railiance-clock/workplans/RCLK-WP-0005-infrastructure-as-code.md

---
id: RCLK-WP-0005
type: workplan
title: "Deploy clock infrastructure through owner-managed infrastructure as code"
domain: infotech
repo: railiance-clock
status: blocked
flavor: implementation
owner: codex
topic_slug: custodian
created: "2026-09-14"
updated: "2026-09-28"
related_workplans:
  - RCLK-WP-0002
  - RCLK-WP-0003
  - RCLK-WP-0004
state_hub_workstream_id: "5af117db-3721-509a-a3a6-36ae6bab7af3"
---

Operator-requested infrastructure plan. Read docs/infrastructure.md. This plan
tracks the cross-owner delivery outcome; each owning repository holds its actual
IaC and any required child work records. Inventory and ownership work can begin
now. Live service deployment depends on the reviewed protocol and built artifact.
Production applies require concrete owner admission, not just this plan's existence.

## Confirm current host state and canonical IaC ownership

```task
id: RCLK-WP-0005-T01
status: done
priority: high
state_hub_task_id: "883743c4-d368-5f94-878b-0e122eab39ee"
```

Inspect railiance01 time sources/daemon, synchronization health, virtualization,
network egress, permissions and existing IaC without fetching secrets or changing
time. Resolve railiance-infra versus inherited railiance-hosts implementation
ownership with railiance-master; select one canonical baseline and reference it.
Record target inventory, responsibility, current drift and gaps. Create/link owner
work records before handing off any execution; no duplicate configuration trees.

Acceptance: reviewed source-path/owner matrix, live read-only inventory receipt,
explicit adoption of existing settings or a bounded source diff; no second daemon.

**Done 2026-09-14.** Receipt:
`docs/evidence/2026-09-14-host-time-inventory.md`. Live: UTC,
systemd-timesyncd only, synchronized to `ntp.ubuntu.com`, stock config.
Canonical S1 owner is **railiance-infra**; railiance-hosts is superseded.
Adopt the existing daemon; do not add chrony. Residual `RAIL-HO-WP-0013`
declares it in IaC after RCLK-WP-0002.

## Implement declarative host UTC discipline and verification

```task
id: RCLK-WP-0005-T02
status: wait
depends_on: [RCLK-WP-0005-T01, RCLK-WP-0002, RAIL-HO-WP-0013]
blocking_reason: "T01 owners, RCLK-WP-0002 UTC/leap/quality contract and RAIL-HO-WP-0013 policy acceptance."
priority: high
state_hub_task_id: "f3eea5a7-e745-57a2-9d76-b78eeba0bf06"
```

Blocked as of 2026-09-28: RAIL-HO-WP-0013 policy acceptance, baseline health integration and disposable reboot/outage/convergence evidence.

Depends on T01 and RCLK-WP-0002's UTC/leap/quality contract. In the S1 owner,
version the selected existing/supported NTP client, independent upstream selection,
network requirements, boot/restart behavior, holdover limits, drift monitoring and
health export. Prefer existing supported automation over inventing a new daemon.
Do not mix timesyncd/chrony or smeared/unsmeared sources. Restrict listeners; a
server NTP offering is optional and separately justified, not an implicit public
UDP/123 endpoint. Do not modify attached corporate workstation clock policy.

Acceptance: lint/render and convergence check; idempotent second apply; reboot
and upstream-loss/recovery proof in disposable infrastructure; exact target diff,
rollback procedure and owner review before live convergence. Service liveness
alone does not prove bounded UTC accuracy.

## Package private authority service and admitted trust delivery

```task
id: RCLK-WP-0005-T03
status: wait
depends_on: [RCLK-WP-0002, RCLK-WP-0003]
blocking_reason: "Adopted RCLK-WP-0002 trust contract and RCLK-WP-0003 artifact; platform-approved durable trust refresh/rotation."
priority: high
state_hub_task_id: "bc07711b-96d1-5d72-aee1-21d39942564c"
```

Blocked as of 2026-09-28: Final architecture coverage and platform-approved durable trust refresh/rotation with native evidence.

Depends on adopted RCLK-WP-0002 trust contract and RCLK-WP-0003 artifact. Use
rail-kubernetes on reef-railiance as the initial packaging candidate; create the
reviewed rapp/deployable declarations under the architecture owner's conventions.
A documented host-service alternative is allowed only if bootstrap dependencies
or measured constraints justify it. The clock app reads host time/health but must
not obtain CAP_SYS_TIME, privileged host access or a host clock-write interface.

Declare immutable image/build pins, namespace/service identity, private exposure,
network policy, resource requests/limits, health versus usability probes, TLS and
sample-signing key delivery/rotation via admitted owners, non-secret config,
monitoring and state-retention/epoch behavior. No secret values in Git, no raw
kubectl patches or console-created persistent resources as the desired state.

Acceptance: IaC rendered/validated by native tools, deployment admission and
trust bootstrap reviewed, least-privilege and no-redirect tests, config/source
hashes and exact deployment/rollback plan. Fail if dynamic trust resolution needs
usable Railiance time before the first sample with no independent bootstrap path.

Local follow-up 2026-09-28: authority sampling now checks continuity and health
age at the exact signed timestamp; malformed health refuses explicitly. Local
HTTP framing, capacity recovery, collection failure and trust-rotation tests
pass. These support C05/C13–C15, but do not close native admission or trust
delivery.

