Support user-owned native AI subscriptions through a secure local companion

[Vinosaamaa]

Implement a user-owned native AI companion so a learner can use a supported provider subscription without Chanter collecting or proxying subscription credentials.

Related: #248 (provider runtime and evidence boundary), #247 (authorized retrieval), #254 (learner UI). The existing issue search found no equivalent companion delivery issue. This is a separate security, packaging, and release boundary; API runtime work does not complete it.

Supported access

• Codex App Server: user-installed unmodified binary, stdio child, provider-owned account/login/start ChatGPT/device-code flow, account-specific model and rate-limit discovery. Chanter never reads auth files or uses external-token authentication.
• Claude Code: unmodified user-installed binary and Anthropic-owned authentication, retaining every built-in authentication method. Each end user supplies their own entitlement. Packaging requires the applicable Commercial Terms and must not intermediate or resell usage.
• No pooled subscription accounts, browser-cookie scraping, shared backend credential relay, or automatic paid API fallback. The provider's own limits remain authoritative.

Acceptance criteria

• Signed/versioned installers for supported desktop platforms; detect compatible provider-owned binaries and show unsupported versions clearly.
• Explicit local pairing restricted to the exact Chanter origin, loopback listener, random per-install secret, replay-resistant single-use request capability, and user/session binding; no unauthenticated localhost inference API.
• Reuse Productionize AI orchestration, safety, usage metering, and evaluations #248 request modes, evidence identifiers, bounded input/output, deadlines, cancellation, and normalized unknown-versus-measured usage. Extraction and grounded explanations remain visibly distinct.
• Backend checks current Course grants and explicit provider export approval before releasing evidence; the user approves the specific provider and request. Short-lived capability binds user, question, provider/model, evidence hashes, budget, and expiry. Recheck authorization and content when accepting results.
• Execute native clients in an empty restricted workspace, disable nonessential tools/integrations through supported controls, preserve provider auth methods, and prove local files/secrets cannot be read or exported. Fail closed if the required isolation cannot be enforced.
• Keep provider credentials in the provider-owned store. Define transcript retention and deletion, prevent credential/content logging, and never upload local provider session files.
• Provider-owned login, account-specific model availability/limits, reconnect, unavailable subscription, cancellation, and exhausted usage have working UI and integration tests. Do not purchase credits, enable overage, or trigger reset credits automatically.
• Treat companion-submitted usage/results as untrusted client claims; enforce backend reservations and evidence validation, label receipt provenance, and do not turn claimed subscription usage into authoritative billing data.
• Threat-model and penetration tests cover malicious websites, origin spoofing/DNS rebinding, replay, tampered evidence/results, revoked memberships, concurrent spend, inherited tools, and provider failures.
• Run a verified native end-to-end flow under a consenting user's eligible account with no unapproved charges; update official entitlement evidence at release.

Official entitlement evidence checked 2026-09-12

• Codex App Server managed authentication: https://learn.chatgpt.com/docs/app-server
• Claude Code hosting/authentication conditions: https://code.claude.com/docs/en/legal-and-compliance
• Claude SDK credit change is paused; current SDK/native usage rules remain account-specific: https://support.claude.com/en/articles/15036540-use-the-claude-agent-sdk-with-your-claude-plan

These sources support the access direction. They do not prove an installed companion, the user's entitlement, safe packaging, or completed product integration.