From 73cee37ad8ef5d292f3c7ebe6b2653b49a65eea5 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 6 Sep 2026 00:25:38 +0200 Subject: [PATCH] docs: record credential transport proof and native activation dependency Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb --- docs/anthropic-workload-key.md | 15 +++++++++++++++ ...WP-0012-credential-transport-2026-09-05.md | 19 +++++++++++++++++++ ...12-first-local-profile-production-proof.md | 12 ++++++++++++ 3 files changed, 46 insertions(+) create mode 100644 docs/evidence/GLAS-WP-0012-credential-transport-2026-09-05.md diff --git a/docs/anthropic-workload-key.md b/docs/anthropic-workload-key.md index 49c5b57..f44f684 100644 --- a/docs/anthropic-workload-key.md +++ b/docs/anthropic-workload-key.md @@ -104,3 +104,18 @@ The UI handoff is complete. Do not run the empty initializer again. The next implementation is an exact sandbox-owner machine binding and protected key delivery, followed by enforced provider egress and the bounded real proof. CCR-2026-0016 remains in flight until those acceptance gates pass. + +## Owner transport and native adoption + +Sand-boxer now implements consumer-bound exec-env delivery through a configured +credential owner provider, with direct private handoff to the namespace broker. +Synthetic proof 880f749e passed child delivery, exact-value output redaction, +next-exec absence, wrong-project denial and teardown. No real key was read. + +Secrets-engine catalog `glas-claude-agent-dev-anthropic` now proposes native +policy/AppRole `se-prod-glas-claude-agent-dev-anthropic` for the exact KV data +path, with metadata access excluded. This supersedes the earlier proposed read +policy name; neither policy has been applied by this work. Adoption is tracked +in SECRETS-WP-0009. The production exec gate refuses before OpenBao while +SECRETS-WP-0007-T04 and SECRETS-WP-0008-T02/T06 remain unresolved. +No production profile selects the unactivated route. diff --git a/docs/evidence/GLAS-WP-0012-credential-transport-2026-09-05.md b/docs/evidence/GLAS-WP-0012-credential-transport-2026-09-05.md new file mode 100644 index 0000000..c4efb2a --- /dev/null +++ b/docs/evidence/GLAS-WP-0012-credential-transport-2026-09-05.md @@ -0,0 +1,19 @@ +# Credential transport acceptance + +Installed sand-boxer synthetic proof `880f749e`: child receives only synthetic +ANTHROPIC_API_KEY, stdout is redacted, next exec has no key, wrong-project +request refuses and workspace is removed. No real key was read. + +Full checks: sand-boxer lint+171 tests, secrets-engine226 tests, Glas101 tests. +Existing persisted-manager egress and deterministic Glas boundary proofs pass. + +Native proposal: secrets-engine/catalog/glas-claude-agent-dev-anthropic.yaml; +SECRETS-WP-0009 tracks live activation. The plan checks the existing platform +mount, creates one exact data-only read policy/AppRole, TTL5m/max15m, +single-use SecretID5m, token uses8. No metadata/list/write grant is included. + +The real production CLI exec invocation with service-jwt selection refused: +`production action 'exec' requires a durable access-engine decision record; +live production remains disabled`. No unsafe-demo flag, real key retrieval or +operator-token fallback was used. This is an upstream authorization/service +implementation dependency, not a successful model authentication proof. diff --git a/workplans/GLAS-WP-0012-first-local-profile-production-proof.md b/workplans/GLAS-WP-0012-first-local-profile-production-proof.md index d41811f..ee808ca 100644 --- a/workplans/GLAS-WP-0012-first-local-profile-production-proof.md +++ b/workplans/GLAS-WP-0012-first-local-profile-production-proof.md @@ -211,3 +211,15 @@ and direct-IP denial, isolated namespace and proxy/workspace cleanup passed. See [egress evidence](../docs/evidence/GLAS-WP-0012-egress-2026-09-05.md). T02 remains waiting on machine auth, protected credential delivery, the pinned Claude executable and the combined production acceptance. Profiles remain blocked. + +## 2026-09-05 credential owner return + +Sand-boxer credential transport is implemented and proved with synthetic +provider sandbox 880f749e. Owner config binds exact profile/project/actor and +run id; unknown routes refuse, shell API-key fallback is stripped, only the +workload child receives the value, and output redaction precedes truncation. +Tests: sand-boxer171, secrets-engine226, Glas101 pass. Native data-only read +policy/AppRole proposal and activation now live in SECRETS-WP-0009. Its +production exec refuses before OpenBao because durable access-engine decision +records and scoped service authority remain unavailable. T02 remains waiting +on that activation, pinned Claude startup and real provider/task acceptance.