From a6db15d20217a18436cd2c81fbfcbb952aa8c3b4 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 28 Sep 2026 09:39:50 +0200 Subject: [PATCH] Close clock scope review and record remaining owner blockers Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0e6f0-a6f6-7b93-9124-55ef584930e2 --- INTENT.md | 11 ++- README.md | 11 ++- SCOPE.md | 11 +-- WORK-RECORDS.md | 22 +++--- docs/closeout-review-2026-09-28.md | 72 +++++++++++++++++++ docs/ecosystem.md | 13 ++-- docs/identity-and-utc-review.md | 5 +- workplans/RCLK-WP-0002-contract-review.md | 27 +++++-- workplans/RCLK-WP-0004-deployment-adoption.md | 19 ++++- .../RCLK-WP-0005-infrastructure-as-code.md | 31 ++++++-- 10 files changed, 179 insertions(+), 43 deletions(-) create mode 100644 docs/closeout-review-2026-09-28.md diff --git a/INTENT.md b/INTENT.md index 9ebf7d6..078f02f 100644 --- a/INTENT.md +++ b/INTENT.md @@ -1,7 +1,16 @@ +--- +layer: Tooling +--- + # INTENT — Railiance Clock Status: founding intent, adopted for repository development on 2026-09-14. -Runtime and cross-owner security adoption are not yet approved. +A private host deployment was recorded on 2026-09-15; broader cross-owner +security adoption remains gated by RCLK-WP-0002/0004/0005. + +Layer declaration follows the NetKingdom owner review against accepted v0.7. +No Engine/PIP or PEP role is declared; a named decision consumer requires +gate-house review. See [owner rulings and remaining gates](docs/closeout-review-2026-09-28.md). ## Purpose diff --git a/README.md b/README.md index 5aa2b74..b660671 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,9 @@ Authenticated application time for Railiance services and attached workstations whose operating-system clocks are managed independently. -Status: specification and planning baseline; no service is deployed. +Status: Python reference implementation with a private host deployment recorded +on 2026-09-15. Contract review, native acceptance and consumer adoption remain +blocked on owner evidence; see the [closeout review](docs/closeout-review-2026-09-28.md). Read [INTENT](INTENT.md), [scope](SCOPE.md), the [draft specification](specs/railiance-clock-v0.1.md), [acceptance criteria](specs/acceptance-v0.1.md), and [ecosystem ownership](docs/ecosystem.md). @@ -20,7 +22,10 @@ in the Coulomb Forgejo organization; repository registration does not admit a ru - [0005 — Infrastructure as code](workplans/RCLK-WP-0005-infrastructure-as-code.md) -No installation is required to review these documents. Runtime commands and -examples will be added only with their implementation and verification. +Run the local reference suite with `uv run --extra dev pytest -q`. The CLI exposes +`read`, `serve`, and `health-export` (`uv run railiance-clock --help`). +`read --trust /path/to/trust.json` requires an independently admitted trust file; +a sample cannot admit its own key or renew trust. Deployment and credentials +remain with their existing owners. [Registration and handoff evidence](docs/registration.md). diff --git a/SCOPE.md b/SCOPE.md index 9a3e506..1bf1c72 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -1,10 +1,11 @@ # Scope -## Established in this seed +## Established Founding intent, draft v0.1 specification, threat/acceptance model, owner boundaries, -registration procedure and staged workplans. This is a specification repository -baseline: no runtime, time endpoint, SDK, signing key or deployment is delivered. +registration and a Python reference authority/client with local tests. A private +systemd deployment on railiance01 was recorded on 2026-09-15. That historical +receipt does not close native recovery, measured policy or consumer adoption gates. ## Planned v0.1 @@ -15,8 +16,8 @@ append-only timestamp attribution; one explicitly reviewed consumer pilot. ## Deferred live work Distributed authority consensus, active/active failover, public NTP/NTS service, -long offline holdover and additional language clients remain RCLK-WP-0004 review -items. No high-availability, external timestamp notarization or production-security +long offline holdover and additional language clients are deferred beyond v0.1 +by the