railiance-platform/credential-change-requests/CCR-2026-0028-railiance-clock-authority-signing.yaml

id: CCR-2026-0028
kind: credential-change-request
schema_version: 1
request_type: workload-kv-read
title: Railiance Clock authority signing key custody and host delivery
status: approved
created: '2026-09-15'
updated: '2026-09-15'
requester:
  agent: codex
  reason: User requested production admission of the Railiance Clock authority after the host time baseline and disposable native acceptance passed.
review:
  required: true
  required_approvers:
  - platform-operator
  - railiance-clock-owner
  comments:
  - at: '2026-09-15'
    reviewer: User (platform-operator)
    decision: approved
    comment: User explicitly approved CCR-2026-0028 for the platform-operator role.
  - at: '2026-09-15'
    reviewer: User (railiance-clock-owner)
    decision: approved
    comment: User explicitly approved CCR-2026-0028 for the railiance-clock-owner role.
target:
  domain: infotech
  tenant: platform
  workload: railiance-clock
  environment: production
  purpose: Hold one ES256 authority private signing key in OpenBao and deliver it only to the private railiance01 Railiance Clock service; no public listener or consumer-wide distribution.
openbao:
  mount: platform
  kv_path: platform/workloads/railiance-clock/authority-signing
  fields:
  - PRIVATE_KEY_PEM
  - KEY_ID
  metadata_read: false
  token_self_lifecycle: true
  policy_name: workload-kv-read-railiance-clock-authority-signing
  policy_file: openbao/policies/workload-kv-read-railiance-clock-authority-signing.hcl
  auth:
    method: kubernetes
    mount: kubernetes
    role: external-secrets-railiance-clock-authority
    bound_claims:
      service_account_names:
      - railiance-clock
      service_account_namespaces:
      - railiance-clock
    bound_claims_confirmed: false
    policies:
    - workload-kv-read-railiance-clock-authority-signing
    ttl: 15m
    audience: openbao
    token_max_ttl: 15m
    token_explicit_max_ttl: 15m
    token_no_default_policy: true
access_frontdoor:
  type: host-file-delivery
  catalog_id: railiance-clock-authority-signing
  selector: Private Railiance Clock authority key on railiance01
  readiness: pending-review
  resolvable: false
delivery:
  surface: attended-host-file
  target: railiance01:/etc/railiance-clock/authority-key.pem, owner railiance-clock, mode 0600; key material must be generated and delivered through the governed OpenBao platform-admin lane and never appear in Git, argv, logs, or chat.
  bootstrap_command: See the attended platform custody runbook to be added with this CCR; configure the service only after key admission, public-key metadata readback, and exact artifact hash verification.
risk:
  classification: high
  notes:
  - Compromise permits forging Railiance Clock samples until the key is revoked and every consumer trust file is replaced.
  - The authority remains loopback-only on railiance01; no workstation-wide or public endpoint is admitted.
  - Key generation, OpenBao write, host delivery, and rotation require an attended platform operator and railiance-clock owner review.
verification:
  positive:
  - Exact service identity reads only PRIVATE_KEY_PEM and KEY_ID; authority readiness and signed sample verification pass.
  - Host file ownership and mode are exact; private key value is absent from all command output and logs.
  negative:
  - Other service accounts, namespaces, sibling paths, metadata/listing, and public listeners are denied.
  - Wrong key id, wrong authority/environment/epoch, expired trust, rollback, and stale health fail closed.
  activation_conditions:
  - CCR approved by platform-operator and railiance-clock-owner.
  - Dedicated OpenBao policy, Kubernetes role, and host delivery path are applied and read back without secret disclosure.
  - Fresh public-key metadata, artifact SHA-256, /readyz, and colocated sample verification are recorded.
  evidence: []
lifecycle:
  deactivate: Stop the authority, remove the host key, revoke the workload policy/role, and replace consumer trust files.
  rotate: Stop authority and consumers, generate a new key under attended custody, deliver mode 0600, then replace trust files and verify old signatures fail.
  compromised: Stop the authority immediately, revoke the policy and key version, replace all trust files, and restart only after fresh verification.
state_hub:
  workplan_id: RCLK-WP-0005