Draft capability entry (reuse-surface REUSE-WP-0017-T04, cohort 3)

Honest first-pass maturity vector grounded in README/docs/tests present
in this repo; no invented evidence. Flagged for human review before
publish. See reuse-surface history/2026-07-06-coverage-classification.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

registry/capabilities/capability.railiance.infra-provisioning.md

@@ -0,0 +1,131 @@
+---
+id: capability.railiance.infra-provisioning
+name: RailianceHosts Infrastructure Provisioning
+summary: Git-driven server provisioning and convergence for Hosteurope/Hetzner Cloud using Terraform,
+  cloud-init, and Ansible, with SOPS+age encrypted in-repo secrets and a servers.yaml inventory as source
+  of truth.
+owner: railiance-infra
+status: draft
+domain: financials
+tags:
+- railiance
+- terraform
+- ansible
+- infrastructure
+maturity:
+  discovery:
+    current: D4
+    target: D5
+    confidence: high
+    rationale: README documents a complete, concrete quickstart (clone, prerequisites, SOPS/age secrets
+      setup, provider setup, terraform apply, ansible convergence) with a specific inventory file (`inventory/servers.yaml`)
+      as source of truth — an unusually complete operational README among the swept repos.
+  availability:
+    current: A2
+    target: A3
+    confidence: high
+    rationale: Real ansible playbooks, terraform config, and scripts/tools present; has `.forgejo/` CI
+      already; documented as the S1 Infrastructure Substrate layer of the Railiance OAS Stack.
+external_evidence:
+  completeness:
+    level: C2
+    confidence: low
+    basis: scope_vs_intent_and_consumer_expectations
+    satisfied_expectations:
+    - documented end-to-end quickstart from bare cloud account to converged servers
+    - SOPS+age encrypted secrets with a documented key-custody model
+    - inventory/servers.yaml as explicit source of truth
+    broken_expectations: []
+    out_of_scope_expectations: []
+  reliability:
+    level: R1
+    confidence: low
+    basis: consumer_quality_signals
+    known_reliability_risks:
+    - reproducibility not independently re-verified via a live provisioning run in this sweep
+discovery:
+  intent: Provision and manage servers on Hosteurope/Hetzner Cloud entirely from Git — Terraform for lifecycle,
+    cloud-init for first boot, Ansible for convergence — as the S1 Infrastructure Substrate of the Railiance
+    OAS Stack.
+  includes:
+  - Terraform server lifecycle management
+  - cloud-init first-boot configuration
+  - Ansible convergence playbooks
+  - SOPS+age encrypted secrets in-repo
+  excludes:
+  - Kubernetes cluster bootstrap on top of provisioned hosts (see railiance-cluster)
+  - platform services (see railiance-platform)
+  assumptions: []
+  use_cases: []
+  research_memos: []
+availability:
+  current_level: A2
+  target_level: A3
+  current_artifacts:
+  - Terraform configs
+  - Ansible playbooks
+  - scripts/
+  - tools/
+  target_artifacts: []
+  consumption_modes:
+  - cli (terraform/ansible)
+  - gitops
+relations:
+  depends_on: []
+  supports: []
+  related_to: []
+evidence:
+  documentation:
+  - README.md
+  - SCOPE.md
+  tests:
+  - sbom-tools.yaml
+  - .forgejo/
+  consumer_feedback: []
+  bug_reports: []
+  incidents: []
+consumer_guidance:
+  recommended_for:
+  - operators provisioning Railiance bare-metal/cloud hosts from Git with encrypted-secret custody
+  not_recommended_for:
+  - needs above the OS/host substrate layer (see railiance-cluster for Kubernetes, railiance-platform
+    for shared services)
+  known_limitations:
+  - reproducibility not independently re-verified via a live provisioning run in this sweep
+promotion_history: []
+---
+
+# RailianceHosts Infrastructure Provisioning
+
+## Overview
+
+`railiance-infra` (RailianceHosts) is Git-driven automation for provisioning and converging servers on Hosteurope and Hetzner Cloud — Terraform for lifecycle, cloud-init for first boot, Ansible for convergence — with secrets encrypted in-repo via SOPS/age and `inventory/servers.yaml` as the source of truth. It is the S1 Infrastructure Substrate layer of the Railiance OAS Stack.
+
+## Assessment notes
+
+### Discovery
+
+README documents a complete, concrete quickstart (clone, prerequisites, SOPS/age secrets setup, provider setup, terraform apply, ansible convergence) with a specific inventory file (`inventory/servers.yaml`) as source of truth — an unusually complete operational README among the swept repos.
+
+### Availability
+
+Real ansible playbooks, terraform config, and scripts/tools present; has `.forgejo/` CI already; documented as the S1 Infrastructure Substrate layer of the Railiance OAS Stack.
+
+### Completeness
+
+First-pass honest assessment from the REUSE-WP-0017 coverage campaign
+(reuse-surface). No external consumer feedback exists yet; levels reflect
+scope-vs-intent documentation quality, not internal code quality.
+
+### Reliability
+
+No production consumer telemetry exists yet; reliability level is
+intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence.
+
+## Promotion checklist
+
+- [x] ID follows `capability.<domain>.<name>` pattern
+- [x] Maturity enums match `specs/CapabilityMaturityStandard.md`
+- [x] `external_evidence` is populated separately from `maturity`
+- [ ] Relations reference valid capability IDs (none yet)
+- [x] Index entry added in `registry/indexes/capabilities.yaml`