glas-harness/docs/anthropic-workload-key.md

Anthropic workload key

User selected a dedicated Anthropic API key on 2026-09-05 for GLAS-WP-0012-T02 / SAND-WP-0015-T04. Credential custody request: CCR-2026-0016. The request is in flight, not an active credential route. Offline validation passes and apply-plan refuses the incomplete request.

Concrete proposal

Setting	Proposed value
Anthropic organization	e1a8f305-9e64-4639-a7fd-af48e34f37c7 (user supplied)
Dedicated workspace	glas-harness
Workspace spend limit	Awaiting user selection
Provider key name	claude_key_bernd.worsch (user supplied; account type unverified)
Key scope	Only the dedicated workspace
Provider expiry	2027-01-31T22:00:00+01:00 = 2027-01-31T21:00:00Z (user supplied)
KV-v2 entry	platform/workloads/glas-harness/claude-agent-dev
Only secret field	ANTHROPIC_API_KEY
Proposed read policy name	se-prod-glas-claude-agent-dev-anthropic
Proposed route	glas-claude-agent-dev-anthropic
Consumer	Sand-boxer owner delivery to the selected Claude workload

These are proposed coordinates, not evidence that provider/OpenBao objects exist. The generic openbao-api-key routing entry is not a usable grant. Provider key metadata was supplied by the user. OpenBao empty version 1 now exists; no live auth role or runtime grant was created.

Provider creation and custody

In the chosen organization's Console, create the dedicated workspace and set the approved spend limit. Have its administrator create the service account, add it to that workspace, and create a key linked to that account and scoped to the workspace. Record only organization/workspace/account/key identifiers, expiration and budget as evidence. Anthropic documents service account keys for automated workloads and creation in Settings → API keys: https://platform.claude.com/docs/en/manage-claude/authentication Workspace administration and limits: https://platform.claude.com/docs/en/manage-claude/workspaces

Complete the protected OpenBao custody writer before revealing a new key in the Console. Enter its value only through an attended hidden prompt or an approved private value file consumed by that writer. Never paste it into chat, put it in shell arguments, or store it in this repository. Initial storage must use KV-v2 CAS zero; rotations must use the reviewed current version. Existing platform tooling supports attended custody, but the exact writer and sandbox owner auth binding for this new entry still need implementation and verification. Do not substitute an ambient human token for machine identity.

The final read policy grants only the exact data entry, without metadata, listing, sibling access or writes. Verify negative access for generic coding agents. Sand-boxer must resolve the approved route and deliver the key to the workload without returning it or an OpenBao token to Glas. Environment delivery is visible to the trusted workload and its descendants; it does not hide the key from hostile code inside that workload.

Acceptance and rotation

Before activation, verify exact owner identity, read scope, protected delivery, redacted failures, source/artifact cleanliness and private-state teardown. Provider egress and the pinned Claude executable remain SAND-WP-0015 gates. Then run the bounded real proof specified in local-profile-acceptance.md. Keep the existing Glas profile blocked until these checks pass.

For rotation, create and store a replacement with CAS, stop runs carrying the predecessor, verify the replacement, revoke the predecessor at Anthropic and prove denial. OpenBao lease expiry alone does not revoke an Anthropic API key. For compromise, disable the provider key immediately and stop affected runs.

Empty-version UI handoff

User authorized an empty version at the proposed path. The platform initializer scripts/prepare-glas-anthropic.py writes only an empty ANTHROPIC_API_KEY using CAS zero, then records non-secret provider metadata. It never reads data and does not create any reader policy or auth role. A contained operator login is required; the local ops-mason grant is absent and its builder policy denies data writes. Creation receipt is /tmp/glas-anthropic-empty-receipt.json. Do not assume creation succeeded without that receipt and a successful envelope.

After confirmed creation, open mount platform, path workloads/glas-harness/claude-agent-dev, and create a new version replacing the empty ANTHROPIC_API_KEY with the real key. The recorded provider expiry is descriptive metadata, not an OpenBao-enforced expiration. Do not send the value back in chat. Workspace/budget and runtime delivery remain unverified.

Creation confirmed 2026-09-05: empty version 1, request id 50cafc25-8d24-c1d6-5be8-1ade049e088b. Metadata completion succeeded through a second contained login after correcting empty-response parsing; both sessions were revoked. See the non-secret evidence in evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json. The user can now create version 2 in the UI.

Custody confirmed

On 2026-09-05 the user reported saving the API key through the UI. A contained metadata-only read confirmed live version 2, created at 2026-09-05T19:12:40.442796563Z, neither deleted nor destroyed. The session was revoked. No secret value or field content was read; provider authentication is not yet verified. Evidence: evidence/GLAS-WP-0012-anthropic-custody-2026-09-05.json.

The UI handoff is complete. Do not run the empty initializer again. The next implementation is an exact sandbox-owner machine binding and protected key delivery, followed by enforced provider egress and the bounded real proof. CCR-2026-0016 remains in flight until those acceptance gates pass.

Owner transport and native adoption

Sand-boxer now implements consumer-bound exec-env delivery through a configured credential owner provider, with direct private handoff to the namespace broker. Synthetic proof 880f749e passed child delivery, exact-value output redaction, next-exec absence, wrong-project denial and teardown. No real key was read.

Secrets-engine catalog glas-claude-agent-dev-anthropic now proposes native policy/AppRole se-prod-glas-claude-agent-dev-anthropic for the exact KV data path, with metadata access excluded. This supersedes the earlier proposed read policy name; neither policy has been applied by this work. Adoption is tracked in SECRETS-WP-0009. The production exec gate refuses before OpenBao while SECRETS-WP-0007-T04 and SECRETS-WP-0008-T02/T06 remain unresolved. No production profile selects the unactivated route.

Owner update received 2026-09-06 (message 3bd23bc9-e863-4f1f-8c76-415812ec0656): secrets-engine reports the local authorization join fixed at 627810b. Live activation still waits on the approval-engine ActionAuthorization claim endpoint and access-engine Check service, then configuration, per-lane approval and positive/negative checks. The owner explicitly distinguishes these durable objects from State Hub decisions. This update does not activate the route or verify the provider key.

Authorization-chain proof update — 2026-09-06

Reviewed secrets-engine f62d3fe and its evidence note 64aeec9. The owner reports a complete claim → Check → CAS consume → backend integration proof against a throwaway OpenBao. Authorization HTTP transport/sequencing is stubbed, with wire contracts pinned to flex-auth fixtures. Negative cases refuse before the backend. This is integration evidence, not production authorization-service deployment or real Anthropic-key delivery.

Remaining live inputs are the consumer PDP and approval service endpoints, production service credentials, the deployed policy pin, and each lane's approval.authorization_id, followed by native-lane access verification. SECRETS-WP-0009-T03 remains waiting. The existing custody-only CCR and stored key do not supply these authorizations. Glas retains its blocked local profile and must still verify pinned Claude startup and the combined real task.