railiance-clock/workplans/RCLK-WP-0005-infrastructure-as-code.md

id	type	title	domain	repo	status	flavor	owner	topic_slug	created	updated	related_workplans	state_hub_workstream_id
RCLK-WP-0005	workplan	Deploy clock infrastructure through owner-managed infrastructure as code	infotech	railiance-clock	blocked	implementation	codex	custodian	2026-09-14	2026-09-28	RCLK-WP-0002 RCLK-WP-0003 RCLK-WP-0004	5af117db-3721-509a-a3a6-36ae6bab7af3

Operator-requested infrastructure plan. Read docs/infrastructure.md. This plan tracks the cross-owner delivery outcome; each owning repository holds its actual IaC and any required child work records. Inventory and ownership work can begin now. Live service deployment depends on the reviewed protocol and built artifact. Production applies require concrete owner admission, not just this plan's existence.

Confirm current host state and canonical IaC ownership

id: RCLK-WP-0005-T01
status: done
priority: high
state_hub_task_id: "883743c4-d368-5f94-878b-0e122eab39ee"

Inspect railiance01 time sources/daemon, synchronization health, virtualization, network egress, permissions and existing IaC without fetching secrets or changing time. Resolve railiance-infra versus inherited railiance-hosts implementation ownership with railiance-master; select one canonical baseline and reference it. Record target inventory, responsibility, current drift and gaps. Create/link owner work records before handing off any execution; no duplicate configuration trees.

Acceptance: reviewed source-path/owner matrix, live read-only inventory receipt, explicit adoption of existing settings or a bounded source diff; no second daemon.

Done 2026-09-14. Receipt: docs/evidence/2026-09-14-host-time-inventory.md. Live: UTC, systemd-timesyncd only, synchronized to ntp.ubuntu.com, stock config. Canonical S1 owner is railiance-infra; railiance-hosts is superseded. Adopt the existing daemon; do not add chrony. Residual RAIL-HO-WP-0013 declares it in IaC after RCLK-WP-0002.

Implement declarative host UTC discipline and verification

id: RCLK-WP-0005-T02
status: wait
priority: high
state_hub_task_id: "f3eea5a7-e745-57a2-9d76-b78eeba0bf06"

Blocked as of 2026-09-28: RAIL-HO-WP-0013 policy acceptance, baseline health integration and disposable reboot/outage/convergence evidence.

Depends on T01 and RCLK-WP-0002's UTC/leap/quality contract. In the S1 owner, version the selected existing/supported NTP client, independent upstream selection, network requirements, boot/restart behavior, holdover limits, drift monitoring and health export. Prefer existing supported automation over inventing a new daemon. Do not mix timesyncd/chrony or smeared/unsmeared sources. Restrict listeners; a server NTP offering is optional and separately justified, not an implicit public UDP/123 endpoint. Do not modify attached corporate workstation clock policy.

Acceptance: lint/render and convergence check; idempotent second apply; reboot and upstream-loss/recovery proof in disposable infrastructure; exact target diff, rollback procedure and owner review before live convergence. Service liveness alone does not prove bounded UTC accuracy.

Package private authority service and admitted trust delivery

id: RCLK-WP-0005-T03
status: wait
priority: high
state_hub_task_id: "bc07711b-96d1-5d72-aee1-21d39942564c"

Blocked as of 2026-09-28: Final architecture coverage and platform-approved durable trust refresh/rotation with native evidence.

Depends on adopted RCLK-WP-0002 trust contract and RCLK-WP-0003 artifact. Use rail-kubernetes on reef-railiance as the initial packaging candidate; create the reviewed rapp/deployable declarations under the architecture owner's conventions. A documented host-service alternative is allowed only if bootstrap dependencies or measured constraints justify it. The clock app reads host time/health but must not obtain CAP_SYS_TIME, privileged host access or a host clock-write interface.

Declare immutable image/build pins, namespace/service identity, private exposure, network policy, resource requests/limits, health versus usability probes, TLS and sample-signing key delivery/rotation via admitted owners, non-secret config, monitoring and state-retention/epoch behavior. No secret values in Git, no raw kubectl patches or console-created persistent resources as the desired state.

Acceptance: IaC rendered/validated by native tools, deployment admission and trust bootstrap reviewed, least-privilege and no-redirect tests, config/source hashes and exact deployment/rollback plan. Fail if dynamic trust resolution needs usable Railiance time before the first sample with no independent bootstrap path.

