rcf-lite 0.27.0 → 0.28.0

package/blueprints/deploy-hetzner-server/contributions/probes/real-account-cloud-init-hardened.mjs

@@ -1,28 +1,72 @@
-// Probe: real-account cloud-init hardened.
+// Probe: real-account cloud-init hardened (v1.1.5).
 //
 // anchorAcId: AC-37105-1. accountBound: true.
 //
-// Without CI_HAS_HETZNER_ACCOUNT the probe records
-// accountBoundSkipped: true and the aggregate flips to pass.
-//
-// With the env var set the probe:
-//   - provisions the throwaway server via the fixture provision.mjs;
-//   - shells cloud-init status --wait over ssh to the throwaway server;
-//   - runs the six baseline checks over ssh (grep for the marker per
-//     baseline block); FAILS naming the first missing block on any
-//     defect.
-//   - always() calls destroy.mjs regardless of verdict.
+// Contract:
+//   - First-tier gate CI_HAS_HETZNER_ACCOUNT must equal exactly the
+//     string "true"; anything else records an honest skip row.
+//   - Second-tier HCLOUD_TOKEN missing carries its own honest skip row.
+//   - The pass row carries an `evidence` object with the created
+//     server id, the ssh readiness result, the cloud-init status exit
+//     code and every baseline block's stdout excerpt (bounded).
+//   - A non-zero exit from `cloud-init status --wait` FAILS the
+//     verdict; the six baseline checks that follow are diagnostic in
+//     that case rather than the verdict.
+//   - Teardown lives in a finally block and its failure FAILS the
+//     verdict (the shape rule).
 
-import { accountBoundSkippedResult, FIXTURE_DIR } from './probe-utils.mjs';
+import { spawn } from 'node:child_process';
 import { resolve } from 'node:path';
+import {
+  firstTierGateSkipResult, secondTierMissingSkipResult, FIXTURE_DIR,
+} from './probe-utils.mjs';
 
 export const anchorAcId = 'AC-37105-1';
 export const accountBound = true;
 
