railiance-clock/workplans/RCLK-WP-0004-deployment-adoption.md

---
id: RCLK-WP-0004
type: workplan
title: "Admit railiance01 pilot and migrate one consumer"
domain: infotech
repo: railiance-clock
status: blocked
flavor: implementation
depends_on:
  - RCLK-WP-0003
  - RCLK-WP-0005
owner: codex
topic_slug: custodian
created: "2026-09-14"
updated: "2026-09-28"
depends_on_workplans:
  - RCLK-WP-0003
  - RCLK-WP-0005
state_hub_workstream_id: "558f178b-1b2c-58e1-b45b-2a8a7f773790"
---

Native operation is a separate production-admission decision. This plan also owns explicit later-scale scope so foundation has no untracked residuals.

## Prepare private placement and trust custody

```task
id: RCLK-WP-0004-T01
status: wait
depends_on: [RCLK-WP-0005, RCLK-WP-0002]
blocking_reason: "Consumes RCLK-WP-0005 placement/custody/health receipts and RCLK-WP-0002 contract acceptance."
priority: high
state_hub_task_id: "a4040b78-ba86-54aa-b6b5-43fdefb3ddda"
```

Blocked as of 2026-09-28: 0005 completes placement/custody/health delivery and 0002 contract acceptance; rail/reef or reviewed host-exception coverage.

Consume RCLK-WP-0005 infrastructure placement, custody, health and exact-source deployment receipts. Verify they satisfy the adopted 0002/0003 contract before consumer pilot. Infrastructure implementation belongs to 0005 and its owner records, not a duplicate apply here.

## Measure and verify the native authority/client pilot

```task
id: RCLK-WP-0004-T02
status: wait
depends_on: [RCLK-WP-0005]
blocking_reason: "Admitted native test targets and RCLK-WP-0005 prerequisites; measured skew/suspend/outage/recovery coverage."
priority: high
state_hub_task_id: "28b4c1e0-833c-583d-9cca-fd794d58a0ac"
```

Blocked as of 2026-09-28: Admitted native test targets and 0005 prerequisites; measured skew/suspend/outage/recovery coverage with accepted thresholds.

Exercise skewed corporate workstation without OS changes, bootstrap limitations, source outage, restart/rollback, delayed samples and suspend/resume. Measure interval coverage/width, latency and holdover; agree versioned thresholds. Verify cleanup, rollback and authority-key revocation. Retain audit evidence, not secrets.

## Migrate one explicitly admitted security consumer

```task
id: RCLK-WP-0004-T03
status: wait
blocked_on: message-from:secrets-engine
blocking_reason: "Consumer owner's admission (IR-WP-0004 / SECRETS-WP-0010 consumers) with native identity, expiry and concurrent-consume negatives."
priority: high
state_hub_task_id: "2d7b4769-0196-5108-83a4-4b481f20d923"
```

Blocked as of 2026-09-28: Named consumer owner's admission and native identity, expiry, uncertainty and concurrent-consume negatives.

Choose server-side native execution where feasible. With consumer-owner approval, test correct use and wrong-caller/owner/tenant/signature/expiry negatives, uncertain boundaries and concurrent consume. Update the consumer contract before replacing its clock. IR-WP-0004/SECRETS-WP-0010 remain independently open until their own return gates pass.

## Review operational scope and hand off later capabilities

```task
id: RCLK-WP-0004-T04
status: done
priority: high
state_hub_task_id: "dc91e30a-412d-5406-8921-25ce4773c785"
```

Review availability/SLO, independent backup authorities, long offline holdover, additional languages and optional authenticated NTP/NTS infrastructure offering. Keep single-host limitations explicit. Any actionable work not delivered becomes live successor records before this plan finishes.


### Closeout review — 2026-09-28

T04 is complete: single-host scope and deferred capabilities are decided. Remaining tasks wait on owner review or native evidence; this plan is blocked.
The [closeout review](../docs/closeout-review-2026-09-28.md) records the completed
portions, each remaining gate and its owner. No new task or workplan was opened.