Record verified production Clock custody and authority acceptance

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

credential-change-requests/CCR-2026-0028-railiance-clock-authority-signing.yaml

@@ -3,7 +3,7 @@ kind: credential-change-request
 schema_version: 1
 request_type: attended-host-key-delivery
 title: Railiance Clock authority signing key custody and host delivery
-status: approved
+status: verified
 created: '2026-09-15'
 updated: '2026-09-15'
 requester:
@@ -53,7 +53,7 @@ openbao:
 access_frontdoor:
   type: attended-host-file
   catalog_id: openbao-platform-admin-login
-  readiness: approved-pending-apply
+  readiness: ready
   resolvable: false
 delivery:
   surface: attended-host-file
@@ -93,7 +93,18 @@ verification:
     host key verification is required.
   - Fresh public key, artifact SHA256, readiness and signed sample acceptance are
     recorded.
-  evidence: []
+  evidence:
+  - kind: attended_host_custody
+    result: passed
+    receipt: docs/evidence/2026-09-15-railiance-clock-host-custody.json
+    details: OpenBao KV version 1 and matching public-key fingerprint on private host
+      file; contained login, child operation and self-revocation succeeded.
+  - kind: production_authority_acceptance
+    result: passed
+    receipt: docs/evidence/2026-09-15-railiance-clock-production.json
+    details: Active/enabled private authority; pinned wheel; bounded host health;
+      three signed workstation samples cross-checked through SSH, wrong key id refused.
+      No standing workload read grant.
 lifecycle:
   deactivate: Stop authority and withdraw consumer trust. Retain custody and host
     key until owner retention decision.