Close clock scope review and record remaining owner blockers
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0e6f0-a6f6-7b93-9124-55ef584930e2
This commit is contained in:
parent
61e86a6e01
commit
a6db15d202
10 changed files with 179 additions and 43 deletions
11
INTENT.md
11
INTENT.md
|
|
@ -1,7 +1,16 @@
|
|||
---
|
||||
layer: Tooling
|
||||
---
|
||||
|
||||
# INTENT — Railiance Clock
|
||||
|
||||
Status: founding intent, adopted for repository development on 2026-09-14.
|
||||
Runtime and cross-owner security adoption are not yet approved.
|
||||
A private host deployment was recorded on 2026-09-15; broader cross-owner
|
||||
security adoption remains gated by RCLK-WP-0002/0004/0005.
|
||||
|
||||
Layer declaration follows the NetKingdom owner review against accepted v0.7.
|
||||
No Engine/PIP or PEP role is declared; a named decision consumer requires
|
||||
gate-house review. See [owner rulings and remaining gates](docs/closeout-review-2026-09-28.md).
|
||||
|
||||
## Purpose
|
||||
|
||||
|
|
|
|||
11
README.md
11
README.md
|
|
@ -3,7 +3,9 @@
|
|||
Authenticated application time for Railiance services and attached workstations
|
||||
whose operating-system clocks are managed independently.
|
||||
|
||||
Status: specification and planning baseline; no service is deployed.
|
||||
Status: Python reference implementation with a private host deployment recorded
|
||||
on 2026-09-15. Contract review, native acceptance and consumer adoption remain
|
||||
blocked on owner evidence; see the [closeout review](docs/closeout-review-2026-09-28.md).
|
||||
|
||||
Read [INTENT](INTENT.md), [scope](SCOPE.md), the [draft specification](specs/railiance-clock-v0.1.md),
|
||||
[acceptance criteria](specs/acceptance-v0.1.md), and [ecosystem ownership](docs/ecosystem.md).
|
||||
|
|
@ -20,7 +22,10 @@ in the Coulomb Forgejo organization; repository registration does not admit a ru
|
|||
|
||||
- [0005 — Infrastructure as code](workplans/RCLK-WP-0005-infrastructure-as-code.md)
|
||||
|
||||
No installation is required to review these documents. Runtime commands and
|
||||
examples will be added only with their implementation and verification.
|
||||
Run the local reference suite with `uv run --extra dev pytest -q`. The CLI exposes
|
||||
`read`, `serve`, and `health-export` (`uv run railiance-clock --help`).
|
||||
`read --trust /path/to/trust.json` requires an independently admitted trust file;
|
||||
a sample cannot admit its own key or renew trust. Deployment and credentials
|
||||
remain with their existing owners.
|
||||
|
||||
[Registration and handoff evidence](docs/registration.md).
|
||||
|
|
|
|||
11
SCOPE.md
11
SCOPE.md
|
|
@ -1,10 +1,11 @@
|
|||
# Scope
|
||||
|
||||
## Established in this seed
|
||||
## Established
|
||||
|
||||
Founding intent, draft v0.1 specification, threat/acceptance model, owner boundaries,
|
||||
registration procedure and staged workplans. This is a specification repository
|
||||
baseline: no runtime, time endpoint, SDK, signing key or deployment is delivered.
|
||||
registration and a Python reference authority/client with local tests. A private
|
||||
systemd deployment on railiance01 was recorded on 2026-09-15. That historical
|
||||
receipt does not close native recovery, measured policy or consumer adoption gates.
|
||||
|
||||
## Planned v0.1
|
||||
|
||||
|
|
@ -15,8 +16,8 @@ append-only timestamp attribution; one explicitly reviewed consumer pilot.
|
|||
## Deferred live work
|
||||
|
||||
Distributed authority consensus, active/active failover, public NTP/NTS service,
|
||||
long offline holdover and additional language clients remain RCLK-WP-0004 review
|
||||
items. No high-availability, external timestamp notarization or production-security
|
||||
long offline holdover and additional language clients are deferred beyond v0.1
|
||||
by the completed RCLK-WP-0004-T04 [scope review](docs/closeout-review-2026-09-28.md). No high-availability, external timestamp notarization or production-security
|
||||
adoption claim is made by the single-host pilot.
|
||||
|
||||
## Authority boundary
|
||||
|
|
|
|||
|
|
@ -9,27 +9,27 @@
|
|||
| Kind | ID | Status | Lane | Source |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| workplan | RCLK-WP-0001 | finished | — | workplans/RCLK-WP-0001-foundation.md |
|
||||
| workplan | RCLK-WP-0002 | active | — | workplans/RCLK-WP-0002-contract-review.md |
|
||||
| workplan | RCLK-WP-0002 | blocked | — | workplans/RCLK-WP-0002-contract-review.md |
|
||||
| workplan | RCLK-WP-0003 | finished | — | workplans/RCLK-WP-0003-reference-implementation.md |
|
||||
| workplan | RCLK-WP-0004 | proposed | — | workplans/RCLK-WP-0004-deployment-adoption.md |
|
||||
| workplan | RCLK-WP-0005 | active | — | workplans/RCLK-WP-0005-infrastructure-as-code.md |
|
||||
| workplan | RCLK-WP-0004 | blocked | — | workplans/RCLK-WP-0004-deployment-adoption.md |
|
||||
| workplan | RCLK-WP-0005 | blocked | — | workplans/RCLK-WP-0005-infrastructure-as-code.md |
|
||||
| task | RCLK-WP-0001-T01 | done | — | workplans/RCLK-WP-0001-foundation.md |
|
||||
| task | RCLK-WP-0001-T02 | done | — | workplans/RCLK-WP-0001-foundation.md |
|
||||
| task | RCLK-WP-0001-T03 | done | — | workplans/RCLK-WP-0001-foundation.md |
|
||||
| task | RCLK-WP-0002-T01 | progress | — | workplans/RCLK-WP-0002-contract-review.md |
|
||||
| task | RCLK-WP-0002-T02 | progress | — | workplans/RCLK-WP-0002-contract-review.md |
|
||||
| task | RCLK-WP-0002-T03 | progress | — | workplans/RCLK-WP-0002-contract-review.md |
|
||||
| task | RCLK-WP-0002-T04 | todo | — | workplans/RCLK-WP-0002-contract-review.md |
|
||||
| task | RCLK-WP-0002-T01 | wait | — | workplans/RCLK-WP-0002-contract-review.md |
|
||||
| task | RCLK-WP-0002-T02 | wait | — | workplans/RCLK-WP-0002-contract-review.md |
|
||||
| task | RCLK-WP-0002-T03 | wait | — | workplans/RCLK-WP-0002-contract-review.md |
|
||||
| task | RCLK-WP-0002-T04 | wait | — | workplans/RCLK-WP-0002-contract-review.md |
|
||||
| task | RCLK-WP-0003-T01 | done | — | workplans/RCLK-WP-0003-reference-implementation.md |
|
||||
| task | RCLK-WP-0003-T02 | done | — | workplans/RCLK-WP-0003-reference-implementation.md |
|
||||
| task | RCLK-WP-0003-T03 | done | — | workplans/RCLK-WP-0003-reference-implementation.md |
|
||||
| task | RCLK-WP-0004-T01 | wait | — | workplans/RCLK-WP-0004-deployment-adoption.md |
|
||||
| task | RCLK-WP-0004-T02 | wait | — | workplans/RCLK-WP-0004-deployment-adoption.md |
|
||||
| task | RCLK-WP-0004-T03 | wait | — | workplans/RCLK-WP-0004-deployment-adoption.md |
|
||||
| task | RCLK-WP-0004-T04 | wait | — | workplans/RCLK-WP-0004-deployment-adoption.md |
|
||||
| task | RCLK-WP-0004-T04 | done | — | workplans/RCLK-WP-0004-deployment-adoption.md |
|
||||
| task | RCLK-WP-0005-T01 | done | — | workplans/RCLK-WP-0005-infrastructure-as-code.md |
|
||||
| task | RCLK-WP-0005-T02 | progress | — | workplans/RCLK-WP-0005-infrastructure-as-code.md |
|
||||
| task | RCLK-WP-0005-T03 | progress | — | workplans/RCLK-WP-0005-infrastructure-as-code.md |
|
||||
| task | RCLK-WP-0005-T02 | wait | — | workplans/RCLK-WP-0005-infrastructure-as-code.md |
|
||||
| task | RCLK-WP-0005-T03 | wait | — | workplans/RCLK-WP-0005-infrastructure-as-code.md |
|
||||
| task | RCLK-WP-0005-T04 | wait | — | workplans/RCLK-WP-0005-infrastructure-as-code.md |
|
||||
| task | RCLK-WP-0005-T05 | progress | — | workplans/RCLK-WP-0005-infrastructure-as-code.md |
|
||||
| task | RCLK-WP-0005-T05 | wait | — | workplans/RCLK-WP-0005-infrastructure-as-code.md |
|
||||
| task | RCLK-WP-0005-T06 | wait | — | workplans/RCLK-WP-0005-infrastructure-as-code.md |
|
||||
|
|
|
|||
72
docs/closeout-review-2026-09-28.md
Normal file
72
docs/closeout-review-2026-09-28.md
Normal file
|
|
@ -0,0 +1,72 @@
|
|||
# Workplan closeout review — 2026-09-28
|
||||
|
||||
Reviewed all five source workplans, the unread Statehub inbox, and human-needed
|
||||
tasks for 0002/0004/0005 (none returned). Plans 0001 and 0003 remain finished.
|
||||
0004-T04 is complete with the scope decisions below. The other twelve open
|
||||
tasks remain `wait`, and their three workplans are `blocked`. No new work record
|
||||
is needed: the existing tasks retain every actionable acceptance gate.
|
||||
|
||||
## Owner evidence incorporated
|
||||
|
||||
- NetKingdom review at `a7a4db5a89d775a88ccdc00a4b2d69cecbf1931b`,
|
||||
`history/2026-09-23-railiance-clock-identity-and-layer-review.md`, received in
|
||||
messages `7cffde44-f7ae-418a-8d08-93b39c8ba986` and
|
||||
`21abd541-4d18-48db-be81-f5e6c9f1094b`: identity vocabulary confirmed; declare
|
||||
Tooling against accepted layer model v0.7. A future named decision consumer
|
||||
requires Engine/PIP review through gate-house, never a PDP declaration.
|
||||
Execution-attribution schema remains with existing NK-WP-0040; the proposed
|
||||
local field list remains unchanged. Tenancy Posture v0.1 remains proposed.
|
||||
- Railiance architecture message `2596094f-0da7-4e3b-b421-cef0d9fb0ca0` confirms
|
||||
S1 ownership, responsibility-repository placement, private exposure and bootstrap
|
||||
sequencing. The target workload requires rapp coverage and reef admission.
|
||||
This does not itself accept the September 15 host-service exception as final
|
||||
architecture coverage, nor confer rail/reef or S1 implementation acceptance.
|
||||
- `railiance-infra@8f027bde8a64fcb1cde85e371f7259987e43ae16`,
|
||||
`workplans/RAIL-HO-WP-0013-host-time-baseline.md`, records the September 27
|
||||
review: source/leap/error policy and disposable VM recovery evidence remain
|
||||
blocked. Its refreshed inventory is diagnostic, not an accuracy proof.
|
||||
- The September 15 [deployment receipt](evidence/2026-09-15-railiance-clock-production.json)
|
||||
and [implementation review](implementation-review-2026-09-15.md) remain valid
|
||||
historical evidence. No fresh runtime, independent UTC or consumer-admission
|
||||
claim is made by this closeout.
|
||||
|
||||
## Operational scope decision (0004-T04)
|
||||
|
||||
The v0.1 scope remains one private authority on railiance01 and the existing
|
||||
Python online client. One host and its admitted upstream are a single failure
|
||||
and compromise domain. Fail closed on unavailable or untrusted time; no failover
|
||||
or availability SLO is promised. Numerical budgets in the implementation review
|
||||
are candidate policy assumptions. Measured interval/latency thresholds belong to
|
||||
0004-T02; accepted operational budgets and alert/recovery ownership to 0005-T06.
|
||||
|
||||
Independent backup authorities and distributed consensus, long offline holdover,
|
||||
additional language clients, and public or private NTP/NTS serving are explicitly
|
||||
deferred beyond v0.1. They are not implementation commitments or prerequisites
|
||||
for this pilot, so no successor tasks are opened. Reconsider them only on a
|
||||
concrete consumer requirement and owner review. This closes the scope-review
|
||||
task without claiming the operational handoff or native pilot is complete.
