tegwick
8f2d17ae06
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbc-910e-77a0-b336-3130194350b3
3.4 KiB
Infrastructure as code and bootstrap placement
Status: reviewed planning recommendation, 2026-09-14; owner assent and live implementation are tracked in RCLK-WP-0005. No infrastructure is deployed by seed.
Recommended split
| Concern | Source/operation owner | Bootstrap responsibility |
|---|---|---|
| Host UTC daemon, upstreams, OS baseline, health adapter | railiance-infra S1 (confirmed by ADR-0004 and RCLK-WP-0005-T01) | Invoke owner convergence before time-sensitive higher layers |
| Cluster/network substrate | railiance-cluster and reef-railiance | Sequence their existing prerequisite gates |
| Application-clock source and contract | railiance-clock | Consume a published version; do not embed a second implementation |
| Workload packaging and placement | Reviewed rapp package / rail-kubernetes / reef-railiance | Invoke admitted deployment after prerequisites |
| Keys, identity, TLS and rotation | Existing platform/NetKingdom owners | Use declared bootstrap trust and retire temporary material |
| UTC quality and operational alerts | Clock operator with railiance-telemetry | Verify and hand off; do not keep operating after bootstrap |
The current railiance-bootstrap INTENT says it sequences a new estate and hands off, and explicitly excludes ongoing operations and S1 OS baseline ownership. railiance-infra owns the declarative substrate. railiance-hosts contains historical S1 content and is superseded. T01 confirmed railiance-infra as canonical against railiance-master ADR-0004; RAIL-HO-WP-0013 owns the host time implementation.
Practical deployment choice
Keep host UTC discipline at host level. Prefer a non-privileged application time service on the estate's default rail-kubernetes, privately placed on railiance01's reef. It reports an estimate and host-quality evidence; it never sets host time. An early host daemon/service alternative must explain its bootstrap advantage, owned unit/package/config IaC and later handoff. Creating a new execution rail merely for this small service is not the default.
The role of Forgejo is committed configuration and audit/review history. Basic external UTC and transport trust must already work before fetching protected source, bootstrapping secrets or obtaining Railiance application time. Document any attended bootstrap action and how it is retired; do not create a circular clock -> TLS -> secret -> clock prerequisite.
Required IaC delivery evidence
All durable resources and configuration must derive from versioned owner source: parameterized target inventory, upstream policy, daemon settings, workload manifests, trust delivery references, exposure/network rules, resources, probes and monitoring. Secret material stays in admitted custody, not in source or rendered evidence.
Require preflight/render, exact reviewed diff, scoped apply, live readback, idempotent reconvergence, drift detection, disposable rebuild and rollback proof. Every live result names source revision, target, artifact digest and observed time quality. A temporary emergency correction is evidence to reconcile back into source, never the completed implementation. Avoid recording unrelated secrets or assuming read-only health means the clock is accurate.
RCLK-WP-0005 covers infrastructure setup and operational handoff. RCLK-WP-0004 covers consumer migration and measured acceptance. Fresh-estate bootstrap includes clock ordering; an existing railiance01 upgrade uses the steady-state owner path, not a rerun of whole-estate bootstrap.