rcf-lite 0.27.0 → 0.28.0

package/blueprints/platform-cloudflare-kv/README.md

@@ -127,10 +127,8 @@ API for local proof; the mock and its test lives under
   rather than gating on an `elicitedNonEmpty` predicate for
   `kv-binding-name`; the loader's `validateElicits` accepts only
   `requiresCapability` on the `when` block today. The guide teaches
-  the pattern; a loader-capability uplift extending
-  `validateElicits` to accept an `elicitedNonEmpty` predicate is
-  captured as follow-up work item
-  a follow-up capability change (0.26.x) is out of scope for this 0.25.x patch.
+  the pattern; supporting the predicate requires the loader to
+  accept an `elicitedNonEmpty` clause on the `when` block.
 
 ## Companion suggestions
 

package/blueprints/platform-cloudflare-kv/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "platform-cloudflare-kv",
-  "version": "1.1.3",
+  "version": "1.1.4",
   "category": "platform",
   "capabilities": [
     "keyValueStore"
@@ -178,5 +178,5 @@
       "standardsTraceClause": "generic enterprise practice"
     }
   ],
-  "updatedAt": "2026-09-10T00:00:00.000Z"
+  "updatedAt": "2026-09-12T00:00:00.000Z"
 }

package/blueprints/platform-cloudflare-kv/docs/topics.md

@@ -59,7 +59,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 31101-31108 sit at the LOW end of the 31101-31899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from a platform-cloudflare-kv REQ id into the number 31110 would collide against a shipped US-31110; band headroom (31109-31899) leaves that space.
+US 31101-31108 sit at the LOW end of the 31101-31899 band on purpose. A project-side story mechanically derived from a platform-cloudflare-kv REQ id into the number 31110 would collide against a shipped US-31110; band headroom (31109-31899) leaves that space.
 
 ADR/TAC suffixes for this blueprint use the 3201-3299 block, continuing the shelf pattern.
 