completed RCLK-WP-0004-T04 [scope review](docs/closeout-review-2026-09-28.md). No high-availability, external timestamp notarization or production-security adoption claim is made by the single-host pilot. ## Authority boundary diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 1baedcb..2a14bcb 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -9,27 +9,27 @@ | Kind | ID | Status | Lane | Source | | --- | --- | --- | --- | --- | | workplan | RCLK-WP-0001 | finished | — | workplans/RCLK-WP-0001-foundation.md | -| workplan | RCLK-WP-0002 | active | — | workplans/RCLK-WP-0002-contract-review.md | +| workplan | RCLK-WP-0002 | blocked | — | workplans/RCLK-WP-0002-contract-review.md | | workplan | RCLK-WP-0003 | finished | — | workplans/RCLK-WP-0003-reference-implementation.md | -| workplan | RCLK-WP-0004 | proposed | — | workplans/RCLK-WP-0004-deployment-adoption.md | -| workplan | RCLK-WP-0005 | active | — | workplans/RCLK-WP-0005-infrastructure-as-code.md | +| workplan | RCLK-WP-0004 | blocked | — | workplans/RCLK-WP-0004-deployment-adoption.md | +| workplan | RCLK-WP-0005 | blocked | — | workplans/RCLK-WP-0005-infrastructure-as-code.md | | task | RCLK-WP-0001-T01 | done | — | workplans/RCLK-WP-0001-foundation.md | | task | RCLK-WP-0001-T02 | done | — | workplans/RCLK-WP-0001-foundation.md | | task | RCLK-WP-0001-T03 | done | — | workplans/RCLK-WP-0001-foundation.md | -| task | RCLK-WP-0002-T01 | progress | — | workplans/RCLK-WP-0002-contract-review.md | -| task | RCLK-WP-0002-T02 | progress | — | workplans/RCLK-WP-0002-contract-review.md | -| task | RCLK-WP-0002-T03 | progress | — | workplans/RCLK-WP-0002-contract-review.md | -| task | RCLK-WP-0002-T04 | todo | — | workplans/RCLK-WP-0002-contract-review.md | +| task | RCLK-WP-0002-T01 | wait | — | workplans/RCLK-WP-0002-contract-review.md | +| task | RCLK-WP-0002-T02 | wait | — | workplans/RCLK-WP-0002-contract-review.md | +| task | RCLK-WP-0002-T03 | wait | — | workplans/RCLK-WP-0002-contract-review.md | +| task | RCLK-WP-0002-T04 | wait | — | workplans/RCLK-WP-0002-contract-review.md | | task | RCLK-WP-0003-T01 | done | — | workplans/RCLK-WP-0003-reference-implementation.md | | task | RCLK-WP-0003-T02 | done | — | workplans/RCLK-WP-0003-reference-implementation.md | | task | RCLK-WP-0003-T03 | done | — | workplans/RCLK-WP-0003-reference-implementation.md | | task | RCLK-WP-0004-T01 | wait | — | workplans/RCLK-WP-0004-deployment-adoption.md | | task | RCLK-WP-0004-T02 | wait | — | workplans/RCLK-WP-0004-deployment-adoption.md | | task | RCLK-WP-0004-T03 | wait | — | workplans/RCLK-WP-0004-deployment-adoption.md | -| task | RCLK-WP-0004-T04 | wait | — | workplans/RCLK-WP-0004-deployment-adoption.md | +| task | RCLK-WP-0004-T04 | done | — | workplans/RCLK-WP-0004-deployment-adoption.md | | task | RCLK-WP-0005-T01 | done | — | workplans/RCLK-WP-0005-infrastructure-as-code.md | -| task | RCLK-WP-0005-T02 | progress | — | workplans/RCLK-WP-0005-infrastructure-as-code.md | -| task | RCLK-WP-0005-T03 | progress | — | workplans/RCLK-WP-0005-infrastructure-as-code.md | +| task | RCLK-WP-0005-T02 | wait | — | workplans/RCLK-WP-0005-infrastructure-as-code.md | +| task | RCLK-WP-0005-T03 | wait | — | workplans/RCLK-WP-0005-infrastructure-as-code.md | | task | RCLK-WP-0005-T04 | wait | — | workplans/RCLK-WP-0005-infrastructure-as-code.md | -| task | RCLK-WP-0005-T05 | progress | — | workplans/RCLK-WP-0005-infrastructure-as-code.md | +| task | RCLK-WP-0005-T05 | wait | — | workplans/RCLK-WP-0005-infrastructure-as-code.md | | task | RCLK-WP-0005-T06 | wait | — | workplans/RCLK-WP-0005-infrastructure-as-code.md | diff --git a/docs/closeout-review-2026-09-28.md b/docs/closeout-review-2026-09-28.md new file mode 100644 index 0000000..bcf97eb --- /dev/null +++ b/docs/closeout-review-2026-09-28.md @@ -0,0 +1,72 @@ +# Workplan closeout review — 2026-09-28 + +Reviewed all five source workplans, the unread Statehub inbox, and human-needed +tasks for 0002/0004/0005 (none returned). Plans 0001 and 0003 remain finished. +0004-T04 is complete with the scope decisions below. The other twelve open +tasks remain `wait`, and their three workplans are `blocked`. No new work record +is needed: the existing tasks retain every actionable acceptance gate. + +## Owner evidence incorporated + +- NetKingdom review at `a7a4db5a89d775a88ccdc00a4b2d69cecbf1931b`, + `history/2026-09-23-railiance-clock-identity-and-layer-review.md`, received in + messages `7cffde44-f7ae-418a-8d08-93b39c8ba986` and + `21abd541-4d18-48db-be81-f5e6c9f1094b`: identity vocabulary confirmed; declare + Tooling against accepted layer model v0.7. A future named decision consumer + requires Engine/PIP review through gate-house, never a PDP declaration. + Execution-attribution schema remains with existing NK-WP-0040; the proposed + local field list remains unchanged. Tenancy Posture v0.1 remains proposed. +- Railiance architecture message `2596094f-0da7-4e3b-b421-cef0d9fb0ca0` confirms + S1 ownership, responsibility-repository placement, private exposure and bootstrap + sequencing. The target workload requires rapp coverage and reef admission. + This does not itself accept the September 15 host-service exception as final + architecture coverage, nor confer rail/reef or S1 implementation acceptance. +- `railiance-infra@8f027bde8a64fcb1cde85e371f7259987e43ae16`, + `workplans/RAIL-HO-WP-0013-host-time-baseline.md`, records the September 27 + review: source/leap/error policy and disposable VM recovery evidence remain + blocked. Its refreshed inventory is diagnostic, not an accuracy proof. +- The September 15 [deployment receipt](evidence/2026-09-15-railiance-clock-production.json) + and [implementation review](implementation-review-2026-09-15.md) remain valid + historical evidence. No fresh runtime, independent UTC or consumer-admission + claim is made by this closeout. + +## Operational scope decision (0004-T04) + +The v0.1 scope remains one private authority on railiance01 and the existing +Python online client. One host and its admitted upstream are a single failure +and compromise domain. Fail closed on unavailable or untrusted time; no failover +or availability SLO is promised. Numerical budgets in the implementation review +are candidate policy assumptions. Measured interval/latency thresholds belong to +0004-T02; accepted operational budgets and alert/recovery ownership to 0005-T06. + +Independent backup authorities and distributed consensus, long offline holdover, +additional language clients, and public or private NTP/NTS serving are explicitly +deferred beyond v0.1. They are not implementation commitments or prerequisites +for this pilot, so no successor tasks are opened. Reconsider them only on a +concrete consumer requirement and owner review. This closes the scope-review +task without claiming the operational handoff or native pilot is complete. + +## Remaining gates in existing records + +| Task | Completed portion / evidence | Required unblock evidence and owner | +| --- | --- | --- | +| 0002-T01 | Architecture and NetKingdom rulings incorporated; Tooling declared in INTENT | gate-house review, registry/custodian prefix confirmation, and architecture disposition of rapp coverage versus host-service delivery | +| 0002-T02 | ES256/schema candidate and online trust implementation | Infrastructure/platform/trust owners accept source/leap, custody refresh/revocation and epoch/rollback recovery contract; NK-WP-0040 remains the execution-receipt dependency | +| 0002-T03 | Interval implementation, fake-clock tests and explicit candidate limits | Infrastructure and supported-platform owners accept measured timer/error/suspend assumptions; no universal VM drift bound inferred | +| 0002-T04 | Consumer semantics proposed; canonical names and custody owner clarified | access-engine (runtime flex-auth), approval-engine, secrets-engine and audit-core return accepted contract versions and native boundary/CAS evidence | +| 0004-T01 | Historical private host deployment receipt available | 0005 completes placement/custody/health delivery and 0002 contract acceptance; rail/reef or reviewed host-exception coverage | +| 0004-T02 | Historical signed workstation samples | Admitted native test targets and 0005 prerequisites; measured skew/suspend/outage/recovery coverage with