checkId: doctor.evidence.timestamp.time.system-sync family: doctor-check/v1 service: evidence-web scope: installation severity: critical tags: [timestamping, time, ntp, clock, evidence]

System Time Sync

Stella Ops is self-hosted software. It does not issue electronic time stamps or provide any qualified trust service. This deployment performs local verification using operator-supplied evidence. Unless an approved jurisdiction-, provider-, service-, and deployment-specific claim profile applies, qualified status is not determined.

Reports the system clock’s offset from a trusted time source against the installation’s skew budgets. A static signed time proof cannot measure an offset (it bounds the current instant from below), so a sealed estate reports this check unavailable rather than inventing a number. Default severity when it fails: critical. Installation-scoped: one result per estate, served on the Evidence doctor path and probed on the worker schedule time-and-reachability (every 5 minutes).

What it measures

Critical when the offset magnitude exceeds SystemClockCriticalSkew (default 5 s); warning above SystemClockWarnSkew (default 1 s).

The check never reports a pass for a value it does not have. When its source cannot be read it reports unhealthy with the message Source unavailable (<reason>): <detail>. No verdict can be reported. and the evidence keys source.state=unavailable, source.reason (one of source-not-configured, source-configuration-invalid, unavailable-by-sealed-policy, source-material-invalid, source-read-failed) and source.detail.

Evidence keys

time.offsetSeconds
time.warnSkewSeconds
time.criticalSkewSeconds
time.sourceId
time.mode

Every value is a bounded measurement or pointer; no token bytes, trust material or credentials appear in evidence.

Common causes

No time source is configured (current state).
Once wired: NTP drift on the host.

Configuration

No allow-listed time source is wired into the Evidence family yet, so the check reports unavailable (source-not-configured online, unavailable-by-sealed-policy sealed).

Thresholds live in Evidence__TimestampAssurance__Policy__* and default to the values the retired Doctor plugin used (carried verbatim so a cadence or threshold change is always a visible edit).

How to verify

The 17 installation checks are served by evidence-web on the shared doctor-check/v1 path and need the ops.health scope. Probe the service DIRECTLY from inside the estate network: the gateway’s unprefixed /doctor/evidence/checks resolves to whichever service registered that template first, not to Evidence.

curl -sS -H "Authorization: Bearer $OPS_HEALTH_TOKEN" \
  http://evidence-web.stella-ops.local:8080/doctor/evidence/checks \
  | jq '.checks[] | select(.checkId == "doctor.evidence.timestamp.time.system-sync")'

Once the Evidence doctor registration is activated (it is off by default in a sealed estate), the same result is also visible through the Platform doctor aggregator under the evidence service.

TSA Time Skew (doctor.evidence.timestamp.time.tsa-skew)
Transparency Time Correlation (doctor.evidence.timestamp.time.rekor-correlation)

This is a local evidentiary classification of the token and issuing service at the stated time. It is not the output of a qualified validation or qualified preservation service and does not determine the legal effect of the underlying release, document, or transaction.