docs: establish Anthropic workload credential proposal

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

docs/anthropic-workload-key.md

@@ -0,0 +1,68 @@
+# Anthropic workload key
+
+User selected a dedicated Anthropic API key on 2026-09-05 for
+GLAS-WP-0012-T02 / SAND-WP-0015-T04. Credential custody request:
+[CCR-2026-0016](../../railiance-platform/credential-change-requests/CCR-2026-0016-glas-claude-anthropic.yaml).
+The request is in flight, not an active credential route. Offline validation
+passes and apply-plan refuses the incomplete request.
+
+## Concrete proposal
+
+| Setting | Proposed value |
+| --- | --- |
+| Anthropic organization | Awaiting user selection |
+| Dedicated workspace | `glas-harness` |
+| Workspace spend limit | Awaiting user selection |
+| Service account / key label | `glas-agent-dev` |
+| Key scope | Only the dedicated workspace |
+| Initial expiry | 30 days, subject to organization policy |
+| KV-v2 entry | `platform/workloads/glas-harness/claude-agent-dev` |
+| Only secret field | `ANTHROPIC_API_KEY` |
+| Read policy name | `workload-kv-read-glas-claude-agent-dev` |
+| Proposed route | `glas-claude-agent-dev-anthropic` |
+| Consumer | Sand-boxer owner delivery to the selected Claude workload |
+
+These are proposed coordinates, not evidence that provider/OpenBao objects
+exist. The generic `openbao-api-key` routing entry is not a usable grant.
+No provider key or live auth role was created in this preparation.
+
+## Provider creation and custody
+
+In the chosen organization's Console, create the dedicated workspace and set
+the approved spend limit. Have its administrator create the service account,
+add it to that workspace, and create a key linked to that account and scoped
+to the workspace. Record only organization/workspace/account/key identifiers,
+expiration and budget as evidence. Anthropic documents service account keys
+for automated workloads and creation in Settings → API keys:
+https://platform.claude.com/docs/en/manage-claude/authentication
+Workspace administration and limits:
+https://platform.claude.com/docs/en/manage-claude/workspaces
+
+Complete the protected OpenBao custody writer before revealing a new key in
+the Console. Enter its value only through an attended hidden prompt or an
+approved private value file consumed by that writer. Never paste it into chat,
+put it in shell arguments, or store it in this repository. Initial storage
+must use KV-v2 CAS zero; rotations must use the reviewed current version.
+Existing platform tooling supports attended custody, but the exact writer and
+sandbox owner auth binding for this new entry still need implementation and
+verification. Do not substitute an ambient human token for machine identity.
+
+The final read policy grants only the exact data entry, without metadata,
+listing, sibling access or writes. Verify negative access for generic coding
+agents. Sand-boxer must resolve the approved route and deliver the key to the
+workload without returning it or an OpenBao token to Glas. Environment delivery
+is visible to the trusted workload and its descendants; it does not hide the
+key from hostile code inside that workload.
+
+## Acceptance and rotation
+
+Before activation, verify exact owner identity, read scope, protected delivery,
+redacted failures, source/artifact cleanliness and private-state teardown.
+Provider egress and the pinned Claude executable remain SAND-WP-0015 gates.
+Then run the bounded real proof specified in local-profile-acceptance.md.
+Keep the existing Glas profile blocked until these checks pass.
+
+For rotation, create and store a replacement with CAS, stop runs carrying the
+predecessor, verify the replacement, revoke the predecessor at Anthropic and
+prove denial. OpenBao lease expiry alone does not revoke an Anthropic API key.
+For compromise, disable the provider key immediately and stop affected runs.

workplans/GLAS-WP-0012-first-local-profile-production-proof.md

@@ -91,8 +91,11 @@ exec calls, and teardown passed in sandbox d4de9531; sand-boxer lint and 132
 tests pass. This completes the candidate runtime mechanism, not production
 selection. Authentication lane, credential delivery/revocation, provider egress,
 pinning the Claude executable, and deployed profile review remain open. The
-credential catalog has no matching Anthropic/Claude workload lane; the user's
+credential catalog has no matching Anthropic/Claude workload lane; the user selected a dedicated Anthropic workload API key. See
-authentication choice is pending. See docs/local-profile-acceptance.md.
+[the concrete custody proposal](../docs/anthropic-workload-key.md) and owner
+CCR-2026-0016 (in flight). Organization/budget, protected custody writer and
+verified machine binding remain outstanding; no key has been created.
+See docs/local-profile-acceptance.md.
 
 ## Review and validate the versioned Glas proof candidate