feat: verify Anthropic custody through metadata only

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb
This commit is contained in:
codex 2026-09-05 21:15:14 +02:00
parent a16c33942a
commit b2c2848e49
2 changed files with 31 additions and 6 deletions

View file

@ -17,6 +17,21 @@ def bao(*args, payload=None):
return json.loads(r.stdout) if r.stdout.strip() else {}
def main():
if sys.argv[1:] == ['--verify-custody']:
result = bao('read', '-format=json', META_PATH)
observed = result['data']
version = observed.get('current_version', 0)
current = observed.get('versions', {}).get(str(version), {})
if version < 2 or not current or current.get('destroyed') or current.get('deletion_time'):
raise RuntimeError('no_live_successor_version')
# Deliberately exclude arbitrary custom metadata and all data values.
receipt = {'ccr': 'CCR-2026-0016', 'path': META_PATH,
'current_version': version, 'created_time': current.get('created_time'),
'live_successor_observed': True, 'secret_value_read': False,
'provider_authentication_verified': False,
'request_id': result.get('request_id')}
Path('/tmp/glas-anthropic-custody-receipt.json').write_text(json.dumps(receipt))
return
if sys.argv[1:] == ['--complete-metadata']:
receipt = json.loads(RECEIPT.read_text())
if receipt.get('path') != DATA_PATH or receipt.get('version') != 1: