@@ -218,7 +218,15 @@ handshake. No autonomy yet: this milestone is the loop, not the license.
 
 Exit: an induced failure is detected, diagnosed, and remediated end to end
 with the human contributing only a confirmation — no human diagnosis, no
-shell access.
+shell access. **Met on 2026-09-10** on a disposable Hetzner Cloud Debian 13
+server, for both trigger kinds: a stopped PostgreSQL went from failure to
+receipted, verified remediation in about 2.5 minutes with one approval
+command, and induced package drift was detected by the scheduled audit,
+proposed, approved through the agent confirmation handshake, and verified
+compliant in 53 seconds — see the
+[M8 proving-run report](docs/proving-runs/2026-09-10-hetzner-m8.md). The
+operator watched remotely over the gateway's new read-only mTLS alerts
+route with no shell access during detection, diagnosis, or verification.
 
 ## M9 — Graduated autonomy
 
 
@@ -0,0 +1,78 @@
+# Proving run: M8 operator loop on a real Hetzner host
+
+| | |
+| --- | --- |
+| **Date** | 2026-09-10 |
+| **Scope** | M8 exit criteria: induced failure detected, diagnosed, and remediated end to end with the human contributing only a confirmation |
+| **Host** | Hetzner Cloud cx23 (fsn1), stock Debian 13 image, deleted after the run |
+| **Verdict** | All criteria met for both trigger kinds; one TLS finding fixed live |
+
+## Method
+
+A disposable cx23 was deployed exactly as in the
+[M7 run](2026-09-10-hetzner-m7.md) (PostgreSQL with declared metrics,
+single-host logging stack with alerting, the `postgresql-down` rule), with
+two differences: the declared firewall allows the mTLS gateway port so the
+operator can watch **remotely from the management host**, and the gateway
+certificate carries an IP subject-alternative name so the operator's strict
+TLS verification passes against the raw address. The operator authenticated
+with its own client certificate signed by the collector CA — it is just
+another mTLS client of the gateway; it never had shell access during
+detection, diagnosis, or verification.
+
+Only public entry points were used: the deploy playbooks,
+`cloudfall operator run|list|approve`, and the `AgentToolset` operator
+surface that `cloudfall-mcp` exposes.
+
+## Results
+
+- **Quiet pass**: with the fleet healthy, `operator run` over
+  `https://<ip>:3101/api/v1/alerts` returned zero proposals
+- **Alert trigger, end to end**: `systemctl stop postgresql@17-main` at
+  17:18:26; the declared alert fired at 17:19:46; the next operator pass
+  wrote a schema-valid proposal at 17:19:59 — trigger evidence, the
+  diagnosis ("service postgresql-main on server hz1 stopped satisfying its
+  rule"), and the exact operation (`services.yml`). One human command
+  approved it at 17:20:12; the engine converged declared services,
+  PostgreSQL came back, the operator watched the same alert resolve, and
+  the receipt recorded **verified at 17:20:53**. Failure to verified
+  remediation: about 2.5 minutes, human contribution: one approval
+- **Drift trigger, through the agent surface**: `apt-get remove unzip`
+  induced package drift with no alert. The operator's drift pass ran the
+  read-only inspect playbook, audited, and proposed `baseline.yml` for
+  exactly `packages.required[unzip]`. The approval went through the
+  `AgentToolset` confirmation handshake — the gate previewed "execute
+  cloudfall-engine playbook baseline.yml because Audit reports drift on
+  server hz1" before `confirm=true` executed it — and verification
+  re-audited the server until the drifted check was compliant:
+  **verified in 53 seconds**
+- **Dedupe**: repeated passes while proposals were open produced no
+  duplicates; the alerts pass stayed quiet during the drift incident
+- **Exit state**: final audit 20/20 compliant; the proposal receipts record
+  the full lifecycle of both incidents
+
+## Findings
+
+1. **The throwaway CA failed Python's strict verification.** A bare
+   `openssl req -x509` CA lacks the key-usage extension, which nginx and
+   Alloy accepted but Python 3.14's TLS stack refused
+   (`CA cert does not include key usage extension`). The proving CA is now
+   generated with `basicConstraints=critical,CA:TRUE` and
+   `keyUsage=critical,keyCertSign,cRLSign`; the
+   [operator guide](../operator-guide.md) documents that the operator is a
+   strict TLS client
+
+## Caveats
+
+- Propose mode only: the ladder's level 2 (autonomy for provenly reversible
+  operations) is designed but not implemented; every execution here went
+  through an explicit approval, which is exactly M8's scope
+- The approval ran on the management host with SSH ambient for the engine;
+  the operator's *detection and verification* path is shell-free, execution
+  still uses the engine's normal SSH contract
+- Single-host fleet; drift and alert triggers were exercised serially, not
+  concurrently
+
+## Cost
+
+One cx23 instance for under an hour: about one euro cent.