From b2c2848e4925e1f0001a877fafbbe14cc83b635c Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Sat, 5 Sep 2026 21:15:14 +0200
Subject: [PATCH] feat: verify Anthropic custody through metadata only

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb
---
 .../CCR-2026-0016-glas-claude-anthropic.yaml  | 22 ++++++++++++++-----
 scripts/prepare-glas-anthropic.py             | 15 +++++++++++++
 2 files changed, 31 insertions(+), 6 deletions(-)

diff --git a/credential-change-requests/CCR-2026-0016-glas-claude-anthropic.yaml b/credential-change-requests/CCR-2026-0016-glas-claude-anthropic.yaml
index 97cdefe..10ccb22 100644
--- a/credential-change-requests/CCR-2026-0016-glas-claude-anthropic.yaml
+++ b/credential-change-requests/CCR-2026-0016-glas-claude-anthropic.yaml
@@ -10,10 +10,9 @@ in_flight:
   missing_fields:
   - openbao.policy_file
   - openbao.auth
-  blocking_reason: Provider organization, key name and expiration supplied by user.
-    Empty-only KV seed authorized for operator UI handoff; live custody and the sandbox
-    owner machine identity/delivery remain unverified. Workspace scope and budget
-    are not confirmed.
+  blocking_reason: User reports key saved through UI; metadata-only owner check confirms
+    live version 2. Sandbox owner machine identity and protected delivery remain unimplemented;
+    workspace scope/budget and provider authentication are unverified.
   owner: railiance-platform
 requester:
   agent: codex
@@ -64,8 +63,8 @@ delivery:
 risk:
   classification: high
   notes:
-  - Proposed KV coordinates and catalog selector are reserved design names, not surveyed
-    live objects.
+  - KV path exists with live version 2. Catalog selector is still proposed and no
+    runtime read grant has been activated.
   - Provider credential can incur API charges; use a dedicated workspace and user-selected
     budget.
   - Use a workspace-scoped service account key; organization administration is outside
@@ -110,6 +109,17 @@ verification:
     - Provider metadata recorded; metadata-only recovery completed after empty response
       parsing fix; contained sessions revoked.
     - No secret data read or real key handled; runtime lane remains inactive.
+  - at: '2026-09-05'
+    actor: codex
+    kind: custody_metadata_verification
+    result: passed
+    details:
+    - User reports secret saved in UI. Metadata confirms live version 2 created 2026-09-05T19:12:40.442796563Z,
+      neither deleted nor destroyed.
+    - Metadata request id d0b60424-a749-c72f-593b-ced6172dd183; contained session
+      revoked.
+    - No value read; field content and provider authentication not verified. Runtime
+      lane remains inactive.
 lifecycle:
   deactivate: Disable the owner route and provider key; revoke outstanding OpenBao
     reader tokens. Preserve KV history under platform retention rules.
diff --git a/scripts/prepare-glas-anthropic.py b/scripts/prepare-glas-anthropic.py
index 02afc48..e5f920d 100644
--- a/scripts/prepare-glas-anthropic.py
+++ b/scripts/prepare-glas-anthropic.py
@@ -17,6 +17,21 @@ def bao(*args, payload=None):
     return json.loads(r.stdout) if r.stdout.strip() else {}
 
 def main():
+    if sys.argv[1:] == ['--verify-custody']:
+        result = bao('read', '-format=json', META_PATH)
+        observed = result['data']
+        version = observed.get('current_version', 0)
+        current = observed.get('versions', {}).get(str(version), {})
+        if version < 2 or not current or current.get('destroyed') or current.get('deletion_time'):
+            raise RuntimeError('no_live_successor_version')
+        # Deliberately exclude arbitrary custom metadata and all data values.
+        receipt = {'ccr': 'CCR-2026-0016', 'path': META_PATH,
+                   'current_version': version, 'created_time': current.get('created_time'),
+                   'live_successor_observed': True, 'secret_value_read': False,
+                   'provider_authentication_verified': False,
+                   'request_id': result.get('request_id')}
+        Path('/tmp/glas-anthropic-custody-receipt.json').write_text(json.dumps(receipt))
+        return
     if sys.argv[1:] == ['--complete-metadata']:
         receipt = json.loads(RECEIPT.read_text())
         if receipt.get('path') != DATA_PATH or receipt.get('version') != 1: