From a3937aae5a226ac201bd1ad7535c92e372722d3e Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 14 Sep 2026 04:24:41 +0200 Subject: [PATCH] Diagnose domain time discovery blocking native credential access Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbc-910e-77a0-b336-3130194350b3 --- .custodian-brief.md | 5 +++ .../2026-09-14-native-access-clock-check.json | 45 +++++++++++++++++++ ...evidence-coverage-and-field-calibration.md | 14 ++++++ 3 files changed, 64 insertions(+) create mode 100644 docs/evidence/2026-09-14-native-access-clock-check.json diff --git a/.custodian-brief.md b/.custodian-brief.md index e85aa6a..2643632 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -33,3 +33,8 @@ Latest: FLEX-WP-0026 supplies the native contract; SECRETS-WP-0010-T03 owns remaining real approval/delivery. Radar `trials --plan` prepares exact pilot/full review inputs without credentials or spending. 35 tests pass. See docs/evidence/2026-09-14-trial-inputs.json and the adjacent trial plans. + +Native delivery update: three human approvals are complete; do not repeat them. +Admin login/time remain blocked. Windows NT5DS cannot discover its domain time +peer; one-time resync did not fix it. Corporate domain connectivity and stable +host/guest time are prerequisites. See native-access-clock-check receipt. diff --git a/docs/evidence/2026-09-14-native-access-clock-check.json b/docs/evidence/2026-09-14-native-access-clock-check.json new file mode 100644 index 0000000..a1f5cc3 --- /dev/null +++ b/docs/evidence/2026-09-14-native-access-clock-check.json @@ -0,0 +1,45 @@ +{ + "observed_at": "2026-09-14T02:21:16.145635+00:00", + "read_only": true, + "clock_changed": false, + "samples": [ + { + "linux_start_epoch": 1789352431.1645145, + "linux_end_epoch": 1789352431.60413, + "windows_minus_linux_midpoint_seconds": -18.93732213973999, + "measurement_window_seconds": 0.43961548805236816, + "timesync_status": "Server: 91.189.91.157 (ntp.ubuntu.com)\nPoll interval: 32s (min: 32s; max 34min 8s)\n Leap: normal\n Version: 4\n Stratum: 2\n Reference: 84A36001\n Precision: 1us (-24)\nRoot distance: 22.223ms (max: 5s)\n Offset: +3.587102s\n Delay: 91.975ms\n Jitter: 9.800ms\n Packet count: 54\n Frequency: +0.000ppm", + "ntp_synchronized": "no" + }, + { + "linux_start_epoch": 1789352451.6275632, + "linux_end_epoch": 1789352452.0516849, + "windows_minus_linux_midpoint_seconds": -16.67362403869629, + "measurement_window_seconds": 0.424121618270874, + "timesync_status": "Server: 91.189.91.157 (ntp.ubuntu.com)\nPoll interval: 32s (min: 32s; max 34min 8s)\n Leap: normal\n Version: 4\n Stratum: 2\n Reference: 84A36001\n Precision: 1us (-24)\nRoot distance: 22.223ms (max: 5s)\n Offset: +3.587102s\n Delay: 91.975ms\n Jitter: 9.800ms\n Packet count: 54\n Frequency: +0.000ppm", + "ntp_synchronized": "no" + }, + { + "linux_start_epoch": 1789352475.6616874, + "linux_end_epoch": 1789352476.1217453, + "windows_minus_linux_midpoint_seconds": -17.95971655845642, + "measurement_window_seconds": 0.46005797386169434, + "timesync_status": "Server: 91.189.91.157 (ntp.ubuntu.com)\nPoll interval: 32s (min: 32s; max 34min 8s)\n Leap: normal\n Version: 4\n Stratum: 2\n Reference: 84A36001\n Precision: 1us (-24)\nRoot distance: 22.254ms (max: 5s)\n Offset: +3.582130s\n Delay: 91.111ms\n Jitter: 8.404ms\n Packet count: 55\n Frequency: +0.000ppm", + "ntp_synchronized": "no" + } + ], + "follow_up": { + "windows_domain_joined": true, + "windows_time_type": "NT5DS", + "windows_source": "Local CMOS Clock", + "windows_leap_indicator": 3, + "windows_stratum": 0, + "windows_last_successful_sync": null, + "one_time_resync_requested": true, + "resync_resolved": false, + "latest_time_service_event_id": 129, + "latest_time_service_error": "domain peer discovery failed; entry not found (0x800706E1)", + "persistent_configuration_changed": false, + "remaining": "Restore corporate domain time-server connectivity, then resync and verify stable Windows and Linux time before retrying attended administration." + } +} diff --git a/workplans/IR-WP-0004-evidence-coverage-and-field-calibration.md b/workplans/IR-WP-0004-evidence-coverage-and-field-calibration.md index ba5f76a..8925a29 100644 --- a/workplans/IR-WP-0004-evidence-coverage-and-field-calibration.md +++ b/workplans/IR-WP-0004-evidence-coverage-and-field-calibration.md @@ -96,3 +96,17 @@ with exact request identities, input hashes and campaign reservations; retained pilot/full review snapshots and source/input hash manifest. These are review inputs, not installation pins or delivery authorization. All 35 tests and repository integrity checks pass. T02 remains wait on native delivery and billing. + +### Native execution prerequisite — 2026-09-14 + +SECRETS-WP-0010-T03 now records all three real human approvals approved and +unconsumed; scoped reader login succeeded. Nested administrator login and +stable workstation time still prevent native execution. Do not repeat approvals. +Read-only clock sampling found Linux unsynchronized (+3.58s NTP offset) and +Windows 16.7–18.9s behind the guest. An operator-approved one-time Windows +resync did not establish synchronization: Windows Time event 129 reports +domain-peer discovery failure. The domain-joined host uses NT5DS; preserve +that managed configuration. Restore domain connectivity (for example corporate +VPN), resync and prove stable time before attended administration. +Receipt: docs/evidence/2026-09-14-native-access-clock-check.json. No provider +request, approval consumption or persistent clock configuration change occurred.