Add experimental Grok consumer account sign-in and verified weekly usage

[HemSoft]

Add experimental Grok consumer account sign-in and verified weekly usage

Parent and priority

HemSoft/codexbar#70

P2 after native auth and account foundations. This is a planning issue, held out of automation with no-agent until its prerequisites and provider decisions are ready.

Verified gap

Grok consumer usage is implemented in iOS and absent from Windows provider registration and backlog. API spending and Cursor's Grok Bot allowance are different ledgers and cannot fill this gap.

Comparison uses iOS commit 8ebadd77becafb53342ef185202c2162ffa84bd7 and Windows commit 556322132cc60a38e061a329567c18ae84d30f20. Checked the full open and closed Windows issue list before filing. Upstream implementation is evidence of behavior, not proof of Windows or live-provider verification.

Acceptance criteria

• Add browser-guided device approval with provider polling rules, expiry, cancellation, and account verification through OIDC userinfo before securely saving a token. No cookie extraction, pasted credentials, inference, or purchase is part of connection or refresh.
• Use the verified first-party CLI consumer billing contract only after documenting the Windows client decision. Verify a current weekly unified paid period before displaying shared-pool percent and reset.
• Display Extra Usage Credits separately when supplied for verified unified billing. Never merge API/developer-team spend, monthly billing dates, product shares, or Cursor Grok Bot allowances into the consumer weekly meter.
• Handle absent, present-zero, explicit null, malformed, and conflicting usage fields separately. The narrowly supported omitted-usage zero convention requires a verified known paid plan, current unified weekly period, and no alternative usage fields, with the message No included usage reported by Grok.
• Use verified plan names for generated label suggestions only. Never overwrite custom labels or infer an entitlement from authorization, a percentage, or a balance.
• Renewal retains the verified subject. Removed or replaced accounts cannot regain old credentials or cached usage; failed persistence never establishes a connection. Disconnect describes local removal rather than remote revocation.
• Mark the integration experimental, retain unsupported/unavailable states, and record human review of the Windows client registration or permitted CLI-client use before release.

Tests and verification

Add device-flow and identity fixtures, polling denial/expiry/slow-down, token renewal and removal races, weekly eligibility, paid-plan mapping, omitted zero versus null, product fields, independent balance, expired and monthly windows, and secure persistence failures. Keep an owner-run live comparison of weekly usage/reset and credits pending until actually performed.

Boundaries

The CLI proxy is a first-party implementation contract, not a published third-party API guarantee. Do not treat HTTP 200 as sufficient success or automatically reuse an upstream CLI public client without a recorded owner decision.

Dependencies

• HemSoft/codexbar#72
• HemSoft/codexbar#73
• HemSoft/codexbar#74
• HemSoft/codexbar#75
• HemSoft/codexbar#76
• HemSoft/codexbar#77
• HemSoft/codexbar#91

Evidence

• iOS GROK-CONSUMER-CONTRACT.md
• iOS CodexBarIOS/Services/GrokDeviceAuthService.swift
• iOS CodexBarIOS/Services/GrokUsageProvider.swift
• Windows src/CodexBar.Core/Models/ProviderId.cs
• Windows src/CodexBar.App/App.xaml.cs

Validation gates

Implementation must pass dotnet build with zero warnings, dotnet format --verify-no-changes, dotnet test, and dotnet list package --vulnerable. Coverage must meet or exceed the current repository threshold using dotnet test --collect:"XPlat Code Coverage" --settings src/CodexBar.Core.Tests/coverage.runsettings; exclude generated *.g.cs and GeneratedRegex output as required by AGENTS.md. Validate changed Markdown.

[HemSoft]

Mission hard-block proof for #108.

This issue is not implemented or delivered. Its declared prerequisite chain is held on #72, #73. The dependency graph was checked against each issue body, not inferred from issue age.

Direct prerequisites: #72, #73, #74, #75, #76, #77, #91.

The missing external requirement is connected Codex review capacity for requester HemSoft. Delivery of the foundation cannot proceed without its required real current-head review. Two distinct self-service paths failed:

1. Automatic review returned an explicit account quota refusal. It was also refused on PR114 and PR115.
2. One explicit request received the same refusal. That is shared requester-capacity evidence, not a clean review of revised code.

No safe repository-code default supplies that required review. Unreviewed foundation delivery, replacing the reviewer, buying credits or waiving the policy is not authorized. Restoring connected Codex capacity is the exact next need. Any alternative policy requires explicit owner authority. Subsequent implementation remains agent work after prerequisites are delivered, not a claim that the owner must write code.

This issue stays open. The final revisit and item-by-item incomplete-run report are recorded in the mission ledger. No lifecycle-completion notification has been sent for unfinished work.