+function hcloudJson(argv, { timeoutMs = 60_000 } = {}) {
+  return new Promise((resolvePromise, reject) => {
+    const p = spawn('hcloud', argv, { stdio: ['ignore', 'pipe', 'pipe'] });
+    let stdout = '';
+    let stderr = '';
+    const timer = setTimeout(() => { try { p.kill('SIGKILL'); } catch (_) {} reject(new Error(`hcloud ${argv.join(' ')} timed out after ${timeoutMs}ms`)); }, timeoutMs);
+    p.stdout.on('data', (d) => { stdout += d.toString(); });
+    p.stderr.on('data', (d) => { stderr += d.toString(); });
+    p.on('error', (err) => { clearTimeout(timer); reject(err); });
+    p.on('close', (code) => {
+      clearTimeout(timer);
+      if (code !== 0) return reject(new Error(`hcloud ${argv.join(' ')} exited ${code}: ${stderr}`));
+      const trimmed = stdout.trim();
+      if (trimmed.length === 0) return resolvePromise([]);
+      try {
+        const parsed = JSON.parse(trimmed);
+        resolvePromise(Array.isArray(parsed) ? parsed : (parsed.servers || []));
+      } catch (err) {
+        reject(new Error(`hcloud stdout not JSON: ${err.message}`));
+      }
+    });
+  });
+}
+
 export default async function runProbe() {
   if (process.env.CI_HAS_HETZNER_ACCOUNT !== 'true') {
     return {
-      results: [accountBoundSkippedResult(anchorAcId, 'real-account cloud-init hardened check skipped; run with CI_HAS_HETZNER_ACCOUNT=true to exercise the six ssh baseline checks against a throwaway cx23.')],
+      results: [firstTierGateSkipResult(
+        anchorAcId,
+        'CI_HAS_HETZNER_ACCOUNT',
+        'real-account cloud-init hardened check skipped; run with CI_HAS_HETZNER_ACCOUNT=true to exercise the six ssh baseline checks against a throwaway cx23.',
+      )],
+      extra: { skipped: true, missingEnv: ['CI_HAS_HETZNER_ACCOUNT'] },
+    };
+  }
+  if (!process.env.HCLOUD_TOKEN) {
+    return {
+      results: [secondTierMissingSkipResult(
+        anchorAcId,
+        'HCLOUD_TOKEN',
+        'the throwaway server cannot be provisioned without HCLOUD_TOKEN.',
+      )],
+      extra: { skipped: true, missingEnv: ['HCLOUD_TOKEN'] },
     };
   }
   const provisionPath = resolve(FIXTURE_DIR, 'provision.mjs');
@@ -31,34 +75,71 @@ export default async function runProbe() {
   const { provisionThrowawayServer } = await import(provisionPath);
   const { destroyThrowawayServer } = await import(destroyPath);
   const { runSshBaselineChecks } = await import(sshCheckPath);
+
+  const evidence = {};
+  const resultRow = { anchorAcId, verdict: 'fail', detail: '', evidence };
   let provisioned;
   try {
     provisioned = await provisionThrowawayServer({ runId: process.env.GITHUB_RUN_ID ?? 'local' });
+    evidence.serverId = provisioned.id;
+    evidence.serverName = provisioned.name;
+    evidence.primaryIpv4 = provisioned.primaryIpv4;
     const report = await runSshBaselineChecks(provisioned);
+    evidence.sshReadiness = report.readiness;
+    evidence.cloudInit = report.cloudInit;
+    evidence.baselineChecks = report.checks.map((c) => ({
+      id: c.id,
+      verdict: c.verdict,
+      stdoutExcerpt: (c.detail || '').slice(0, 200),
+    }));
+    // Rule 6 of the fix list: cloud-init non-zero FAILS the verdict.
+    if (!report.cloudInit || report.cloudInit.code !== 0) {
+      resultRow.verdict = 'fail';
+      resultRow.detail = `cloud-init status --wait exited ${report.cloudInit ? report.cloudInit.code : 'null'} on server ${provisioned.id}; the ssh baseline checks are diagnostic and do not carry the verdict when cloud-init did not reach a terminal success state. stderr: ${(report.cloudInit && report.cloudInit.stderr) || ''}`;
+      return { results: [resultRow], extra: evidence };
+    }
     const failed = report.checks.filter((c) => c.verdict === 'fail');
     if (failed.length > 0) {
-      return {
-        results: failed.map((c) => ({
-          anchorAcId,
-          verdict: 'fail',
-          detail: `cloud-init baseline block "${c.label}" failed on server ${provisioned.id}: ${c.detail}`,
-        })),
-      };
+      // Fail with per-block detail on the FIRST failing block so the
+      // result row carries a specific failure locus; the full check
+      // list is in evidence.baselineChecks.
+      const first = failed[0];
+      resultRow.verdict = 'fail';
+      resultRow.detail = `cloud-init baseline block "${first.label}" failed on server ${provisioned.id}: ${first.detail}`;
+      return { results: [resultRow], extra: evidence };
     }
     const blocks = report.checks.filter((c) => c.verdict === 'pass').map((c) => c.id);
-    return {
-      results: [{
-        anchorAcId,
-        verdict: 'pass',
-        detail: `cloud-init reached terminal state on server ${provisioned.id} (cloud-init status --wait exit ${report.cloudInit ? report.cloudInit.code : 'skipped'}); six baseline hardening blocks observed: ${blocks.join(', ')}.`,
-      }],
-      extra: report,
-    };
+    resultRow.verdict = 'pass';
+    resultRow.detail = `cloud-init reached terminal state on server ${provisioned.id} (cloud-init status --wait exit 0); six baseline hardening blocks observed: ${blocks.join(', ')}.`;
   } catch (err) {
-    return { results: [{ anchorAcId, verdict: 'fail', detail: `check failed: ${err.message}` }] };
+    resultRow.verdict = 'fail';
+    resultRow.detail = `check failed: ${err.message}`;
+    evidence.checkError = err.message;
+    return { results: [resultRow], extra: evidence };
   } finally {
     if (provisioned && provisioned.id) {
-      try { await destroyThrowawayServer(provisioned); } catch (_) { /* swept by orphan cron */ }
+      try {
+        await destroyThrowawayServer(provisioned);
+        evidence.teardown = { destroyed: provisioned.id };
+        try {
+          const finalList = await hcloudJson(['server', 'list', '--output', 'json']);
+          evidence.postTeardownServerIds = finalList.map((s) => s.id);
+          if (finalList.some((s) => s.id === provisioned.id)) {
+            resultRow.verdict = 'fail';
+            resultRow.detail = `${resultRow.detail} TEARDOWN INCOMPLETE: server ${provisioned.id} still present in hcloud server list.`;
+          }
+        } catch (err) {
+          evidence.postTeardownListError = err.message;
+          resultRow.verdict = 'fail';
+          resultRow.detail = `${resultRow.detail} TEARDOWN CONFIRMATION FAILED: post-teardown hcloud server list threw (${err.message}); cannot confirm server ${provisioned.id} was removed.`;
+        }
+      } catch (err) {
+        resultRow.verdict = 'fail';
+        resultRow.detail = `${resultRow.detail} TEARDOWN FAILED for server ${provisioned.id}: ${err.message}.`;
+        evidence.teardownError = err.message;
+        evidence.orphanServerId = provisioned.id;
+      }
     }
   }
+  return { results: [resultRow], extra: evidence };
 }

package/blueprints/deploy-hetzner-server/contributions/probes/real-account-snapshot-on-demand.mjs

