docs: record credential transport proof and native activation dependency

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

docs/anthropic-workload-key.md

@@ -104,3 +104,18 @@ The UI handoff is complete. Do not run the empty initializer again. The next
 implementation is an exact sandbox-owner machine binding and protected key
 delivery, followed by enforced provider egress and the bounded real proof.
 CCR-2026-0016 remains in flight until those acceptance gates pass.
+
+## Owner transport and native adoption
+
+Sand-boxer now implements consumer-bound exec-env delivery through a configured
+credential owner provider, with direct private handoff to the namespace broker.
+Synthetic proof 880f749e passed child delivery, exact-value output redaction,
+next-exec absence, wrong-project denial and teardown. No real key was read.
+
+Secrets-engine catalog `glas-claude-agent-dev-anthropic` now proposes native
+policy/AppRole `se-prod-glas-claude-agent-dev-anthropic` for the exact KV data
+path, with metadata access excluded. This supersedes the earlier proposed read
+policy name; neither policy has been applied by this work. Adoption is tracked
+in SECRETS-WP-0009. The production exec gate refuses before OpenBao while
+SECRETS-WP-0007-T04 and SECRETS-WP-0008-T02/T06 remain unresolved.
+No production profile selects the unactivated route.

docs/evidence/GLAS-WP-0012-credential-transport-2026-09-05.md

@@ -0,0 +1,19 @@
+# Credential transport acceptance
+
+Installed sand-boxer synthetic proof `880f749e`: child receives only synthetic
+ANTHROPIC_API_KEY, stdout is redacted, next exec has no key, wrong-project
+request refuses and workspace is removed. No real key was read.
+
+Full checks: sand-boxer lint+171 tests, secrets-engine226 tests, Glas101 tests.
+Existing persisted-manager egress and deterministic Glas boundary proofs pass.
+
+Native proposal: secrets-engine/catalog/glas-claude-agent-dev-anthropic.yaml;
+SECRETS-WP-0009 tracks live activation. The plan checks the existing platform
+mount, creates one exact data-only read policy/AppRole, TTL5m/max15m,
+single-use SecretID5m, token uses8. No metadata/list/write grant is included.
+
+The real production CLI exec invocation with service-jwt selection refused:
+`production action 'exec' requires a durable access-engine decision record;
+live production remains disabled`. No unsafe-demo flag, real key retrieval or
+operator-token fallback was used. This is an upstream authorization/service
+implementation dependency, not a successful model authentication proof.

workplans/GLAS-WP-0012-first-local-profile-production-proof.md

@@ -211,3 +211,15 @@ and direct-IP denial, isolated namespace and proxy/workspace cleanup passed.
 See [egress evidence](../docs/evidence/GLAS-WP-0012-egress-2026-09-05.md).
 T02 remains waiting on machine auth, protected credential delivery, the pinned
 Claude executable and the combined production acceptance. Profiles remain blocked.
+
+## 2026-09-05 credential owner return
+
+Sand-boxer credential transport is implemented and proved with synthetic
+provider sandbox 880f749e. Owner config binds exact profile/project/actor and
+run id; unknown routes refuse, shell API-key fallback is stripped, only the
+workload child receives the value, and output redaction precedes truncation.
+Tests: sand-boxer171, secrets-engine226, Glas101 pass. Native data-only read
+policy/AppRole proposal and activation now live in SECRETS-WP-0009. Its
+production exec refuses before OpenBao because durable access-engine decision
+records and scoped service authority remain unavailable. T02 remains waiting
+on that activation, pinned Claude startup and real provider/task acceptance.