docs/anthropic-workload-key.md

@@ -1,106 +0,0 @@
-# Anthropic workload key
-
-User selected a dedicated Anthropic API key on 2026-09-05 for
-GLAS-WP-0012-T02 / SAND-WP-0015-T04. Credential custody request:
-[CCR-2026-0016](../../railiance-platform/credential-change-requests/CCR-2026-0016-glas-claude-anthropic.yaml).
-The request is in flight, not an active credential route. Offline validation
-passes and apply-plan refuses the incomplete request.
-
-## Concrete proposal
-
-| Setting | Proposed value |
-| --- | --- |
-| Anthropic organization | `e1a8f305-9e64-4639-a7fd-af48e34f37c7` (user supplied) |
-| Dedicated workspace | `glas-harness` |
-| Workspace spend limit | Awaiting user selection |
-| Provider key name | `claude_key_bernd.worsch` (user supplied; account type unverified) |
-| Key scope | Only the dedicated workspace |
-| Provider expiry | `2027-01-31T22:00:00+01:00` = `2027-01-31T21:00:00Z` (user supplied) |
-| KV-v2 entry | `platform/workloads/glas-harness/claude-agent-dev` |
-| Only secret field | `ANTHROPIC_API_KEY` |
-| Read policy name | `workload-kv-read-glas-claude-agent-dev` |
-| Proposed route | `glas-claude-agent-dev-anthropic` |
-| Consumer | Sand-boxer owner delivery to the selected Claude workload |
-
-These are proposed coordinates, not evidence that provider/OpenBao objects
-exist. The generic `openbao-api-key` routing entry is not a usable grant.
-Provider key metadata was supplied by the user. OpenBao empty version 1 now
-exists; no live auth role or runtime grant was created.
-
-## Provider creation and custody
-
-In the chosen organization's Console, create the dedicated workspace and set
-the approved spend limit. Have its administrator create the service account,
-add it to that workspace, and create a key linked to that account and scoped
-to the workspace. Record only organization/workspace/account/key identifiers,
-expiration and budget as evidence. Anthropic documents service account keys
-for automated workloads and creation in Settings → API keys:
-https://platform.claude.com/docs/en/manage-claude/authentication
-Workspace administration and limits:
-https://platform.claude.com/docs/en/manage-claude/workspaces
-
-Complete the protected OpenBao custody writer before revealing a new key in
-the Console. Enter its value only through an attended hidden prompt or an
-approved private value file consumed by that writer. Never paste it into chat,
-put it in shell arguments, or store it in this repository. Initial storage
-must use KV-v2 CAS zero; rotations must use the reviewed current version.
-Existing platform tooling supports attended custody, but the exact writer and
-sandbox owner auth binding for this new entry still need implementation and
-verification. Do not substitute an ambient human token for machine identity.
-
-The final read policy grants only the exact data entry, without metadata,
-listing, sibling access or writes. Verify negative access for generic coding
-agents. Sand-boxer must resolve the approved route and deliver the key to the
-workload without returning it or an OpenBao token to Glas. Environment delivery
-is visible to the trusted workload and its descendants; it does not hide the
-key from hostile code inside that workload.
-
-## Acceptance and rotation
-
-Before activation, verify exact owner identity, read scope, protected delivery,
-redacted failures, source/artifact cleanliness and private-state teardown.
-Provider egress and the pinned Claude executable remain SAND-WP-0015 gates.
-Then run the bounded real proof specified in local-profile-acceptance.md.
-Keep the existing Glas profile blocked until these checks pass.
-
-For rotation, create and store a replacement with CAS, stop runs carrying the
-predecessor, verify the replacement, revoke the predecessor at Anthropic and
-prove denial. OpenBao lease expiry alone does not revoke an Anthropic API key.
-For compromise, disable the provider key immediately and stop affected runs.
-
-## Empty-version UI handoff
-
-User authorized an empty version at the proposed path. The platform initializer
-`scripts/prepare-glas-anthropic.py` writes only an empty `ANTHROPIC_API_KEY`
-using CAS zero, then records non-secret provider metadata. It never reads data
-and does not create any reader policy or auth role. A contained operator login
-is required; the local ops-mason grant is absent and its builder policy denies
-data writes. Creation receipt is `/tmp/glas-anthropic-empty-receipt.json`.
-Do not assume creation succeeded without that receipt and a successful envelope.
-
-After confirmed creation, open mount `platform`, path
-`workloads/glas-harness/claude-agent-dev`, and create a new version replacing
-the empty `ANTHROPIC_API_KEY` with the real key. The recorded provider expiry
-is descriptive metadata, not an OpenBao-enforced expiration. Do not send the
-value back in chat. Workspace/budget and runtime delivery remain unverified.
-
-Creation confirmed 2026-09-05: empty version 1, request id
-`50cafc25-8d24-c1d6-5be8-1ade049e088b`. Metadata completion succeeded through
-a second contained login after correcting empty-response parsing; both sessions
-were revoked. See the non-secret evidence in
-`evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json`.
-The user can now create version 2 in the UI.
-
-## Custody confirmed
-
-On 2026-09-05 the user reported saving the API key through the UI. A contained
-metadata-only read confirmed live version 2, created at
-`2026-09-05T19:12:40.442796563Z`, neither deleted nor destroyed. The session
-was revoked. No secret value or field content was read; provider authentication
-is not yet verified. Evidence:
-`evidence/GLAS-WP-0012-anthropic-custody-2026-09-05.json`.
-
-The UI handoff is complete. Do not run the empty initializer again. The next
-implementation is an exact sandbox-owner machine binding and protected key
-delivery, followed by enforced provider egress and the bounded real proof.
-CCR-2026-0016 remains in flight until those acceptance gates pass.

docs/evidence/GLAS-WP-0012-anthropic-custody-2026-09-05.json

@@ -1,10 +0,0 @@
-{
-  "ccr": "CCR-2026-0016",
-  "path": "platform/metadata/workloads/glas-harness/claude-agent-dev",
-  "current_version": 2,
-  "created_time": "2026-09-05T19:12:40.442796563Z",
-  "live_successor_observed": true,
-  "secret_value_read": false,
-  "provider_authentication_verified": false,
-  "request_id": "d0b60424-a749-c72f-593b-ced6172dd183"
-}

docs/evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json

@@ -1,8 +0,0 @@
-{
-  "ccr": "CCR-2026-0016",
-  "path": "platform/data/workloads/glas-harness/claude-agent-dev",
-  "version": 1,
-  "empty_seed_created": true,
-  "metadata_written": true,
-  "request_id": "50cafc25-8d24-c1d6-5be8-1ade049e088b"
-}

workplans/GLAS-WP-0012-first-local-profile-production-proof.md

@@ -91,14 +91,8 @@ exec calls, and teardown passed in sandbox d4de9531; sand-boxer lint and 132
 tests pass. This completes the candidate runtime mechanism, not production
 selection. Authentication lane, credential delivery/revocation, provider egress,
 pinning the Claude executable, and deployed profile review remain open. The
-credential catalog has no matching Anthropic/Claude workload lane; the user selected a dedicated Anthropic workload API key. See
+credential catalog has no matching Anthropic/Claude workload lane; the user's
-[the concrete custody proposal](../docs/anthropic-workload-key.md) and owner
+authentication choice is pending. See docs/local-profile-acceptance.md.
-CCR-2026-0016 (in flight). Organization/key metadata is supplied and the user saved the key in OpenBao.
-A metadata-only owner check confirmed live version 2 on 2026-09-05, without
-reading the value. Custody handoff is complete. Verified machine binding,
-protected runtime delivery, workspace scope/budget and provider egress remain
-outstanding; provider authentication has not been tested.
-See docs/local-profile-acceptance.md.
 
 ## Review and validate the versioned Glas proof candidate