|
||||
|
||||
## Remaining gates in existing records
|
||||
|
||||
| Task | Completed portion / evidence | Required unblock evidence and owner |
|
||||
| --- | --- | --- |
|
||||
| 0002-T01 | Architecture and NetKingdom rulings incorporated; Tooling declared in INTENT | gate-house review, registry/custodian prefix confirmation, and architecture disposition of rapp coverage versus host-service delivery |
|
||||
| 0002-T02 | ES256/schema candidate and online trust implementation | Infrastructure/platform/trust owners accept source/leap, custody refresh/revocation and epoch/rollback recovery contract; NK-WP-0040 remains the execution-receipt dependency |
|
||||
| 0002-T03 | Interval implementation, fake-clock tests and explicit candidate limits | Infrastructure and supported-platform owners accept measured timer/error/suspend assumptions; no universal VM drift bound inferred |
|
||||
| 0002-T04 | Consumer semantics proposed; canonical names and custody owner clarified | access-engine (runtime flex-auth), approval-engine, secrets-engine and audit-core return accepted contract versions and native boundary/CAS evidence |
|
||||
| 0004-T01 | Historical private host deployment receipt available | 0005 completes placement/custody/health delivery and 0002 contract acceptance; rail/reef or reviewed host-exception coverage |
|
||||
| 0004-T02 | Historical signed workstation samples | Admitted native test targets and 0005 prerequisites; measured skew/suspend/outage/recovery coverage with accepted thresholds |
|
||||
| 0004-T03 | Optional integration documented | Named consumer owner's admission and native identity, expiry, uncertainty and concurrent-consume negatives |
|
||||
| 0005-T02 | Opt-in S1 role and source-preserving host delivery | RAIL-HO-WP-0013 policy acceptance, baseline health integration and disposable reboot/outage/convergence evidence |
|
||||
| 0005-T03 | Private systemd authority, empty capabilities and historical custody receipt | Final architecture coverage and platform-approved durable trust refresh/rotation with native evidence |
|
||||
| 0005-T04 | Owner role invocation exists in bootstrap | Bootstrap owner fresh-estate and upgrade rehearsal, failed-time gate and steady-state handoff receipts |
|
||||
| 0005-T05 | September 15 deployment and no-op convergence | Admitted disposable VM recovery/drift/rebuild/rollback proof, then specifically authorized native verification through S1 owner |
|
||||
| 0005-T06 | Source/ownership references and single-host limits documented | Telemetry/platform accept alerts, budgets, recovery/rotation runbooks and native evidence from preceding tasks |
|
||||
|
||||
## Validation and boundary
|
||||
|
||||
`uv run --extra dev pytest -q`: 37 passed and 4 subtests passed. These are local
|
||||
reference tests, not native infrastructure acceptance. No host clock, credential,
|
||||
service, consumer configuration or owner repository was changed. Inbox messages
|
||||
are processed by incorporating their rulings here; no additional owner request
|
||||
is needed to restate existing gates.
|
||||
|
|
@ -1,7 +1,8 @@
|
|||
# Ecosystem placement and registration
|
||||
|
||||
Status: proposed owner relationships; registration is repository discovery, not
|
||||
production admission or owner assent.
|
||||
Status: architecture and NetKingdom owner reviews partially returned; see the
|
||||
[review disposition](closeout-review-2026-09-28.md). Registration alone remains
|
||||
repository discovery, not production admission.
|
||||
|
||||
| Concern | Existing owner / intended interaction |
|
||||
| --- | --- |
|
||||
|
|
@ -11,7 +12,7 @@ production admission or owner assent.