accepted thresholds | +| 0004-T03 | Optional integration documented | Named consumer owner's admission and native identity, expiry, uncertainty and concurrent-consume negatives | +| 0005-T02 | Opt-in S1 role and source-preserving host delivery | RAIL-HO-WP-0013 policy acceptance, baseline health integration and disposable reboot/outage/convergence evidence | +| 0005-T03 | Private systemd authority, empty capabilities and historical custody receipt | Final architecture coverage and platform-approved durable trust refresh/rotation with native evidence | +| 0005-T04 | Owner role invocation exists in bootstrap | Bootstrap owner fresh-estate and upgrade rehearsal, failed-time gate and steady-state handoff receipts | +| 0005-T05 | September 15 deployment and no-op convergence | Admitted disposable VM recovery/drift/rebuild/rollback proof, then specifically authorized native verification through S1 owner | +| 0005-T06 | Source/ownership references and single-host limits documented | Telemetry/platform accept alerts, budgets, recovery/rotation runbooks and native evidence from preceding tasks | + +## Validation and boundary + +`uv run --extra dev pytest -q`: 37 passed and 4 subtests passed. These are local +reference tests, not native infrastructure acceptance. No host clock, credential, +service, consumer configuration or owner repository was changed. Inbox messages +are processed by incorporating their rulings here; no additional owner request +is needed to restate existing gates. diff --git a/docs/ecosystem.md b/docs/ecosystem.md index be55c24..2261526 100644 --- a/docs/ecosystem.md +++ b/docs/ecosystem.md @@ -1,7 +1,8 @@ # Ecosystem placement and registration -Status: proposed owner relationships; registration is repository discovery, not -production admission or owner assent. +Status: architecture and NetKingdom owner reviews partially returned; see the +[review disposition](closeout-review-2026-09-28.md). Registration alone remains +repository discovery, not production admission. | Concern | Existing owner / intended interaction | | --- | --- | @@ -11,7 +12,7 @@ production admission or owner assent. | Shared discovery/work records | Repo Manager + primary Statehub; derive exact pushed source and stable identifiers | | Security architecture | net-kingdom / gate-house; review layer role and trust/validity semantics | | Identity and trust material | key-cape / secrets-engine / platform through existing admitted paths; no local credential broker | -| Decisions / human approvals | flex-auth (access-engine role) / approval-engine; retain their protocols and lifetime authority | +| Decisions / human approvals | access-engine (runtime flex-auth) / approval-engine; retain their protocols and lifetime authority | | Evidence | audit-core; distinguish receipt from event occurrence and bounded translation | | Initial consumers | secrets-engine, ops-warden, intelligence-radar; explicitly review adoption rather than substitute local clocks silently | | Operational monitoring | railiance-telemetry; quality/uncertainty/epoch metrics | @@ -29,9 +30,9 @@ production admission or owner assent. - `flex-auth/docs/decision-record-contract.md` Paths are ecosystem repository references, not vendored copies. Review current -versions and pin consumed contracts before implementation. This seed publishes -no speculative layer.yaml, PEP stance-map, capability readiness or runtime grants. -The role declaration is a named RCLK-WP-0002 task, not implied compliance. +versions and pin consumed contracts before implementation. INTENT declares Tooling following the returned NetKingdom review. No Engine/PIP +or PEP role, capability readiness or runtime grant is implied. Remaining +classification and coverage review stays in RCLK-WP-0002-T01. ## Registration sequence diff --git a/docs/identity-and-utc-review.md b/docs/identity-and-utc-review.md index fe165e4..1c0d850 100644 --- a/docs/identity-and-utc-review.md +++ b/docs/identity-and-utc-review.md @@ -1,6 +1,9 @@ # Identity and host UTC contract review -Status: review proposal, 2026-09-14. RCLK-WP-0002-T01/T02/T03 remain open. +Status: identity vocabulary confirmed by