RFD-090: Anthropic Subscription Auth with Credential Fallback

[JeanMertz]

Tracking issue for RFD-090: Anthropic Subscription Auth with Credential Fallback.

This issue tracks the progress towards the complete implementation of RFD-090.

Tasks

• Phase 1: Bearer auth mode in the async-anthropic fork implementing the request fingerprint as named, documented constants
• Phase 1: Credential store with file locking, versioned schema, and tagged credential variants (oauth, token)
• Phase 1: Chain preflight and resolution logic in jp_cli
• Phase 1: jp provider auth login llm.anthropic --setup-token reading a long-lived token from stdin, stored as a static token credential, with identity recovery attempted at login
• Phase 1: jp provider auth list and jp provider auth logout commands
• Phase 1: Measure the minimum request fingerprint Anthropic accepts (top-down from full inventory: headers, identity metadata, system content, attestation)
• Phase 1: Measure whether the bootstrap endpoint accepts setup tokens for identity recovery
• Phase 1: Capture the observed wire shape of a subscription-limit failure (status, body, headers)
• Phase 2: Implement subscription-window exhaustion classification fixed against Phase 1's observed error shape
• Phase 2: Implement retryable-via-credential-switch handling and scoped cooldown persistence
• Phase 2: Implement the fallback notice and no-backoff retry on credential switch
• Phase 3: Implement full PKCE browser login flow (PKCE, browser, localhost callback, paste fallback)
• Phase 3: Implement refresh-on-expiry for OAuth credentials
• Phase 3: Measure whether the authorize endpoint grants the reduced user:inference + user:profile scope set; if not, add full-set fallback with per-capability justifications
• Phase 4: Implement macOS Keychain credential store backend behind the store interface
• Phase 4: Implement one-time migration from file store to Keychain store with verification and fallback-on-failure