Pilot xAI subscription OAuth with CodexHub-specific approval #94

Part of #71.

Outcome

Pilot xAI subscription OAuth only after xAI documents or approves a CodexHub-specific client registration, redirect policy, scopes, and subscription API entitlement.

External gate

Do not implement or enable this pilot until written xAI authorization or public documentation covers CodexHub's product flow. Do not reuse OpenCode's, Grok CLI's, or another application's public client ID.

Scope after approval

• Implement the xAI Provider auth driver using the shared OAuth and credential boundaries.
• Verify authorization, refresh, revocation, entitlement, account switching, and failure recovery.
• Ship disabled by default until compatibility and security evidence is reviewed.

Acceptance criteria

• CodexHub-specific client identity, redirect URI, scopes, and subscription entitlement are documented.
• No third-party allowlisted client identity is reused.
• Tokens remain backend-only and protected by the OS secret store.
• Login, refresh, revoke, re-auth, account switching, and failure paths are tested.
• The maintainer records GO, PARTIAL, or NO-GO before enablement.

Required verification

• Provider contract and security tests.
• Sanitized real-account evidence after approval.
• Explicit disabled/unavailable behavior before approval.