|
|||
| Shared discovery/work records | Repo Manager + primary Statehub; derive exact pushed source and stable identifiers |
|
||||
| Security architecture | net-kingdom / gate-house; review layer role and trust/validity semantics |
|
||||
| Identity and trust material | key-cape / secrets-engine / platform through existing admitted paths; no local credential broker |
|
||||
| Decisions / human approvals | flex-auth (access-engine role) / approval-engine; retain their protocols and lifetime authority |
|
||||
| Decisions / human approvals | access-engine (runtime flex-auth) / approval-engine; retain their protocols and lifetime authority |
|
||||
| Evidence | audit-core; distinguish receipt from event occurrence and bounded translation |
|
||||
| Initial consumers | secrets-engine, ops-warden, intelligence-radar; explicitly review adoption rather than substitute local clocks silently |
|
||||
| Operational monitoring | railiance-telemetry; quality/uncertainty/epoch metrics |
|
||||
|
|
@ -29,9 +30,9 @@ production admission or owner assent.
|
|||
- `flex-auth/docs/decision-record-contract.md`
|
||||
|
||||
Paths are ecosystem repository references, not vendored copies. Review current
|
||||
versions and pin consumed contracts before implementation. This seed publishes
|
||||
no speculative layer.yaml, PEP stance-map, capability readiness or runtime grants.
|
||||
The role declaration is a named RCLK-WP-0002 task, not implied compliance.
|
||||
versions and pin consumed contracts before implementation. INTENT declares Tooling following the returned NetKingdom review. No Engine/PIP
|
||||
or PEP role, capability readiness or runtime grant is implied. Remaining
|
||||
classification and coverage review stays in RCLK-WP-0002-T01.
|
||||
|
||||
## Registration sequence
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,9 @@
|
|||
# Identity and host UTC contract review
|
||||
|
||||
Status: review proposal, 2026-09-14. RCLK-WP-0002-T01/T02/T03 remain open.
|
||||
Status: identity vocabulary confirmed by NetKingdom on 2026-09-23; UTC policy
|
||||
and remaining owner gates are still open in RCLK-WP-0002-T01/T02/T03.
|
||||
See the [September 28 disposition](closeout-review-2026-09-28.md) for the pinned
|
||||
owner review, Tooling declaration and existing NK-WP-0040 receipt-schema gap.
|
||||
This review authorizes no principal provisioning, policy grant or production use.
|
||||
|
||||
## Source baseline
|
||||
|
|
|
|||
|
|
@ -4,14 +4,14 @@ type: workplan
|
|||
title: "Review time authority, trust and consumer contracts"
|
||||
domain: infotech
|
||||
repo: railiance-clock
|
||||
status: active
|
||||
status: blocked
|
||||
flavor: planning
|
||||
depends_on:
|
||||
- RCLK-WP-0001
|
||||
owner: codex
|
||||
topic_slug: custodian
|
||||
created: "2026-09-14"
|
||||
updated: "2026-09-14"
|
||||
updated: "2026-09-28"
|
||||
depends_on_workplans:
|
||||
- RCLK-WP-0001
|
||||
state_hub_workstream_id: "8a320731-32a6-5d33-9517-2242a05c0d30"
|
||||
|
|
@ -23,44 +23,52 @@ Ready to perform review of the completed draft, not ready for production securit
|
|||
|
||||
```task
|
||||
id: RCLK-WP-0002-T01
|
||||
status: progress
|
||||
status: wait
|
||||
priority: high
|
||||
state_hub_task_id: "437734bd-8930-56d5-9eb3-2835cb19db8b"
|
||||
```
|
||||
|
||||
Blocked as of 2026-09-28: gate-house review, registry/custodian prefix confirmation, and architecture disposition of rapp coverage versus host-service delivery.
|
||||
|
||||
Obtain Railiance architecture and NetKingdom/gate-house review. Resolve authority host operation, Forgejo evidence role, source/runtime packaging and time-provider layer/PEP classification. Publish adopted role declaration only after review. Confirm RCLK-WP prefix ownership.
|
||||
|
||||
## Specify authenticated samples and trust lifecycle
|
||||
|
||||
```task
|
||||
id: RCLK-WP-0002-T02
|
||||
status: progress
|
||||
status: wait
|
||||
priority: high
|
||||
state_hub_task_id: "5f7dd460-06d7-59ef-9d37-102ca9a22f6c"
|
||||
```
|
||||
|
||||
Blocked as of 2026-09-28: Infrastructure/platform/trust owners accept source/leap, custody refresh/revocation and epoch/rollback recovery contract; NK-WP-0040 remains the execution-receipt dependency.
