Implement attended Railiance Clock host key delivery

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

credential-change-requests/CCR-2026-0028-railiance-clock-authority-signing.yaml

@@ -1,14 +1,15 @@
 id: CCR-2026-0028
 kind: credential-change-request
 schema_version: 1
-request_type: workload-kv-read
+request_type: attended-host-key-delivery
 title: Railiance Clock authority signing key custody and host delivery
 status: approved
 created: '2026-09-15'
 updated: '2026-09-15'
 requester:
   agent: codex
-  reason: User requested production admission of the Railiance Clock authority after the host time baseline and disposable native acceptance passed.
+  reason: User requested production admission of the Railiance Clock authority after
+    the host time baseline and disposable native acceptance passed.
 review:
   required: true
   required_approvers:
@@ -22,71 +23,83 @@ review:
   - at: '2026-09-15'
     reviewer: User (railiance-clock-owner)
     decision: approved
-    comment: User explicitly approved CCR-2026-0028 for the railiance-clock-owner role.
+    comment: User explicitly approved CCR-2026-0028 for the railiance-clock-owner
+      role.
+  - at: '2026-09-15'
+    reviewer: User (platform-operator and railiance-clock-owner)
+    decision: approved_host_delivery
+    comment: User accepted the corrected systemd host-file design and instructed then
+      lets go; existing two-role approval retained.
 target:
   domain: infotech
   tenant: platform
   workload: railiance-clock
   environment: production
-  purpose: Hold one ES256 authority private signing key in OpenBao and deliver it only to the private railiance01 Railiance Clock service; no public listener or consumer-wide distribution.
+  purpose: Hold one ES256 authority private signing key in OpenBao and deliver it
+    only to the private railiance01 Railiance Clock service; no public listener or
+    consumer-wide distribution.
 openbao:
   mount: platform
   kv_path: platform/workloads/railiance-clock/authority-signing
   fields:
   - PRIVATE_KEY_PEM
   - KEY_ID
-  metadata_read: false
-  token_self_lifecycle: true
-  policy_name: workload-kv-read-railiance-clock-authority-signing
-  policy_file: openbao/policies/workload-kv-read-railiance-clock-authority-signing.hcl
   auth:
-    method: kubernetes
-    mount: kubernetes
-    role: external-secrets-railiance-clock-authority
-    bound_claims:
-      service_account_names:
-      - railiance-clock
-      service_account_namespaces:
-      - railiance-clock
-    bound_claims_confirmed: false
-    policies:
-    - workload-kv-read-railiance-clock-authority-signing
-    ttl: 15m
-    audience: openbao
-    token_max_ttl: 15m
-    token_explicit_max_ttl: 15m
-    token_no_default_policy: true
+    method: attended-oidc
+    mount: netkingdom
+    role: platform-admin
+  runtime_access: false
+  initial_cas: 0
 access_frontdoor:
-  type: host-file-delivery
-  catalog_id: railiance-clock-authority-signing
-  selector: Private Railiance Clock authority key on railiance01
-  readiness: pending-review
+  type: attended-host-file
+  catalog_id: openbao-platform-admin-login
+  readiness: approved-pending-apply
   resolvable: false
 delivery:
   surface: attended-host-file
-  target: railiance01:/etc/railiance-clock/authority-key.pem, owner railiance-clock, mode 0600; key material must be generated and delivered through the governed OpenBao platform-admin lane and never appear in Git, argv, logs, or chat.
-  bootstrap_command: See the attended platform custody runbook to be added with this CCR; configure the service only after key admission, public-key metadata readback, and exact artifact hash verification.
+  host: 92.205.62.239
+  ssh_user: tegwick
+  target: /var/lib/railiance-clock/signing.pem
+  owner: railiance-clock
+  mode: '0600'
+  directory_mode: '0700'
+  procedure: scripts/railiance_clock_custody.py
 risk:
   classification: high
   notes:
-  - Compromise permits forging Railiance Clock samples until the key is revoked and every consumer trust file is replaced.
-  - The authority remains loopback-only on railiance01; no workstation-wide or public endpoint is admitted.
-  - Key generation, OpenBao write, host delivery, and rotation require an attended platform operator and railiance-clock owner review.
+  - Compromise permits forging Railiance Clock samples until the key is revoked and
+    every consumer trust file is replaced.
+  - The authority remains loopback-only on railiance01; no workstation-wide or public
+    endpoint is admitted.
+  - Key generation, OpenBao write, host delivery, and rotation require an attended
+    platform operator and railiance-clock owner review.
 verification:
   positive:
-  - Exact service identity reads only PRIVATE_KEY_PEM and KEY_ID; authority readiness and signed sample verification pass.
-  - Host file ownership and mode are exact; private key value is absent from all command output and logs.
+  - Attended platform-admin identity and OpenBao audit enabled; initial key stored
+    with CAS zero.
+  - Host account, private directory, exact key ownership and permissions verified;
+    public key matches custody.
+  - Authority readiness and independent signed sample verification pass.
   negative:
-  - Other service accounts, namespaces, sibling paths, metadata/listing, and public listeners are denied.
-  - Wrong key id, wrong authority/environment/epoch, expired trust, rollback, and stale health fail closed.
+  - Existing key is never overwritten during initial admission; interrupted delivery
+    resumes only with the admitted custody version.
+  - Wrong key id, authority, environment, epoch, stale health and expired trust are
+    refused.
+  - No new workload role, policy or token; no public authority listener.
   activation_conditions:
-  - CCR approved by platform-operator and railiance-clock-owner.
-  - Dedicated OpenBao policy, Kubernetes role, and host delivery path are applied and read back without secret disclosure.
-  - Fresh public-key metadata, artifact SHA-256, /readyz, and colocated sample verification are recorded.
+  - Existing two-role approval covers attended host delivery.
+  - Ansible prepares the service account and private directory before custody.
+  - Reviewed helper runs through warden access openbao-platform-admin-login --exec;
+    host key verification is required.
+  - Fresh public key, artifact SHA256, readiness and signed sample acceptance are
+    recorded.
   evidence: []
 lifecycle:
-  deactivate: Stop the authority, remove the host key, revoke the workload policy/role, and replace consumer trust files.
-  rotate: Stop authority and consumers, generate a new key under attended custody, deliver mode 0600, then replace trust files and verify old signatures fail.
-  compromised: Stop the authority immediately, revoke the policy and key version, replace all trust files, and restart only after fresh verification.
+  deactivate: Stop authority and withdraw consumer trust. Retain custody and host
+    key until owner retention decision.
+  rotate: Stop authority, perform separately versioned attended CAS rotation and atomic
+    host replacement, then admit new public key and epoch for consumers.
+  compromised: Stop authority immediately and withdraw all consumer trust; replace
+    key forward under attended custody before restarting.
 state_hub:
   workplan_id: RCLK-WP-0005