NetKingdom on 2026-09-23; UTC policy +and remaining owner gates are still open in RCLK-WP-0002-T01/T02/T03. +See the [September 28 disposition](closeout-review-2026-09-28.md) for the pinned +owner review, Tooling declaration and existing NK-WP-0040 receipt-schema gap. This review authorizes no principal provisioning, policy grant or production use. ## Source baseline diff --git a/workplans/RCLK-WP-0002-contract-review.md b/workplans/RCLK-WP-0002-contract-review.md index 642ca8c..d6c8fe0 100644 --- a/workplans/RCLK-WP-0002-contract-review.md +++ b/workplans/RCLK-WP-0002-contract-review.md @@ -4,14 +4,14 @@ type: workplan title: "Review time authority, trust and consumer contracts" domain: infotech repo: railiance-clock -status: active +status: blocked flavor: planning depends_on: - RCLK-WP-0001 owner: codex topic_slug: custodian created: "2026-09-14" -updated: "2026-09-14" +updated: "2026-09-28" depends_on_workplans: - RCLK-WP-0001 state_hub_workstream_id: "8a320731-32a6-5d33-9517-2242a05c0d30" @@ -23,44 +23,52 @@ Ready to perform review of the completed draft, not ready for production securit ```task id: RCLK-WP-0002-T01 -status: progress +status: wait priority: high state_hub_task_id: "437734bd-8930-56d5-9eb3-2835cb19db8b" ``` +Blocked as of 2026-09-28: gate-house review, registry/custodian prefix confirmation, and architecture disposition of rapp coverage versus host-service delivery. + Obtain Railiance architecture and NetKingdom/gate-house review. Resolve authority host operation, Forgejo evidence role, source/runtime packaging and time-provider layer/PEP classification. Publish adopted role declaration only after review. Confirm RCLK-WP prefix ownership. ## Specify authenticated samples and trust lifecycle ```task id: RCLK-WP-0002-T02 -status: progress +status: wait priority: high state_hub_task_id: "5f7dd460-06d7-59ef-9d37-102ca9a22f6c" ``` +Blocked as of 2026-09-28: Infrastructure/platform/trust owners accept source/leap, custody refresh/revocation and epoch/rollback recovery contract; NK-WP-0040 remains the execution-receipt dependency. + Choose established signing profile, canonical encoding and wire schema; trust bootstrap, key distribution/rotation/revocation, replay/nonce scope, authority epoch and rollback recovery. Pin upstream UTC/leap convention and defend delayed authentic samples. Satisfy C02–C05/C09/C14. ## Specify measured clock bounds and platform lifecycle ```task id: RCLK-WP-0002-T03 -status: progress +status: wait priority: high state_hub_task_id: "8038f9ee-8585-57e3-a769-701e16ff7e8b" ``` +Blocked as of 2026-09-28: Infrastructure and supported-platform owners accept measured timer/error/suspend assumptions; no universal VM drift bound inferred. + Review interval arithmetic with explicit timer/upstream assumptions, drift/age policies and unsupported-platform behavior. Define Windows/Linux/WSL suspend/reboot detection and telemetry. No guessed ppm or offline lifetime as proven policy. Satisfy C01/C06/C08/C13/C15. ## Adopt consumer and audit time semantics ```task id: RCLK-WP-0002-T04 -status: todo +status: wait priority: high state_hub_task_id: "53d248c0-b73d-5ee7-a3a8-360bd1b1042d" ``` +Blocked as of 2026-09-28: access-engine (runtime flex-auth), approval-engine, secrets-engine and audit-core return accepted contract versions and native boundary/CAS evidence. + Agree with flex-auth, approval-engine, secrets-engine and audit-core on clock injection/server-side execution, validity boundaries, CAS/check-to-use semantics and event attribution. Preserve current refusal until reviewed replacement. Pin accepted contract versions and update acceptance matrix C07/C10–C12/C16. Record disagreements as decisions/live work. Review started 2026-09-14: `docs/identity-and-utc-review.md` pins the IAM/layer @@ -74,3 +82,10 @@ and twenty structural negatives; no crypto/lifecycle/UTC acceptance claimed. Trust delivery, measured timer/error policy, leap and rollback recovery remain owner review gates. Custodian response 03014307-20b6-47d3-81f4-7f12fcaed014 confirms discovery only and does not close admission tasks. + + +### Closeout review — 2026-09-28 + +Remaining tasks wait on owner review or native evidence; this plan is blocked. +The [closeout review](../docs/closeout-review-2026-09-28.md) records the completed +portions, each remaining gate and its owner. No new task or workplan was opened. diff --git a/workplans/RCLK-WP-0004-deployment-adoption.md b/workplans/RCLK-WP-0004-deployment-adoption.md index 6b0a19f..1304ae1 100644 --- a/workplans/RCLK-WP-0004-deployment-adoption.md +++ b/workplans/RCLK-WP-0004-deployment-adoption.md @@ -4,7 +4,7 @@ type: workplan title: "Admit railiance01 pilot and migrate one consumer" domain: infotech repo: railiance-clock -status: proposed +status: blocked flavor: implementation depends_on: - RCLK-WP-0003 @@ -12,7 +12,7 @@ depends_on: owner: codex topic_slug: custodian created: "2026-09-14" -updated: "2026-09-14" +updated: "2026-09-28" depends_on_workplans: - RCLK-WP-0003 - RCLK-WP-0005 @@ -30,6 +30,8 @@ priority: high state_hub_task_id: "a4040b78-ba86-54aa-b6b5-43fdefb3ddda" ``` +Blocked as of 2026-09-28: 0005 completes placement/custody/health delivery and 0002 contract acceptance; rail/reef or reviewed host-exception coverage. + Consume RCLK-WP-0005 infrastructure placement, custody, health and exact-source deployment receipts. Verify they satisfy the adopted 0002/0003 contract before consumer pilot. Infrastructure implementation belongs to 0005 and its owner records, not a duplicate apply here. ## Measure and verify the native authority/client pilot @@ -41,6 +43,8 @@ priority: high state_hub_task_id: "28b4c1e0-833c-583d-9cca-fd794d58a0ac" ``` +Blocked as of 2026-09-28: Admitted native test targets and 0005 prerequisites; measured skew/suspend/outage/recovery coverage with accepted thresholds. + Exercise skewed corporate workstation without OS changes, bootstrap limitations, source outage, restart/rollback, delayed samples and suspend/resume. Measure interval coverage/width, latency and holdover; agree versioned thresholds. Verify cleanup, rollback and authority-key revocation. Retain audit evidence, not secrets. ## Migrate one explicitly admitted security consumer @@ -52,15 +56,24 @@ priority: high state_hub_task_id: "2d7b4769-0196-5108-83a4-4b481f20d923" ``` +Blocked as of 2026-09-28: Named consumer owner's admission and native identity, expiry, uncertainty and concurrent-consume negatives. + Choose server-side native execution where feasible. With consumer-owner approval, test correct use and wrong-caller/owner/tenant/signature/expiry negatives, uncertain boundaries and concurrent consume. Update the consumer contract before replacing its clock. IR-WP-0004/SECRETS-WP-0010 remain independently open until their own return gates pass. ## Review operational scope and hand off later capabilities ```task id: RCLK-WP-0004-T04 -status: wait +status: done priority: high state_hub_task_id: "dc91e30a-412d-5406-8921-25ce4773c785" ``` Review availability/SLO, independent backup authorities, long offline holdover, additional languages and optional authenticated NTP/NTS infrastructure offering. Keep single-host limitations explicit. Any actionable work not delivered becomes live successor records before this plan finishes. + + +### Closeout review — 2026-09-28 + +T04 is complete: single-host scope and deferred capabilities are decided. Remaining tasks wait on owner review or native evidence; this plan is blocked. +The [closeout review](../docs/closeout-review-2026-09-28.md) records the completed +portions, each remaining gate and its owner. No new task or workplan was opened. diff --git a/workplans/RCLK-WP-0005-infrastructure-as-code.md b/workplans/RCLK-WP-0005-infrastructure-as-code.md index 609a9ac..642fa78 100644 --- a/workplans/RCLK-WP-0005-infrastructure-as-code.md +++ b/workplans/RCLK-WP-0005-infrastructure-as-code.md @@ -4,12 +4,12 @@ type: workplan title: "Deploy clock infrastructure through owner-managed infrastructure as code" domain: infotech repo: railiance-clock -status: active +status: blocked flavor: implementation owner: codex topic_slug: custodian created: "2026-09-14" -updated: "2026-09-15" +updated: "2026-09-28" related_workplans: - RCLK-WP-0002 - RCLK-WP-0003 @@ -53,11 +53,13 @@ declares it in