@@ -1,30 +1,72 @@
-// Probe: real-account snapshot on demand.
+// Probe: real-account snapshot on demand (v1.1.5).
 //
 // anchorAcId: AC-37108-1. accountBound: true.
 //
-// Without CI_HAS_HETZNER_ACCOUNT the probe records
-// accountBoundSkipped: true and the aggregate flips to pass.
-//
-// With the env var set the probe:
-//   - provisions the throwaway server via provision.mjs;
-//   - fires the snapshot verb on the provisioner facade;
-//   - asserts hcloud image list --type=snapshot --output json shows a
-//     snapshot with the server name and current wall-clock time in the
-//     labels;
-//   - always() calls destroy.mjs regardless of verdict; the snapshot is
-//     deleted as part of destroy.mjs so the run leaves no orphaned
-//     image behind.
+// Contract:
+//   - First-tier gate CI_HAS_HETZNER_ACCOUNT must equal exactly the
+//     string "true"; anything else records an honest skip row.
+//   - Second-tier HCLOUD_TOKEN missing carries its own honest skip row.
+//   - The pass row carries an `evidence` object with the created
+//     server id, the pre- and post-snapshot inventory (proving the
+//     snapshot id was created then deleted), the snapshot id, the
+//     hetznerSnapshotTaken event shape (serverName, snapshotId, ts),
+//     and the label-match evidence.
+//   - Teardown failure FAILS the verdict (the shape rule); the
+//     evidence tree carries the orphan snapshot id and server id when
+//     the destroy leaks.
 
-import { accountBoundSkippedResult, FIXTURE_DIR } from './probe-utils.mjs';
+import { spawn } from 'node:child_process';
 import { resolve } from 'node:path';
+import {
+  firstTierGateSkipResult, secondTierMissingSkipResult, FIXTURE_DIR,
+} from './probe-utils.mjs';
 
 export const anchorAcId = 'AC-37108-1';
 export const accountBound = true;
 
