railiance-clock/workplans/RCLK-WP-0005-infrastructure-as-code.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related_workplans	state_hub_workstream_id
RCLK-WP-0005	workplan	Deploy clock infrastructure through owner-managed infrastructure as code	infotech	railiance-clock	active	codex	custodian	2026-09-14	2026-09-14	RCLK-WP-0002 RCLK-WP-0003 RCLK-WP-0004	5af117db-3721-509a-a3a6-36ae6bab7af3

Operator-requested infrastructure plan. Read docs/infrastructure.md. This plan tracks the cross-owner delivery outcome; each owning repository holds its actual IaC and any required child work records. Inventory and ownership work can begin now. Live service deployment depends on the reviewed protocol and built artifact. Production applies require concrete owner admission, not just this plan's existence.

Confirm current host state and canonical IaC ownership

id: RCLK-WP-0005-T01
status: done
priority: high
state_hub_task_id: "883743c4-d368-5f94-878b-0e122eab39ee"

Inspect railiance01 time sources/daemon, synchronization health, virtualization, network egress, permissions and existing IaC without fetching secrets or changing time. Resolve railiance-infra versus inherited railiance-hosts implementation ownership with railiance-master; select one canonical baseline and reference it. Record target inventory, responsibility, current drift and gaps. Create/link owner work records before handing off any execution; no duplicate configuration trees.

Acceptance: reviewed source-path/owner matrix, live read-only inventory receipt, explicit adoption of existing settings or a bounded source diff; no second daemon.

Done 2026-09-14. Receipt: docs/evidence/2026-09-14-host-time-inventory.md. Live: UTC, systemd-timesyncd only, synchronized to ntp.ubuntu.com, stock config. Canonical S1 owner is railiance-infra; railiance-hosts is superseded. Adopt the existing daemon; do not add chrony. Residual RAIL-HO-WP-0013 declares it in IaC after RCLK-WP-0002.

Implement declarative host UTC discipline and verification

id: RCLK-WP-0005-T02
status: wait
priority: high
state_hub_task_id: "f3eea5a7-e745-57a2-9d76-b78eeba0bf06"

Depends on T01 and RCLK-WP-0002's UTC/leap/quality contract. In the S1 owner, version the selected existing/supported NTP client, independent upstream selection, network requirements, boot/restart behavior, holdover limits, drift monitoring and health export. Prefer existing supported automation over inventing a new daemon. Do not mix timesyncd/chrony or smeared/unsmeared sources. Restrict listeners; a server NTP offering is optional and separately justified, not an implicit public UDP/123 endpoint. Do not modify attached corporate workstation clock policy.

Acceptance: lint/render and convergence check; idempotent second apply; reboot and upstream-loss/recovery proof in disposable infrastructure; exact target diff, rollback procedure and owner review before live convergence. Service liveness alone does not prove bounded UTC accuracy.

Package private authority service and admitted trust delivery

id: RCLK-WP-0005-T03
status: wait
priority: high
state_hub_task_id: "bc07711b-96d1-5d72-aee1-21d39942564c"

Depends on adopted RCLK-WP-0002 trust contract and RCLK-WP-0003 artifact. Use rail-kubernetes on reef-railiance as the initial packaging candidate; create the reviewed rapp/deployable declarations under the architecture owner's conventions. A documented host-service alternative is allowed only if bootstrap dependencies or measured constraints justify it. The clock app reads host time/health but must not obtain CAP_SYS_TIME, privileged host access or a host clock-write interface.

Declare immutable image/build pins, namespace/service identity, private exposure, network policy, resource requests/limits, health versus usability probes, TLS and sample-signing key delivery/rotation via admitted owners, non-secret config, monitoring and state-retention/epoch behavior. No secret values in Git, no raw kubectl patches or console-created persistent resources as the desired state.

Acceptance: IaC rendered/validated by native tools, deployment admission and trust bootstrap reviewed, least-privilege and no-redirect tests, config/source hashes and exact deployment/rollback plan. Fail if dynamic trust resolution needs usable Railiance time before the first sample with no independent bootstrap path.

Integrate the clock prerequisite into the new-estate bootstrap path

id: RCLK-WP-0005-T04
status: wait
priority: high
state_hub_task_id: "584440e4-49ce-57f4-b6f1-953c0feec710"

Coordinate with railiance-bootstrap after T01 establishes owners. Add ordering: S1 obtains usable external UTC and basic transport trust; S2/S3 bring up the required substrate and admitted custody; the authority service is deployed; protected consumers start only after usable time/identity evidence. Bootstrap invokes pinned owner automation and verifies its receipts; it does not copy host roles or retain ongoing clock operation. The external UTC prerequisite must not require the not-yet-created Forgejo, OpenBao, cluster or clock endpoint.

Acceptance: fresh-estate rehearsal, existing-estate upgrade path, explicit manual bootstrap actions and retirement, failed-time gate, versioned handoff to steady state owners. No unsupported claim that corporate workstations can be converged.

Deploy on railiance01 and prove drift, recovery and rollback

id: RCLK-WP-0005-T05
status: wait
priority: high
state_hub_task_id: "1b9fa2cb-77c5-5519-a4d3-184cb8597f86"

Depends on T02/T03 readiness and specific live owner authorization. Apply the reviewed source revision through its normal owner pipeline. Keep clock steps and effects on existing token consumers within the reviewed rollout window. Read back daemon configuration, image digest, service/identity/network state and usable UTC interval. Verify an independently managed workstation obtains a sample without changing OS clocks. Exercise upstream outage, restart, revoked signing trust and rollback through safe rehearsals and the approved native scope.

Acceptance: exact-commit render/apply/readback receipts; repeated convergence is no-op; drift detection catches a disposable config change; rebuild from committed source succeeds; rollback restores known-good configuration without falsely restoring old epochs/trust. No unnoticed unrelated resource or credential changes.

Transfer operational responsibility and gate consumer adoption

id: RCLK-WP-0005-T06
status: wait
priority: high
state_hub_task_id: "c2edb898-7446-5e82-8d2a-9f3f45f41b00"

Deliver alert ownership, quality/error budgets, backup/recovery and key-rotation runbooks, source locations, pipeline/placement identifiers and native evidence to railiance-telemetry/platform and RCLK-WP-0004. Document what remains single-host. Keep all unresolved work as live records before finishing this plan. RCLK-WP-0004 may adopt a protected consumer only after this infrastructure gate AND its own explicit consumer review/negative tests pass. A deployed endpoint is not a grant.