IaC after RCLK-WP-0002. ```task id: RCLK-WP-0005-T02 -status: progress +status: wait priority: high state_hub_task_id: "f3eea5a7-e745-57a2-9d76-b78eeba0bf06" ``` +Blocked as of 2026-09-28: RAIL-HO-WP-0013 policy acceptance, baseline health integration and disposable reboot/outage/convergence evidence. + Depends on T01 and RCLK-WP-0002's UTC/leap/quality contract. In the S1 owner, version the selected existing/supported NTP client, independent upstream selection, network requirements, boot/restart behavior, holdover limits, drift monitoring and @@ -75,11 +77,13 @@ alone does not prove bounded UTC accuracy. ```task id: RCLK-WP-0005-T03 -status: progress +status: wait priority: high state_hub_task_id: "bc07711b-96d1-5d72-aee1-21d39942564c" ``` +Blocked as of 2026-09-28: Final architecture coverage and platform-approved durable trust refresh/rotation with native evidence. + Depends on adopted RCLK-WP-0002 trust contract and RCLK-WP-0003 artifact. Use rail-kubernetes on reef-railiance as the initial packaging candidate; create the reviewed rapp/deployable declarations under the architecture owner's conventions. @@ -107,6 +111,8 @@ priority: high state_hub_task_id: "584440e4-49ce-57f4-b6f1-953c0feec710" ``` +Blocked as of 2026-09-28: Bootstrap owner fresh-estate and upgrade rehearsal, failed-time gate and steady-state handoff receipts. + Coordinate with railiance-bootstrap after T01 establishes owners. Add ordering: S1 obtains usable external UTC and basic transport trust; S2/S3 bring up the required substrate and admitted custody; the authority service is deployed; @@ -123,11 +129,13 @@ state owners. No unsupported claim that corporate workstations can be converged. ```task id: RCLK-WP-0005-T05 -status: progress +status: wait priority: high state_hub_task_id: "1b9fa2cb-77c5-5519-a4d3-184cb8597f86" ``` +Blocked as of 2026-09-28: Admitted disposable VM recovery/drift/rebuild/rollback proof, then specifically authorized native verification through S1 owner. + Depends on T02/T03 readiness and specific live owner authorization. Apply the reviewed source revision through its normal owner pipeline. Keep clock steps and effects on existing token consumers within the reviewed rollout window. @@ -150,6 +158,8 @@ priority: high state_hub_task_id: "c2edb898-7446-5e82-8d2a-9f3f45f41b00" ``` +Blocked as of 2026-09-28: Telemetry/platform accept alerts, budgets, recovery/rotation runbooks and native evidence from preceding tasks. + Deliver alert ownership, quality/error budgets, backup/recovery and key-rotation runbooks, source locations, pipeline/placement identifiers and native evidence to railiance-telemetry/platform and RCLK-WP-0004. Document what remains single-host. @@ -157,7 +167,7 @@ Keep all unresolved work as live records before finishing this plan. RCLK-WP-000 may adopt a protected consumer only after this infrastructure gate AND its own explicit consumer review/negative tests pass. A deployed endpoint is not a grant. -## Production deployment evidence — 2026-09-15 +### Production deployment evidence — 2026-09-15 The operator approved CCR-2026-0028 for platform and Clock ownership and then accepted systemd host delivery. Authority and health timer are active/enabled @@ -176,7 +186,14 @@ Readiness and three workstation signed samples passed, with interval widths interval construction against the same host, not independent UTC consensus. Evidence: docs/evidence/2026-09-15-railiance-clock-production.json. -T02/T03/T05 remain in progress for the broader acceptance criteria: disposable +At deployment, T02/T03/T05 remained in progress for the broader acceptance criteria: disposable reboot/outage/rotation/rollback rehearsals, durable consumer trust refresh, and operational handoff in T06. Per-run consumer admission is boot-bound and expires after 15 minutes; this deployment does not enable every optional consumer. + + +### Closeout review — 2026-09-28 + +Remaining tasks wait on owner review or native evidence; this plan is blocked. +The [closeout review](../docs/closeout-review-2026-09-28.md) records the completed +portions, each remaining gate and its owner. No new task or workplan was opened.