coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Document Railiance Clock validity integration
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
tegwick 2026-09-15 22:19:12 +02:00
parent f4b4dd6b17
commit 14c5704650
1 changed files with 11 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/approval-consumption.md
View file

@ -163,6 +163,7 @@ Production and declared human-control paths need:
| `SECRETS_ENGINE_AUTHORIZATION_SUBJECT_ID` / `_SUBJECT_TYPE` | the acting principal |
| `SECRETS_ENGINE_AUTHORIZATION_POLICY_PACKAGE` / `_VERSION` | the live pin (step 2) |
| `SECRETS_ENGINE_PDP_URL` / `_PDP_TOKEN_FILE` | the per-consumer access-engine pin |
| `SECRETS_ENGINE_CLOCK_TRUST_FILE` | optional admitted Railiance Clock trust file; when set, the full returned interval is used for validity and an unavailable clock refuses |
The distinct-approver threshold is no longer a consumer-side check. The claim
does not expose approver entries; approval-engine folds that requirement into
@ -207,3 +208,13 @@ the consumer never shifts its validation clock or treats a future decision as
already valid. Native preflight exposed workstation clock drift; the existing
NTP service was restarted. All three owner-store/native-PDP diagnostic joins
passed afterward, without consuming approvals. Full regression suite: 420 passed.
### Railiance Clock consumer integration — 2026-09-15
When `SECRETS_ENGINE_CLOCK_TRUST_FILE` is configured, claim and decision validity
use the Railiance Clock interval: its lower bound must reach `not_before`, and its
upper bound must remain strictly before expiry. The interval is rechecked before
and after CAS consume. The client keeps a boot-bound trust admission and private
rollback floor. It never changes the OS clock, accepts a sample as its own trust
bootstrap, or falls back to a shifted local timestamp. The option stays unset
until the owner publishes trust through the admitted Railiance Clock deployment.