three ACs (long-running policy classification closing the first gap, job policy classification closing the second gap, missing restart field); US-38107 gains three ACs (Traefik topology closing the first gap, none topology closing the second gap, read-only bind-mount); US-38108 gains three ACs (Traefik reload verb, none topology no-op, reload window too short); US-38109 gains three ACs (journald marker probe closing the first gap, loki marker probe closing the second gap, missing logging block); US-38110 gains three ACs (sources file content, keyring presence, idempotent install). Every new AC carries `disposition`, most carry `ownerRef` into the owning TAC, and vendor-fact ACs carry `vendorCitation` (Docker Engine install, compose healthcheck reference, compose secrets reference, compose logging reference, Caddy docs, Traefik docs, journald docs, Loki docs).
+- `rcf define blueprint lint-consistency` still reports zero pass-1 and pass-2 findings. Blueprint stays at v1.1.0 on the same unreleased minor.
+
+### Fixed (2026-09-09)
+
+- Register sweep: every `blueprint.json` elicit prompt, guide passage, README row, ADR title/context/decision and probe comment on the blueprint has "a platform reverse-proxy decision", "a development host", "an internal ops host", "shipped tunnel" and "hetzner-shipped-spec-2026-09-07.md" neutralised to concept ("a platform decision", "a common Linux-host baseline that already runs Caddy", "a Cloudflare-tunnel sibling"). CHANGELOG entries keep internal provenance.
+
 ## 1.0.0 - 2026-09-08
 
-Initial release. Round-7 T-2 of the Hetzner spec at `projects/blueprint-library/specs/hetzner-round-7-spec-2026-09-07.md`.
+Initial release. Hetzner blueprint per the Hetzner host specification.
 
 - Mints capability `containerHost` and global topic `containerHostContract`.
 - Six REQs, nine USs, four TACs, four ADRs; five Node-only probes.
 - Extends the shared throwaway-Hetzner-server fixture with a minimal compose stack (`compose.yaml`, `caddy/Caddyfile`, `secrets/web-token` file mount, `src/serve.mjs` healthchecked stub) plus five `run-<probe>.mjs` delegate shims.
 - Compose-config-lint carries four mutation switches (`SIMULATE_MISSING_HEALTHCHECK`, `SIMULATE_UNCLASSIFIED_RESTART`, `SIMULATE_UNCLASSIFIED_LOG_DRIVER`, `SIMULATE_EVENT_SECRECY_LEAK`); secrets-as-files-scan carries `SIMULATE_PLAINTEXT_SECRET`; caddyfile-validate carries `SIMULATE_INVALID_CADDYFILE` and runs `caddy validate` via the `caddy:2` container when a local `caddy` binary is not on PATH.
-- Reverse-proxy choice elicited via `reverse-proxy` (caddy default per Baz decision 19; traefik and none alternatives); Coolify rejected verbatim per Baz decision 20; log driver elicited via `log-driver` (journald default; loki opt-in).
-- Consumers: `w-2026-09-07-dave-004` migrates the ops-01 remote-library compose stack onto this contract after 0.25.0 ships; blueprint acceptance never depends on that migration.
+- Reverse-proxy choice elicited via `reverse-proxy` (caddy default per a platform reverse-proxy decision; traefik and none alternatives); Coolify rejected verbatim per a platform reverse-proxy decision; log driver elicited via `log-driver` (journald default; loki opt-in).
+- Consumers: future work migrates an internal ops host's remote-library compose stack onto this contract after 0.25.0 ships; blueprint acceptance never depends on that migration.

package/blueprints/platform-docker-compose-host/README.md

@@ -4,7 +4,7 @@ A container-orchestration facade over docker compose running on a Linux `cloudHo
 
