feat: prepare empty Anthropic custody entry for UI handoff

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

scripts/prepare-glas-anthropic.py

@@ -0,0 +1,54 @@
+#!/usr/bin/env python3
+"""User-authorized empty KV seed for CCR-2026-0016; silent OIDC child."""
+import json
+from pathlib import Path
+import subprocess
+import sys
+
+DATA_PATH = 'platform/data/workloads/glas-harness/claude-agent-dev'
+META_PATH = 'platform/metadata/workloads/glas-harness/claude-agent-dev'
+RECEIPT = Path('/tmp/glas-anthropic-empty-receipt.json')
+
+def bao(*args, payload=None):
+    r = subprocess.run(['bao', *args], input=None if payload is None else json.dumps(payload),
+                       text=True, capture_output=True, timeout=30)
+    if r.returncode:
+        raise RuntimeError('bao_operation_failed')
+    return json.loads(r.stdout) if r.stdout.strip() else {}
+
+def main():
+    if sys.argv[1:] == ['--complete-metadata']:
+        receipt = json.loads(RECEIPT.read_text())
+        if receipt.get('path') != DATA_PATH or receipt.get('version') != 1:
+            raise RuntimeError('invalid_receipt')
+        observed = bao('read', '-format=json', META_PATH)['data']
+        if observed.get('current_version', 0) < 1:
+            raise RuntimeError('missing_seed')
+    elif not sys.argv[1:]:
+        # CAS zero makes concurrent creation and existing versions refuse; no data GET.
+        result = bao('write', '-format=json', DATA_PATH, '-',
+                     payload={'options': {'cas': 0}, 'data': {'ANTHROPIC_API_KEY': ''}})
+        version = result['data']['version']
+        receipt = {'ccr': 'CCR-2026-0016', 'path': DATA_PATH, 'version': version,
+                   'empty_seed_created': True, 'metadata_written': False,
+                   'request_id': result.get('request_id')}
+        with RECEIPT.open('x') as f:
+            json.dump(receipt, f)
+    else:
+        raise RuntimeError('invalid_arguments')
+    # Only non-secret custom metadata. No secret expiry is enforced by KV metadata.
+    bao('write', '-format=json', META_PATH, '-', payload={'custom_metadata': {
+        'ccr': 'CCR-2026-0016', 'custody_owner': 'railiance-platform',
+        'provider': 'anthropic', 'organization_id': 'e1a8f305-9e64-4639-a7fd-af48e34f37c7',
+        'provider_key_name': 'claude_key_bernd.worsch',
+        'provider_expires_at': '2027-01-31T21:00:00Z',
+        'seed_version': '1', 'seed_contains_secret': 'false',
+        'handoff': 'operator creates next version in UI; runtime lane remains inactive'}})
+    receipt['metadata_written'] = True
+    RECEIPT.write_text(json.dumps(receipt))
+
+if __name__ == '__main__':
+    try:
+        main()
+    except Exception:
+        sys.exit(1)  # contained executor must never return provider/client output