tegwick
53f2abf7e0
Some checks failed
ci / validate (push) Has been cancelled
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb
129 lines
7.1 KiB
Markdown
129 lines
7.1 KiB
Markdown
# Anthropic workload key
|
|
|
|
User selected a dedicated Anthropic API key on 2026-09-05 for
|
|
GLAS-WP-0012-T02 / SAND-WP-0015-T04. Credential custody request:
|
|
[CCR-2026-0016](../../railiance-platform/credential-change-requests/CCR-2026-0016-glas-claude-anthropic.yaml).
|
|
The request is in flight, not an active credential route. Offline validation
|
|
passes and apply-plan refuses the incomplete request.
|
|
|
|
## Concrete proposal
|
|
|
|
| Setting | Proposed value |
|
|
| --- | --- |
|
|
| Anthropic organization | `e1a8f305-9e64-4639-a7fd-af48e34f37c7` (user supplied) |
|
|
| Dedicated workspace | `glas-harness` |
|
|
| Workspace spend limit | Awaiting user selection |
|
|
| Provider key name | `claude_key_bernd.worsch` (user supplied; account type unverified) |
|
|
| Key scope | Only the dedicated workspace |
|
|
| Provider expiry | `2027-01-31T22:00:00+01:00` = `2027-01-31T21:00:00Z` (user supplied) |
|
|
| KV-v2 entry | `platform/workloads/glas-harness/claude-agent-dev` |
|
|
| Only secret field | `ANTHROPIC_API_KEY` |
|
|
| Proposed read policy name | `se-prod-glas-claude-agent-dev-anthropic` |
|
|
| Proposed route | `glas-claude-agent-dev-anthropic` |
|
|
| Consumer | Sand-boxer owner delivery to the selected Claude workload |
|
|
|
|
These are proposed coordinates, not evidence that provider/OpenBao objects
|
|
exist. The generic `openbao-api-key` routing entry is not a usable grant.
|
|
Provider key metadata was supplied by the user. OpenBao empty version 1 now
|
|
exists; no live auth role or runtime grant was created.
|
|
|
|
## Provider creation and custody
|
|
|
|
In the chosen organization's Console, create the dedicated workspace and set
|
|
the approved spend limit. Have its administrator create the service account,
|
|
add it to that workspace, and create a key linked to that account and scoped
|
|
to the workspace. Record only organization/workspace/account/key identifiers,
|
|
expiration and budget as evidence. Anthropic documents service account keys
|
|
for automated workloads and creation in Settings → API keys:
|
|
https://platform.claude.com/docs/en/manage-claude/authentication
|
|
Workspace administration and limits:
|
|
https://platform.claude.com/docs/en/manage-claude/workspaces
|
|
|
|
Complete the protected OpenBao custody writer before revealing a new key in
|
|
the Console. Enter its value only through an attended hidden prompt or an
|
|
approved private value file consumed by that writer. Never paste it into chat,
|
|
put it in shell arguments, or store it in this repository. Initial storage
|
|
must use KV-v2 CAS zero; rotations must use the reviewed current version.
|
|
Existing platform tooling supports attended custody, but the exact writer and
|
|
sandbox owner auth binding for this new entry still need implementation and
|
|
verification. Do not substitute an ambient human token for machine identity.
|
|
|
|
The final read policy grants only the exact data entry, without metadata,
|
|
listing, sibling access or writes. Verify negative access for generic coding
|
|
agents. Sand-boxer must resolve the approved route and deliver the key to the
|
|
workload without returning it or an OpenBao token to Glas. Environment delivery
|
|
is visible to the trusted workload and its descendants; it does not hide the
|
|
key from hostile code inside that workload.
|
|
|
|
## Acceptance and rotation
|
|
|
|
Before activation, verify exact owner identity, read scope, protected delivery,
|
|
redacted failures, source/artifact cleanliness and private-state teardown.
|
|
Provider egress and the pinned Claude executable remain SAND-WP-0015 gates.
|
|
Then run the bounded real proof specified in local-profile-acceptance.md.
|
|
Keep the existing Glas profile blocked until these checks pass.
|
|
|
|
For rotation, create and store a replacement with CAS, stop runs carrying the
|
|
predecessor, verify the replacement, revoke the predecessor at Anthropic and
|
|
prove denial. OpenBao lease expiry alone does not revoke an Anthropic API key.
|
|
For compromise, disable the provider key immediately and stop affected runs.
|
|
|
|
## Empty-version UI handoff
|
|
|
|
User authorized an empty version at the proposed path. The platform initializer
|
|
`scripts/prepare-glas-anthropic.py` writes only an empty `ANTHROPIC_API_KEY`
|
|
using CAS zero, then records non-secret provider metadata. It never reads data
|
|
and does not create any reader policy or auth role. A contained operator login
|
|
is required; the local ops-mason grant is absent and its builder policy denies
|
|
data writes. Creation receipt is `/tmp/glas-anthropic-empty-receipt.json`.
|
|
Do not assume creation succeeded without that receipt and a successful envelope.
|
|
|
|
After confirmed creation, open mount `platform`, path
|
|
`workloads/glas-harness/claude-agent-dev`, and create a new version replacing
|
|
the empty `ANTHROPIC_API_KEY` with the real key. The recorded provider expiry
|
|
is descriptive metadata, not an OpenBao-enforced expiration. Do not send the
|
|
value back in chat. Workspace/budget and runtime delivery remain unverified.
|
|
|
|
Creation confirmed 2026-09-05: empty version 1, request id
|
|
`50cafc25-8d24-c1d6-5be8-1ade049e088b`. Metadata completion succeeded through
|
|
a second contained login after correcting empty-response parsing; both sessions
|
|
were revoked. See the non-secret evidence in
|
|
`evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json`.
|
|
The user can now create version 2 in the UI.
|
|
|
|
## Custody confirmed
|
|
|
|
On 2026-09-05 the user reported saving the API key through the UI. A contained
|
|
metadata-only read confirmed live version 2, created at
|
|
`2026-09-05T19:12:40.442796563Z`, neither deleted nor destroyed. The session
|
|
was revoked. No secret value or field content was read; provider authentication
|
|
is not yet verified. Evidence:
|
|
`evidence/GLAS-WP-0012-anthropic-custody-2026-09-05.json`.
|
|
|
|
The UI handoff is complete. Do not run the empty initializer again. The next
|
|
implementation is an exact sandbox-owner machine binding and protected key
|
|
delivery, followed by enforced provider egress and the bounded real proof.
|
|
CCR-2026-0016 remains in flight until those acceptance gates pass.
|
|
|
|
## Owner transport and native adoption
|
|
|
|
Sand-boxer now implements consumer-bound exec-env delivery through a configured
|
|
credential owner provider, with direct private handoff to the namespace broker.
|
|
Synthetic proof 880f749e passed child delivery, exact-value output redaction,
|
|
next-exec absence, wrong-project denial and teardown. No real key was read.
|
|
|
|
Secrets-engine catalog `glas-claude-agent-dev-anthropic` now proposes native
|
|
policy/AppRole `se-prod-glas-claude-agent-dev-anthropic` for the exact KV data
|
|
path, with metadata access excluded. This supersedes the earlier proposed read
|
|
policy name; neither policy has been applied by this work. Adoption is tracked
|
|
in SECRETS-WP-0009. The production exec gate refuses before OpenBao while
|
|
SECRETS-WP-0007-T04 and SECRETS-WP-0008-T02/T06 remain unresolved.
|
|
No production profile selects the unactivated route.
|
|
|
|
Owner update received 2026-09-06 (message
|
|
`3bd23bc9-e863-4f1f-8c76-415812ec0656`): secrets-engine reports the local
|
|
authorization join fixed at `627810b`. Live activation still waits on the
|
|
approval-engine ActionAuthorization claim endpoint and access-engine Check
|
|
service, then configuration, per-lane approval and positive/negative checks.
|
|
The owner explicitly distinguishes these durable objects from State Hub
|
|
decisions. This update does not activate the route or verify the provider key.
|