+function hcloudJson(argv, { timeoutMs = 60_000 } = {}) {
+  return new Promise((resolvePromise, reject) => {
+    const p = spawn('hcloud', argv, { stdio: ['ignore', 'pipe', 'pipe'] });
+    let stdout = '';
+    let stderr = '';
+    const timer = setTimeout(() => { try { p.kill('SIGKILL'); } catch (_) {} reject(new Error(`hcloud ${argv.join(' ')} timed out after ${timeoutMs}ms`)); }, timeoutMs);
+    p.stdout.on('data', (d) => { stdout += d.toString(); });
+    p.stderr.on('data', (d) => { stderr += d.toString(); });
+    p.on('error', (err) => { clearTimeout(timer); reject(err); });
+    p.on('close', (code) => {
+      clearTimeout(timer);
+      if (code !== 0) return reject(new Error(`hcloud ${argv.join(' ')} exited ${code}: ${stderr}`));
+      const trimmed = stdout.trim();
+      if (trimmed.length === 0) return resolvePromise([]);
+      try {
+        const parsed = JSON.parse(trimmed);
+        resolvePromise(Array.isArray(parsed) ? parsed : (parsed.images || parsed.servers || []));
+      } catch (err) {
+        reject(new Error(`hcloud stdout not JSON: ${err.message}`));
+      }
+    });
+  });
+}
+
 export default async function runProbe() {
   if (process.env.CI_HAS_HETZNER_ACCOUNT !== 'true') {
     return {
-      results: [accountBoundSkippedResult(anchorAcId, 'real-account snapshot on-demand skipped; run with CI_HAS_HETZNER_ACCOUNT=true to exercise the hcloud image create-image path.')],
+      results: [firstTierGateSkipResult(
+        anchorAcId,
+        'CI_HAS_HETZNER_ACCOUNT',
+        'real-account snapshot on-demand skipped; run with CI_HAS_HETZNER_ACCOUNT=true to exercise the hcloud server create-image path.',
+      )],
+      extra: { skipped: true, missingEnv: ['CI_HAS_HETZNER_ACCOUNT'] },
+    };
+  }
+  if (!process.env.HCLOUD_TOKEN) {
+    return {
+      results: [secondTierMissingSkipResult(
+        anchorAcId,
+        'HCLOUD_TOKEN',
+        'the snapshot verb cannot be issued without HCLOUD_TOKEN.',
+      )],
+      extra: { skipped: true, missingEnv: ['HCLOUD_TOKEN'] },
     };
   }
   const provisionPath = resolve(FIXTURE_DIR, 'provision.mjs');
@@ -33,28 +75,114 @@ export default async function runProbe() {
   const { provisionThrowawayServer } = await import(provisionPath);
   const { destroyThrowawayServer } = await import(destroyPath);
   const { takeAndVerifySnapshot } = await import(snapshotPath);
+
+  const evidence = {};
+  const resultRow = { anchorAcId, verdict: 'fail', detail: '', evidence };
   let provisioned;
+  // Observed events on injected sinks (defect): the snapshot
+  // verb emits hetznerSnapshotTaken; the provision emits
+  // hetznerServerProvisioned. Both are OBSERVED, not constructed here.
+  const observedEvents = [];
+  const eventSink = (body) => observedEvents.push(body);
   try {
-    provisioned = await provisionThrowawayServer({ runId: process.env.GITHUB_RUN_ID ?? 'local' });
-    const outcome = await takeAndVerifySnapshot(provisioned);
+    // Pre-snapshot inventory: capture the snapshot ids present before
+    // the run so the inventory-diff evidence shape is honest.
+    try {
+      const baseline = await hcloudJson(['image', 'list', '--type=snapshot', '--output', 'json']);
+      evidence.baselineSnapshotIds = baseline.map((s) => s.id);
+    } catch (err) {
+      evidence.baselineListError = err.message;
+    }
+    provisioned = await provisionThrowawayServer({
+      runId: process.env.GITHUB_RUN_ID ?? 'local',
+      eventSink,
+    });
+    evidence.serverId = provisioned.id;
+    evidence.serverName = provisioned.name;
+    const outcome = await takeAndVerifySnapshot(provisioned, { eventSink });
+    evidence.snapshotId = outcome.snapshotId;
+    evidence.wallClockTime = outcome.wallClockTime;
+    evidence.labelMatch = outcome.match ? {
+      id: outcome.match.id,
+      serverNameLabel: (outcome.match.labels || {}).serverName,
+    } : null;
+    // OBSERVE the hetznerSnapshotTaken event from the sink. The event
+    // body is derived by snapshot-verb.mjs after the vendor list call
+    // confirmed the id landed (defect: was constructed here
+    // in v1.1.4; now observed from the sink emit).
+    evidence.observedEvents = observedEvents.map((e) => ({ event: e.event, keys: Object.keys(e).sort() }));
+    const snapshotEvent = observedEvents.find((e) => e && e.event === 'hetznerSnapshotTaken');
+    if (outcome.snapshotId && !snapshotEvent) {
+      resultRow.verdict = 'fail';
+      resultRow.detail = `snapshot verb returned snapshotId ${outcome.snapshotId} but no hetznerSnapshotTaken event was observed on the injected sink; AC-37108-3 event-shape observation is missing.`;