## Integrate the clock prerequisite into the new-estate bootstrap path

```task
id: RCLK-WP-0005-T04
status: wait
depends_on: [RCLK-WP-0005-T01]
blocked_on: message-from:railiance-bootstrap
blocking_reason: "Bootstrap owner fresh-estate and upgrade rehearsal, failed-time gate and steady-state handoff receipts."
priority: high
state_hub_task_id: "584440e4-49ce-57f4-b6f1-953c0feec710"
```

Blocked as of 2026-09-28: Bootstrap owner fresh-estate and upgrade rehearsal, failed-time gate and steady-state handoff receipts.

Coordinate with railiance-bootstrap after T01 establishes owners. Add ordering:
S1 obtains usable external UTC and basic transport trust; S2/S3 bring up the
required substrate and admitted custody; the authority service is deployed;
protected consumers start only after usable time/identity evidence. Bootstrap
invokes pinned owner automation and verifies its receipts; it does not copy host
roles or retain ongoing clock operation. The external UTC prerequisite must not
require the not-yet-created Forgejo, OpenBao, cluster or clock endpoint.

Acceptance: fresh-estate rehearsal, existing-estate upgrade path, explicit manual
bootstrap actions and retirement, failed-time gate, versioned handoff to steady
state owners. No unsupported claim that corporate workstations can be converged.

## Deploy on railiance01 and prove drift, recovery and rollback

```task
id: RCLK-WP-0005-T05
status: wait
needs_human: true
depends_on: [RCLK-WP-0005-T02, RCLK-WP-0005-T03]
blocking_reason: "Disposable VM proof after T02/T03, then specifically authorized native verification through the S1 owner."
priority: high
state_hub_task_id: "1b9fa2cb-77c5-5519-a4d3-184cb8597f86"
```

Blocked as of 2026-09-28: Admitted disposable VM recovery/drift/rebuild/rollback proof, then specifically authorized native verification through S1 owner.

Depends on T02/T03 readiness and specific live owner authorization. Apply the
reviewed source revision through its normal owner pipeline. Keep clock steps
and effects on existing token consumers within the reviewed rollout window.
Read back daemon configuration, image digest, service/identity/network state and
usable UTC interval. Verify an independently managed workstation obtains a sample
without changing OS clocks. Exercise upstream outage, restart, revoked signing
trust and rollback through safe rehearsals and the approved native scope.

Acceptance: exact-commit render/apply/readback receipts; repeated convergence is
no-op; drift detection catches a disposable config change; rebuild from committed
source succeeds; rollback restores known-good configuration without falsely
restoring old epochs/trust. No unnoticed unrelated resource or credential changes.

## Transfer operational responsibility and gate consumer adoption

```task
id: RCLK-WP-0005-T06
status: wait
depends_on: [RCLK-WP-0005-T02, RCLK-WP-0005-T03, RCLK-WP-0005-T04, RCLK-WP-0005-T05]
blocked_on: message-from:railiance-telemetry
blocking_reason: "Telemetry/platform accept alerts, budgets and runbooks with native evidence from the preceding tasks."
priority: high
state_hub_task_id: "c2edb898-7446-5e82-8d2a-9f3f45f41b00"
```

Blocked as of 2026-09-28: Telemetry/platform accept alerts, budgets, recovery/rotation runbooks and native evidence from preceding tasks.

Deliver alert ownership, quality/error budgets, backup/recovery and key-rotation
runbooks, source locations, pipeline/placement identifiers and native evidence to
railiance-telemetry/platform and RCLK-WP-0004. Document what remains single-host.
Keep all unresolved work as live records before finishing this plan. RCLK-WP-0004
may adopt a protected consumer only after this infrastructure gate AND its own
explicit consumer review/negative tests pass. A deployed endpoint is not a grant.

Local follow-up 2026-09-28: the [operations runbook](../docs/operations-runbook.md)
now supplies reviewable alert, recovery, rotation and rollback procedures.
Telemetry/platform acceptance and native evidence remain the T06 blockers.

### Production deployment evidence — 2026-09-15

The operator approved CCR-2026-0028 for platform and Clock ownership and then
accepted systemd host delivery. Authority and health timer are active/enabled
on railiance01; the sole listener is 127.0.0.1:8787. Custody is OpenBao version 1,
with an attended direct SSH delivery to the service-owned mode-0600 key file.
No workload Kubernetes role or policy was created. The host alternative avoids
a cluster identity/token dependency for the clock bootstrap and directly uses
the existing S1 health collector. Kubernetes itself is present on Railiance01;
the earlier session claim that it was absent was a faulty SSH check.

The authority has ProtectClock=yes and empty capability sets. The health exporter
has empty capability sets and ProtectClock=no because its read-only adjtimex query
is otherwise blocked by the syscall filter. Both configurations were read back.
Readiness and three workstation signed samples passed, with interval widths
102–161 ms and a separate SSH host-time cross-check. This checks transport and
interval construction against the same host, not independent UTC consensus.
Evidence: docs/evidence/2026-09-15-railiance-clock-production.json.

At deployment, T02/T03/T05 remained in progress for the broader acceptance criteria: disposable
reboot/outage/rotation/rollback rehearsals, durable consumer trust refresh, and
operational handoff in T06. Per-run consumer admission is boot-bound and expires
after 15 minutes; this deployment does not enable every optional consumer.


### Closeout review — 2026-09-28

Remaining tasks wait on owner review or native evidence; this plan is blocked.
The [closeout review](../docs/closeout-review-2026-09-28.md) records the completed
portions, each remaining gate and its owner. No new task or workplan was opened.