RFD-090: Anthropic Subscription Auth with Credential Fallback

Tracking issue for RFD-090: Anthropic Subscription Auth with Credential Fallback.

This issue tracks the progress towards the complete implementation of RFD-090.

Tasks

• Phase 1: Bearer auth mode in the async-anthropic fork implementing the request fingerprint as named, documented constants
• Phase 1: Credential store with file locking, versioned schema, and tagged credential variants (oauth, token)
• Phase 1: Chain preflight and resolution logic in jp_cli
• Phase 1: jp provider auth login llm.anthropic --setup-token reading a long-lived token from stdin, stored as a static token credential, with identity recovery attempted at login
• Phase 1: jp provider auth list and jp provider auth logout commands
• Phase 1: Measure the minimum request fingerprint Anthropic accepts (top-down from full inventory: headers, identity metadata, system content, attestation)
• Phase 1: Measure whether the bootstrap endpoint accepts setup tokens for identity recovery
• Phase 1: Capture the observed wire shape of a subscription-limit failure (status, body, headers)
• Phase 2: Implement subscription-window exhaustion classification fixed against Phase 1's observed error shape
• Phase 2: Implement retryable-via-credential-switch handling and scoped cooldown persistence
• Phase 2: Implement the fallback notice and no-backoff retry on credential switch
• Phase 3: Implement full PKCE browser login flow (PKCE, browser, localhost callback, paste fallback)
• Phase 3: Implement refresh-on-expiry for OAuth credentials
• Phase 3: Measure whether the authorize endpoint grants the reduced user:inference + user:profile scope set; if not, add full-set fallback with per-capability justifications
• Phase 4: Implement macOS Keychain credential store backend behind the store interface
• Phase 4: Implement one-time migration from file store to Keychain store with verification and fallback-on-failure

Read RFD-090 first, then trace the Phase 1 entry points in the async-anthropic fork and jp_cli, including jp provider auth login, list, and logout. Done means the phased authentication, credential fallback, OAuth, and Keychain tasks are implemented and the requested Anthropic measurements and observed failure shape are recorded.