Implement reproducible S1 handoff contracts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018

README.md

@@ -3,12 +3,12 @@
 **Tagline:** Git-driven automation for secure, self-reliant servers.
 
 `railiance-infra` is the canonical S1 ownership repo for the Railiance
-infrastructure substrate. It provisions and manages servers on HostEurope and
-Hetzner Cloud entirely from Git. It combines **Terraform** for lifecycle
-management, **cloud-init** for first-boot configuration, and **Ansible** for
-convergence. All secrets live in-repo encrypted with **SOPS** and are unlocked
-with your single **age** master key (which you keep in your password manager).
-The minimal server registry in `inventory/servers.yaml` is the source of truth.
+infrastructure substrate. It manages two adopted Host Europe servers through
+source-backed inventory, **Ansible** convergence, and recurring **Goss**
+verification. A separate **Terraform** and cloud-init path provisions only
+records explicitly declared as provider-managed Hetzner resources. Selected
+provider material lives in-repo encrypted with **SOPS/age**; host convergence
+does not distribute the private age key.
 
 Future `reef-*` repos will model purpose-bound substrate boundaries such as
 `reef-railiance` or `reef-ops-workstations`, but the source-backed S1
@@ -20,7 +20,8 @@ inventory, hardening baseline, and OS convergence facts stay here.
 1. **Prerequisites**: terraform >= 1.7, ansible >= 2.16, age, sops.
 2. **Secrets Management**: Generate master key (age), provide it to sops and provide your SSH key.
 3. **Setup Provider**: Create account, select payment option, establish API token.
-4. **Provisioning**: Plan and apply `inventory/servers.yaml` to add hosts with terraform.
+4. **Provisioning**: Validate inventory; plan/apply only provider-managed
+   Hetzner records. Adopted Host Europe records are never Terraform resources.
 5. **Convergence**: Setup security and tooling with ansible.
 
 
@@ -100,13 +101,16 @@ How to declare hosts and bring them up on Hetzner:
 ➡️ [Provisioning Servers](docs/provisioning.md)
 
 TL;DR
- - Define servers in inventory/servers.yaml (name, region, type, image, ssh_user, labels/role).
- - Provision with make tf-apply (or make apply to also run Ansible).
+ - Run `make validate-inventory` after editing `inventory/servers.yaml`.
+ - Put Hetzner-only fields under `provisioning` on a
+   `lifecycle_mode: provider-managed` record.
+ - Review `make tf-plan`; an apply additionally requires
+   `APPROVE_TF_APPLY=YES`.
  - One-shot helper: scripts/hcloud_new_server.sh <name> --type ... --region ....
 
 ## 💻 5. Convergence
 
-After provisioning a server with Terraform, `railiance-infra` uses
+For adopted or newly provisioned servers, `railiance-infra` uses
 [Ansible](https://docs.ansible.com/) to **converge** hosts into a secure,
 baseline state.  
 This includes admin user setup, SSH hardening, firewall rules, essential tooling, and secret handling.