diff --git a/docs/anthropic-workload-key.md b/docs/anthropic-workload-key.md deleted file mode 100644 index 49c5b57..0000000 --- a/docs/anthropic-workload-key.md +++ /dev/null @@ -1,106 +0,0 @@ -# Anthropic workload key - -User selected a dedicated Anthropic API key on 2026-09-05 for -GLAS-WP-0012-T02 / SAND-WP-0015-T04. Credential custody request: -[CCR-2026-0016](../../railiance-platform/credential-change-requests/CCR-2026-0016-glas-claude-anthropic.yaml). -The request is in flight, not an active credential route. Offline validation -passes and apply-plan refuses the incomplete request. - -## Concrete proposal - -| Setting | Proposed value | -| --- | --- | -| Anthropic organization | `e1a8f305-9e64-4639-a7fd-af48e34f37c7` (user supplied) | -| Dedicated workspace | `glas-harness` | -| Workspace spend limit | Awaiting user selection | -| Provider key name | `claude_key_bernd.worsch` (user supplied; account type unverified) | -| Key scope | Only the dedicated workspace | -| Provider expiry | `2027-01-31T22:00:00+01:00` = `2027-01-31T21:00:00Z` (user supplied) | -| KV-v2 entry | `platform/workloads/glas-harness/claude-agent-dev` | -| Only secret field | `ANTHROPIC_API_KEY` | -| Read policy name | `workload-kv-read-glas-claude-agent-dev` | -| Proposed route | `glas-claude-agent-dev-anthropic` | -| Consumer | Sand-boxer owner delivery to the selected Claude workload | - -These are proposed coordinates, not evidence that provider/OpenBao objects -exist. The generic `openbao-api-key` routing entry is not a usable grant. -Provider key metadata was supplied by the user. OpenBao empty version 1 now -exists; no live auth role or runtime grant was created. - -## Provider creation and custody - -In the chosen organization's Console, create the dedicated workspace and set -the approved spend limit. Have its administrator create the service account, -add it to that workspace, and create a key linked to that account and scoped -to the workspace. Record only organization/workspace/account/key identifiers, -expiration and budget as evidence. Anthropic documents service account keys -for automated workloads and creation in Settings → API keys: -https://platform.claude.com/docs/en/manage-claude/authentication -Workspace administration and limits: -https://platform.claude.com/docs/en/manage-claude/workspaces - -Complete the protected OpenBao custody writer before revealing a new key in -the Console. Enter its value only through an attended hidden prompt or an -approved private value file consumed by that writer. Never paste it into chat, -put it in shell arguments, or store it in this repository. Initial storage -must use KV-v2 CAS zero; rotations must use the reviewed current version. -Existing platform tooling supports attended custody, but the exact writer and -sandbox owner auth binding for this new entry still need implementation and -verification. Do not substitute an ambient human token for machine identity. - -The final read policy grants only the exact data entry, without metadata, -listing, sibling access or writes. Verify negative access for generic coding -agents. Sand-boxer must resolve the approved route and deliver the key to the -workload without returning it or an OpenBao token to Glas. Environment delivery -is visible to the trusted workload and its descendants; it does not hide the -key from hostile code inside that workload. - -## Acceptance and rotation - -Before activation, verify exact owner identity, read scope, protected delivery, -redacted failures, source/artifact cleanliness and private-state teardown. -Provider egress and the pinned Claude executable remain SAND-WP-0015 gates. -Then run the bounded real proof specified in local-profile-acceptance.md. -Keep the existing Glas profile blocked until these checks pass. - -For rotation, create and store a replacement with CAS, stop runs carrying the -predecessor, verify the replacement, revoke the predecessor at Anthropic and -prove denial. OpenBao lease expiry alone does not revoke an Anthropic API key. -For compromise, disable the provider key immediately and stop affected runs. - -## Empty-version UI handoff - -User authorized an empty version at the proposed path. The platform initializer -`scripts/prepare-glas-anthropic.py` writes only an empty `ANTHROPIC_API_KEY` -using CAS zero, then records non-secret provider metadata. It never reads data -and does not create