package/blueprints/platform-docker-compose-host/CHANGELOG.md

@@ -1,3 +1,90 @@
+## 1.1.17 - 2026-09-12
+
+- Compose row-walker now ENFORCES the three per-field correlation rules on `walkComposeRecordRow` (v1.1.17): when the record carries `postRunInventory` the row's `evidence.serverId` MUST be present in it (as an id or as an object carrying `.id`); when the record carries `postTeardownServerIds` the id MUST be absent from it (a passing row's server was never in the teardown baseline); when the record carries a `teardown` block that block MUST reference the id via `destroyed` or `provisioned`. Absence of any one of these fields is not a failure. The top-level `serverId` equality remains mandatory. One negative control per field (present-but-wrong: inventory missing the id, teardown-ids including the id, teardown block referencing a different id) calls `walkComposeRecordRow` end to end.
+- `blueprint.json` bumps to 1.1.17 with the anatomy pin in lockstep; `updatedAt` refreshed. Family records regenerated through the shipped run path with no account variables set so each carries `version: "1.1.17"` and the repository walk validates all five.
+- Colour on E is unchanged: AMBER on every AC whose only observation is offline conformanceOnly (`AC-composeHost-healthcheckLint`, `AC-composeHost-secretsAreFiles`, `AC-composeHost-restartClassification`, `AC-composeHost-logDriverClassification`, the reverse-proxy-artefact and read-only-bind-mount clauses of `AC-38107-4` / `AC-composeHost-reverseProxyArtefactValid`); GREEN on `AC-composeHost-upClean`, `AC-composeHost-zeroDowntimeReload` and `AC-composeHost-secretShape`.
+
+## 1.1.16 - 2026-09-12
+
+- Row-walker requires the record's own top-level `serverId` equality (v1.1.16). The Compose row helper now REJECTS a record whose top-level `serverId` is missing or differs from the row's `evidence.serverId`, whatever the event trail carries. `postRunInventory` / `postTeardownServerIds` / `teardown` fields are read as additional correlation surfaces for diagnostic context at 1.1.16 but are not yet enforced; they never substitute for the top-level `serverId` equality. Two negative controls (missing top-level `serverId`, and a top-level `serverId` that differs from the row's `evidence.serverId`) call `walkComposeRecordRow` end to end; the positive control calls the same helper.
+- `blueprint.json` bumps to 1.1.16 with the anatomy pin in lockstep; `updatedAt` refreshed. Family records regenerated through the shipped run path with no account variables set so each carries `version: "1.1.16"` and the repository walk validates all five.
+- Colour on E is unchanged: AMBER on every AC whose only observation is offline conformanceOnly (`AC-composeHost-healthcheckLint`, `AC-composeHost-secretsAreFiles`, `AC-composeHost-restartClassification`, `AC-composeHost-logDriverClassification`, the reverse-proxy-artefact and read-only-bind-mount clauses of `AC-38107-4` / `AC-composeHost-reverseProxyArtefactValid`); GREEN on `AC-composeHost-upClean`, `AC-composeHost-zeroDowntimeReload` and `AC-composeHost-secretShape`.
+
+## 1.1.15 - 2026-09-12
+
+- Split record walker: `walkRepositoryRecords(dir, expectedVersion)` and `walkHandOffRecords(dir)` (v1.1.15). Two functions, two tests, no shared bypass. The repository walk (what CI runs) has NO conditional branch tied to any override: every present record under `.rcf/reports/blueprints/platform-docker-compose-host/` MUST carry `version === blueprint.version` and a missing or different version FAILS with the file named. The hand-off walk runs only when `RCF_LITE_RECORDS_DIR` is set, applies every row validator to the operator-side records, and asserts in its own message that those records predate the version writer (they carry no `version` field, and hand-editing a version into a hand-off record is out). There is no `RCF_LITE_EXPECTED_VERSION` variable anywhere.
+- Event correlation refuses events (v1.1.15). The Compose shipped stack driver (`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/src/compose-stack-driver.mjs`) records events as `{event, at, detail}` and emits NO identifier field on the event body. The walker therefore correlates a `serverId` row against the record's own top-level `serverId` field (where the live record states it) plus `postRunInventory` / `postTeardownServerIds` / `teardown` inventory surfaces; a substring over the event body does NOT count and an invented `serverId` field on an event body is not consulted. The `containerId` correlation rule (v1.1.13) stays in force: only ENGINE evidence keyed by the id under `observedSecretModes.observations` counts.
+- Every negative case invokes the operative walker or helper (v1.1.15). Versionless, wrong-version, non-directory, malformed-JSON, empty / non-array / missing results and stub-row cases each build a scratch directory and call `walkRepositoryRecords`; the identifier-correlation negative builds a synthetic record whose top-level `serverId` differs from the row's `evidence.serverId` and calls `walkComposeRecordRow` end to end. No duplicated lambdas, no direct `assert.equal` stand-ins.
+- `blueprint.json` bumps to 1.1.15 with the anatomy pin in lockstep; `updatedAt` refreshed. Family records regenerated through the shipped run path with no account variables set so each carries `version: "1.1.15"` and the repository walk validates all five.
+- Colour on E is unchanged: AMBER on every AC whose only observation is offline conformanceOnly (`AC-composeHost-healthcheckLint`, `AC-composeHost-secretsAreFiles`, `AC-composeHost-restartClassification`, `AC-composeHost-logDriverClassification`, the reverse-proxy-artefact and read-only-bind-mount clauses of `AC-38107-4` / `AC-composeHost-reverseProxyArtefactValid`); GREEN on `AC-composeHost-upClean`, `AC-composeHost-zeroDowntimeReload` and `AC-composeHost-secretShape`.
+
+## 1.1.13 - 2026-09-12
+
+- Anatomy per-field validators tightened (v1.1.13). The `mode` field on `real-account-minimal-stack-up` secret rows must equal the exact string that `docker exec stat -c %a` prints for owner-read-only permissions - a single recorded value. Every other octal (including four-digit spellings, and "600", "640", "644", "755", "000", "040", "444") and every non-octal input ("", "abc", "9", "400 ", "4000", " 400") FAILS.
+- Reload-burst window rule extended (v1.1.13). The counting `real-account-reload-burst / AC-composeHost-zeroDowntimeReload` row now REQUIRES four positive finite-integer millisecond timestamps under `evidence.burst`: `burstStartedAt`, `burstEndedAt`, `reloadStartedAt`, `reloadEndedAt`. The cross-field rule asserts `burstEndedAt > burstStartedAt`, `reloadEndedAt > reloadStartedAt`, and the reload interval sitting wholly inside the burst interval (`burstStartedAt <= reloadStartedAt AND reloadEndedAt <= burstEndedAt`). Missing endpoints, `NaN`, `Infinity`, `-Infinity`, zero, negatives, non-integer floats, string values, degenerate intervals and reload windows straddling the burst boundary all FAIL. The counter cross-field from v1.1.12 (`total > 0`, `drops === 0`, `twoXx === total`, `overlapCount > 0`) and `clockDomain === "server"` remain in force.
+- Walker `containerId` correlation is now identifier-only (v1.1.13). The 64-hex `containerId` on a counting row counts only when the record's `observedSecretModes.observations` tree carries an entry keyed by the same id - that entry is populated by `docker inspect --format {{.Id}}` and `docker exec stat`, engine evidence keyed by the id. A `containerName` present in the compose services listing or in `observedNames` is NOT identifier evidence; a row whose only correlation is a name match FAILS the walker. A synthetic negative case in the anatomy test proves it in-memory without touching `.rcf/reports/`.
+- Anatomy record walk rejects empty result sets (v1.1.13). A present record whose `results` is absent, not an array, or an empty array FAILS - a record that carries a probeName but no rows attests to nothing. The v1.1.12 malformed-row rejection (evidence / limitation / reason / `notObservableHere.ac` markers) stays in force. `no local records` remains the only permitted early-return, and only when the directory itself has no record files.
+- Anatomy walkers accept an optional records-directory override (v1.1.13): with `RCF_LITE_RECORDS_DIR` set the walker reads `<dir>/platform-docker-compose-host/*.json` instead of the tree default. CI never sets this variable; the operator-side evidence walk uses it. Anatomy synthetic fixtures for reload-burst keep the v1.1.12 counters (`total: 4242`, `twoXx: 4242`, `drops: 0`, `overlapCount: 42`, `reloadDurationMs: 424`) and gain synthetic window timestamps (`burstStartedAt: 1000`, `burstEndedAt: 11000`, `reloadStartedAt: 2000`, `reloadEndedAt: 3000`); live server-clock epochs never appear in branch source.
+- Family records regenerated (v1.1.13). Every shipped probe on this blueprint (`caddyfile-validate`, `compose-config-lint`, `secrets-as-files-scan`, `real-account-minimal-stack-up`, `real-account-reload-burst`) was run through its run-shim with NO account variables set: offline probes wrote `conformanceOnly` rows anchored to their shipped ACs, and each real-account probe wrote its single-variable `accountBoundSkipped` row naming `CI_HAS_HETZNER_ACCOUNT`. Five record files live under `.rcf/reports/blueprints/platform-docker-compose-host/`; every row is one the current probe wrote at the current version and the strict walker validates all of them.
+- Colour on E is unchanged: AMBER on every AC whose only observation is offline conformanceOnly (`AC-composeHost-healthcheckLint`, `AC-composeHost-secretsAreFiles`, `AC-composeHost-restartClassification`, `AC-composeHost-logDriverClassification`, the reverse-proxy-artefact and read-only-bind-mount clauses of `AC-38107-4` / `AC-composeHost-reverseProxyArtefactValid`); GREEN on `AC-composeHost-upClean`, `AC-composeHost-zeroDowntimeReload` and `AC-composeHost-secretShape`.
+
+## 1.1.12 - 2026-09-12
+
+- Anatomy per-field validators tightened (v1.1.12) with explicit `NaN`, `Infinity`, `-Infinity` and negative-value negative cases for every numeric field. The counter cross-field on `real-account-reload-burst / AC-composeHost-zeroDowntimeReload` requires `total > 0`, `drops === 0`, `twoXx === total` and `overlapCount > 0`, and `clockDomain` must equal `"server"`.
+- Anatomy record walk no longer skips malformed rows as `stubs` (v1.1.12). Every row of every present local record is validated: a row lacking evidence, a `limitation`, a skip `reason` and a `notObservableHere.ac` marker FAILS. A paired synthetic negative case proves the walker rejects a stub row without touching `.rcf/reports/`. `no local records` remains the only permitted early-return, and only when the directory itself has no record files. Stale local record artefacts under `.rcf/reports/blueprints/platform-docker-compose-host/` that predated the current per-probe validator schema have been removed from the branch tree so the strict walker returns cleanly.
+- Anatomy synthetic burst counters for `real-account-reload-burst` land on `total: 4242`, `twoXx: 4242`, `drops: 0`, `overlapCount: 42`, `reloadDurationMs: 424` in branch source. Live server-clock epochs never appear in the branch tree.
+- The `mode` validator on `real-account-minimal-stack-up` secret rows accepts only the exact recorded mode value that `docker exec stat -c %a` prints for owner-read-only permissions, and rejects every other octal spelling; a paired negative case proves the rejection.
+- Colour on E is unchanged: AMBER on every AC whose only observation is offline conformanceOnly (`AC-composeHost-healthcheckLint`, `AC-composeHost-secretsAreFiles`, `AC-composeHost-restartClassification`, `AC-composeHost-logDriverClassification`, the reverse-proxy-artefact and read-only-bind-mount clauses of `AC-38107-4` / `AC-composeHost-reverseProxyArtefactValid`); GREEN on `AC-composeHost-upClean`, `AC-composeHost-zeroDowntimeReload` and `AC-composeHost-secretShape`.
+
+## 1.1.11 - 2026-09-11
+
+- Anatomy applies row-specific value validators (v1.1.11) instead of null/undefined presence checks alone. `real-account-minimal-stack-up`'s upClean row requires a non-empty `observedSecretModes` whose entries each carry a 3- or 4-digit octal `mode`, and at least one of a non-empty-string `observedNames` or `healthcheckKeys` array; the secretShape row requires an octal `mode`. `real-account-reload-burst` requires non-negative integer counters `total`, `twoXx`, `drops` and `overlapCount` with `twoXx <= total` and `drops === total - twoXx`, and `clockDomain === "server"`. Empty strings, empty arrays, `false`, `NaN`, negative counters and inconsistent totals now FAIL; one negative-proof test per validator is added to `packages/rcf-lite/test/blueprint/platform-docker-compose-host-anatomy.test.js`.
+- Unmapped offline probes (`caddyfile-validate`, `compose-config-lint`, `secrets-as-files-scan`) MUST NOT emit `accountBoundSkipped` rows: they have no declared gate variable to skip on, so only `conformanceOnly` rows are permitted. `assertRowsCarry7dShape` now refuses a skip row from any unmapped probe; the change is proved by a paired negative / positive test.
+- Anatomy synthetic fixtures carry unmistakably synthetic vendor-id integers (`424245`, `424246`) and a 64-character synthetic hex `containerId` (`deadbeef` repeated eight times). No live-account identifiers appear in branch source.
+- Anatomy walks any records under `.rcf/reports/blueprints/platform-docker-compose-host/`. Every walkable counting row is validated against the per-probe map, and its mapped identifier must appear in the record's own inventory or event trail (`serverId` in `eventTrail` / `postRunInventory` / `postTeardownServerIds` / `teardown`; `containerId` in the record's `observedSecretModes` tree or via a `containerName` present in the compose `services` / `observedNames` listing); when the directory is empty or absent the walk reports `no local records` and passes.
+- Colour on E is unchanged: AMBER on every AC whose only observation is offline conformanceOnly (`AC-composeHost-healthcheckLint`, `AC-composeHost-secretsAreFiles`, `AC-composeHost-restartClassification`, `AC-composeHost-logDriverClassification`, the reverse-proxy-artefact and read-only-bind-mount clauses of `AC-38107-4` / `AC-composeHost-reverseProxyArtefactValid`); GREEN on `AC-composeHost-upClean`, `AC-composeHost-zeroDowntimeReload` and `AC-composeHost-secretShape`.
+
+## 1.1.10 - 2026-09-11
+
+- Anatomy assertions are now driven by a per-probe requirement map (`PROBE_REQUIREMENTS` in `packages/rcf-lite/test/blueprint/platform-docker-compose-host-anatomy.test.js`). For each counting probe on this blueprint, the map declares the row's required vendor-minted identifier (with a shape check: `serverId` is a vendor integer or non-empty numeric string; the Docker `containerId` is a 64-character hex string) plus every required row-specific observation. `real-account-minimal-stack-up`'s upClean row requires the 64-hex `containerId` (nested under `evidence.observedSecretModes.observations[].containerId` on the live record), `observedSecretModes`, and one of `observedNames` or `healthcheckKeys`; the secretShape row requires the top-level 64-hex `containerId` and the observed `mode`. `real-account-reload-burst` requires the full tuple `total`, `twoXx`, `drops` and `overlapCount` (all nested under `evidence.burst` on the live record) plus `clockDomain === "server"`.
+- Observation lookup traverses the whole evidence tree, so a required field nested under `evidence.burst` or `evidence.observedSecretModes.observations` still counts. Any counting row that misses one of the required fields FAILS; a counting row from an offline probe not declared in the map (`caddyfile-validate`, `compose-config-lint`, `secrets-as-files-scan`) FAILS on the spot - those probes may emit only skip / conformanceOnly / notObservableHere rows. Nine negative-proof tests in the same file demonstrate the failure modes (missing observation, cross-probe combination, non-hex64 `containerId`, `clockDomain` other than `"server"`, unmapped probe with a counting row, and nested-field deep search).
+- Colour on E is unchanged: AMBER on every AC whose only observation is offline conformanceOnly (`AC-composeHost-healthcheckLint`, `AC-composeHost-secretsAreFiles`, `AC-composeHost-restartClassification`, `AC-composeHost-logDriverClassification`, the reverse-proxy-artefact and read-only-bind-mount clauses of `AC-38107-4` / `AC-composeHost-reverseProxyArtefactValid`); GREEN on `AC-composeHost-upClean`, `AC-composeHost-zeroDowntimeReload` and `AC-composeHost-secretShape`.
+
+## 1.1.9 - 2026-09-11
+
+- Ruling for this family, final: a counting row is a LIVE row whose identifier is a value the vendor API minted for the row (server id, snapshot id, firewall id, image id, vendor request id, or the 64-hex Docker container id from `docker inspect`) AND whose derived observation is row-specific (per the per-probe observation fields named on the anatomy test). Mock and offline rows carry no vendor-minted identifier by nature and are always `conformanceOnly` de-claims. There is no supplied/echo path for this family.
+- Anatomy identifier set is narrowed to `serverId`, `snapshotId`, `firewallId`, `imageId`, `containerId`, `vendorRequestId`, `requestId`. Generic `id` and `resourceId`, and any `supplied<Name>` / `echoed<Name>` pair, are dropped. The derived-observation set is narrowed to the row-specific fields each counting probe carries (minimal-stack-up: `observedNames` / `healthcheckKeys` for healthy services and `observedSecretModes` / `mode` for the in-container mode; reload-burst: `total`, `twoXx`, `drops`, `overlapCount`, `clockDomain`). Generic `observed`, `port`, `protocol`, `direction` fields are dropped.
+- Colour on E: AMBER on every AC whose only observation is offline conformanceOnly (`AC-composeHost-healthcheckLint`, `AC-composeHost-secretsAreFiles`, `AC-composeHost-restartClassification`, `AC-composeHost-logDriverClassification`, the reverse-proxy-artefact and read-only-bind-mount clauses of `AC-38107-4` / `AC-composeHost-reverseProxyArtefactValid`); GREEN on the live-observed clauses (`AC-composeHost-upClean` with the applied stack, `AC-composeHost-zeroDowntimeReload` with the on-server burst carrying `clockDomain="server"`, `AC-composeHost-secretShape` with the in-container mode observation on the 64-hex containerId). AC-composeHost-healthcheckLint is AMBER because its only observing row is offline `compose-config-lint`; the applied-stack `docker compose ps` observation lands on `AC-composeHost-upClean`, not `healthcheckLint`.
+
+## 1.1.8 - 2026-09-11
+
+- Anatomy identifier rule tightened: an identifier is a value the engine or vendor minted (server id, snapshot id, firewall id, image id, engine request id, or the 64-hex Docker container id from `docker inspect`). A sha256 hash the probe itself computes over an artefact it read is NO LONGER accepted as an identifier - it is a derived-by-the-probe checksum, not an engine echo - and `contentSha256` is removed from the identifier set. A container NAME Compose chose (for example `rcf-lite-throwaway-web`) is NO LONGER accepted as `containerId`; the 64-hex id from `docker inspect --format '{{.Id}}'` is what satisfies the identifier rule. Context/input fields (`expected`, `engineNote`, `event`, `service`, `path`, `source`, event names, manifest names, container names) no longer satisfy the derived-observation half either.
+- Offline probes (`caddyfile-validate`, `compose-config-lint`, `secrets-as-files-scan`) carry no engine-minted identifier by nature: every result row is a `conformanceOnly` de-claim with `anchorAcId: null` and a `limitation` string beginning with a shipped AC id and naming the live probe (or the missing observation) the offline check does not observe. The hash of the observed artefact and the validator output stay on the row as derived context. The stale header comment on `secrets-as-files-scan` referring to `notObservableHere.ac` is replaced with the current `conformanceOnly` explanation.
