Record verified production Clock custody and authority acceptance

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

docs/credential-lane-designs/railiance-clock-host-delivery.md

@@ -34,3 +34,23 @@ Rotation is a separate explicit operation: stop the authority, CAS against the
 known current custody version, replace the host key atomically, and distribute
 new public key/epoch trust before resuming clients. This initial-admission helper
 deliberately does not implement rotation or overwrite keys.
+
+## Accepted production deployment
+
+Version 1 custody and native workstation samples passed on 2026-09-15. See
+`docs/evidence/2026-09-15-railiance-clock-host-custody.json` and
+`docs/evidence/2026-09-15-railiance-clock-production.json`.
+Use the documented private OpenBao endpoint `http://127.0.0.1:18200` for the
+attended envelope: the configured public hostname presented an untrusted
+certificate during deployment. TLS verification was not disabled.
+
+Authority endpoint on Railiance01: `http://127.0.0.1:8787/v1/time-samples`;
+readiness: `http://127.0.0.1:8787/readyz`. Workstations use an authenticated SSH
+loopback connection and separately admitted public key/epoch. Trust files last
+at most 15 minutes and do not survive a workstation boot. Optional integrations
+are not globally enabled by this deployment; operational trust refresh remains
+in RCLK-WP-0005-T06 and consumer adoption in RCLK-WP-0004.
+
+The health export sandbox allows read-only adjtimex, which ProtectClock would
+block even with modes=0. Empty bounding/ambient capability sets deny clock writes.
+The authority keeps ProtectClock enabled.

docs/evidence/2026-09-15-railiance-clock-host-custody.json

@@ -0,0 +1,15 @@
+{
+  "schema": "platform.railiance-clock-host-custody.v1",
+  "status": "delivered_pending_authority_acceptance",
+  "stage": "complete",
+  "ccr": "CCR-2026-0028",
+  "kv_version": 1,
+  "kid": "railiance01-clock-20260915-v1",
+  "public_key_pem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE6dgMrD13yE5PKBxDSl7ledal2vwd\nDmPZEjdYW8UK48Abto6dfuJfjCHeC+Jl3w1D5VZLfbbzD114ymKTszE80A==\n-----END PUBLIC KEY-----\n",
+  "public_key_sha256": "bd583446b5ed61d086806b2a0c5aaf33a875b751e45599e75335d1f415be609a",
+  "host": {
+    "public_key_sha256": "bd583446b5ed61d086806b2a0c5aaf33a875b751e45599e75335d1f415be609a",
+    "owner": "railiance-clock",
+    "mode": "0600"
+  }
+}

docs/evidence/2026-09-15-railiance-clock-production.json

@@ -0,0 +1,42 @@
+{
+  "scope": "production authority acceptance",
+  "host": "railiance01",
+  "client": "Linux/WSL via SSH loopback",
+  "os_clocks_changed": false,
+  "samples": [
+    {
+      "width_ms": 101.667802,
+      "railiance_minus_local_midpoint_ms": 253.602519,
+      "independent_host_cross_check": true
+    },
+    {
+      "width_ms": 108.062875,
+      "railiance_minus_local_midpoint_ms": 325.159405,
+      "independent_host_cross_check": true
+    },
+    {
+      "width_ms": 160.436282,
+      "railiance_minus_local_midpoint_ms": 371.73663,
+      "independent_host_cross_check": true
+    }
+  ],
+  "wrong_kid_refused": true,
+  "epoch": "b1164ccb-a4c2-4cc8-adf8-1d5597de697b",
+  "kid": "railiance01-clock-20260915-v1",
+  "public_key_sha256": "bd583446b5ed61d086806b2a0c5aaf33a875b751e45599e75335d1f415be609a",
+  "trust_lifetime_seconds": 900,
+  "wheel_sha256": "89d1419f038eff485a27a4206a19101ce7ca2976092971bbc796a77188fc93ad",
+  "listener": "127.0.0.1:8787",
+  "service_active": true,
+  "service_enabled": true,
+  "authority_clock_write_capabilities": [],
+  "health_clock_write_capabilities": [],
+  "readiness": "usable",
+  "key_custody": "CCR-2026-0028 version 1",
+  "final_ansible_convergence": {
+    "ok": 29,
+    "changed": 0,
+    "failed": 0,
+    "unreachable": 0
+  }
+}