[Subscription Providers 7/7] Claude ordinary-tool/protocol and dual-platform qualification

[NOirBRight]

Part of #603.

Acceptance

After organization permission allows Claude Code subscription inference, qualify production text, streaming, multi-turn, actual caller tools/results, completed ordinary history and cancellation across Responses/Chat/Messages and existing projection. Prove routing isolation, exact identity, auth expiry/account change and no builtin execution. Verify recorded prompt-priority consent; disclose best-effort advanced adaptations while retaining essential semantics. Denied requests, model listing, chat-only or synthetic-only evidence cannot complete live acceptance. Use isolated current account, disposable fixtures and sanitized exact-SHA/version evidence. Strict local suites and Linux/Windows packages from same SHA before independent release acceptance. Never substitute API-key credentials or another account.

Dependencies

#607, #608

Verification

Risk class: strict. Follow docs/agents/verification-policy.md and docs/specs/cli-subscription-providers.md. Historical feasibility does not qualify the production candidate.

[NOirBRight]

Primary-source output-budget research is checked into PR #614 at docs/research/2026-10-01-cli-subscription-output-budget.md (official docs, exact installed versions/artifact SHA/byte offsets; zero inference, credential reads or implementation changes).

Claude Code 2.1.286 has a genuine CLAUDE_CODE_MAX_OUTPUT_TOKENS → native API max_tokens path, but automatic truncated-output recovery can start another generation. Whole-Gateway-turn budget semantics and the effect of --max-turns 1 are unproven; a simple environment assignment cannot yet qualify Messages.

Cursor 2026.09.28-64d2043's current AgentService/Run descriptors and actual CLI request construction expose no evidenced output-budget field/parameter ID. Generic string parameters do not prove an enforcement contract. desired_max_tokens belongs to a different legacy request type and cannot be transplanted into Run. This is a version-specific bounded finding, not a claim that hidden service support is impossible.

Messages stays explicitly unsupported until a genuine mapping and bounded capture/runtime proof exist. Context limits, monetary/turn limits, prompt instructions and estimated local token cutoffs are not substitutes. This technical gap remains separate from Claude inference permission and Windows qualification; no acceptance issue closes.