any reader policy or auth role. A contained operator login -is required; the local ops-mason grant is absent and its builder policy denies -data writes. Creation receipt is `/tmp/glas-anthropic-empty-receipt.json`. -Do not assume creation succeeded without that receipt and a successful envelope. - -After confirmed creation, open mount `platform`, path -`workloads/glas-harness/claude-agent-dev`, and create a new version replacing -the empty `ANTHROPIC_API_KEY` with the real key. The recorded provider expiry -is descriptive metadata, not an OpenBao-enforced expiration. Do not send the -value back in chat. Workspace/budget and runtime delivery remain unverified. - -Creation confirmed 2026-09-05: empty version 1, request id -`50cafc25-8d24-c1d6-5be8-1ade049e088b`. Metadata completion succeeded through -a second contained login after correcting empty-response parsing; both sessions -were revoked. See the non-secret evidence in -`evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json`. -The user can now create version 2 in the UI. - -## Custody confirmed - -On 2026-09-05 the user reported saving the API key through the UI. A contained -metadata-only read confirmed live version 2, created at -`2026-09-05T19:12:40.442796563Z`, neither deleted nor destroyed. The session -was revoked. No secret value or field content was read; provider authentication -is not yet verified. Evidence: -`evidence/GLAS-WP-0012-anthropic-custody-2026-09-05.json`. - -The UI handoff is complete. Do not run the empty initializer again. The next -implementation is an exact sandbox-owner machine binding and protected key -delivery, followed by enforced provider egress and the bounded real proof. -CCR-2026-0016 remains in flight until those acceptance gates pass. diff --git a/docs/evidence/GLAS-WP-0012-anthropic-custody-2026-09-05.json b/docs/evidence/GLAS-WP-0012-anthropic-custody-2026-09-05.json deleted file mode 100644 index d955879..0000000 --- a/docs/evidence/GLAS-WP-0012-anthropic-custody-2026-09-05.json +++ /dev/null @@ -1,10 +0,0 @@ -{ - "ccr": "CCR-2026-0016", - "path": "platform/metadata/workloads/glas-harness/claude-agent-dev", - "current_version": 2, - "created_time": "2026-09-05T19:12:40.442796563Z", - "live_successor_observed": true, - "secret_value_read": false, - "provider_authentication_verified": false, - "request_id": "d0b60424-a749-c72f-593b-ced6172dd183" -} diff --git a/docs/evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json b/docs/evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json deleted file mode 100644 index 3252367..0000000 --- a/docs/evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json +++ /dev/null @@ -1,8 +0,0 @@ -{ - "ccr": "CCR-2026-0016", - "path": "platform/data/workloads/glas-harness/claude-agent-dev", - "version": 1, - "empty_seed_created": true, - "metadata_written": true, - "request_id": "50cafc25-8d24-c1d6-5be8-1ade049e088b" -} diff --git a/workplans/GLAS-WP-0012-first-local-profile-production-proof.md b/workplans/GLAS-WP-0012-first-local-profile-production-proof.md index 214639a..a04739c 100644 --- a/workplans/GLAS-WP-0012-first-local-profile-production-proof.md +++ b/workplans/GLAS-WP-0012-first-local-profile-production-proof.md @@ -91,14 +91,8 @@ exec calls, and teardown passed in sandbox d4de9531; sand-boxer lint and 132 tests pass. This completes the candidate runtime mechanism, not production selection. Authentication lane, credential delivery/revocation, provider egress, pinning the Claude executable, and deployed profile review remain open. The -credential catalog has no matching Anthropic/Claude workload lane; the user selected a dedicated Anthropic workload API key. See -[the concrete custody proposal](../docs/anthropic-workload-key.md) and owner -CCR-2026-0016 (in flight). Organization/key metadata is supplied and the user saved the key in OpenBao. -A metadata-only owner check confirmed live version 2 on 2026-09-05, without -reading the value. Custody handoff is complete. Verified machine binding, -protected runtime delivery, workspace scope/budget and provider egress remain -outstanding; provider authentication has not been tested. -See docs/local-profile-acceptance.md. +credential catalog has no matching Anthropic/Claude workload lane; the user's +authentication choice is pending. See docs/local-profile-acceptance.md. ## Review and validate the versioned Glas proof candidate