Integrate the clock prerequisite into the new-estate bootstrap path

id: RCLK-WP-0005-T04
status: wait
priority: high
state_hub_task_id: "584440e4-49ce-57f4-b6f1-953c0feec710"

Blocked as of 2026-09-28: Bootstrap owner fresh-estate and upgrade rehearsal, failed-time gate and steady-state handoff receipts.

Coordinate with railiance-bootstrap after T01 establishes owners. Add ordering: S1 obtains usable external UTC and basic transport trust; S2/S3 bring up the required substrate and admitted custody; the authority service is deployed; protected consumers start only after usable time/identity evidence. Bootstrap invokes pinned owner automation and verifies its receipts; it does not copy host roles or retain ongoing clock operation. The external UTC prerequisite must not require the not-yet-created Forgejo, OpenBao, cluster or clock endpoint.

Acceptance: fresh-estate rehearsal, existing-estate upgrade path, explicit manual bootstrap actions and retirement, failed-time gate, versioned handoff to steady state owners. No unsupported claim that corporate workstations can be converged.

Deploy on railiance01 and prove drift, recovery and rollback

id: RCLK-WP-0005-T05
status: wait
priority: high
state_hub_task_id: "1b9fa2cb-77c5-5519-a4d3-184cb8597f86"

Blocked as of 2026-09-28: Admitted disposable VM recovery/drift/rebuild/rollback proof, then specifically authorized native verification through S1 owner.

Depends on T02/T03 readiness and specific live owner authorization. Apply the reviewed source revision through its normal owner pipeline. Keep clock steps and effects on existing token consumers within the reviewed rollout window. Read back daemon configuration, image digest, service/identity/network state and usable UTC interval. Verify an independently managed workstation obtains a sample without changing OS clocks. Exercise upstream outage, restart, revoked signing trust and rollback through safe rehearsals and the approved native scope.

Acceptance: exact-commit render/apply/readback receipts; repeated convergence is no-op; drift detection catches a disposable config change; rebuild from committed source succeeds; rollback restores known-good configuration without falsely restoring old epochs/trust. No unnoticed unrelated resource or credential changes.

Transfer operational responsibility and gate consumer adoption

id: RCLK-WP-0005-T06
status: wait
priority: high
state_hub_task_id: "c2edb898-7446-5e82-8d2a-9f3f45f41b00"

Blocked as of 2026-09-28: Telemetry/platform accept alerts, budgets, recovery/rotation runbooks and native evidence from preceding tasks.

Deliver alert ownership, quality/error budgets, backup/recovery and key-rotation runbooks, source locations, pipeline/placement identifiers and native evidence to railiance-telemetry/platform and RCLK-WP-0004. Document what remains single-host. Keep all unresolved work as live records before finishing this plan. RCLK-WP-0004 may adopt a protected consumer only after this infrastructure gate AND its own explicit consumer review/negative tests pass. A deployed endpoint is not a grant.

Production deployment evidence — 2026-09-15

The operator approved CCR-2026-0028 for platform and Clock ownership and then accepted systemd host delivery. Authority and health timer are active/enabled on railiance01; the sole listener is 127.0.0.1:8787. Custody is OpenBao version 1, with an attended direct SSH delivery to the service-owned mode-0600 key file. No workload Kubernetes role or policy was created. The host alternative avoids a cluster identity/token dependency for the clock bootstrap and directly uses the existing S1 health collector. Kubernetes itself is present on Railiance01; the earlier session claim that it was absent was a faulty SSH check.

The authority has ProtectClock=yes and empty capability sets. The health exporter has empty capability sets and ProtectClock=no because its read-only adjtimex query is otherwise blocked by the syscall filter. Both configurations were read back. Readiness and three workstation signed samples passed, with interval widths 102–161 ms and a separate SSH host-time cross-check. This checks transport and interval construction against the same host, not independent UTC consensus. Evidence: docs/evidence/2026-09-15-railiance-clock-production.json.

At deployment, T02/T03/T05 remained in progress for the broader acceptance criteria: disposable reboot/outage/rotation/rollback rehearsals, durable consumer trust refresh, and operational handoff in T06. Per-run consumer admission is boot-bound and expires after 15 minutes; this deployment does not enable every optional consumer.

Closeout review — 2026-09-28

Remaining tasks wait on owner review or native evidence; this plan is blocked. The closeout review records the completed portions, each remaining gate and its owner. No new task or workplan was opened.