id: glas-claude-agent-dev-anthropic
kind: kv
org: coulomb
repo: sand-boxer
stage: prod
description: Catalog-bound metered owner with Activity Core worker-token companion.
  The 2026-09-27 corrected owner pin requires reviewed host installation; the old
  200k/32k owner is not admitted by this catalog. Native activation remains SECRETS-WP-0009-T03.
mount: platform
path: workloads/glas-harness/claude-agent-dev
mount_management: existing
fields:
- ANTHROPIC_API_KEY
consumers:
- name: sand-boxer-glas-agent-dev
  auth: approle
  claim: catalog:glas-claude-agent-dev-anthropic
  purpose: Owner-admitted glas-harness agt run through the reviewed local profile;
    no caller-facing key fetch
workload_delivery: []
delivery_config:
  exec_owner:
    status: configured
    owner: rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary
    command:
    - /home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3
    - -I
    - -B
    - -m
    - rein_aharness.cli
    - metered-once
    - --owner-config
    - /home/tegwick/hfact/owner-metered/owner.json
    cwd: /home/tegwick/hfact/owner-metered
    environment:
      PATH: /usr/bin:/bin
      LANG: C.UTF-8
      HOME: /home/tegwick
      ACTIVITY_CORE_URL: http://127.0.0.1:8010
      AGENT_HARNESS_WORKER_ID: rein-aharness-metered@railiance01
      AGENT_HARNESS_OPS_LABELS: hfact-metered
      AGENT_HARNESS_OPS_LABELS_MODE: all
      AGENT_HARNESS_EXECUTION_PROJECT: prj-helixforge-factory
      AGENT_HARNESS_REQUIRE_SPEND_ADMISSION: '1'
      AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION: '1'
      AGENT_HARNESS_SPEND_POLICY: /home/tegwick/hfact/owner-metered/spend-policy.json
      AGENT_HARNESS_SPEND_LEDGER: /home/tegwick/hfact/owner-metered/spend.sqlite3
      AGENT_HARNESS_REPO_MAP: '{"hfact-glas-proof":"/home/tegwick/hfact/targets/hfact-glas-proof"}'
    files:
      /home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3:
        sha256: e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f
        private: false
      /home/tegwick/hfact/owner-metered/owner.json:
        sha256: e0d3fb84649fdca302eccd9415f3cc2beaee84bf07bd83205cdffbe93e5573bc
        private: true
      /home/tegwick/hfact/owner-metered/spend-policy.json:
        sha256: f31c585916de1ea8bd8e48c72421803dfde1015e6201704b9320f77d2c545d9c
        private: true
    companions:
    - catalog: activity-core-metered-worker-token
      field: token
      env: ACTIVITY_CORE_WORKER_TOKEN
delivery_modes:
- exec-env
- read-check
delivery_auth:
  method: approle
  management: engine
  policy_name: se-prod-glas-claude-agent-dev-anthropic
  role_name: se-prod-glas-claude-agent-dev-anthropic
  metadata_read: false
  token_ttl: 5m
  token_max_ttl: 15m
  secret_id_ttl: 5m
  secret_id_num_uses: 1
  token_num_uses: 8
approval:
  model: ccr
  human_control: true
  decision_ref: CCR-2026-0016
  notes: Custody only has been completed. Native apply and exec require durable exact-action
    authorization, engine consume, scoped backend authority and verified delivery
    state. This entry is not authorization.
verification:
  positive: Exact scoped AppRole reads only ANTHROPIC_API_KEY into the approved child;
    owner binding and redaction pass.
  negative: Wrong owner profile/project/actor, direct caller fetch, sibling KV, metadata,
    listing and writes denied.
risk:
  classification: high
  notes: API spend; provider expiry 2027-01-31T21:00:00Z is not enforced by Bao token
    TTL. Workspace scope and budget unverified.
rotation:
  owner: railiance-platform + sand-boxer
  expectation: Provider replacement, versioned CAS custody, stop old runs, verify
    replacement then revoke predecessor at Anthropic and prove denial.
  ttl: provider-defined
deactivation:
  owner: railiance-platform + sand-boxer
  expectation: Disable lane, stop affected runs, revoke Bao sessions and provider
    key. Preserve custody history.
audit:
  evidence: CCR id, actor, exact path, field name, provider key identifier if non-secret,
    timestamps, and pass/fail only