id: CCR-2026-0028
kind: credential-change-request
schema_version: 1
request_type: attended-host-key-delivery
title: Railiance Clock authority signing key custody and host delivery
status: verified
created: '2026-09-15'
updated: '2026-09-15'
requester:
  agent: codex
  reason: User requested production admission of the Railiance Clock authority after
    the host time baseline and disposable native acceptance passed.
review:
  required: true
  required_approvers:
  - platform-operator
  - railiance-clock-owner
  comments:
  - at: '2026-09-15'
    reviewer: User (platform-operator)
    decision: approved
    comment: User explicitly approved CCR-2026-0028 for the platform-operator role.
  - at: '2026-09-15'
    reviewer: User (railiance-clock-owner)
    decision: approved
    comment: User explicitly approved CCR-2026-0028 for the railiance-clock-owner
      role.
  - at: '2026-09-15'
    reviewer: User (platform-operator and railiance-clock-owner)
    decision: approved_host_delivery
    comment: User accepted the corrected systemd host-file design and instructed then
      lets go; existing two-role approval retained.
target:
  domain: infotech
  tenant: platform
  workload: railiance-clock
  environment: production
  purpose: Hold one ES256 authority private signing key in OpenBao and deliver it
    only to the private railiance01 Railiance Clock service; no public listener or
    consumer-wide distribution.
openbao:
  mount: platform
  kv_path: platform/workloads/railiance-clock/authority-signing
  fields:
  - PRIVATE_KEY_PEM
  - KEY_ID
  auth:
    method: attended-oidc
    mount: netkingdom
    role: platform-admin
  runtime_access: false
  initial_cas: 0
access_frontdoor:
  type: attended-host-file
  catalog_id: openbao-platform-admin-login
  readiness: ready
  resolvable: false
delivery:
  surface: attended-host-file
  host: 92.205.62.239
  ssh_user: tegwick
  target: /var/lib/railiance-clock/signing.pem
  owner: railiance-clock
  mode: '0600'
  directory_mode: '0700'
  procedure: scripts/railiance_clock_custody.py
risk:
  classification: high
  notes:
  - Compromise permits forging Railiance Clock samples until the key is revoked and
    every consumer trust file is replaced.
  - The authority remains loopback-only on railiance01; no workstation-wide or public
    endpoint is admitted.
  - Key generation, OpenBao write, host delivery, and rotation require an attended
    platform operator and railiance-clock owner review.
verification:
  positive:
  - Attended platform-admin identity and OpenBao audit enabled; initial key stored
    with CAS zero.
  - Host account, private directory, exact key ownership and permissions verified;
    public key matches custody.
  - Authority readiness and independent signed sample verification pass.
  negative:
  - Existing key is never overwritten during initial admission; interrupted delivery
    resumes only with the admitted custody version.
  - Wrong key id, authority, environment, epoch, stale health and expired trust are
    refused.
  - No new workload role, policy or token; no public authority listener.
  activation_conditions:
  - Existing two-role approval covers attended host delivery.
  - Ansible prepares the service account and private directory before custody.
  - Reviewed helper runs through warden access openbao-platform-admin-login --exec;
    host key verification is required.
  - Fresh public key, artifact SHA256, readiness and signed sample acceptance are
    recorded.
  evidence:
  - kind: attended_host_custody
    result: passed
    receipt: docs/evidence/2026-09-15-railiance-clock-host-custody.json
    details: OpenBao KV version 1 and matching public-key fingerprint on private host
      file; contained login, child operation and self-revocation succeeded.
  - kind: production_authority_acceptance
    result: passed
    receipt: docs/evidence/2026-09-15-railiance-clock-production.json
    details: Active/enabled private authority; pinned wheel; bounded host health;
      three signed workstation samples cross-checked through SSH, wrong key id refused.
      No standing workload read grant.
lifecycle:
  deactivate: Stop authority and withdraw consumer trust. Retain custody and host
    key until owner retention decision.
  rotate: Stop authority, perform separately versioned attended CAS rotation and atomic
    host replacement, then admit new public key and epoch for consumers.
  compromised: Stop authority immediately and withdraw all consumer trust; replace
    key forward under attended custody before restarting.
state_hub:
  workplan_id: RCLK-WP-0005