 ## What it commits
 
-Six REQs, nine USs, four TACs, four ADRs and five Node-only probes. Round-7 T-2 of the Hetzner spec at `projects/blueprint-library/specs/hetzner-round-7-spec-2026-09-07.md`.
+Six REQs, nine USs, four TACs, four ADRs and five Node-only probes. Ships the containerHostContract topic on top of a cloudHost provider.
 
 | REQ | Contract |
 |---|---|
@@ -26,7 +26,7 @@ Six REQs, nine USs, four TACs, four ADRs and five Node-only probes. Round-7 T-2
 
 ## Elicits (via `elicits[]`)
 
-- `reverse-proxy`: `caddy` (default per Baz decision 19, matches dev-01 and ops-01) | `traefik` (alternative for docker-label auto-discovery) | `none` (alternative for projects fronted only by the round-7 tunnel).
+- `reverse-proxy`: `caddy` (the shipped default, matching a common Linux-host baseline that already runs Caddy) | `traefik` (alternative for docker-label auto-discovery) | `none` (alternative for projects fronted only by a Cloudflare-tunnel sibling).
 - `docker-engine-channel`: `stable` (default) | `test`.
 - `compose-file-location`: `repo-root` (default) | `compose/compose.yaml`.
 - `healthcheck-default-kind`: `http` (default) | `tcp` | `command`.
@@ -35,9 +35,9 @@ Six REQs, nine USs, four TACs, four ADRs and five Node-only probes. Round-7 T-2
 
 ## ADR shape
 
-- ADR-3901 container host contract: scope `global` on new topic `containerHostContract`; standards trace clause `Docker Compose file reference AND Docker Engine install-on-Ubuntu docs per hetzner-round-7-spec-2026-09-07.md`.
-- ADR-3902 reverse proxy: elicited, `caddy` default; standards trace clause `Caddy docs AND Traefik docs per hetzner-round-7-spec-2026-09-07.md`.
-- ADR-3903 reject Coolify: decision quoted verbatim from Baz ruling 20 ("reject; it shadows what the blueprints contract and adds its own DB and UI as a second source of state"); standards trace clause `generic enterprise practice`.
+- ADR-3901 container host contract: scope `global` on new topic `containerHostContract`; standards trace clause `Docker Compose file reference AND Docker Engine install-on-Ubuntu docs`.
+- ADR-3902 reverse proxy: elicited, `caddy` default; standards trace clause `Caddy docs AND Traefik docs`.
+- ADR-3903 reject Coolify: rejected by platform decision ("it shadows what the blueprints contract and adds its own DB and UI as a second source of state"); standards trace clause `generic enterprise practice`.
 - ADR-3904 log driver: elicited, `journald` default; standards trace clause `generic enterprise practice`.
 
 ## Probes
@@ -68,9 +68,9 @@ CI_HAS_HETZNER_ACCOUNT=true HCLOUD_TOKEN=$HETZNER_ACCOUNT_API_KEY node ./run-rea
 
 ## Fixture extension path
 
-Round-7 T-1 (`deploy-hetzner-server`) minted the shared fixture at `packages/rcf-lite/test/fixtures/hetzner-throwaway-server/`. T-2 EXTENDS that fixture, never duplicates it: `compose.yaml`, `caddy/Caddyfile`, `secrets/web-token`, `src/serve.mjs` and five `run-<probe>.mjs` delegate shims land alongside T-1's `provision.mjs`/`destroy.mjs`/`sweep-orphans.mjs`. T-3 (`edge-cloudflare-tunnel`) extends the same fixture further; consumers of that fixture see one folder, one manifest, three tracks worth of runtime.
+The `deploy-hetzner-server` sibling minted the shared fixture at `packages/rcf-lite/test/fixtures/hetzner-throwaway-server/`. This blueprint EXTENDS that fixture, never duplicates it: `compose.yaml`, `caddy/Caddyfile`, `secrets/web-token`, `src/serve.mjs` and five `run-<probe>.mjs` delegate shims land alongside the hetzner blueprint's `provision.mjs`/`destroy.mjs`/`sweep-orphans.mjs`. The `edge-cloudflare-tunnel` sibling extends the same fixture further; consumers of that fixture see one folder, one manifest, three tracks worth of runtime.
 