+      evidence.eventName = 'hetznerSnapshotTaken';
+      evidence.eventObserved = false;
+      return { results: [resultRow], extra: evidence };
+    }
+    evidence.hetznerSnapshotTakenEvent = snapshotEvent ?? null;
+    // Post-create inventory: prove the id appears in the vendor
+    // snapshot list so the AC's inventory-diff evidence is real.
+    try {
+      const afterCreate = await hcloudJson(['image', 'list', '--type=snapshot', '--output', 'json']);
+      evidence.postCreateSnapshotIds = afterCreate.map((s) => s.id);
+      evidence.postCreateSnapshotCarriedId = !!(outcome.snapshotId && afterCreate.some((s) => s.id === outcome.snapshotId));
+    } catch (err) {
+      evidence.postCreateListError = err.message;
+    }
     if (!outcome.snapshotId) {
-      return {
-        results: [{ anchorAcId, verdict: 'fail', detail: `snapshot verb ran but no matching snapshot appeared in hcloud image list.` }],
-      };
+      resultRow.verdict = 'fail';
+      resultRow.detail = `snapshot verb ran but no matching snapshot appeared in hcloud image list; the AC's inventory-diff evidence is missing.`;
+      return { results: [resultRow], extra: evidence };
     }
-    return {
-      results: [{
-        anchorAcId,
-        verdict: 'pass',
-        detail: `snapshot ${outcome.snapshotId} tagged with server name ${provisioned.name} and time ${outcome.wallClockTime} on server ${provisioned.id}.`,
-      }],
-      extra: outcome,
-    };
+    resultRow.verdict = 'pass';
+    resultRow.detail = `snapshot ${outcome.snapshotId} created against server ${provisioned.id} (${provisioned.name}); hcloud image list --type=snapshot carries the id; hetznerSnapshotTaken event shape {serverName, snapshotId, ts} confirmed.`;
   } catch (err) {
-    return { results: [{ anchorAcId, verdict: 'fail', detail: `snapshot verb threw: ${err.message}` }] };
+    resultRow.verdict = 'fail';
+    resultRow.detail = `snapshot verb threw: ${err.message}`;
+    evidence.snapshotError = err.message;
+    return { results: [resultRow], extra: evidence };
   } finally {
     if (provisioned && provisioned.id) {
-      try { await destroyThrowawayServer(provisioned); } catch (_) { /* swept by orphan cron */ }
+      try {
+        await destroyThrowawayServer(provisioned);
+        evidence.teardown = { destroyed: provisioned.id };
+        // Confirm the snapshot AND the server were both removed;
+        // destroy.mjs sweeps snapshots that carry the server-name
+        // label in the same call, so the post-teardown snapshot list
+        // must NOT carry the id.
+        try {
+          const finalSnaps = await hcloudJson(['image', 'list', '--type=snapshot', '--output', 'json']);
+          evidence.postTeardownSnapshotIds = finalSnaps.map((s) => s.id);
+          if (evidence.snapshotId && finalSnaps.some((s) => s.id === evidence.snapshotId)) {
+            resultRow.verdict = 'fail';
+            resultRow.detail = `${resultRow.detail} TEARDOWN INCOMPLETE: snapshot ${evidence.snapshotId} still present.`;
+            evidence.orphanSnapshotId = evidence.snapshotId;
+          }
+        } catch (err) {
+          evidence.postTeardownListError = err.message;
+          resultRow.verdict = 'fail';
+          resultRow.detail = `${resultRow.detail} TEARDOWN CONFIRMATION FAILED: post-teardown snapshot list threw (${err.message}); cannot confirm snapshot ${evidence.snapshotId || 'n/a'} was deleted.`;
+        }
+        try {
+          const finalServers = await hcloudJson(['server', 'list', '--output', 'json']);
+          evidence.postTeardownServerIds = finalServers.map((s) => s.id);
+          if (finalServers.some((s) => s.id === provisioned.id)) {
+            resultRow.verdict = 'fail';
+            resultRow.detail = `${resultRow.detail} TEARDOWN INCOMPLETE: server ${provisioned.id} still present.`;
+          }
+        } catch (err) {
+          evidence.postTeardownServerListError = err.message;
+          resultRow.verdict = 'fail';
+          resultRow.detail = `${resultRow.detail} TEARDOWN CONFIRMATION FAILED: post-teardown server list threw (${err.message}); cannot confirm server ${provisioned.id} was removed.`;
+        }
+      } catch (err) {
+        resultRow.verdict = 'fail';
+        resultRow.detail = `${resultRow.detail} TEARDOWN FAILED for server ${provisioned.id}: ${err.message}.`;
+        evidence.teardownError = err.message;
+        evidence.orphanServerId = provisioned.id;
+        if (evidence.snapshotId) evidence.orphanSnapshotId = evidence.snapshotId;
+      }
     }
   }
+  return { results: [resultRow], extra: evidence };
 }

