From 823796ff6d1edc170cc895555812832d5d1265df Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 5 Sep 2026 20:47:35 +0200 Subject: [PATCH] docs: establish Anthropic workload credential proposal Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb --- docs/anthropic-workload-key.md | 68 +++++++++++++++++++ ...12-first-local-profile-production-proof.md | 7 +- 2 files changed, 73 insertions(+), 2 deletions(-) create mode 100644 docs/anthropic-workload-key.md diff --git a/docs/anthropic-workload-key.md b/docs/anthropic-workload-key.md new file mode 100644 index 0000000..5331e89 --- /dev/null +++ b/docs/anthropic-workload-key.md @@ -0,0 +1,68 @@ +# Anthropic workload key + +User selected a dedicated Anthropic API key on 2026-09-05 for +GLAS-WP-0012-T02 / SAND-WP-0015-T04. Credential custody request: +[CCR-2026-0016](../../railiance-platform/credential-change-requests/CCR-2026-0016-glas-claude-anthropic.yaml). +The request is in flight, not an active credential route. Offline validation +passes and apply-plan refuses the incomplete request. + +## Concrete proposal + +| Setting | Proposed value | +| --- | --- | +| Anthropic organization | Awaiting user selection | +| Dedicated workspace | `glas-harness` | +| Workspace spend limit | Awaiting user selection | +| Service account / key label | `glas-agent-dev` | +| Key scope | Only the dedicated workspace | +| Initial expiry | 30 days, subject to organization policy | +| KV-v2 entry | `platform/workloads/glas-harness/claude-agent-dev` | +| Only secret field | `ANTHROPIC_API_KEY` | +| Read policy name | `workload-kv-read-glas-claude-agent-dev` | +| Proposed route | `glas-claude-agent-dev-anthropic` | +| Consumer | Sand-boxer owner delivery to the selected Claude workload | + +These are proposed coordinates, not evidence that provider/OpenBao objects +exist. The generic `openbao-api-key` routing entry is not a usable grant. +No provider key or live auth role was created in this preparation. + +## Provider creation and custody + +In the chosen organization's Console, create the dedicated workspace and set +the approved spend limit. Have its administrator create the service account, +add it to that workspace, and create a key linked to that account and scoped +to the workspace. Record only organization/workspace/account/key identifiers, +expiration and budget as evidence. Anthropic documents service account keys +for automated workloads and creation in Settings → API keys: +https://platform.claude.com/docs/en/manage-claude/authentication +Workspace administration and limits: +https://platform.claude.com/docs/en/manage-claude/workspaces + +Complete the protected OpenBao custody writer before revealing a new key in +the Console. Enter its value only through an attended hidden prompt or an +approved private value file consumed by that writer. Never paste it into chat, +put it in shell arguments, or store it in this repository. Initial storage +must use KV-v2 CAS zero; rotations must use the reviewed current version. +Existing platform tooling supports attended custody, but the exact writer and +sandbox owner auth binding for this new entry still need implementation and +verification. Do not substitute an ambient human token for machine identity. + +The final read policy grants only the exact data entry, without metadata, +listing, sibling access or writes. Verify negative access for generic coding +agents. Sand-boxer must resolve the approved route and deliver the key to the +workload without returning it or an OpenBao token to Glas. Environment delivery +is visible to the trusted workload and its descendants; it does not hide the +key from hostile code inside that workload. + +## Acceptance and rotation + +Before activation, verify exact owner identity, read scope, protected delivery, +redacted failures, source/artifact cleanliness and private-state teardown. +Provider egress and the pinned Claude executable remain SAND-WP-0015 gates. +Then run the bounded real proof specified in local-profile-acceptance.md. +Keep the existing Glas profile blocked until these checks pass. + +For rotation, create and store a replacement with CAS, stop runs carrying the +predecessor, verify the replacement, revoke the predecessor at Anthropic and +prove denial. OpenBao lease expiry alone does not revoke an Anthropic API key. +For compromise, disable the provider key immediately and stop affected runs. diff --git a/workplans/GLAS-WP-0012-first-local-profile-production-proof.md b/workplans/GLAS-WP-0012-first-local-profile-production-proof.md index a04739c..c8cfacd 100644 --- a/workplans/GLAS-WP-0012-first-local-profile-production-proof.md +++ b/workplans/GLAS-WP-0012-first-local-profile-production-proof.md @@ -91,8 +91,11 @@ exec calls, and teardown passed in sandbox d4de9531; sand-boxer lint and 132 tests pass. This completes the candidate runtime mechanism, not production selection. Authentication lane, credential delivery/revocation, provider egress, pinning the Claude executable, and deployed profile review remain open. The -credential catalog has no matching Anthropic/Claude workload lane; the user's -authentication choice is pending. See docs/local-profile-acceptance.md. +credential catalog has no matching Anthropic/Claude workload lane; the user selected a dedicated Anthropic workload API key. See +[the concrete custody proposal](../docs/anthropic-workload-key.md) and owner +CCR-2026-0016 (in flight). Organization/budget, protected custody writer and +verified machine binding remain outstanding; no key has been created. +See docs/local-profile-acceptance.md. ## Review and validate the versioned Glas proof candidate