docs: record credential transport proof and native activation dependency

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

docs/evidence/GLAS-WP-0012-credential-transport-2026-09-05.md

@@ -0,0 +1,19 @@
+# Credential transport acceptance
+
+Installed sand-boxer synthetic proof `880f749e`: child receives only synthetic
+ANTHROPIC_API_KEY, stdout is redacted, next exec has no key, wrong-project
+request refuses and workspace is removed. No real key was read.
+
+Full checks: sand-boxer lint+171 tests, secrets-engine226 tests, Glas101 tests.
+Existing persisted-manager egress and deterministic Glas boundary proofs pass.
+
+Native proposal: secrets-engine/catalog/glas-claude-agent-dev-anthropic.yaml;
+SECRETS-WP-0009 tracks live activation. The plan checks the existing platform
+mount, creates one exact data-only read policy/AppRole, TTL5m/max15m,
+single-use SecretID5m, token uses8. No metadata/list/write grant is included.
+
+The real production CLI exec invocation with service-jwt selection refused:
+`production action 'exec' requires a durable access-engine decision record;
+live production remains disabled`. No unsafe-demo flag, real key retrieval or
+operator-token fallback was used. This is an upstream authorization/service
+implementation dependency, not a successful model authentication proof.