docs: confirm Anthropic key custody and remaining runtime gates

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

docs/anthropic-workload-key.md

@@ -0,0 +1,106 @@
+# Anthropic workload key
+
+User selected a dedicated Anthropic API key on 2026-09-05 for
+GLAS-WP-0012-T02 / SAND-WP-0015-T04. Credential custody request:
+[CCR-2026-0016](../../railiance-platform/credential-change-requests/CCR-2026-0016-glas-claude-anthropic.yaml).
+The request is in flight, not an active credential route. Offline validation
+passes and apply-plan refuses the incomplete request.
+
+## Concrete proposal
+
+| Setting | Proposed value |
+| --- | --- |
+| Anthropic organization | `e1a8f305-9e64-4639-a7fd-af48e34f37c7` (user supplied) |
+| Dedicated workspace | `glas-harness` |
+| Workspace spend limit | Awaiting user selection |
+| Provider key name | `claude_key_bernd.worsch` (user supplied; account type unverified) |
+| Key scope | Only the dedicated workspace |
+| Provider expiry | `2027-01-31T22:00:00+01:00` = `2027-01-31T21:00:00Z` (user supplied) |
+| KV-v2 entry | `platform/workloads/glas-harness/claude-agent-dev` |
+| Only secret field | `ANTHROPIC_API_KEY` |
+| Read policy name | `workload-kv-read-glas-claude-agent-dev` |
+| Proposed route | `glas-claude-agent-dev-anthropic` |
+| Consumer | Sand-boxer owner delivery to the selected Claude workload |
+
+These are proposed coordinates, not evidence that provider/OpenBao objects
+exist. The generic `openbao-api-key` routing entry is not a usable grant.
+Provider key metadata was supplied by the user. OpenBao empty version 1 now
+exists; no live auth role or runtime grant was created.
+
+## Provider creation and custody
+
+In the chosen organization's Console, create the dedicated workspace and set
+the approved spend limit. Have its administrator create the service account,
+add it to that workspace, and create a key linked to that account and scoped
+to the workspace. Record only organization/workspace/account/key identifiers,
+expiration and budget as evidence. Anthropic documents service account keys
+for automated workloads and creation in Settings → API keys:
+https://platform.claude.com/docs/en/manage-claude/authentication
+Workspace administration and limits:
+https://platform.claude.com/docs/en/manage-claude/workspaces
+
+Complete the protected OpenBao custody writer before revealing a new key in
+the Console. Enter its value only through an attended hidden prompt or an
+approved private value file consumed by that writer. Never paste it into chat,
+put it in shell arguments, or store it in this repository. Initial storage
+must use KV-v2 CAS zero; rotations must use the reviewed current version.
+Existing platform tooling supports attended custody, but the exact writer and
+sandbox owner auth binding for this new entry still need implementation and
+verification. Do not substitute an ambient human token for machine identity.
+
+The final read policy grants only the exact data entry, without metadata,
+listing, sibling access or writes. Verify negative access for generic coding
+agents. Sand-boxer must resolve the approved route and deliver the key to the
+workload without returning it or an OpenBao token to Glas. Environment delivery
+is visible to the trusted workload and its descendants; it does not hide the
+key from hostile code inside that workload.
+
+## Acceptance and rotation
+
+Before activation, verify exact owner identity, read scope, protected delivery,
+redacted failures, source/artifact cleanliness and private-state teardown.
+Provider egress and the pinned Claude executable remain SAND-WP-0015 gates.
+Then run the bounded real proof specified in local-profile-acceptance.md.
+Keep the existing Glas profile blocked until these checks pass.
+
+For rotation, create and store a replacement with CAS, stop runs carrying the
+predecessor, verify the replacement, revoke the predecessor at Anthropic and
+prove denial. OpenBao lease expiry alone does not revoke an Anthropic API key.
+For compromise, disable the provider key immediately and stop affected runs.
+
+## Empty-version UI handoff
+
+User authorized an empty version at the proposed path. The platform initializer
+`scripts/prepare-glas-anthropic.py` writes only an empty `ANTHROPIC_API_KEY`
+using CAS zero, then records non-secret provider metadata. It never reads data
+and does not create any reader policy or auth role. A contained operator login
+is required; the local ops-mason grant is absent and its builder policy denies
+data writes. Creation receipt is `/tmp/glas-anthropic-empty-receipt.json`.
+Do not assume creation succeeded without that receipt and a successful envelope.
+
+After confirmed creation, open mount `platform`, path
+`workloads/glas-harness/claude-agent-dev`, and create a new version replacing
+the empty `ANTHROPIC_API_KEY` with the real key. The recorded provider expiry
+is descriptive metadata, not an OpenBao-enforced expiration. Do not send the
+value back in chat. Workspace/budget and runtime delivery remain unverified.
+
+Creation confirmed 2026-09-05: empty version 1, request id
+`50cafc25-8d24-c1d6-5be8-1ade049e088b`. Metadata completion succeeded through
+a second contained login after correcting empty-response parsing; both sessions
+were revoked. See the non-secret evidence in
+`evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json`.
+The user can now create version 2 in the UI.
+
+## Custody confirmed
+
+On 2026-09-05 the user reported saving the API key through the UI. A contained
+metadata-only read confirmed live version 2, created at
+`2026-09-05T19:12:40.442796563Z`, neither deleted nor destroyed. The session
+was revoked. No secret value or field content was read; provider authentication
+is not yet verified. Evidence:
+`evidence/GLAS-WP-0012-anthropic-custody-2026-09-05.json`.
+
+The UI handoff is complete. Do not run the empty initializer again. The next
+implementation is an exact sandbox-owner machine binding and protected key
+delivery, followed by enforced provider egress and the bounded real proof.
+CCR-2026-0016 remains in flight until those acceptance gates pass.

docs/evidence/GLAS-WP-0012-anthropic-custody-2026-09-05.json

@@ -0,0 +1,10 @@
+{
+  "ccr": "CCR-2026-0016",
+  "path": "platform/metadata/workloads/glas-harness/claude-agent-dev",
+  "current_version": 2,
+  "created_time": "2026-09-05T19:12:40.442796563Z",
+  "live_successor_observed": true,
+  "secret_value_read": false,
+  "provider_authentication_verified": false,
+  "request_id": "d0b60424-a749-c72f-593b-ced6172dd183"
+}

docs/evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json

@@ -0,0 +1,8 @@
+{
+  "ccr": "CCR-2026-0016",
+  "path": "platform/data/workloads/glas-harness/claude-agent-dev",
+  "version": 1,
+  "empty_seed_created": true,
+  "metadata_written": true,
+  "request_id": "50cafc25-8d24-c1d6-5be8-1ade049e088b"
+}

workplans/GLAS-WP-0012-first-local-profile-production-proof.md

@@ -91,8 +91,14 @@ exec calls, and teardown passed in sandbox d4de9531; sand-boxer lint and 132
 tests pass. This completes the candidate runtime mechanism, not production
 selection. Authentication lane, credential delivery/revocation, provider egress,
 pinning the Claude executable, and deployed profile review remain open. The
-credential catalog has no matching Anthropic/Claude workload lane; the user's
-authentication choice is pending. See docs/local-profile-acceptance.md.
+credential catalog has no matching Anthropic/Claude workload lane; the user selected a dedicated Anthropic workload API key. See
+[the concrete custody proposal](../docs/anthropic-workload-key.md) and owner
+CCR-2026-0016 (in flight). Organization/key metadata is supplied and the user saved the key in OpenBao.
+A metadata-only owner check confirmed live version 2 on 2026-09-05, without
+reading the value. Custody handoff is complete. Verified machine binding,
+protected runtime delivery, workspace scope/budget and provider egress remain
+outstanding; provider authentication has not been tested.
+See docs/local-profile-acceptance.md.
 
 ## Review and validate the versioned Glas proof candidate