 ## When to reach for this blueprint
 
-- Any project running a containerised stack on a `cloudHost` (T-1 `deploy-hetzner-server` provides the shipped v1.0.0 provider).
+- Any project running a containerised stack on a `cloudHost` (`deploy-hetzner-server` provides the shipped v1.0.0 provider).
 - Any project that wants secrets as file mounts (not environment literals), healthchecks that gate boot, a checked-in reverse-proxy artefact, and a log driver on the elicited sink.

package/blueprints/platform-docker-compose-host/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "platform-docker-compose-host",
-  "version": "1.0.0",
+  "version": "1.1.17",
   "category": "platform",
   "capabilities": [
     "containerHost"
@@ -18,7 +18,7 @@
   "elicits": [
     {
       "id": "reverse-proxy",
-      "prompt": "Reverse proxy in front of the compose services. caddy is the shipped default per Baz decision 19 (matches dev-01 and ops-01); traefik is the alternative for docker-label auto-discovery; none is the alternative for projects fronted only by the round-7 tunnel.",
+      "prompt": "Reverse proxy in front of the compose services. caddy is the shipped default (a platform decision matching a common Linux-host baseline that already runs Caddy); traefik is the alternative for docker-label auto-discovery; none is the alternative for projects fronted only by a Cloudflare-tunnel sibling.",
       "kind": "enum",
       "options": [
         "caddy",
@@ -58,9 +58,15 @@
       ],
       "default": "http"
     },
+    {
+      "id": "healthcheck-timeout-seconds",
+      "prompt": "Elicited healthcheck timeout in seconds (per REQ-003 the stack is not considered up until every declared service reaches healthy inside this window; docker compose up -d --wait respects the compose healthcheck timeout: field). Default 30, floor 5, ceiling 300.",
+      "kind": "string",
+      "default": "30"
+    },
     {
       "id": "log-driver",
-      "prompt": "Container log driver per ADR-3904. journald is the shipped default matching the Debian 12 and Ubuntu 24.04 baseline T-1 sets up; loki is the opt-in alternative when the project runs Grafana.",
+      "prompt": "Container log driver per ADR-3904. journald is the shipped default matching the Debian 12 and Ubuntu 24.04 baseline the deploy-hetzner-server cloud-init sets up; loki is the opt-in alternative when the project runs Grafana.",
       "kind": "enum",
       "options": [
         "journald",
@@ -106,6 +112,11 @@
       "kind": "req",
       "path": "requirements/platform-docker-compose-host-req-006.json"
     },
+    {
+      "id": "platform-docker-compose-host-REQ-007",
+      "kind": "req",
+      "path": "requirements/platform-docker-compose-host-req-007.json"
+    },
     {
       "id": "platform-docker-compose-host-US-38101",
       "kind": "us",
@@ -151,6 +162,11 @@
       "kind": "us",
       "path": "user-stories/platform-docker-compose-host-us-38109.json"
     },
+    {
+      "id": "platform-docker-compose-host-US-38110",
+      "kind": "us",
+      "path": "user-stories/platform-docker-compose-host-us-38110.json"
+    },
     {
       "id": "TAC-3901-platform-docker-compose-host-compose-layout",
       "kind": "tac",
@@ -179,7 +195,7 @@
       "topic": "containerHostContract",
       "recommendedDefault": true,
       "elicited": false,
-      "standardsTraceClause": "Docker Compose file reference AND Docker Engine install-on-Ubuntu docs per hetzner-round-7-spec-2026-09-07.md"
+      "standardsTraceClause": "Docker Compose file reference AND Docker Engine install-on-Ubuntu docs"
     },
     {
       "id": "ADR-3902-platform-docker-compose-host-reverse-proxy",
@@ -187,7 +203,7 @@
       "path": "adrs/adr-3902-platform-docker-compose-host-reverse-proxy.json",
       "recommendedDefault": true,
       "elicited": true,
-      "standardsTraceClause": "Caddy docs AND Traefik docs per hetzner-round-7-spec-2026-09-07.md"
+      "standardsTraceClause": "Caddy docs AND Traefik docs"
     },
     {
       "id": "ADR-3903-platform-docker-compose-host-reject-coolify",
@@ -205,5 +221,6 @@
       "elicited": true,
       "standardsTraceClause": "generic enterprise practice"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-12T02:07:23.000Z"
 }

