Add Anthropic API inference for Planner and research

[brendan-kellam]

Chopin currently uses the channel owner's Copilot entitlement for every hosted model session. This adds AGENT_PROVIDER=anthropic so a deployment can pay for Planner and background-worker inference with its own ANTHROPIC_API_KEY, while retaining GitHub sign-in and repository authorization. Copilot remains the default.

Behavior

• Planner, document descriptions, private document analysis, and report synthesis use the pinned Copilot SDK's singular Anthropic BYOK provider. No GitHub token is supplied as the model credential in Anthropic mode; repository tools and read-only GitHub MCP retain the owner's separate GitHub authorization.
• Public research uses Anthropic's Messages API and basic web-search tool directly, with only the disclosed public query. Private material stays in separate no-web sessions. Search results must substantiate citation URLs, and the existing public HTTPS and artifact validators still apply before publication.
• Public searches observe owner revocation and job deadlines, preserve encrypted state during bounded pause_turn continuations, and limit requests, searches, response bytes, and output tokens. Provider failures, missing citations, and incomplete responses fail the job.
• Startup validates provider/key configuration. Anthropic sessions verify their selected model after agent selection, and usage logs record the runtime-reported model/token counts without prompts or credentials.
• Compose, environment examples, authentication/hosting documentation, and CI cover the new provider.

Configuration

AGENT_PROVIDER=anthropic
MODEL=claude-fable-5-1
ANTHROPIC_API_KEY=<injected server-side secret>

The Anthropic API model ID uses 5-1, rather than Copilot's 5.1. No database migration is required. The key must be provisioned through the deployment's secret manager and injected into the app; external AWS/CDK deployment changes are not part of this fork PR.

Validation

• bun test: 1,446 passed, 6 skipped (the existing opt-in PostgreSQL tests and four opt-in provider contract tests).
• bun run test:anthropic: 4 passed using the pinned CLI and local mock Anthropic endpoints, covering wire model/key routing, streaming, allowed/denied tools, terminal results, and provider authentication failure.
• bun run ci, bun run types, and bun run build: passed.
• Relative documentation links validated with exact casing.
• CI runs the provider contract tests alongside its existing PostgreSQL, browser, and Docker checks.

Limits and deployment verification

No live Anthropic key was used. The mock tests establish runtime/protocol behavior, not access to Fable 5.1 or live research quality for a deployment's account. Verify a Planner edit and a research request with the deployment key before rollout.

Copilot credit ceilings do not measure BYOK usage and are omitted in Anthropic sessions. Existing job deadlines and input/artifact bounds remain; direct public search has explicit request/search/output limits. The pinned runtime ignored its advertised provider.maxOutputTokens override in a local wire-level probe, so this PR does not expose that ineffective setting or claim a per-session dollar/token budget. Planner/private-worker token limits remain runtime-selected; deployments should configure provider-side spending limits.

---

Note

Medium Risk
Introduces a deployment-wide API key and splits model credentials from GitHub authorization on core Planner, worker, and research paths; behavior is opt-in with startup validation and broad mocked contract tests, but live rollout still needs key and spend controls verified.

Overview
Adds AGENT_PROVIDER=anthropic so self-hosted deployments can bill Planner, background workers, and related jobs through a server-side ANTHROPIC_API_KEY instead of each channel owner’s Copilot entitlement. Copilot stays the default; startup rejects unknown providers or missing keys rather than falling back.

Planner and private workers use the Copilot SDK’s Anthropic BYOK provider (no gitHubToken as the model credential). GitHub App tokens still drive repository tools and read-only GitHub MCP. Sessions verify the configured model after agent selection, log usage without prompts or keys, and omit Copilot maxAiCredits in Anthropic mode.

Public research in Anthropic mode bypasses the Copilot public-web worker and calls Anthropic’s Messages API with only the public brief and web_search_20250305, with bounded continuations, citation/provenance checks, and existing artifact validation.

CI gains bun run test:anthropic (mock contract tests). Compose, .env.example, and hosting docs document the new variables and ownership wording (“Planner owner” vs Copilot-only).

^{Reviewed by Cursor Bugbot for commit 99b0ce6. Bugbot is set up for automated code reviews on this repo. Configure here.}