package/blueprints/deploy-hetzner-server/contributions/probes/real-account-throwaway-server-provision.mjs

@@ -1,58 +1,180 @@
-// Probe: real-account throwaway-server provision.
+// Probe: real-account throwaway-server provision (v1.1.5).
 //
 // anchorAcId: AC-37103-1. accountBound: true.
 //
-// Without CI_HAS_HETZNER_ACCOUNT the probe records
-// accountBoundSkipped: true and the aggregate flips to pass per
-// hetzner-round-7-spec-2026-09-07.md section 3.5.
-//
-// With the env var set the probe:
-//   - runs the fixture's provision.mjs against the ci-throwaway manifest;
-//   - asserts a new server appears in `hcloud server list --output json`
-//     whose id matches the scratch-file-written id;
-//   - asserts the fixture's captured hetznerServerProvisioned event
-//     carries id, primaryIpv4, location=fsn1, serverType=cx23;
-//   - always() calls destroy.mjs so the throwaway server is torn down
-//     regardless of verdict.
+// Contract:
+//   - First-tier gate CI_HAS_HETZNER_ACCOUNT must equal exactly the
+//     string "true"; anything else records an honest skip row naming
+//     the variable (set-but-not-true distinguished from unset).
+//   - Second-tier HCLOUD_TOKEN must be set once past the first-tier
+//     gate; missing carries its own honest skip row naming HCLOUD_TOKEN.
+//   - The pass row carries an `evidence` object with the created
+//     server id, the pre-provision inventory count, the post-provision
+//     inventory entry proving the id landed, the primaryIpv4, location
+//     and serverType observed on the vendor payload, plus the emitted
+//     `hetznerServerProvisioned` event shape (event names only, no
+//     token bytes).
+//   - Teardown lives in a finally block and its failure FAILS the
+//     verdict; the evidence carries the surviving orphan id so a
+//     later sweep-orphans run can find it.
 
-import { accountBoundSkippedResult, FIXTURE_DIR } from './probe-utils.mjs';
+import { spawn } from 'node:child_process';
 import { resolve } from 'node:path';
+import {
+  firstTierGateSkipResult, secondTierMissingSkipResult, FIXTURE_DIR,
+} from './probe-utils.mjs';
 
 export const anchorAcId = 'AC-37103-1';
 export const accountBound = true;
 