package/blueprints/platform-docker-compose-host/contributions/adrs/adr-3901-platform-docker-compose-host-contract.json

@@ -5,9 +5,9 @@
   "version": "1.0.0",
   "status": "accepted",
   "title": "Container host contract: docker compose as source of truth on a cloudHost (scope global, new topic containerHostContract)",
-  "context": "An applying project running its stack on a Linux cloudHost needs one shipped contract for how services are declared, wired and brought up on a container-orchestration surface. Round-7 T-2 mints the containerHostContract topic on this ADR. Docker Compose is the shipped v1.0.0 surface (compose.yaml as source of truth, healthchecks required, secrets as files, restart discipline, reverse-proxy as artefact). Every applied container host needs one project-wide answer to the containerHostContract topic; a future non-compose sibling (Docker Swarm, Nomad) would contribute the same topic string with a different mechanism, forcing a DELIBERATE conflict the operator resolves per the round-2 conflict pattern. Standards trace clause: Docker Compose file reference AND Docker Engine install-on-Ubuntu docs per hetzner-round-7-spec-2026-09-07.md.",
-  "decision": "The shipped v1.0.0 default is docker compose on a cloudHost as the containerHostContract provider. A canonical compose.yaml at the repo root drives docker compose up on the applied cloudHost (T-1 deploy-hetzner-server); healthchecks refuse at docker compose config on missing; secrets are file mounts; restart policies are unless-stopped or on-failure; the reverse-proxy config is a first-class versioned artefact per TAC-3904. The containerHostContract topic scope is global on this blueprint; the topic string is containerHostContract (lower camelCase, one concept per topic, no version suffix, per the round-2 rules-for-new-topics clause on the shelf registry). Standards trace clause: Docker Compose file reference AND Docker Engine install-on-Ubuntu docs per hetzner-round-7-spec-2026-09-07.md.",
-  "consequences": "Consumer blueprints that ship as containers declare capabilities: [containerHost] on their applied contract; the round-7 T-3 edge-cloudflare-tunnel reads this capability at apply-time to choose the compose-service runtime. Rebuild-from-manifest is always possible: the compose file is the source of truth, the running stack is derivative. Compose is famously many right ways; over-specifying alienates a project with a defensible different shape, so v1.0.0 pins the small load-bearing set (healthchecks, secrets-as-files, restart discipline, reverse-proxy-as-artefact) and leaves everything else to project-owned ADRs.",
+  "context": "An applying project running its stack on a Linux cloudHost needs one shipped contract for how services are declared, wired and brought up on a container-orchestration surface. This ADR mints the containerHostContract topic. Docker Compose is the shipped v1.0.0 surface (compose.yaml as source of truth, healthchecks required, secrets as files, restart discipline, reverse-proxy as artefact). Every applied container host needs one project-wide answer to the containerHostContract topic; a future non-compose sibling (Docker Swarm, Nomad) would contribute the same topic string with a different mechanism, forcing a DELIBERATE conflict the operator resolves per the round-2 conflict pattern. Standards trace clause: Docker Compose file reference AND Docker Engine install-on-Ubuntu docs.",
+  "decision": "The shipped v1.0.0 default is docker compose on a cloudHost as the containerHostContract provider. A canonical compose.yaml at the repo root drives docker compose up on the applied cloudHost (via deploy-hetzner-server); healthchecks refuse at docker compose config on missing; secrets are file mounts; restart policies are unless-stopped or on-failure; the reverse-proxy config is a first-class versioned artefact per TAC-3904. The containerHostContract topic scope is global on this blueprint; the topic string is containerHostContract (lower camelCase, one concept per topic, no version suffix, per the round-2 rules-for-new-topics clause on the shelf registry). Standards trace clause: Docker Compose file reference AND Docker Engine install-on-Ubuntu docs.",
+  "consequences": "Consumer blueprints that ship as containers declare capabilities: [containerHost] on their applied contract; the sibling edge-cloudflare-tunnel reads this capability at apply-time to choose the compose-service runtime. Rebuild-from-manifest is always possible: the compose file is the source of truth, the running stack is derivative. Compose is famously many right ways; over-specifying alienates a project with a defensible different shape, so v1.0.0 pins the small load-bearing set (healthchecks, secrets-as-files, restart discipline, reverse-proxy-as-artefact) and leaves everything else to project-owned ADRs.",
   "alternativesConsidered": [],
   "createdAt": "2026-09-08T00:00:00.000Z",
   "updatedAt": "2026-09-08T00:00:00.000Z"