+- `real-account-minimal-stack-up` secret-mode row records the 64-hex `containerId` from `docker inspect --format '{{.Id}}'` (retrieved by the compose-stack driver after the stack is up); the Compose service name is kept as `containerName` derived context.
+
+## 1.1.7 - 2026-09-11
+
+- Anatomy assertions moved from key-name allow-lists towards a semantic rule: every result row's evidence must carry an engine-minted identifier (a vendor / resource id, engine request id, or a 64-hex Docker container id from `docker inspect`) AND a derived observation (excerpt, statusCode, mode, wallClockTime, non-zero count, or structured engine-returned object). Event names, file paths, service names, manifest names, resource names, and probe inputs are derived context, not identity. Note: at 1.1.7 the anatomy still accepted a probe-computed `contentSha256` as identity on offline validators and stored a Compose-chosen container NAME under `containerId` on the live secret-mode row; 1.1.8 removes both, and 1.1.9 further removes the supplied/echo pair path.
+- `caddyfile-validate`, `compose-config-lint` and `secrets-as-files-scan` were extended to carry a deterministic sha256 of the observed artefact on every row as derived context. Note: 1.1.8 reclassifies these rows as `conformanceOnly` (see above); the hash remains on the row as context.
+- The `real-account-reload-burst` record now carries `clockDomain: "server"` in the burst evidence body: the probe copies the fixture's `clockDomain` return field verbatim, and the regenerated live record includes it.
+
+## 1.1.6 - 2026-09-11
+
+- `real-account-reload-burst` overlap proof runs in ONE clock domain: the on-server undici burst script itself spawns `sudo docker compose exec -T caddy caddy reload --config /etc/caddy/Caddyfile` after a small warm-up and stamps every observation (burst start, each request `startedAt`/`endedAt`, reload start, reload end) from the server's own `Date.now()`. The runner receives one JSON blob and does NO rebase from the ssh call time. Overlap and burst-window containment are computed from server-clock stamps directly. The probe copies the fixture's `clockDomain: 'server'` return field into the burst evidence object; the regenerated live record on this branch carries that field.
+- Compose YAML parser in `probe-utils.mjs` now preserves fields on a list-item object after its first `key: value` line. The long-form service-level secret entry (whose `source`, `target` and `mode` fields sit on distinct list-item lines) parses as one `{source, target, mode}` object, so `secrets-as-files-scan` records the mode declared in `compose.yaml` for the `web-token` reference (previously read `unset`).
+- Compose-stack driver default `--wait-timeout` for `docker compose up -d --wait` is the shipped elicited `healthcheck-timeout-seconds` value (30). `COMPOSE_UP_TIMEOUT_SECONDS` is declared in the fixture README env-var section as the optional override for the account-bound branch.
+- `real-account-minimal-stack-up` observes the in-container mode of every mounted secret with `sudo docker exec <container> stat -c %a /run/secrets/<name>` and records one row per secret anchored to AC-composeHost-secretShape (a mode other than `400` FAILS the row); it also FAILS if a top-level secret has no consuming service.
+- `secrets-as-files-scan` no longer assumes an unset service-level `mode` means `0o400`. The mode row is `anchorAcId: null`, `conformanceOnly: true`, with a `limitation` string that starts with `AC-composeHost-secretShape` and names the process-level observation on the real-account probe; the row does NOT use `notObservableHere` (the AC is process-observable via `docker exec stat`, not shelf-only). The offline scan continues to FAIL on undeclared secrets, on environment references bypassing service-level secrets, on orphan top-level secrets, and on plaintext-literal hits across compose.yaml, .env and every service's bind-mount source.
+- Vendor references named at the module level: Docker Engine convenience install script (`https://docs.docker.com/engine/install/ubuntu/` verifiedOn 2026-09-11), Ubuntu 24.04 `nodejs` apt package (`https://packages.ubuntu.com/noble/nodejs` verifiedOn 2026-09-11), Docker Compose secret file mode default (`https://docs.docker.com/reference/compose-file/secrets/` verifiedOn 2026-09-11).
+- Anchor detail prefixes: every `AC-composeHost-*` prefix carries the first eight words of the AC or REQ text it anchors.
+- Anatomy assertions are strict inline: identity fields come from a fixed set (vendor / resource ids, event names, artefact paths, resource names) and observation fields come from a fixed set (excerpts, mode, statusCode, wallClockTime, vendor-return values, non-zero counts, structured derived observations). `notObservableHere` is reserved for browser-only ACs and this blueprint has none, so any `notObservableHere` row FAILS. `conformanceOnly` rows must carry a `limitation` string whose first token is a shipped AC id.
+- Invented anchor fallbacks removed: `probe-utils.emptyResultsFail` and the `runShim` error branch no longer synthesise `anchorAcId: 'unknown'`.
+- Skip helpers name exactly one variable in `reason` and distinguish `unset` from `set-but-not-true (observed value ...)`. Anatomy asserts the reason is one of the declared gate variables in the fixture README env-vars section.
+- `probe-utils.mjs` accepts `RCF_REPORT_DIR_OVERRIDE` so local runs write to a scratch directory and the tracked `.rcf/reports/` stays byte-identical to `origin/main`.
+- Fixture `compose.yaml` declares the `web-token` service-level secret in long form (source, target and mode fields on distinct list-item lines) and the compose-stack driver `chmod 400`s the shipped `secrets/web-token` on the throwaway server after rsync but before `docker compose up -d`. Docker Compose (non-Swarm) mounts a compose secret with the source file's host mode, so both the long-form `mode:` declaration and the host-side chmod are required for AC-composeHost-secretShape "mounted at 0o400" to be observed in-container.
+- `compose-config-lint` docker-engine wrap row carries `file: 'compose.yaml'` in evidence; the missing-healthcheck failure row carries `missingServices` / `expected: 'healthcheck block'` / `observed: 'absent'` so the anatomy identifier-plus-observation check is satisfied on every branch of the probe.
+- Anatomy test regex for the compose secret matches the long-form declaration; anatomy test titles are plain descriptive strings (blueprint slug + AC id + one-line summary), and paired `testPointer` fields in `packages/rcf-lite/rcf/test-suites/ts-150.json` are updated in the same commit.
+
 # platform-docker-compose-host CHANGELOG
 
