From 823796ff6d1edc170cc895555812832d5d1265df Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 5 Sep 2026 20:47:35 +0200 Subject: [PATCH 1/3] docs: establish Anthropic workload credential proposal Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb --- docs/anthropic-workload-key.md | 68 +++++++++++++++++++ ...12-first-local-profile-production-proof.md | 7 +- 2 files changed, 73 insertions(+), 2 deletions(-) create mode 100644 docs/anthropic-workload-key.md diff --git a/docs/anthropic-workload-key.md b/docs/anthropic-workload-key.md new file mode 100644 index 0000000..5331e89 --- /dev/null +++ b/docs/anthropic-workload-key.md @@ -0,0 +1,68 @@ +# Anthropic workload key + +User selected a dedicated Anthropic API key on 2026-09-05 for +GLAS-WP-0012-T02 / SAND-WP-0015-T04. Credential custody request: +[CCR-2026-0016](../../railiance-platform/credential-change-requests/CCR-2026-0016-glas-claude-anthropic.yaml). +The request is in flight, not an active credential route. Offline validation +passes and apply-plan refuses the incomplete request. + +## Concrete proposal + +| Setting | Proposed value | +| --- | --- | +| Anthropic organization | Awaiting user selection | +| Dedicated workspace | `glas-harness` | +| Workspace spend limit | Awaiting user selection | +| Service account / key label | `glas-agent-dev` | +| Key scope | Only the dedicated workspace | +| Initial expiry | 30 days, subject to organization policy | +| KV-v2 entry | `platform/workloads/glas-harness/claude-agent-dev` | +| Only secret field | `ANTHROPIC_API_KEY` | +| Read policy name | `workload-kv-read-glas-claude-agent-dev` | +| Proposed route | `glas-claude-agent-dev-anthropic` | +| Consumer | Sand-boxer owner delivery to the selected Claude workload | + +These are proposed coordinates, not evidence that provider/OpenBao objects +exist. The generic `openbao-api-key` routing entry is not a usable grant. +No provider key or live auth role was created in this preparation. + +## Provider creation and custody + +In the chosen organization's Console, create the dedicated workspace and set +the approved spend limit. Have its administrator create the service account, +add it to that workspace, and create a key linked to that account and scoped +to the workspace. Record only organization/workspace/account/key identifiers, +expiration and budget as evidence. Anthropic documents service account keys +for automated workloads and creation in Settings → API keys: +https://platform.claude.com/docs/en/manage-claude/authentication +Workspace administration and limits: +https://platform.claude.com/docs/en/manage-claude/workspaces + +Complete the protected OpenBao custody writer before revealing a new key in +the Console. Enter its value only through an attended hidden prompt or an +approved private value file consumed by that writer. Never paste it into chat, +put it in shell arguments, or store it in this repository. Initial storage +must use KV-v2 CAS zero; rotations must use the reviewed current version. +Existing platform tooling supports attended custody, but the exact writer and +sandbox owner auth binding for this new entry still need implementation and +verification. Do not substitute an ambient human token for machine identity. + +The final read policy grants only the exact data entry, without metadata, +listing, sibling access or writes. Verify negative access for generic coding +agents. Sand-boxer must resolve the approved route and deliver the key to the +workload without returning it or an OpenBao token to Glas. Environment delivery +is visible to the trusted workload and its descendants; it does not hide the +key from hostile code inside that workload. + +## Acceptance and rotation + +Before activation, verify exact owner identity, read scope, protected delivery, +redacted failures, source/artifact cleanliness and private-state teardown. +Provider egress and the pinned Claude executable remain SAND-WP-0015 gates. +Then run the bounded real proof specified in local-profile-acceptance.md. +Keep the existing Glas profile blocked until these checks pass. + +For rotation, create and store a replacement with CAS, stop runs carrying the +predecessor, verify the replacement, revoke the predecessor at Anthropic and +prove denial. OpenBao lease expiry alone does not revoke an Anthropic API key. +For compromise, disable the provider key immediately and stop affected runs. diff --git a/workplans/GLAS-WP-0012-first-local-profile-production-proof.md b/workplans/GLAS-WP-0012-first-local-profile-production-proof.md index a04739c..c8cfacd 100644 --- a/workplans/GLAS-WP-0012-first-local-profile-production-proof.md +++ b/workplans/GLAS-WP-0012-first-local-profile-production-proof.md @@ -91,8 +91,11 @@ exec calls, and teardown passed in sandbox d4de9531; sand-boxer lint and 132 tests pass. This completes the candidate runtime mechanism, not production selection. Authentication lane, credential delivery/revocation, provider egress, pinning the Claude executable, and deployed profile review remain open. The -credential catalog has no matching Anthropic/Claude workload lane; the user's -authentication choice is pending. See docs/local-profile-acceptance.md. +credential catalog has no matching Anthropic/Claude workload lane; the user selected a dedicated Anthropic workload API key. See +[the concrete custody proposal](../docs/anthropic-workload-key.md) and owner +CCR-2026-0016 (in flight). Organization/budget, protected custody writer and +verified machine binding remain outstanding; no key has been created. +See docs/local-profile-acceptance.md. ## Review and validate the versioned Glas proof candidate From 39e9562802714e1b1ba1c1a6c46372335a932397 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 5 Sep 2026 21:10:43 +0200 Subject: [PATCH 2/3] docs: record Anthropic empty entry and UI handoff Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb --- docs/anthropic-workload-key.md | 32 ++++++++++++++++--- ...0012-anthropic-empty-entry-2026-09-05.json | 8 +++++ 2 files changed, 36 insertions(+), 4 deletions(-) create mode 100644 docs/evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json diff --git a/docs/anthropic-workload-key.md b/docs/anthropic-workload-key.md index 5331e89..4a9f83d 100644 --- a/docs/anthropic-workload-key.md +++ b/docs/anthropic-workload-key.md @@ -10,12 +10,12 @@ passes and apply-plan refuses the incomplete request. | Setting | Proposed value | | --- | --- | -| Anthropic organization | Awaiting user selection | +| Anthropic organization | `e1a8f305-9e64-4639-a7fd-af48e34f37c7` (user supplied) | | Dedicated workspace | `glas-harness` | | Workspace spend limit | Awaiting user selection | -| Service account / key label | `glas-agent-dev` | +| Provider key name | `claude_key_bernd.worsch` (user supplied; account type unverified) | | Key scope | Only the dedicated workspace | -| Initial expiry | 30 days, subject to organization policy | +| Provider expiry | `2027-01-31T22:00:00+01:00` = `2027-01-31T21:00:00Z` (user supplied) | | KV-v2 entry | `platform/workloads/glas-harness/claude-agent-dev` | | Only secret field | `ANTHROPIC_API_KEY` | | Read policy name | `workload-kv-read-glas-claude-agent-dev` | @@ -24,7 +24,8 @@ passes and apply-plan refuses the incomplete request. These are proposed coordinates, not evidence that provider/OpenBao objects exist. The generic `openbao-api-key` routing entry is not a usable grant. -No provider key or live auth role was created in this preparation. +Provider key metadata was supplied by the user. OpenBao empty version 1 now +exists; no live auth role or runtime grant was created. ## Provider creation and custody @@ -66,3 +67,26 @@ For rotation, create and store a replacement with CAS, stop runs carrying the predecessor, verify the replacement, revoke the predecessor at Anthropic and prove denial. OpenBao lease expiry alone does not revoke an Anthropic API key. For compromise, disable the provider key immediately and stop affected runs. + +## Empty-version UI handoff + +User authorized an empty version at the proposed path. The platform initializer +`scripts/prepare-glas-anthropic.py` writes only an empty `ANTHROPIC_API_KEY` +using CAS zero, then records non-secret provider metadata. It never reads data +and does not create any reader policy or auth role. A contained operator login +is required; the local ops-mason grant is absent and its builder policy denies +data writes. Creation receipt is `/tmp/glas-anthropic-empty-receipt.json`. +Do not assume creation succeeded without that receipt and a successful envelope. + +After confirmed creation, open mount `platform`, path +`workloads/glas-harness/claude-agent-dev`, and create a new version replacing +the empty `ANTHROPIC_API_KEY` with the real key. The recorded provider expiry +is descriptive metadata, not an OpenBao-enforced expiration. Do not send the +value back in chat. Workspace/budget and runtime delivery remain unverified. + +Creation confirmed 2026-09-05: empty version 1, request id +`50cafc25-8d24-c1d6-5be8-1ade049e088b`. Metadata completion succeeded through +a second contained login after correcting empty-response parsing; both sessions +were revoked. See the non-secret evidence in +`evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json`. +The user can now create version 2 in the UI. diff --git a/docs/evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json b/docs/evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json new file mode 100644 index 0000000..3252367 --- /dev/null +++ b/docs/evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json @@ -0,0 +1,8 @@ +{ + "ccr": "CCR-2026-0016", + "path": "platform/data/workloads/glas-harness/claude-agent-dev", + "version": 1, + "empty_seed_created": true, + "metadata_written": true, + "request_id": "50cafc25-8d24-c1d6-5be8-1ade049e088b" +} From 13027544f4b204e957a5ac99b85749f474b88d71 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 5 Sep 2026 21:15:14 +0200 Subject: [PATCH 3/3] docs: confirm Anthropic key custody and remaining runtime gates Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb --- docs/anthropic-workload-key.md | 14 ++++++++++++++ .../GLAS-WP-0012-anthropic-custody-2026-09-05.json | 10 ++++++++++ ...WP-0012-first-local-profile-production-proof.md | 7 +++++-- 3 files changed, 29 insertions(+), 2 deletions(-) create mode 100644 docs/evidence/GLAS-WP-0012-anthropic-custody-2026-09-05.json diff --git a/docs/anthropic-workload-key.md b/docs/anthropic-workload-key.md index 4a9f83d..49c5b57 100644 --- a/docs/anthropic-workload-key.md +++ b/docs/anthropic-workload-key.md @@ -90,3 +90,17 @@ a second contained login after correcting empty-response parsing; both sessions were revoked. See the non-secret evidence in `evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json`. The user can now create version 2 in the UI. + +## Custody confirmed + +On 2026-09-05 the user reported saving the API key through the UI. A contained +metadata-only read confirmed live version 2, created at +`2026-09-05T19:12:40.442796563Z`, neither deleted nor destroyed. The session +was revoked. No secret value or field content was read; provider authentication +is not yet verified. Evidence: +`evidence/GLAS-WP-0012-anthropic-custody-2026-09-05.json`. + +The UI handoff is complete. Do not run the empty initializer again. The next +implementation is an exact sandbox-owner machine binding and protected key +delivery, followed by enforced provider egress and the bounded real proof. +CCR-2026-0016 remains in flight until those acceptance gates pass. diff --git a/docs/evidence/GLAS-WP-0012-anthropic-custody-2026-09-05.json b/docs/evidence/GLAS-WP-0012-anthropic-custody-2026-09-05.json new file mode 100644 index 0000000..d955879 --- /dev/null +++ b/docs/evidence/GLAS-WP-0012-anthropic-custody-2026-09-05.json @@ -0,0 +1,10 @@ +{ + "ccr": "CCR-2026-0016", + "path": "platform/metadata/workloads/glas-harness/claude-agent-dev", + "current_version": 2, + "created_time": "2026-09-05T19:12:40.442796563Z", + "live_successor_observed": true, + "secret_value_read": false, + "provider_authentication_verified": false, + "request_id": "d0b60424-a749-c72f-593b-ced6172dd183" +} diff --git a/workplans/GLAS-WP-0012-first-local-profile-production-proof.md b/workplans/GLAS-WP-0012-first-local-profile-production-proof.md index c8cfacd..214639a 100644 --- a/workplans/GLAS-WP-0012-first-local-profile-production-proof.md +++ b/workplans/GLAS-WP-0012-first-local-profile-production-proof.md @@ -93,8 +93,11 @@ selection. Authentication lane, credential delivery/revocation, provider egress, pinning the Claude executable, and deployed profile review remain open. The credential catalog has no matching Anthropic/Claude workload lane; the user selected a dedicated Anthropic workload API key. See [the concrete custody proposal](../docs/anthropic-workload-key.md) and owner -CCR-2026-0016 (in flight). Organization/budget, protected custody writer and -verified machine binding remain outstanding; no key has been created. +CCR-2026-0016 (in flight). Organization/key metadata is supplied and the user saved the key in OpenBao. +A metadata-only owner check confirmed live version 2 on 2026-09-05, without +reading the value. Custody handoff is complete. Verified machine binding, +protected runtime delivery, workspace scope/budget and provider egress remain +outstanding; provider authentication has not been tested. See docs/local-profile-acceptance.md. ## Review and validate the versioned Glas proof candidate