coulomb/railiance-clock
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close clock scope review and record remaining owner blockers

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e6f0-a6f6-7b93-9124-55ef584930e2
This commit is contained in:
tegwick 2026-09-28 09:39:50 +02:00
parent 61e86a6e01
commit a6db15d202
10 changed files with 179 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

72
docs/closeout-review-2026-09-28.md Normal file
View file

@ -0,0 +1,72 @@
# Workplan closeout review — 2026-09-28
Reviewed all five source workplans, the unread Statehub inbox, and human-needed
tasks for 0002/0004/0005 (none returned). Plans 0001 and 0003 remain finished.
0004-T04 is complete with the scope decisions below. The other twelve open
tasks remain `wait`, and their three workplans are `blocked`. No new work record
is needed: the existing tasks retain every actionable acceptance gate.
## Owner evidence incorporated
- NetKingdom review at `a7a4db5a89d775a88ccdc00a4b2d69cecbf1931b`,
`history/2026-09-23-railiance-clock-identity-and-layer-review.md`, received in
messages `7cffde44-f7ae-418a-8d08-93b39c8ba986` and
`21abd541-4d18-48db-be81-f5e6c9f1094b`: identity vocabulary confirmed; declare
Tooling against accepted layer model v0.7. A future named decision consumer
requires Engine/PIP review through gate-house, never a PDP declaration.
Execution-attribution schema remains with existing NK-WP-0040; the proposed
local field list remains unchanged. Tenancy Posture v0.1 remains proposed.
- Railiance architecture message `2596094f-0da7-4e3b-b421-cef0d9fb0ca0` confirms
S1 ownership, responsibility-repository placement, private exposure and bootstrap
sequencing. The target workload requires rapp coverage and reef admission.
This does not itself accept the September 15 host-service exception as final
architecture coverage, nor confer rail/reef or S1 implementation acceptance.
- `railiance-infra@8f027bde8a64fcb1cde85e371f7259987e43ae16`,
`workplans/RAIL-HO-WP-0013-host-time-baseline.md`, records the September 27
review: source/leap/error policy and disposable VM recovery evidence remain
blocked. Its refreshed inventory is diagnostic, not an accuracy proof.
- The September 15 [deployment receipt](evidence/2026-09-15-railiance-clock-production.json)
and [implementation review](implementation-review-2026-09-15.md) remain valid
historical evidence. No fresh runtime, independent UTC or consumer-admission
claim is made by this closeout.
## Operational scope decision (0004-T04)
The v0.1 scope remains one private authority on railiance01 and the existing
Python online client. One host and its admitted upstream are a single failure
and compromise domain. Fail closed on unavailable or untrusted time; no failover
or availability SLO is promised. Numerical budgets in the implementation review
are candidate policy assumptions. Measured interval/latency thresholds belong to
0004-T02; accepted operational budgets and alert/recovery ownership to 0005-T06.
Independent backup authorities and distributed consensus, long offline holdover,
additional language clients, and public or private NTP/NTS serving are explicitly
deferred beyond v0.1. They are not implementation commitments or prerequisites
for this pilot, so no successor tasks are opened. Reconsider them only on a
concrete consumer requirement and owner review. This closes the scope-review
task without claiming the operational handoff or native pilot is complete.
## Remaining gates in existing records
| Task | Completed portion / evidence | Required unblock evidence and owner |
| --- | --- | --- |
| 0002-T01 | Architecture and NetKingdom rulings incorporated; Tooling declared in INTENT | gate-house review, registry/custodian prefix confirmation, and architecture disposition of rapp coverage versus host-service delivery |
| 0002-T02 | ES256/schema candidate and online trust implementation | Infrastructure/platform/trust owners accept source/leap, custody refresh/revocation and epoch/rollback recovery contract; NK-WP-0040 remains the execution-receipt dependency |
| 0002-T03 | Interval implementation, fake-clock tests and explicit candidate limits | Infrastructure and supported-platform owners accept measured timer/error/suspend assumptions; no universal VM drift bound inferred |
| 0002-T04 | Consumer semantics proposed; canonical names and custody owner clarified | access-engine (runtime flex-auth), approval-engine, secrets-engine and audit-core return accepted contract versions and native boundary/CAS evidence |
| 0004-T01 | Historical private host deployment receipt available | 0005 completes placement/custody/health delivery and 0002 contract acceptance; rail/reef or reviewed host-exception coverage |
| 0004-T02 | Historical signed workstation samples | Admitted native test targets and 0005 prerequisites; measured skew/suspend/outage/recovery coverage with accepted thresholds |
| 0004-T03 | Optional integration documented | Named consumer owner's admission and native identity, expiry, uncertainty and concurrent-consume negatives |
| 0005-T02 | Opt-in S1 role and source-preserving host delivery | RAIL-HO-WP-0013 policy acceptance, baseline health integration and disposable reboot/outage/convergence evidence |
| 0005-T03 | Private systemd authority, empty capabilities and historical custody receipt | Final architecture coverage and platform-approved durable trust refresh/rotation with native evidence |
| 0005-T04 | Owner role invocation exists in bootstrap | Bootstrap owner fresh-estate and upgrade rehearsal, failed-time gate and steady-state handoff receipts |
| 0005-T05 | September 15 deployment and no-op convergence | Admitted disposable VM recovery/drift/rebuild/rollback proof, then specifically authorized native verification through S1 owner |
| 0005-T06 | Source/ownership references and single-host limits documented | Telemetry/platform accept alerts, budgets, recovery/rotation runbooks and native evidence from preceding tasks |
## Validation and boundary
`uv run --extra dev pytest -q`: 37 passed and 4 subtests passed. These are local
reference tests, not native infrastructure acceptance. No host clock, credential,
service, consumer configuration or owner repository was changed. Inbox messages
are processed by incorporating their rulings here; no additional owner request
is needed to restate existing gates.

