legends-hetzner v0.1.4

0.1.4 - 2026-11-05

• Add symlink refusal (is_symlink()) across --out, --plan, --user-data, and --receipt file paths (CWE-59) with unit test coverage.
• Add .legends-module, docs/router-provenance.json, assets/manifest.json, and scripts/smoke_installed_resources.py to match the CTO Legends ecosystem module contract.
• Upgrade scripts/check_release.py, AGENTS.md, and docs/AGENT-RECIPE.md with Windows Defender / EDR anti-ransomware guardrails, raster metadata verification, and em/en-dash enforcement.
• Pin avalonreset/legends-empire v0.3.4 (1ede96ad670b60b215b66457369691da6c61d017) in .github/workflows/checks.yml.

legends-hetzner 0.1.3

legends-hetzner v0.1.3

• Live Cost-Optimized Stock Radar (radar): Added legends-hetzner radar (--locations fsn1,nbg1,hel1, --types, --watch, --interval, --jitter, --max-polls) to inspect Hetzner Cloud CX23-CX53 (x86) and CAX11-CAX41 (ARM64) availability, pricing, and datacenter placement in real time.
• Fractional CTO Sizing Doctrine (CX vs CAX): Codified deterministic priority ranking (CX43 -> CX33 -> CX23 -> CX53 -> CAX31 -> CAX21 -> CAX11 -> CAX41) and workload guidance across CLI output, docs/CTO-SIZING-AND-SNIPING.md, and the 16-file Empire knowledge pack.
• Direct API Placement Workflow (--allow-unavailable): Added --allow-unavailable to server preflight, server create, and server snipe so operators can verify the other 9 preflight invariants (name_available, arch_compatible, ssh_keys_exist, etc.) and submit a guarded POST /v1/servers placement check even when the cached locations[].server_types catalog array omits a tier (location_catalog_bypassed: true), while preserving strict location catalog blocking by default.
• Guarded Server Sniper (server snipe): Added legends-hetzner server snipe --plan <plan.json> --plan-hash <sha256:...> --approve with rate-limit-safe bounds (--interval >= 30s, --jitter 0-60s, --max-polls 1-120), immediate abort on non-capacity preflight failures, and full _snipe_meta audit receipts.
• REST server_types Enrichment (hcloud 1.61.0 compatibility): Added automatic stdlib HTTPS enrichment against https://api.hetzner.cloud/v1/server_types (supporting both HCLOUD_TOKEN and --context via ~/.config/hcloud/cli.toml with full token redaction) when hcloud server-type list -o json omits category or locations fields.

legends-hetzner 0.1.2

legends-hetzner v0.1.2

• Raise minimum supported Python runtime to Python 3.11+ (requires-python = ">=3.11").
• Harden GitHub Actions CI workflows with 40-character commit SHA action pins, explicit contents: read permissions, and pip>=26.2.2 before package installation.

Legends Hetzner 0.1.1

Legends Hetzner now supports optional knowledge attachment through the native Windows transaction backend in legends-empire 0.3.1, alongside Linux and macOS. Pack updates preserve user-owned notes and refuse conflicting local reference edits.

A disposable live canary verified reviewed provisioning, API readback, key-based SSH and cloud-init on one CX23/Ubuntu 24.04 server. Cleanup confirmed the server, temporary SSH key and allocated IPs were removed. This is evidence for that configuration, not a guarantee for every image, region or application.

Validation covers wheel/sdist installation on Windows, macOS and Linux (Python 3.10 and 3.14), plus packaged knowledge attachment on all three native operating systems. Installation performs no cloud purchases or vault writes. Official hcloud remains the execution dependency; Empire and Coolify are optional.

Legends Hetzner 0.1.0

First public release of Legends Hetzner: portable agent workflows over the
official Hetzner Cloud CLI, with reviewed plans and a reusable knowledge library.

• Python 3.10+ runtime for Windows, macOS and Linux.
• Explicit project authentication, readiness, inventory and current catalog.
• Hashed server plans, read-only preflight and guarded create invocation.
• Generic onboarding and source-cited SSH, backup and troubleshooting runbooks.
• Optional Empire knowledge attachment that preserves user-owned notes.
• No bundled credentials, private fleet configuration or extra registered skill.

Install the wheel below in a virtual environment, install the official hcloud
CLI separately, then run legends-hetzner doctor and
legends-hetzner resources. CTO Legends catalog installation is also supported;
see the README.

Live server creation is experimental: no paid disposable-server lifecycle was
performed for this release. Mocked writes, authenticated reads, OS validation
and knowledge attachment are reported separately in the
validation record.
The module does not establish SSH, cloud-init or application health from a
successful provider response. Coolify remains optional and separately managed.

Verify downloaded wheel/source files against SHA256SUMS.