coulomb/glas-harness
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: record Anthropic empty entry and UI handoff

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb
This commit is contained in:
tegwick 2026-09-05 21:10:43 +02:00
parent 823796ff6d
commit 39e9562802
2 changed files with 36 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

32
docs/anthropic-workload-key.md
View file

@ -10,12 +10,12 @@ passes and apply-plan refuses the incomplete request.
| Setting | Proposed value |
| --- | --- |
| Anthropic organization | Awaiting user selection |
| Anthropic organization | `e1a8f305-9e64-4639-a7fd-af48e34f37c7` (user supplied) |
| Dedicated workspace | `glas-harness` |
| Workspace spend limit | Awaiting user selection |
| Service account / key label | `glas-agent-dev` |
| Provider key name | `claude_key_bernd.worsch` (user supplied; account type unverified) |
| Key scope | Only the dedicated workspace |
| Initial expiry | 30 days, subject to organization policy |
| Provider expiry | `2027-01-31T22:00:00+01:00` = `2027-01-31T21:00:00Z` (user supplied) |
| KV-v2 entry | `platform/workloads/glas-harness/claude-agent-dev` |
| Only secret field | `ANTHROPIC_API_KEY` |
| Read policy name | `workload-kv-read-glas-claude-agent-dev` |
@ -24,7 +24,8 @@ passes and apply-plan refuses the incomplete request.
These are proposed coordinates, not evidence that provider/OpenBao objects
exist. The generic `openbao-api-key` routing entry is not a usable grant.
No provider key or live auth role was created in this preparation.
Provider key metadata was supplied by the user. OpenBao empty version 1 now
exists; no live auth role or runtime grant was created.
## Provider creation and custody
@ -66,3 +67,26 @@ For rotation, create and store a replacement with CAS, stop runs carrying the
predecessor, verify the replacement, revoke the predecessor at Anthropic and
prove denial. OpenBao lease expiry alone does not revoke an Anthropic API key.
For compromise, disable the provider key immediately and stop affected runs.
## Empty-version UI handoff
User authorized an empty version at the proposed path. The platform initializer
`scripts/prepare-glas-anthropic.py` writes only an empty `ANTHROPIC_API_KEY`
using CAS zero, then records non-secret provider metadata. It never reads data
and does not create any reader policy or auth role. A contained operator login
is required; the local ops-mason grant is absent and its builder policy denies
data writes. Creation receipt is `/tmp/glas-anthropic-empty-receipt.json`.
Do not assume creation succeeded without that receipt and a successful envelope.
After confirmed creation, open mount `platform`, path
`workloads/glas-harness/claude-agent-dev`, and create a new version replacing
the empty `ANTHROPIC_API_KEY` with the real key. The recorded provider expiry
is descriptive metadata, not an OpenBao-enforced expiration. Do not send the
value back in chat. Workspace/budget and runtime delivery remain unverified.
Creation confirmed 2026-09-05: empty version 1, request id
`50cafc25-8d24-c1d6-5be8-1ade049e088b`. Metadata completion succeeded through
a second contained login after correcting empty-response parsing; both sessions
were revoked. See the non-secret evidence in
`evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json`.
The user can now create version 2 in the UI.

8
docs/evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json Normal file
View file

@ -0,0 +1,8 @@
{
"ccr": "CCR-2026-0016",
"path": "platform/data/workloads/glas-harness/claude-agent-dev",
"version": 1,
"empty_seed_created": true,
"metadata_written": true,
"request_id": "50cafc25-8d24-c1d6-5be8-1ade049e088b"
}