docs: confirm Anthropic key custody and remaining runtime gates
All checks were successful
ci / validate (push) Successful in 2m3s

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb
This commit is contained in:
tegwick 2026-09-05 21:15:14 +02:00
parent 39e9562802
commit 13027544f4
3 changed files with 29 additions and 2 deletions

View file

@ -90,3 +90,17 @@ a second contained login after correcting empty-response parsing; both sessions
were revoked. See the non-secret evidence in
`evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json`.
The user can now create version 2 in the UI.
## Custody confirmed
On 2026-09-05 the user reported saving the API key through the UI. A contained
metadata-only read confirmed live version 2, created at
`2026-09-05T19:12:40.442796563Z`, neither deleted nor destroyed. The session
was revoked. No secret value or field content was read; provider authentication
is not yet verified. Evidence:
`evidence/GLAS-WP-0012-anthropic-custody-2026-09-05.json`.
The UI handoff is complete. Do not run the empty initializer again. The next
implementation is an exact sandbox-owner machine binding and protected key
delivery, followed by enforced provider egress and the bounded real proof.
CCR-2026-0016 remains in flight until those acceptance gates pass.