|
||||
|
||||
Choose established signing profile, canonical encoding and wire schema; trust bootstrap, key distribution/rotation/revocation, replay/nonce scope, authority epoch and rollback recovery. Pin upstream UTC/leap convention and defend delayed authentic samples. Satisfy C02–C05/C09/C14.
|
||||
|
||||
## Specify measured clock bounds and platform lifecycle
|
||||
|
||||
```task
|
||||
id: RCLK-WP-0002-T03
|
||||
status: progress
|
||||
status: wait
|
||||
priority: high
|
||||
state_hub_task_id: "8038f9ee-8585-57e3-a769-701e16ff7e8b"
|
||||
```
|
||||
|
||||
Blocked as of 2026-09-28: Infrastructure and supported-platform owners accept measured timer/error/suspend assumptions; no universal VM drift bound inferred.
|
||||
|
||||
Review interval arithmetic with explicit timer/upstream assumptions, drift/age policies and unsupported-platform behavior. Define Windows/Linux/WSL suspend/reboot detection and telemetry. No guessed ppm or offline lifetime as proven policy. Satisfy C01/C06/C08/C13/C15.
|
||||
|
||||
## Adopt consumer and audit time semantics
|
||||
|
||||
```task
|
||||
id: RCLK-WP-0002-T04
|
||||
status: todo
|
||||
status: wait
|
||||
priority: high
|
||||
state_hub_task_id: "53d248c0-b73d-5ee7-a3a8-360bd1b1042d"
|
||||
```
|
||||
|
||||
Blocked as of 2026-09-28: access-engine (runtime flex-auth), approval-engine, secrets-engine and audit-core return accepted contract versions and native boundary/CAS evidence.
|
||||
|
||||
Agree with flex-auth, approval-engine, secrets-engine and audit-core on clock injection/server-side execution, validity boundaries, CAS/check-to-use semantics and event attribution. Preserve current refusal until reviewed replacement. Pin accepted contract versions and update acceptance matrix C07/C10–C12/C16. Record disagreements as decisions/live work.
|
||||
|
||||
Review started 2026-09-14: `docs/identity-and-utc-review.md` pins the IAM/layer
|
||||
|
|
@ -74,3 +82,10 @@ and twenty structural negatives; no crypto/lifecycle/UTC acceptance claimed.
|
|||
Trust delivery, measured timer/error policy, leap and rollback recovery remain
|
||||
owner review gates. Custodian response 03014307-20b6-47d3-81f4-7f12fcaed014
|
||||
confirms discovery only and does not close admission tasks.
|
||||
|
||||
|
||||
### Closeout review — 2026-09-28
|
||||
|
||||
Remaining tasks wait on owner review or native evidence; this plan is blocked.
|
||||
The [closeout review](../docs/closeout-review-2026-09-28.md) records the completed
|
||||
portions, each remaining gate and its owner. No new task or workplan was opened.
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ type: workplan
|
|||
title: "Admit railiance01 pilot and migrate one consumer"
|
||||
domain: infotech
|
||||
repo: railiance-clock
|
||||
status: proposed
|
||||
status: blocked
|
||||
flavor: implementation
|
||||
depends_on:
|
||||
- RCLK-WP-0003
|
||||
|
|
@ -12,7 +12,7 @@ depends_on:
|
|||
owner: codex
|
||||
topic_slug: custodian
|
||||
created: "2026-09-14"
|
||||
updated: "2026-09-14"
|
||||
updated: "2026-09-28"
|
||||
depends_on_workplans:
|
||||
- RCLK-WP-0003
|
||||
- RCLK-WP-0005
|
||||
|
|
@ -30,6 +30,8 @@ priority: high
|
|||
state_hub_task_id: "a4040b78-ba86-54aa-b6b5-43fdefb3ddda"
|
||||
```
|
||||
|
||||
Blocked as of 2026-09-28: 0005 completes placement/custody/health delivery and 0002 contract acceptance; rail/reef or reviewed host-exception coverage.
|
||||
|
||||
Consume RCLK-WP-0005 infrastructure placement, custody, health and exact-source deployment receipts. Verify they satisfy the adopted 0002/0003 contract before consumer pilot. Infrastructure implementation belongs to 0005 and its owner records, not a duplicate apply here.