13
docs/ecosystem.md
View file

@ -1,7 +1,8 @@
# Ecosystem placement and registration
Status: proposed owner relationships; registration is repository discovery, not
production admission or owner assent.
Status: architecture and NetKingdom owner reviews partially returned; see the
[review disposition](closeout-review-2026-09-28.md). Registration alone remains
repository discovery, not production admission.
| Concern | Existing owner / intended interaction |
| --- | --- |
@ -11,7 +12,7 @@ production admission or owner assent.
| Shared discovery/work records | Repo Manager + primary Statehub; derive exact pushed source and stable identifiers |
| Security architecture | net-kingdom / gate-house; review layer role and trust/validity semantics |
| Identity and trust material | key-cape / secrets-engine / platform through existing admitted paths; no local credential broker |
| Decisions / human approvals | flex-auth (access-engine role) / approval-engine; retain their protocols and lifetime authority |
| Decisions / human approvals | access-engine (runtime flex-auth) / approval-engine; retain their protocols and lifetime authority |
| Evidence | audit-core; distinguish receipt from event occurrence and bounded translation |
| Initial consumers | secrets-engine, ops-warden, intelligence-radar; explicitly review adoption rather than substitute local clocks silently |
| Operational monitoring | railiance-telemetry; quality/uncertainty/epoch metrics |
@ -29,9 +30,9 @@ production admission or owner assent.
- `flex-auth/docs/decision-record-contract.md`
Paths are ecosystem repository references, not vendored copies. Review current
versions and pin consumed contracts before implementation. This seed publishes
no speculative layer.yaml, PEP stance-map, capability readiness or runtime grants.
The role declaration is a named RCLK-WP-0002 task, not implied compliance.
versions and pin consumed contracts before implementation. INTENT declares Tooling following the returned NetKingdom review. No Engine/PIP
or PEP role, capability readiness or runtime grant is implied. Remaining
classification and coverage review stays in RCLK-WP-0002-T01.
## Registration sequence

5
docs/identity-and-utc-review.md
View file

@ -1,6 +1,9 @@
# Identity and host UTC contract review
Status: review proposal, 2026-09-14. RCLK-WP-0002-T01/T02/T03 remain open.
Status: identity vocabulary confirmed by NetKingdom on 2026-09-23; UTC policy
and remaining owner gates are still open in RCLK-WP-0002-T01/T02/T03.
See the [September 28 disposition](closeout-review-2026-09-28.md) for the pinned
owner review, Tooling declaration and existing NK-WP-0040 receipt-schema gap.
This review authorizes no principal provisioning, policy grant or production use.
## Source baseline