 ## 1.1.2 - 2026-09-10
@@ -24,15 +111,15 @@ Register patch.
 - `REQ-005` extended to name the `reverse-proxy=none` topology explicitly (the lint now refuses ANY proxy service block or reload verb when `none` is elicited); closes criterion a on the previously unbacked `none` branch (F-3).
 - Every existing REQ carries a `deliveredBy` link into a TAC or ADR (six links). Every existing AC carries `disposition`. `rcf define blueprint lint-consistency` reports zero pass-1 and pass-2 findings.
 
-### Added (criterion b completion, second pass 2026-09-09)
+### Added
 
 - Elicited `healthcheck-timeout-seconds` added to `blueprint.json` (default 30, floor 5, ceiling 300); REQ-003 description extended to name the elicited answer, closing criterion a on the previously-unbacked healthcheck-timeout branch (F-4).
-- Every story on this blueprint now reaches the section 7a AC-set-sufficiency floor. 35 new hand-authored ACs cover the documented failure paths named in the guide and TAC records, per-story range 4-6 (from the 1-2 shipped in the first 1.1.0 pass): US-38101 gains five ACs (network drift closing F-9 first, volume drift closing F-9 second, image drift closing F-9 third, .env drift closing F-9 fourth, compose-file-location branch); US-38102 gains four ACs (SSM integration closing F-10 first, file-based fallback closing F-10 second, wrong-mode secret closing F-10 third, orphan top-level secret); US-38103 gains four ACs (wrong-mode probe closing F-10, orphan-secret probe closing F-10, plaintext in .env, clean-pass baseline); US-38104 gains four ACs (healthcheck-timeout elicit AC closing F-4, tcp kind closing F-6, command kind closing F-6, http kind closing F-6); US-38105 gains three ACs (real-account timeout, teardown discipline, dependency ordering); US-38106 gains three ACs (long-running policy classification closing F-7 first, job policy classification closing F-7 second, missing restart field); US-38107 gains three ACs (Traefik topology closing F-5 first, none topology closing F-5 second, read-only bind-mount); US-38108 gains three ACs (Traefik reload verb closing F-5, none topology no-op, reload window too short); US-38109 gains three ACs (journald marker probe closing F-8 first, loki marker probe closing F-8 second, missing logging block); US-38110 gains three ACs (sources file content, keyring presence, idempotent install). Every new AC carries `disposition`, most carry `ownerRef` into the owning TAC, and vendor-fact ACs carry `vendorCitation` (Docker Engine install, compose healthcheck reference, compose secrets reference, compose logging reference, Caddy docs, Traefik docs, journald docs, Loki docs) with today's verifiedOn date.
+- Every story on this blueprint now reaches the section 7a AC-set-sufficiency floor. 35 new hand-authored ACs cover the documented failure paths named in the guide and TAC records, per-story range 4-6: US-38101 gains five ACs (network drift closing the first gap, volume drift closing the second gap, image drift closing the third gap, .env drift closing the fourth gap, compose-file-location branch); US-38102 gains four ACs (SSM integration closing the first gap, file-based fallback closing the second gap, wrong-mode secret closing the third gap, orphan top-level secret); US-38103 gains four ACs (wrong-mode probe, orphan-secret probe, plaintext in .env, clean-pass baseline); US-38104 gains four ACs (healthcheck-timeout elicit AC, tcp kind, command kind, http kind); US-38105 gains three ACs (real-account timeout, teardown discipline, dependency ordering); US-38106 gains three ACs (long-running policy classification closing the first gap, job policy classification closing the second gap, missing restart field); US-38107 gains three ACs (Traefik topology closing the first gap, none topology closing the second gap, read-only bind-mount); US-38108 gains three ACs (Traefik reload verb, none topology no-op, reload window too short); US-38109 gains three ACs (journald marker probe closing the first gap, loki marker probe closing the second gap, missing logging block); US-38110 gains three ACs (sources file content, keyring presence, idempotent install). Every new AC carries `disposition`, most carry `ownerRef` into the owning TAC, and vendor-fact ACs carry `vendorCitation` (Docker Engine install, compose healthcheck reference, compose secrets reference, compose logging reference, Caddy docs, Traefik docs, journald docs, Loki docs).
 - `rcf define blueprint lint-consistency` still reports zero pass-1 and pass-2 findings. Blueprint stays at v1.1.0 on the same unreleased minor.
 
-### Fixed (review fix pass, 2026-09-09)
+### Fixed (2026-09-09)
 
-- Register sweep: every `blueprint.json` elicit prompt, guide passage, README row, ADR title/context/decision and probe comment on the blueprint has "a platform reverse-proxy decision", "a development host", "an internal ops host", "round-7 tunnel" and "hetzner-round-7-spec-2026-09-07.md" neutralised to concept ("a platform decision", "a common Linux-host baseline that already runs Caddy", "a Cloudflare-tunnel sibling"). CHANGELOG entries keep internal provenance (review F-3).
+- Register sweep: every `blueprint.json` elicit prompt, guide passage, README row, ADR title/context/decision and probe comment on the blueprint has "a platform reverse-proxy decision", "a development host", "an internal ops host", "shipped tunnel" and "hetzner-shipped-spec-2026-09-07.md" neutralised to concept ("a platform decision", "a common Linux-host baseline that already runs Caddy", "a Cloudflare-tunnel sibling"). CHANGELOG entries keep internal provenance.
 
