docs: confirm Anthropic key custody and remaining runtime gates

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

docs/anthropic-workload-key.md

@@ -90,3 +90,17 @@ a second contained login after correcting empty-response parsing; both sessions
 were revoked. See the non-secret evidence in
 `evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json`.
 The user can now create version 2 in the UI.
+
+## Custody confirmed
+
+On 2026-09-05 the user reported saving the API key through the UI. A contained
+metadata-only read confirmed live version 2, created at
+`2026-09-05T19:12:40.442796563Z`, neither deleted nor destroyed. The session
+was revoked. No secret value or field content was read; provider authentication
+is not yet verified. Evidence:
+`evidence/GLAS-WP-0012-anthropic-custody-2026-09-05.json`.
+
+The UI handoff is complete. Do not run the empty initializer again. The next
+implementation is an exact sandbox-owner machine binding and protected key
+delivery, followed by enforced provider egress and the bounded real proof.
+CCR-2026-0016 remains in flight until those acceptance gates pass.

docs/evidence/GLAS-WP-0012-anthropic-custody-2026-09-05.json

@@ -0,0 +1,10 @@
+{
+  "ccr": "CCR-2026-0016",
+  "path": "platform/metadata/workloads/glas-harness/claude-agent-dev",
+  "current_version": 2,
+  "created_time": "2026-09-05T19:12:40.442796563Z",
+  "live_successor_observed": true,
+  "secret_value_read": false,
+  "provider_authentication_verified": false,
+  "request_id": "d0b60424-a749-c72f-593b-ced6172dd183"
+}