# Credential transport acceptance

Installed sand-boxer synthetic proof `880f749e`: child receives only synthetic
ANTHROPIC_API_KEY, stdout is redacted, next exec has no key, wrong-project
request refuses and workspace is removed. No real key was read.

Full checks: sand-boxer lint+171 tests, secrets-engine226 tests, Glas101 tests.
Existing persisted-manager egress and deterministic Glas boundary proofs pass.

Native proposal: secrets-engine/catalog/glas-claude-agent-dev-anthropic.yaml;
SECRETS-WP-0009 tracks live activation. The plan checks the existing platform
mount, creates one exact data-only read policy/AppRole, TTL5m/max15m,
single-use SecretID5m, token uses8. No metadata/list/write grant is included.

The real production CLI exec invocation with service-jwt selection refused:
`production action 'exec' requires a durable access-engine decision record;
live production remains disabled`. No unsafe-demo flag, real key retrieval or
operator-token fallback was used. This is an upstream authorization/service
implementation dependency, not a successful model authentication proof.