Activate production Clock authority and verify host convergence

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

ansible/inventory/host_vars/Railiance01.yml

@@ -1,5 +1,10 @@
 # RCLK-WP-0005 / RAIL-HO-WP-0013: scoped operator-requested host baseline.
 railiance_clock_enabled: true
 railiance_clock_manage_timesyncd: true
-railiance_clock_authority_enabled: false
-railiance_clock_admission_ref: operator-clock-infrastructure-request-2026-09-15
+railiance_clock_authority_enabled: true
+railiance_clock_admission_ref: CCR-2026-0028
+
+# Artifact wheelhouse is supplied by the deployment controller; exact wheel is pinned.
+railiance_clock_key_preinstalled: true
+railiance_clock_wheel_sha256: 89d1419f038eff485a27a4206a19101ce7ca2976092971bbc796a77188fc93ad
+railiance_clock_kid: railiance01-clock-20260915-v1

ansible/roles/railiance_clock/tasks/authority.yaml

@@ -99,6 +99,7 @@
 - name: Load changed units before starting
   ansible.builtin.meta: flush_handlers
 - name: Export current host health
+  changed_when: false  # Refresh observation; no desired-state configuration changes.
   ansible.builtin.systemd:
     name: railiance-clock-health.service
     state: started

ansible/roles/railiance_clock/templates/railiance-clock-health.service.j2

@@ -12,7 +12,9 @@ ProtectSystem=strict
 ReadWritePaths={{ railiance_clock_health_root }}
 ProtectHome=yes
 PrivateTmp=yes
-ProtectClock=yes
+# adjtimex(modes=0) is read-only but ProtectClock blocks the syscall entirely.
+# Empty capability sets still deny clock writes, including nonzero adjtimex modes.
+ProtectClock=no
 RestrictAddressFamilies=AF_UNIX
 TimeoutStartSec=12
 UMask=0022