|
||||
|
||||
## Measure and verify the native authority/client pilot
|
||||
|
|
@ -41,6 +43,8 @@ priority: high
|
|||
state_hub_task_id: "28b4c1e0-833c-583d-9cca-fd794d58a0ac"
|
||||
```
|
||||
|
||||
Blocked as of 2026-09-28: Admitted native test targets and 0005 prerequisites; measured skew/suspend/outage/recovery coverage with accepted thresholds.
|
||||
|
||||
Exercise skewed corporate workstation without OS changes, bootstrap limitations, source outage, restart/rollback, delayed samples and suspend/resume. Measure interval coverage/width, latency and holdover; agree versioned thresholds. Verify cleanup, rollback and authority-key revocation. Retain audit evidence, not secrets.
|
||||
|
||||
## Migrate one explicitly admitted security consumer
|
||||
|
|
@ -52,15 +56,24 @@ priority: high
|
|||
state_hub_task_id: "2d7b4769-0196-5108-83a4-4b481f20d923"
|
||||
```
|
||||
|
||||
Blocked as of 2026-09-28: Named consumer owner's admission and native identity, expiry, uncertainty and concurrent-consume negatives.
|
||||
|
||||
Choose server-side native execution where feasible. With consumer-owner approval, test correct use and wrong-caller/owner/tenant/signature/expiry negatives, uncertain boundaries and concurrent consume. Update the consumer contract before replacing its clock. IR-WP-0004/SECRETS-WP-0010 remain independently open until their own return gates pass.
|
||||
|
||||
## Review operational scope and hand off later capabilities
|
||||
|
||||
```task
|
||||
id: RCLK-WP-0004-T04
|
||||
status: wait
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "dc91e30a-412d-5406-8921-25ce4773c785"
|
||||
```
|
||||
|
||||
Review availability/SLO, independent backup authorities, long offline holdover, additional languages and optional authenticated NTP/NTS infrastructure offering. Keep single-host limitations explicit. Any actionable work not delivered becomes live successor records before this plan finishes.
|
||||
|
||||
|
||||
### Closeout review — 2026-09-28
|
||||
|
||||
T04 is complete: single-host scope and deferred capabilities are decided. Remaining tasks wait on owner review or native evidence; this plan is blocked.
|
||||
The [closeout review](../docs/closeout-review-2026-09-28.md) records the completed
|
||||
portions, each remaining gate and its owner. No new task or workplan was opened.
|
||||
|
|
|
|||
|
|
@ -4,12 +4,12 @@ type: workplan
|
|||
title: "Deploy clock infrastructure through owner-managed infrastructure as code"
|
||||
domain: infotech
|
||||
repo: railiance-clock
|
||||
status: active
|
||||
status: blocked
|
||||
flavor: implementation
|
||||
owner: codex
|
||||
topic_slug: custodian
|
||||
created: "2026-09-14"
|
||||
updated: "2026-09-15"
|
||||
updated: "2026-09-28"
|
||||
related_workplans:
|
||||
- RCLK-WP-0002
|
||||
- RCLK-WP-0003
|
||||
|
|
@ -53,11 +53,13 @@ declares it in IaC after RCLK-WP-0002.
|
|||
|
||||
```task
|
||||
id: RCLK-WP-0005-T02
|
||||
status: progress
|
||||
status: wait
|
||||
priority: high
|
||||
state_hub_task_id: "f3eea5a7-e745-57a2-9d76-b78eeba0bf06"
|
||||
```
|
||||
|
||||
Blocked as of 2026-09-28: RAIL-HO-WP-0013 policy acceptance, baseline health integration and disposable reboot/outage/convergence evidence.
|
||||
|
||||
Depends on T01 and RCLK-WP-0002's UTC/leap/quality contract. In the S1 owner,
|
||||
version the selected existing/supported NTP client, independent upstream selection,
|
||||
network requirements, boot/restart behavior, holdover limits, drift monitoring and
|
||||
|
|
@ -75,11 +77,13 @@ alone does not prove bounded UTC accuracy.
|
|||
|
||||
```task
|
||||
id: RCLK-WP-0005-T03
|
||||
status: progress
|
||||
status: wait
|
||||
priority: high
|
||||
state_hub_task_id: "bc07711b-96d1-5d72-aee1-21d39942564c"
|
||||
```
|
||||
|
||||
Blocked as of 2026-09-28: Final architecture coverage and platform-approved durable trust refresh/rotation with native evidence.
