diff --git a/credential-change-requests/CCR-2026-0016-glas-claude-anthropic.yaml b/credential-change-requests/CCR-2026-0016-glas-claude-anthropic.yaml
index 10ccb22..fe81bcd 100644
--- a/credential-change-requests/CCR-2026-0016-glas-claude-anthropic.yaml
+++ b/credential-change-requests/CCR-2026-0016-glas-claude-anthropic.yaml
@@ -10,9 +10,10 @@ in_flight:
   missing_fields:
   - openbao.policy_file
   - openbao.auth
-  blocking_reason: User reports key saved through UI; metadata-only owner check confirms
-    live version 2. Sandbox owner machine identity and protected delivery remain unimplemented;
-    workspace scope/budget and provider authentication are unverified.
+  blocking_reason: Custody version 2 confirmed. Sand-boxer exec-env transport is proved
+    with synthetic values. Native activation is SECRETS-WP-0009; durable production
+    authorization/consume and scoped engine service authority are unavailable. Workspace
+    scope/budget and real provider authentication remain unverified.
   owner: railiance-platform
 requester:
   agent: codex
@@ -49,7 +50,7 @@ openbao:
   fields:
   - ANTHROPIC_API_KEY
   metadata_read: false
-  policy_name: workload-kv-read-glas-claude-agent-dev
+  policy_name: se-prod-glas-claude-agent-dev-anthropic
 access_frontdoor:
   type: sandbox-owner
   catalog_id: glas-claude-agent-dev-anthropic
@@ -120,6 +121,17 @@ verification:
       revoked.
     - No value read; field content and provider authentication not verified. Runtime
       lane remains inactive.
+  - at: '2026-09-05'
+    actor: codex
+    kind: synthetic_owner_transport
+    result: passed
+    details:
+    - Sand-boxer sandbox880f749e proved synthetic exec-env delivery, output redaction,
+      subsequent-exec absence, wrong-project denial and teardown.
+    - 'No real credential was read. Native production exec refused before OpenBao:
+      durable access-engine decision record unavailable.'
+    - SECRETS-WP-0009 owns native activation; this CCR remains custody provenance,
+      not native apply authorization.
 lifecycle:
   deactivate: Disable the owner route and provider key; revoke outstanding OpenBao
     reader tokens. Preserve KV history under platform retention rules.
@@ -137,3 +149,11 @@ provider_metadata:
   key_name: claude_key_bernd.worsch
   expires_at: '2027-01-31T21:00:00Z'
   source: user supplied; provider identity and workspace scope not independently verified
+native_delivery:
+  owner: secrets-engine
+  catalog_id: glas-claude-agent-dev-anthropic
+  workplan: SECRETS-WP-0009
+  policy_name: se-prod-glas-claude-agent-dev-anthropic
+  role_name: se-prod-glas-claude-agent-dev-anthropic
+  status: proposed-not-applied
+  custody_only_ccr: true