propose Railiance Clock authority key custody lane

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

credential-change-requests/CCR-2026-0028-railiance-clock-authority-signing.yaml

@@ -0,0 +1,84 @@
+id: CCR-2026-0028
+kind: credential-change-request
+schema_version: 1
+request_type: workload-kv-read
+title: Railiance Clock authority signing key custody and host delivery
+status: proposed
+created: '2026-09-15'
+updated: '2026-09-15'
+requester:
+  agent: codex
+  reason: User requested production admission of the Railiance Clock authority after the host time baseline and disposable native acceptance passed.
+review:
+  required: true
+  required_approvers:
+  - platform-operator
+  - railiance-clock-owner
+  comments: []
+target:
+  domain: infotech
+  tenant: platform
+  workload: railiance-clock
+  environment: production
+  purpose: Hold one ES256 authority private signing key in OpenBao and deliver it only to the private railiance01 Railiance Clock service; no public listener or consumer-wide distribution.
+openbao:
+  mount: platform
+  kv_path: platform/workloads/railiance-clock/authority-signing
+  fields:
+  - PRIVATE_KEY_PEM
+  - KEY_ID
+  metadata_read: false
+  token_self_lifecycle: true
+  policy_name: workload-kv-read-railiance-clock-authority-signing
+  policy_file: openbao/policies/workload-kv-read-railiance-clock-authority-signing.hcl
+  auth:
+    method: kubernetes
+    mount: kubernetes
+    role: external-secrets-railiance-clock-authority
+    bound_claims:
+      service_account_names:
+      - railiance-clock
+      service_account_namespaces:
+      - railiance-clock
+    bound_claims_confirmed: false
+    policies:
+    - workload-kv-read-railiance-clock-authority-signing
+    ttl: 15m
+    audience: openbao
+    token_max_ttl: 15m
+    token_explicit_max_ttl: 15m
+    token_no_default_policy: true
+access_frontdoor:
+  type: host-file-delivery
+  catalog_id: railiance-clock-authority-signing
+  selector: Private Railiance Clock authority key on railiance01
+  readiness: pending-review
+  resolvable: false
+delivery:
+  surface: attended-host-file
+  target: railiance01:/etc/railiance-clock/authority-key.pem, owner railiance-clock, mode 0600; key material must be generated and delivered through the governed OpenBao platform-admin lane and never appear in Git, argv, logs, or chat.
+  bootstrap_command: See the attended platform custody runbook to be added with this CCR; configure the service only after key admission, public-key metadata readback, and exact artifact hash verification.
+risk:
+  classification: high
+  notes:
+  - Compromise permits forging Railiance Clock samples until the key is revoked and every consumer trust file is replaced.
+  - The authority remains loopback-only on railiance01; no workstation-wide or public endpoint is admitted.
+  - Key generation, OpenBao write, host delivery, and rotation require an attended platform operator and railiance-clock owner review.
+verification:
+  positive:
+  - Exact service identity reads only PRIVATE_KEY_PEM and KEY_ID; authority readiness and signed sample verification pass.
+  - Host file ownership and mode are exact; private key value is absent from all command output and logs.
+  negative:
+  - Other service accounts, namespaces, sibling paths, metadata/listing, and public listeners are denied.
+  - Wrong key id, wrong authority/environment/epoch, expired trust, rollback, and stale health fail closed.
+  activation_conditions:
+  - CCR approved by platform-operator and railiance-clock-owner.
+  - Dedicated OpenBao policy, Kubernetes role, and host delivery path are applied and read back without secret disclosure.
+  - Fresh public-key metadata, artifact SHA-256, /readyz, and colocated sample verification are recorded.
+  evidence: []
+lifecycle:
+  deactivate: Stop the authority, remove the host key, revoke the workload policy/role, and replace consumer trust files.
+  rotate: Stop authority and consumers, generate a new key under attended custody, deliver mode 0600, then replace trust files and verify old signatures fail.
+  compromised: Stop the authority immediately, revoke the policy and key version, replace all trust files, and restart only after fresh verification.
+state_hub:
+  workplan_id: RCLK-WP-0005

openbao/policies/workload-kv-read-railiance-clock-authority-signing.hcl

@@ -0,0 +1,3 @@
+path "platform/data/workloads/railiance-clock/authority-signing" {
+  capabilities = ["read"]
+}