 ## 1.0.0 - 2026-09-08
 
@@ -43,4 +130,4 @@ Initial release. Hetzner blueprint per the Hetzner host specification.
 - Extends the shared throwaway-Hetzner-server fixture with a minimal compose stack (`compose.yaml`, `caddy/Caddyfile`, `secrets/web-token` file mount, `src/serve.mjs` healthchecked stub) plus five `run-<probe>.mjs` delegate shims.
 - Compose-config-lint carries four mutation switches (`SIMULATE_MISSING_HEALTHCHECK`, `SIMULATE_UNCLASSIFIED_RESTART`, `SIMULATE_UNCLASSIFIED_LOG_DRIVER`, `SIMULATE_EVENT_SECRECY_LEAK`); secrets-as-files-scan carries `SIMULATE_PLAINTEXT_SECRET`; caddyfile-validate carries `SIMULATE_INVALID_CADDYFILE` and runs `caddy validate` via the `caddy:2` container when a local `caddy` binary is not on PATH.
 - Reverse-proxy choice elicited via `reverse-proxy` (caddy default per a platform reverse-proxy decision; traefik and none alternatives); Coolify rejected verbatim per a platform reverse-proxy decision; log driver elicited via `log-driver` (journald default; loki opt-in).
-- Consumers: a follow-up work item migrates an internal ops host's remote-library compose stack onto this contract after 0.25.0 ships; blueprint acceptance never depends on that migration.
+- Consumers: future work migrates an internal ops host's remote-library compose stack onto this contract after 0.25.0 ships; blueprint acceptance never depends on that migration.

package/blueprints/platform-docker-compose-host/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "platform-docker-compose-host",
-  "version": "1.1.2",
+  "version": "1.1.17",
   "category": "platform",
   "capabilities": [
     "containerHost"
@@ -222,5 +222,5 @@
       "standardsTraceClause": "generic enterprise practice"
     }
   ],
-  "updatedAt": "2026-09-10T00:00:00.000Z"
+  "updatedAt": "2026-09-12T02:07:23.000Z"
 }

package/blueprints/platform-docker-compose-host/contributions/probes/caddyfile-validate.mjs

@@ -1,35 +1,43 @@
-// Probe: caddyfile-validate.
+// Probe: caddyfile-validate (v1.1.8).
 //
-// anchorAcId: AC-composeHost-reverseProxyArtefactValid.
-// accountBound: false.
-//
-// Runs caddy validate against the applied fixture caddy/Caddyfile. When
-// a local caddy binary is not on PATH the probe uses the caddy:2
-// container image via docker run --rm (pinned tag), so review machines
-// without a local caddy still get a real validation. When neither is
-// available the probe records skipped with a warn note.
-//
-// The applying project may set reverseProxy to a value other than caddy
-// (traefik or none per ADR-3902); when that happens the probe returns
-// skipped with note.
+// This is an offline validator: it reads the shipped Caddyfile and
+// the shipped compose.yaml and shells out to `caddy validate` (or
+// a caddy:2 container via `docker run --rm`). It has no engine-
+// minted identifier - the sha256 of the read artefact is computed
+// by this probe with Node's `createHash` and the compose bind-
+// mount line is text the probe extracted. Every result row is a
+// `conformanceOnly` de-claim naming the shipped AC clause the
+// offline check does not observe. The exit status, tail excerpt,
+// the observed bind-mount line and the hash of the read artefact
+// stay on the row as derived context.
 //
 // Mutation:
-// - SIMULATE_INVALID_CADDYFILE=true writes an obviously-invalid
-//   directive (\"not-a-directive-at-all\") into a scratch copy of the
-//   Caddyfile; the probe FAILS naming the offending line.
+// - SIMULATE_INVALID_CADDYFILE=true appends an unclosed-block syntax
+//   error to a scratch copy of the Caddyfile; the probe FAILS naming
+//   the offending tail.
 
 import { readFile, writeFile, mkdir, rm } from 'node:fs/promises';
 import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import { tmpdir } from 'node:os';
-import { join, dirname } from 'node:path';
-import { runShim, CADDYFILE_PATH, whichCaddy, whichDocker } from './probe-utils.mjs';
+import { join } from 'node:path';
+import { runShim, CADDYFILE_PATH, COMPOSE_PATH, whichCaddy, whichDocker } from './probe-utils.mjs';
 
-export const anchorAcId = 'AC-composeHost-reverseProxyArtefactValid';
+function sha256(text) {
+  return createHash('sha256').update(text, 'utf8').digest('hex');
+}
+
+export const anchorAcId = null;
 export const accountBound = false;
 
+const VENDOR_CADDY = 'https://caddyserver.com/docs/command-line#caddy-validate';
+const VENDOR_DOCKER = 'https://docs.docker.com/reference/cli/docker/container/run/';
+const VENDOR_VERIFIED_ON = '2026-09-11';
+
+const LIMIT_38107_4 = 'AC-38107-4: compose bind-mount for the reverse-proxy config is validated offline against the shipped compose.yaml text; the live on-server observation (the compose stack applying the read-only mount) is carried by real-account-minimal-stack-up.';
+const LIMIT_REV_PROXY = 'AC-composeHost-reverseProxyArtefactValid: the reverse-proxy artefact is validated offline by `caddy validate` against the shipped Caddyfile; the live observation (the artefact serving traffic on the applied stack) is carried by real-account-reload-burst.';
+
 function isCaddyReverseProxy() {
-  // Applying project passes reverseProxy via env for the probe run; the
-  // shipped default per ADR-3902 is caddy.
   const v = process.env.REVERSE_PROXY;
   if (v === undefined || v === 'caddy') return true;
   return false;
@@ -42,12 +50,61 @@ export default async function runProbe() {
   extra.reverseProxy = process.env.REVERSE_PROXY ?? 'caddy';
   if (!isCaddyReverseProxy()) {
     results.push({
-      anchorAcId,
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIMIT_REV_PROXY,
       verdict: 'skipped',
-      detail: `reverseProxy=${extra.reverseProxy}: caddyfile-validate skipped (applies only when reverseProxy=caddy)`,
+      detail: `offline caddyfile-validate: reverseProxy=${extra.reverseProxy}: skipped (applies only when reverseProxy=caddy)`,
+      evidence: { reverseProxy: extra.reverseProxy },
     });
     return { results, extra };
   }
+
+  // Bind-mount check: the compose file mounts caddy/Caddyfile
+  // read-only into the caddy service. AC-38107-4 requires the :ro
+  // suffix or read_only: true on the long-form. This is a source-
+  // tree observation carried as a conformanceOnly de-claim.
+  try {
+    const composeText = await readFile(COMPOSE_PATH, 'utf8');
+    const composeSha256 = sha256(composeText);
+    const caddyMountRe = /\.\/caddy\/Caddyfile:\/etc\/caddy\/Caddyfile:ro/;
+    if (caddyMountRe.test(composeText)) {
+      results.push({
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: LIMIT_38107_4,
+        verdict: 'pass',
+        detail: 'offline caddyfile-validate: compose.yaml bind-mounts caddy/Caddyfile into the caddy service read-only (:ro suffix present)',
+        evidence: {
+          composeSha256,
+          composeMountLine: (composeText.match(/[^\n]*Caddyfile:\/etc\/caddy\/Caddyfile[^\n]*/) || [''])[0],
+          mountSuffix: ':ro',
+        },
+      });
+    } else {
+      results.push({
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: LIMIT_38107_4,
+        verdict: 'fail',
+        detail: 'offline caddyfile-validate: compose.yaml Caddyfile bind-mount is not read-only; expected :ro suffix on ./caddy/Caddyfile:/etc/caddy/Caddyfile',
+        evidence: {
+          composeSha256,
+          composeMountLine: (composeText.match(/[^\n]*Caddyfile[^\n]*/) || [''])[0],
+        },
+      });
+    }
+  } catch (err) {
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIMIT_38107_4,
+      verdict: 'fail',
+      detail: `offline caddyfile-validate: could not read compose.yaml to check the Caddyfile bind-mount: ${err.message}`,
+      evidence: { composePath: COMPOSE_PATH, error: err.message },
+    });
+  }
+
   const scratchDir = join(tmpdir(), `rcf-lite-t2-caddyfile-validate-${Date.now()}`);
   await mkdir(scratchDir, { recursive: true });
   const scratchPath = join(scratchDir, 'Caddyfile');
@@ -56,6 +113,7 @@ export default async function runProbe() {
     if (process.env.SIMULATE_INVALID_CADDYFILE === 'true') {
       text = text + "\n{ unclosed_block_that_never_ends_and_is_a_syntax_error_caddy_will_reject\n";
     }
+    const caddyfileSha256 = sha256(text);
     await writeFile(scratchPath, text, 'utf8');
     const localCaddy = whichCaddy();
     const localDocker = whichDocker();
@@ -73,9 +131,12 @@ export default async function runProbe() {
       engineLabel = 'caddy:2 container (docker run --rm)';
     } else {
       results.push({
-        anchorAcId,
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: LIMIT_REV_PROXY,
         verdict: 'warn',
-        detail: 'neither caddy binary nor docker on PATH; caddy validate could not be exercised',
+        detail: 'offline caddyfile-validate: neither caddy binary nor docker on PATH; caddy validate could not be exercised',
+        evidence: { caddyLocal: null, dockerLocal: null },
       });
       return { results, extra };
     }
@@ -85,15 +146,41 @@ export default async function runProbe() {
     const tail = ((r.stderr || '') + (r.stdout || '')).split('\n').slice(-10).join('\n');
     if (r.status === 0) {
       results.push({
-        anchorAcId,
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: LIMIT_REV_PROXY,
         verdict: 'pass',
-        detail: `caddy validate exit 0 (${engineLabel}); tail: ${tail.slice(-200)}`,
+        detail: `offline caddyfile-validate: caddy validate exit 0 (${engineLabel}); tail: ${tail.slice(-200)}`,
+        evidence: {
+          caddyfileSha256,
+          engineLabel,
+          exitStatus: 0,
+          tailExcerpt: tail.slice(-400),
+          vendorDocs: {
+            caddyValidate: VENDOR_CADDY,
+            dockerRunRm: VENDOR_DOCKER,
+            verifiedOn: VENDOR_VERIFIED_ON,
+          },
+        },
       });
     } else {
       results.push({
-        anchorAcId,
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: LIMIT_REV_PROXY,
         verdict: 'fail',
-        detail: `caddy validate exit ${r.status} (${engineLabel}); tail: ${tail.slice(-400)}`,
+        detail: `offline caddyfile-validate: caddy validate exit ${r.status} (${engineLabel}); tail: ${tail.slice(-400)}`,
+        evidence: {
+          caddyfileSha256,
+          engineLabel,
+          exitStatus: r.status,
+          tailExcerpt: tail.slice(-400),
+          vendorDocs: {
+            caddyValidate: VENDOR_CADDY,
+            dockerRunRm: VENDOR_DOCKER,
+            verifiedOn: VENDOR_VERIFIED_ON,
+          },
+        },
       });
     }
   } finally {