|
||||
|
||||
Depends on adopted RCLK-WP-0002 trust contract and RCLK-WP-0003 artifact. Use
|
||||
rail-kubernetes on reef-railiance as the initial packaging candidate; create the
|
||||
reviewed rapp/deployable declarations under the architecture owner's conventions.
|
||||
|
|
@ -107,6 +111,8 @@ priority: high
|
|||
state_hub_task_id: "584440e4-49ce-57f4-b6f1-953c0feec710"
|
||||
```
|
||||
|
||||
Blocked as of 2026-09-28: Bootstrap owner fresh-estate and upgrade rehearsal, failed-time gate and steady-state handoff receipts.
|
||||
|
||||
Coordinate with railiance-bootstrap after T01 establishes owners. Add ordering:
|
||||
S1 obtains usable external UTC and basic transport trust; S2/S3 bring up the
|
||||
required substrate and admitted custody; the authority service is deployed;
|
||||
|
|
@ -123,11 +129,13 @@ state owners. No unsupported claim that corporate workstations can be converged.
|
|||
|
||||
```task
|
||||
id: RCLK-WP-0005-T05
|
||||
status: progress
|
||||
status: wait
|
||||
priority: high
|
||||
state_hub_task_id: "1b9fa2cb-77c5-5519-a4d3-184cb8597f86"
|
||||
```
|
||||
|
||||
Blocked as of 2026-09-28: Admitted disposable VM recovery/drift/rebuild/rollback proof, then specifically authorized native verification through S1 owner.
|
||||
|
||||
Depends on T02/T03 readiness and specific live owner authorization. Apply the
|
||||
reviewed source revision through its normal owner pipeline. Keep clock steps
|
||||
and effects on existing token consumers within the reviewed rollout window.
|
||||
|
|
@ -150,6 +158,8 @@ priority: high
|
|||
state_hub_task_id: "c2edb898-7446-5e82-8d2a-9f3f45f41b00"
|
||||
```
|
||||
|
||||
Blocked as of 2026-09-28: Telemetry/platform accept alerts, budgets, recovery/rotation runbooks and native evidence from preceding tasks.
|
||||
|
||||
Deliver alert ownership, quality/error budgets, backup/recovery and key-rotation
|
||||
runbooks, source locations, pipeline/placement identifiers and native evidence to
|
||||
railiance-telemetry/platform and RCLK-WP-0004. Document what remains single-host.
|
||||
|
|
@ -157,7 +167,7 @@ Keep all unresolved work as live records before finishing this plan. RCLK-WP-000
|
|||
may adopt a protected consumer only after this infrastructure gate AND its own
|
||||
explicit consumer review/negative tests pass. A deployed endpoint is not a grant.
|
||||
|
||||
## Production deployment evidence — 2026-09-15
|
||||
### Production deployment evidence — 2026-09-15
|
||||
|
||||
The operator approved CCR-2026-0028 for platform and Clock ownership and then
|
||||
accepted systemd host delivery. Authority and health timer are active/enabled
|
||||
|
|
@ -176,7 +186,14 @@ Readiness and three workstation signed samples passed, with interval widths
|
|||
interval construction against the same host, not independent UTC consensus.
|
||||
Evidence: docs/evidence/2026-09-15-railiance-clock-production.json.
|
||||
|
||||
T02/T03/T05 remain in progress for the broader acceptance criteria: disposable
|
||||
At deployment, T02/T03/T05 remained in progress for the broader acceptance criteria: disposable
|
||||
reboot/outage/rotation/rollback rehearsals, durable consumer trust refresh, and
|
||||
operational handoff in T06. Per-run consumer admission is boot-bound and expires
|
||||
after 15 minutes; this deployment does not enable every optional consumer.
|
||||
|
||||
|
||||
### Closeout review — 2026-09-28
|
||||
|
||||
Remaining tasks wait on owner review or native evidence; this plan is blocked.
|
||||
The [closeout review](../docs/closeout-review-2026-09-28.md) records the completed
|
||||
portions, each remaining gate and its owner. No new task or workplan was opened.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue