From 14c5704650fde5e082d98662ad43ad85091bcf4c Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 15 Sep 2026 22:19:12 +0200 Subject: [PATCH] Document Railiance Clock validity integration Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6 --- docs/approval-consumption.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/docs/approval-consumption.md b/docs/approval-consumption.md index 849599f..de6b7e7 100644 --- a/docs/approval-consumption.md +++ b/docs/approval-consumption.md @@ -163,6 +163,7 @@ Production and declared human-control paths need: | `SECRETS_ENGINE_AUTHORIZATION_SUBJECT_ID` / `_SUBJECT_TYPE` | the acting principal | | `SECRETS_ENGINE_AUTHORIZATION_POLICY_PACKAGE` / `_VERSION` | the live pin (step 2) | | `SECRETS_ENGINE_PDP_URL` / `_PDP_TOKEN_FILE` | the per-consumer access-engine pin | +| `SECRETS_ENGINE_CLOCK_TRUST_FILE` | optional admitted Railiance Clock trust file; when set, the full returned interval is used for validity and an unavailable clock refuses | The distinct-approver threshold is no longer a consumer-side check. The claim does not expose approver entries; approval-engine folds that requirement into @@ -207,3 +208,13 @@ the consumer never shifts its validation clock or treats a future decision as already valid. Native preflight exposed workstation clock drift; the existing NTP service was restarted. All three owner-store/native-PDP diagnostic joins passed afterward, without consuming approvals. Full regression suite: 420 passed. + +### Railiance Clock consumer integration — 2026-09-15 + +When `SECRETS_ENGINE_CLOCK_TRUST_FILE` is configured, claim and decision validity +use the Railiance Clock interval: its lower bound must reach `not_before`, and its +upper bound must remain strictly before expiry. The interval is rechecked before +and after CAS consume. The client keeps a boot-bound trust admission and private +rollback floor. It never changes the OS clock, accepts a sample as its own trust +bootstrap, or falls back to a shifted local timestamp. The option stays unset +until the owner publishes trust through the admitted Railiance Clock deployment.