diff --git a/docs/anthropic-workload-key.md b/docs/anthropic-workload-key.md new file mode 100644 index 0000000..49c5b57 --- /dev/null +++ b/docs/anthropic-workload-key.md @@ -0,0 +1,106 @@ +# Anthropic workload key + +User selected a dedicated Anthropic API key on 2026-09-05 for +GLAS-WP-0012-T02 / SAND-WP-0015-T04. Credential custody request: +[CCR-2026-0016](../../railiance-platform/credential-change-requests/CCR-2026-0016-glas-claude-anthropic.yaml). +The request is in flight, not an active credential route. Offline validation +passes and apply-plan refuses the incomplete request. + +## Concrete proposal + +| Setting | Proposed value | +| --- | --- | +| Anthropic organization | `e1a8f305-9e64-4639-a7fd-af48e34f37c7` (user supplied) | +| Dedicated workspace | `glas-harness` | +| Workspace spend limit | Awaiting user selection | +| Provider key name | `claude_key_bernd.worsch` (user supplied; account type unverified) | +| Key scope | Only the dedicated workspace | +| Provider expiry | `2027-01-31T22:00:00+01:00` = `2027-01-31T21:00:00Z` (user supplied) | +| KV-v2 entry | `platform/workloads/glas-harness/claude-agent-dev` | +| Only secret field | `ANTHROPIC_API_KEY` | +| Read policy name | `workload-kv-read-glas-claude-agent-dev` | +| Proposed route | `glas-claude-agent-dev-anthropic` | +| Consumer | Sand-boxer owner delivery to the selected Claude workload | + +These are proposed coordinates, not evidence that provider/OpenBao objects +exist. The generic `openbao-api-key` routing entry is not a usable grant. +Provider key metadata was supplied by the user. OpenBao empty version 1 now +exists; no live auth role or runtime grant was created. + +## Provider creation and custody + +In the chosen organization's Console, create the dedicated workspace and set +the approved spend limit. Have its administrator create the service account, +add it to that workspace, and create a key linked to that account and scoped +to the workspace. Record only organization/workspace/account/key identifiers, +expiration and budget as evidence. Anthropic documents service account keys +for automated workloads and creation in Settings → API keys: +https://platform.claude.com/docs/en/manage-claude/authentication +Workspace administration and limits: +https://platform.claude.com/docs/en/manage-claude/workspaces + +Complete the protected OpenBao custody writer before revealing a new key in +the Console. Enter its value only through an attended hidden prompt or an +approved private value file consumed by that writer. Never paste it into chat, +put it in shell arguments, or store it in this repository. Initial storage +must use KV-v2 CAS zero; rotations must use the reviewed current version. +Existing platform tooling supports attended custody, but the exact writer and +sandbox owner auth binding for this new entry still need implementation and +verification. Do not substitute an ambient human token for machine identity. + +The final read policy grants only the exact data entry, without metadata, +listing, sibling access or writes. Verify negative access for generic coding +agents. Sand-boxer must resolve the approved route and deliver the key to the +workload without returning it or an OpenBao token to Glas. Environment delivery +is visible to the trusted workload and its descendants; it does not hide the +key from hostile code inside that workload. + +## Acceptance and rotation + +Before activation, verify exact owner identity, read scope, protected delivery, +redacted failures, source/artifact cleanliness and private-state teardown. +Provider egress and the pinned Claude executable remain SAND-WP-0015 gates. +Then run the bounded real proof specified in local-profile-acceptance.md. +Keep the existing Glas profile blocked until these checks pass. + +For rotation, create and store a replacement with CAS, stop runs carrying the +predecessor, verify the replacement, revoke the predecessor at Anthropic and +prove denial. OpenBao lease expiry alone does not revoke an Anthropic API key. +For compromise, disable the provider key immediately and stop affected runs. + +## Empty-version UI handoff + +User authorized an empty version at the proposed path. The platform initializer +`scripts/prepare-glas-anthropic.py` writes only an empty `ANTHROPIC_API_KEY` +using CAS zero, then records non-secret provider metadata. It never reads data +and does not create any reader policy or auth role. A contained operator login +is required; the local ops-mason grant is absent and its builder policy denies +data writes. Creation receipt is `/tmp/glas-anthropic-empty-receipt.json`. +Do not assume creation succeeded without that receipt and a successful envelope. + +After confirmed creation, open mount `platform`, path +`workloads/glas-harness/claude-agent-dev`, and create a new version replacing +the empty `ANTHROPIC_API_KEY` with the real key. The recorded provider expiry +is descriptive metadata, not an OpenBao-enforced expiration. Do not send the +value back in chat. Workspace/budget and runtime delivery remain unverified. + +Creation confirmed 2026-09-05: empty version 1, request id +`50cafc25-8d24-c1d6-5be8-1ade049e088b`. Metadata completion succeeded through +a second contained login after correcting empty-response parsing; both sessions +were revoked. See the non-secret evidence in +`evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json`. +The user can now create version 2 in the UI. + +## Custody confirmed + +On 2026-09-05 the user reported saving the API key through the UI. A contained +metadata-only read confirmed live version 2, created at +`2026-09-05T19:12:40.442796563Z`, neither deleted nor destroyed. The session +was revoked. No secret value or field content was read; provider authentication +is not yet verified. Evidence: +`evidence/GLAS-WP-0012-anthropic-custody-2026-09-05.json`. + +The UI handoff is complete. Do not run the empty initializer again. The next +implementation is an exact sandbox-owner machine binding and protected key +delivery, followed by enforced provider egress and the bounded real proof. +CCR-2026-0016 remains in flight until those acceptance gates pass. diff --git a/docs/evidence/GLAS-WP-0012-anthropic-custody-2026-09-05.json b/docs/evidence/GLAS-WP-0012-anthropic-custody-2026-09-05.json new file mode 100644 index 0000000..d955879 --- /dev/null +++ b/docs/evidence/GLAS-WP-0012-anthropic-custody-2026-09-05.json @@ -0,0 +1,10 @@ +{ + "ccr": "CCR-2026-0016", + "path": "platform/metadata/workloads/glas-harness/claude-agent-dev", + "current_version": 2, + "created_time": "2026-09-05T19:12:40.442796563Z", + "live_successor_observed": true, + "secret_value_read": false, + "provider_authentication_verified": false, + "request_id": "d0b60424-a749-c72f-593b-ced6172dd183" +} diff --git a/docs/evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json b/docs/evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json new file mode 100644 index 0000000..3252367 --- /dev/null +++ b/docs/evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json @@ -0,0 +1,8 @@ +{ + "ccr": "CCR-2026-0016", + "path": "platform/data/workloads/glas-harness/claude-agent-dev", + "version": 1, + "empty_seed_created": true, + "metadata_written": true, + "request_id": "50cafc25-8d24-c1d6-5be8-1ade049e088b" +} diff --git a/workplans/GLAS-WP-0012-first-local-profile-production-proof.md b/workplans/GLAS-WP-0012-first-local-profile-production-proof.md index a04739c..214639a 100644 --- a/workplans/GLAS-WP-0012-first-local-profile-production-proof.md +++ b/workplans/GLAS-WP-0012-first-local-profile-production-proof.md @@ -91,8 +91,14 @@ exec calls, and teardown passed in sandbox d4de9531; sand-boxer lint and 132 tests pass. This completes the candidate runtime mechanism, not production selection. Authentication lane, credential delivery/revocation, provider egress, pinning the Claude executable, and deployed profile review remain open. The -credential catalog has no matching Anthropic/Claude workload lane; the user's -authentication choice is pending. See docs/local-profile-acceptance.md. +credential catalog has no matching Anthropic/Claude workload lane; the user selected a dedicated Anthropic workload API key. See +[the concrete custody proposal](../docs/anthropic-workload-key.md) and owner +CCR-2026-0016 (in flight). Organization/key metadata is supplied and the user saved the key in OpenBao. +A metadata-only owner check confirmed live version 2 on 2026-09-05, without +reading the value. Custody handoff is complete. Verified machine binding, +protected runtime delivery, workspace scope/budget and provider egress remain +outstanding; provider authentication has not been tested. +See docs/local-profile-acceptance.md. ## Review and validate the versioned Glas proof candidate