package/blueprints/platform-docker-compose-host/contributions/adrs/adr-3902-platform-docker-compose-host-reverse-proxy.json

@@ -4,10 +4,10 @@
   "tadId": "TAD-001",
   "version": "1.0.0",
   "status": "accepted",
-  "title": "Reverse proxy choice: caddy default (matches dev-01 and ops-01), traefik alternative for docker-label auto-discovery, none for tunnel-fronted projects (elicited)",
-  "context": "Compose stacks need a reverse-proxy for HTTPS termination and hostname-to-service routing. Caddy is the estate baseline (dev-01 and ops-01 already run it per Baz decision 19 on 2026-09-07 09:50Z). Traefik has a docker-label auto-discovery model some projects prefer. Some projects front their stack only with the round-7 tunnel and skip a reverse proxy inside compose.",
-  "decision": "The reverse-proxy choice is elicited via the reverseProxy parameter. The shipped default is caddy per Baz decision 19. The alternatives are traefik (for projects that want docker-label auto-discovery) and none (for projects fronted only by the round-7 tunnel). Standards trace clause: Caddy docs AND Traefik docs per hetzner-round-7-spec-2026-09-07.md.",
-  "consequences": "A project applying reverseProxy=caddy gets the caddy/Caddyfile artefact and the caddy reload verb. A project applying reverseProxy=traefik gets the traefik/traefik.yaml artefact and the Traefik equivalent reload verb; docker-label auto-discovery is a project-side pattern the guide names. A project applying reverseProxy=none omits the reverse-proxy service and must apply edge-cloudflare-tunnel (T-3) so ingress terminates at the CF edge.",
+  "title": "Reverse proxy choice: caddy default (matching a common Linux-host baseline that already runs Caddy), traefik alternative for docker-label auto-discovery, none for tunnel-fronted projects (elicited)",
+  "context": "Compose stacks need a reverse-proxy for HTTPS termination and hostname-to-service routing. Caddy is the shipped default, matching a common Linux-host baseline that already runs it. Traefik has a docker-label auto-discovery model some projects prefer. Some projects front their stack only with the Cloudflare-tunnel sibling and skip a reverse proxy inside compose.",
+  "decision": "The reverse-proxy choice is elicited via the reverseProxy parameter. The shipped default is caddy. The alternatives are traefik (for projects that want docker-label auto-discovery) and none (for projects fronted only by the Cloudflare-tunnel sibling). Standards trace clause: Caddy docs AND Traefik docs.",
+  "consequences": "A project applying reverseProxy=caddy gets the caddy/Caddyfile artefact and the caddy reload verb. A project applying reverseProxy=traefik gets the traefik/traefik.yaml artefact and the Traefik equivalent reload verb; docker-label auto-discovery is a project-side pattern the guide names. A project applying reverseProxy=none omits the reverse-proxy service and must apply the edge-cloudflare-tunnel sibling so ingress terminates at the CF edge.",
   "alternativesConsidered": [],
   "createdAt": "2026-09-08T00:00:00.000Z",
   "updatedAt": "2026-09-08T00:00:00.000Z"

package/blueprints/platform-docker-compose-host/contributions/adrs/adr-3903-platform-docker-compose-host-reject-coolify.json