+function hcloudJson(argv, { timeoutMs = 60_000 } = {}) {
+  return new Promise((resolvePromise, reject) => {
+    const p = spawn('hcloud', argv, { stdio: ['ignore', 'pipe', 'pipe'] });
+    let stdout = '';
+    let stderr = '';
+    const timer = setTimeout(() => { try { p.kill('SIGKILL'); } catch (_) {} reject(new Error(`hcloud ${argv.join(' ')} timed out after ${timeoutMs}ms`)); }, timeoutMs);
+    p.stdout.on('data', (d) => { stdout += d.toString(); });
+    p.stderr.on('data', (d) => { stderr += d.toString(); });
+    p.on('error', (err) => { clearTimeout(timer); reject(err); });
+    p.on('close', (code) => {
+      clearTimeout(timer);
+      if (code !== 0) return reject(new Error(`hcloud ${argv.join(' ')} exited ${code}: ${stderr}`));
+      const trimmed = stdout.trim();
+      if (trimmed.length === 0) return resolvePromise([]);
+      try {
+        const parsed = JSON.parse(trimmed);
+        resolvePromise(Array.isArray(parsed) ? parsed : (parsed.servers || []));
+      } catch (err) {
+        reject(new Error(`hcloud stdout not JSON: ${err.message}`));
+      }
+    });
+  });
+}
+
 export default async function runProbe() {
   if (process.env.CI_HAS_HETZNER_ACCOUNT !== 'true') {
     return {
-      results: [accountBoundSkippedResult(anchorAcId, 'real-account throwaway-server provision skipped; run with CI_HAS_HETZNER_ACCOUNT=true to exercise.')],
+      results: [firstTierGateSkipResult(
+        anchorAcId,
+        'CI_HAS_HETZNER_ACCOUNT',
+        'real-account throwaway-server provision skipped; run with CI_HAS_HETZNER_ACCOUNT=true to exercise.',
+      )],
+      extra: { skipped: true, missingEnv: ['CI_HAS_HETZNER_ACCOUNT'] },
+    };
+  }
+  if (!process.env.HCLOUD_TOKEN) {
+    return {
+      results: [secondTierMissingSkipResult(
+        anchorAcId,
+        'HCLOUD_TOKEN',
+        'the shared hetzner-throwaway-server provisioner cannot open without HCLOUD_TOKEN.',
+      )],
+      extra: { skipped: true, missingEnv: ['HCLOUD_TOKEN'] },
     };
   }
   const provisionPath = resolve(FIXTURE_DIR, 'provision.mjs');
   const destroyPath = resolve(FIXTURE_DIR, 'destroy.mjs');
   const { provisionThrowawayServer } = await import(provisionPath);
   const { destroyThrowawayServer } = await import(destroyPath);
+
+  const evidence = {};
   let provisioned;
+  const resultRow = { anchorAcId, verdict: 'fail', detail: '', evidence };
+  // Observed event sink (defect). We OBSERVE the emitted
+  // hetznerServerProvisioned event rather than constructing one from
+  // the return value.
+  const observedEvents = [];
+  const eventSink = (body) => observedEvents.push(body);
   try {
-    provisioned = await provisionThrowawayServer({ runId: process.env.GITHUB_RUN_ID ?? 'local' });
-    return {
-      results: [{
-        anchorAcId,
-        verdict: 'pass',
-        detail: `throwaway server ${provisioned.id} provisioned; hetznerServerProvisioned event captured; primaryIpv4=${provisioned.primaryIpv4} location=${provisioned.location} serverType=${provisioned.serverType}.`,
-      }],
-      extra: { serverId: provisioned.id, primaryIpv4: provisioned.primaryIpv4 },
-    };
+    let baselineList = [];
+    try {
+      baselineList = await hcloudJson(['server', 'list', '--output', 'json']);
+      evidence.baselineServerIds = baselineList.map((s) => s.id);
+    } catch (err) {
+      // Baseline list is diagnostic; capture error but do not fail.
+      evidence.baselineListError = err.message;
+    }
+    provisioned = await provisionThrowawayServer({
+      runId: process.env.GITHUB_RUN_ID ?? 'local',
+      eventSink,
+    });
+    evidence.serverId = provisioned.id;
+    evidence.serverName = provisioned.name;
+    evidence.primaryIpv4 = provisioned.primaryIpv4;
+    evidence.location = provisioned.location;
+    evidence.serverType = provisioned.serverType;
+    // OBSERVE the emitted event from the sink; do not manufacture it.
+    const provisionedEvent = observedEvents.find((e) => e && e.event === 'hetznerServerProvisioned');
+    evidence.observedEvents = observedEvents.map((e) => ({ event: e.event, keys: Object.keys(e).sort() }));
+    if (!provisionedEvent) {
+      resultRow.verdict = 'fail';
+      resultRow.detail = `hetznerServerProvisioned event was not observed on the injected sink after provisionThrowawayServer returned id ${provisioned.id}.`;
+      evidence.eventName = 'hetznerServerProvisioned';
+      evidence.eventObserved = false;
+      return { results: [resultRow], extra: evidence };
+    }
+    evidence.hetznerServerProvisionedEvent = provisionedEvent;
+    // Observe the server-list AFTER provision to prove the id landed.
+    // A list failure at this step FAILS the row (defect:
+    // the new list failure is no longer allowed to continue to pass).
+    let postListError = null;
+    try {
+      const postList = await hcloudJson(['server', 'list', '--output', 'json']);
+      evidence.postProvisionServerIds = postList.map((s) => s.id);
+      const match = postList.find((s) => s.id === provisioned.id);
+      evidence.postProvisionMatch = match ? { id: match.id, name: match.name, status: match.status } : null;
+      if (!match) {
+        resultRow.verdict = 'fail';
+        resultRow.detail = `provisionThrowawayServer returned id ${provisioned.id} but the post-provision hcloud server list did not carry it; the AC's inventory-diff evidence is missing.`;
+        return { results: [resultRow], extra: evidence };
+      }
+    } catch (err) {
+      postListError = err.message;
+      evidence.postProvisionListError = postListError;
+      resultRow.verdict = 'fail';
+      resultRow.detail = `hcloud server list after provision failed (${postListError}); AC-37103-1 requires the live inventory-diff evidence, which could not be observed.`;
+      return { results: [resultRow], extra: evidence };
+    }
+    if (!provisioned.primaryIpv4 || provisioned.location !== 'fsn1' || provisioned.serverType !== 'cx23') {
+      resultRow.verdict = 'fail';
+      resultRow.detail = `hetznerServerProvisioned payload malformed: expected primaryIpv4, location=fsn1, serverType=cx23; observed ${JSON.stringify(evidence.hetznerServerProvisionedEvent)}.`;
+      return { results: [resultRow], extra: evidence };
+    }
+    resultRow.verdict = 'pass';
+    resultRow.detail = `throwaway server ${provisioned.id} provisioned in fsn1; hetznerServerProvisioned event OBSERVED on the injected sink (id ${provisioned.id}, primaryIpv4 ${provisioned.primaryIpv4}, serverType cx23); post-provision hcloud server list carries the id.`;
   } catch (err) {
-    return {
-      results: [{
-        anchorAcId,
-        verdict: 'fail',
-        detail: `provision failed: ${err.message}`,
-      }],
-    };
+    resultRow.verdict = 'fail';
+    resultRow.detail = `provision failed: ${err.message}`;
+    evidence.provisionError = err.message;
+    return { results: [resultRow], extra: evidence };
   } finally {
     if (provisioned && provisioned.id) {
-      try { await destroyThrowawayServer(provisioned); } catch (_) { /* swept by orphan cron */ }
+      try {
+        await destroyThrowawayServer(provisioned);
+        evidence.teardown = { destroyed: provisioned.id };
+        // Confirm absence by re-listing. Failure to confirm FAILS the
+        // row ( Item on partly-fixed teardown: post-teardown
+        // inventory failures were being swallowed).
+        try {
+          const finalList = await hcloudJson(['server', 'list', '--output', 'json']);
+          evidence.postTeardownServerIds = finalList.map((s) => s.id);
+          if (finalList.some((s) => s.id === provisioned.id)) {
+            resultRow.verdict = 'fail';
+            resultRow.detail = `${resultRow.detail} TEARDOWN INCOMPLETE: server ${provisioned.id} still present in hcloud server list; sweep-orphans must collect.`;
+          }
+        } catch (err) {
+          evidence.postTeardownListError = err.message;
+          resultRow.verdict = 'fail';
+          resultRow.detail = `${resultRow.detail} TEARDOWN CONFIRMATION FAILED: post-teardown hcloud server list threw (${err.message}); cannot confirm server ${provisioned.id} was removed.`;
+        }
+      } catch (err) {
+        // Teardown failure fails the verdict (the shape rule).
+        resultRow.verdict = 'fail';
+        resultRow.detail = `${resultRow.detail} TEARDOWN FAILED for server ${provisioned.id}: ${err.message}. Orphan surfaced through sweep-orphans on next run.`;
+        evidence.teardownError = err.message;
+        evidence.orphanServerId = provisioned.id;
+      }
     }
   }
+  return { results: [resultRow], extra: evidence };
 }

