Record production authority and workstation acceptance

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

docs/evidence/2026-09-15-railiance-clock-production.json

@@ -0,0 +1,42 @@
+{
+  "scope": "production authority acceptance",
+  "host": "railiance01",
+  "client": "Linux/WSL via SSH loopback",
+  "os_clocks_changed": false,
+  "samples": [
+    {
+      "width_ms": 101.667802,
+      "railiance_minus_local_midpoint_ms": 253.602519,
+      "independent_host_cross_check": true
+    },
+    {
+      "width_ms": 108.062875,
+      "railiance_minus_local_midpoint_ms": 325.159405,
+      "independent_host_cross_check": true
+    },
+    {
+      "width_ms": 160.436282,
+      "railiance_minus_local_midpoint_ms": 371.73663,
+      "independent_host_cross_check": true
+    }
+  ],
+  "wrong_kid_refused": true,
+  "epoch": "b1164ccb-a4c2-4cc8-adf8-1d5597de697b",
+  "kid": "railiance01-clock-20260915-v1",
+  "public_key_sha256": "bd583446b5ed61d086806b2a0c5aaf33a875b751e45599e75335d1f415be609a",
+  "trust_lifetime_seconds": 900,
+  "wheel_sha256": "89d1419f038eff485a27a4206a19101ce7ca2976092971bbc796a77188fc93ad",
+  "listener": "127.0.0.1:8787",
+  "service_active": true,
+  "service_enabled": true,
+  "authority_clock_write_capabilities": [],
+  "health_clock_write_capabilities": [],
+  "readiness": "usable",
+  "key_custody": "CCR-2026-0028 version 1",
+  "final_ansible_convergence": {
+    "ok": 29,
+    "changed": 0,
+    "failed": 0,
+    "unreachable": 0
+  }
+}

workplans/RCLK-WP-0005-infrastructure-as-code.md

@@ -9,7 +9,7 @@ flavor: implementation
 owner: codex
 topic_slug: custodian
 created: "2026-09-14"
-updated: "2026-09-14"
+updated: "2026-09-15"
 related_workplans:
   - RCLK-WP-0002
   - RCLK-WP-0003
@@ -53,7 +53,7 @@ declares it in IaC after RCLK-WP-0002.
 
 ```task
 id: RCLK-WP-0005-T02
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "f3eea5a7-e745-57a2-9d76-b78eeba0bf06"
 ```
@@ -75,7 +75,7 @@ alone does not prove bounded UTC accuracy.
 
 ```task
 id: RCLK-WP-0005-T03
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "bc07711b-96d1-5d72-aee1-21d39942564c"
 ```
@@ -123,7 +123,7 @@ state owners. No unsupported claim that corporate workstations can be converged.
 
 ```task
 id: RCLK-WP-0005-T05
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "1b9fa2cb-77c5-5519-a4d3-184cb8597f86"
 ```
@@ -156,3 +156,27 @@ railiance-telemetry/platform and RCLK-WP-0004. Document what remains single-host
 Keep all unresolved work as live records before finishing this plan. RCLK-WP-0004
 may adopt a protected consumer only after this infrastructure gate AND its own
 explicit consumer review/negative tests pass. A deployed endpoint is not a grant.
+
+## Production deployment evidence — 2026-09-15
+
+The operator approved CCR-2026-0028 for platform and Clock ownership and then
+accepted systemd host delivery. Authority and health timer are active/enabled
+on railiance01; the sole listener is 127.0.0.1:8787. Custody is OpenBao version 1,
+with an attended direct SSH delivery to the service-owned mode-0600 key file.
+No workload Kubernetes role or policy was created. The host alternative avoids
+a cluster identity/token dependency for the clock bootstrap and directly uses
+the existing S1 health collector. Kubernetes itself is present on Railiance01;
+the earlier session claim that it was absent was a faulty SSH check.
+
+The authority has ProtectClock=yes and empty capability sets. The health exporter
+has empty capability sets and ProtectClock=no because its read-only adjtimex query
+is otherwise blocked by the syscall filter. Both configurations were read back.
+Readiness and three workstation signed samples passed, with interval widths
+102–161 ms and a separate SSH host-time cross-check. This checks transport and
+interval construction against the same host, not independent UTC consensus.
+Evidence: docs/evidence/2026-09-15-railiance-clock-production.json.
+
+T02/T03/T05 remain in progress for the broader acceptance criteria: disposable
+reboot/outage/rotation/rollback rehearsals, durable consumer trust refresh, and
+operational handoff in T06. Per-run consumer admission is boot-bound and expires
+after 15 minutes; this deployment does not enable every optional consumer.