@@ -4,8 +4,8 @@
   "tadId": "TAD-001",
   "version": "1.0.0",
   "status": "accepted",
-  "title": "Coolify rejected per Baz decision 20 (it shadows what the blueprints contract and adds its own DB and UI as a second source of state)",
-  "context": "Coolify was proposed as a candidate platform-* sibling in the round-7 proposal. It is a self-hosted PaaS with its own database and UI. Baz decision 20 on 2026-09-07 09:50Z ruled Coolify out for round 7.",
+  "title": "Coolify rejected as a platform decision (it shadows what the blueprints contract and adds its own DB and UI as a second source of state)",
+  "context": "Coolify was proposed as a candidate platform-* sibling. It is a self-hosted PaaS with its own database and UI. A platform decision ruled it out for this shelf release.",
   "decision": "reject; it shadows what the blueprints contract and adds its own DB and UI as a second source of state.",
   "consequences": "No platform-coolify-host blueprint is scoped in round 7 and no reserved slot is allocated. A future platform-coolify-host sibling mints on operator demand under a fresh scope PR. The standards trace clause on the contribution entry is generic enterprise practice; no vendor-doc URL is claimed for the reject decision.",
   "alternativesConsidered": [],

package/blueprints/platform-docker-compose-host/contributions/adrs/adr-3904-platform-docker-compose-host-log-driver.json

@@ -5,8 +5,8 @@
   "version": "1.0.0",
   "status": "accepted",
   "title": "Log driver: journald default matching Debian 12 and Ubuntu 24.04 baseline; loki opt-in when the project runs Grafana (elicited)",
-  "context": "Containers write stdout and stderr to a log driver. Debian 12 and Ubuntu 24.04 (the T-1 cloud-init baseline) ship journald. Grafana users on the estate reach for loki as a native sink. A one-choice hard-code loses either journald parity with the OS or loki when the operator runs Grafana.",
-  "decision": "The log driver is elicited via the log-driver parameter. The shipped default is journald matching the Debian 12 and Ubuntu 24.04 baselines T-1 sets up. The alternative is loki, opted into when the applying project runs Grafana. When observability-logging is applied, the compose file wires the elicited driver to that companion. Standards trace clause: generic enterprise practice.",
+  "context": "Containers write stdout and stderr to a log driver. Debian 12 and Ubuntu 24.04 (the deploy-hetzner-server cloud-init baseline) ship journald. Grafana users on the estate reach for loki as a native sink. A one-choice hard-code loses either journald parity with the OS or loki when the operator runs Grafana.",
+  "decision": "The log driver is elicited via the log-driver parameter. The shipped default is journald matching the Debian 12 and Ubuntu 24.04 baselines the deploy-hetzner-server cloud-init sets up. The alternative is loki, opted into when the applying project runs Grafana. When observability-logging is applied, the compose file wires the elicited driver to that companion. Standards trace clause: generic enterprise practice.",
   "consequences": "A project applying log-driver=journald gets the systemd-native path; the journald sink is queried via journalctl. A project applying log-driver=loki targets the Grafana loki endpoint; the observability-logging companion supplies the endpoint address. Neither choice adds a runtime npm dependency. The compose-config-lint refuses on any driver value outside the allowed set.",
   "alternativesConsidered": [],
   "createdAt": "2026-09-08T00:00:00.000Z",