package/blueprints/edge-cloudflare-access/CHANGELOG.md

@@ -1,12 +1,14 @@
 # Changelog
 
+## 1.1.4 - 2026-09-12
+
+- The application-admin-console fixture now refuses unauthenticated requests on gated sign-in paths (AC-21815-2), so the admin-console-gate-surface probe supplies a fixture Authorization header when the applied capability set includes zeroTrustGate; the fallback (non-gated) request is unchanged.
+
 ## 1.1.3 - 2026-09-10
 
 Positive-evidence rule alignment on the probe pack skip path (authoring standard section 7d); register tidy in shipped prose (no capability change).
 
 - Probes and fixture: the account-bound skip return on `contributions/probes/real-account-gated-url.mjs` now carries a `reason` field naming the exact env var(s) that were unset; the same fixture README (`packages/rcf-lite/test/fixtures/cf-edge/README.md`) gains a "Declared env vars" section covering the access-side env-var surface, per authoring standard section 7d. Skip-path probe reports regenerated so the shipped shape carries the new field.
-- Closes F-8: README compose bullet and consumer note stripped of internal pattern label.
-- Closes F-9: REQ-006 description stripped of internal mechanism label.
 
 ## 1.1.2 - 2026-09-10
 
@@ -21,8 +23,7 @@ Single-mechanism story legality notes; owner reference for the audit-record shap
 
 ## 1.1.0 - 2026-09-09
 
-hardening pass edge (criterion a REQ-layer backing; criterion b AC-set sufficiency; criterion c chain consistency lint-zero on pass 1 and pass 2).
-
+Adds REQ-007 with its US-34110 binding, and adds failure-path ACs to US-34102, US-34104 and US-34107.
 - Added REQ-007 and US-34110: the shipped guide names, per policy-shape option, the required dashboard-owned inputs (email domain, group name, identity provider, application-vs-path scope) and every shipped elicit alongside its runtime effect (closes F-1).
 - Added failure-path ACs to US-34102 (AC-34102-2..5 close F-2: wrong audience, malformed JWT, unknown kid after refresh, JWKS-unavailable fail-closed); US-34104 (AC-34104-2..3 close F-3: neither and both application identifiers refuse apply); US-34107 (AC-34107-2..5 close F-4: break-glass disabled, wrong id, wrong secret via constant-time compare, and partial-pair fall-through).
 - Every REQ now carries `deliveredBy`; every AC carries `disposition`; ACs referencing owner-owned literals carry `ownerRef`.
@@ -31,7 +32,7 @@ hardening pass edge (criterion a REQ-layer backing; criterion b AC-set sufficien
 
 
 All notable changes to `edge-cloudflare-access` are recorded here. The shape follows Keep a Changelog and Semantic Versioning per the blueprint authoring standard.
-- Review fix pass (2026-09-09): split US-34103 into canonical-pass and SIMULATE_NON_VALIDATOR_HEADER-fail ACs, each with a concrete oracle (probe verdict + named field) and an `ownerRef` into TAC-3501. Re-marked ACs per section 7b: mechanism-invariant refusal reasons (`aud-mismatch`, `jwt-malformed`, `kid-unknown`, `jwks-unavailable`, `bypass-id-mismatch`, `bypass-secret-mismatch`, `jwt-missing`), audit-record shapes, guide-section presence assertions and the JWT validator happy path stay `fixed`; US-34104 AC-34104-1 (elicit shape recording), US-34107 AC-34107-1/-3/-4/-5 (bypass id/secret pair) and US-34109 AC-34109-1 (CF_ACCESS_HOST) re-marked `template` naming the values the applying agent sets (access-application-host or access-selfhosted-app-id, access-audience, access-jwks-url, access-policy-shape enum, access-bypass-service-auth-id + paired secret, CF_ACCESS_HOST). Vendor citations added on US-34101 (Cf-Access-Jwt-Assertion header), US-34105 (Zero Trust dashboard docs), US-34107 AC-34107-1 (service-tokens docs) and US-34109 (Access policies docs). Genuinely single-mechanism stories (US-34101, US-34105, US-34106, US-34108, US-34109, US-34110) carry the section-7a note inside the story `description` field, not in a schema-illegal new field.
+- split US-34103 into canonical-pass and SIMULATE_NON_VALIDATOR_HEADER-fail ACs, each with a concrete oracle (probe verdict + named field) and an `ownerRef` into TAC-3501. Re-marked ACs per section 7b: mechanism-invariant refusal reasons (`aud-mismatch`, `jwt-malformed`, `kid-unknown`, `jwks-unavailable`, `bypass-id-mismatch`, `bypass-secret-mismatch`, `jwt-missing`), audit-record shapes, guide-section presence assertions and the JWT validator happy path stay `fixed`; US-34104 AC-34104-1 (elicit shape recording), US-34107 AC-34107-1/-3/-4/-5 (bypass id/secret pair) and US-34109 AC-34109-1 (CF_ACCESS_HOST) re-marked `template` naming the values the applying agent sets (access-application-host or access-selfhosted-app-id, access-audience, access-jwks-url, access-policy-shape enum, access-bypass-service-auth-id + paired secret, CF_ACCESS_HOST). Vendor citations added on US-34101 (Cf-Access-Jwt-Assertion header), US-34105 (Zero Trust dashboard docs), US-34107 AC-34107-1 (service-tokens docs) and US-34109 (Access policies docs). Genuinely single-mechanism stories (US-34101, US-34105, US-34106, US-34108, US-34109, US-34110) carry the section-7a note inside the story `description` field, not in a schema-illegal new field.
 
 
 ## 1.0.0 (2026-09-07)