Adopt Foundation Models framework for AI config repair (on-device + Claude via LanguageModel protocol)

[malpern]

Post-1.0. Not for the 1.0 launch. From the WWDC 2026 review — see docs/wwdc-2026-macos-27-opportunities.md (PR #911), opportunity #1 (highest reward).

Why

The biggest UX barrier to the AI repair feature is "bring your own Anthropic API key" (Keychain plumbing, APIKeyValidator, biometric gate, AICostTracker). macOS 27's Foundation Models v2 changes the calculus:

• The on-device model can likely handle simple Kanata syntax repairs free, offline, with zero key setup.
• The new public LanguageModel protocol drives on-device, Apple Private Cloud Compute, or third-party cloud models (Claude) through one Swift API — Claude stays as the escalation path.
• The free Private Cloud Compute tier may eliminate user-borne cost entirely. Eligibility is tied to the Small Business Program — verify this applies to a non-App-Store Developer ID app.

Plan

1. Stage now (macOS 15-safe): extract a ConfigRepairModel protocol; make AnthropicConfigRepairService (Sources/KeyPathAppKit/Services/AI/) one implementation. Pure refactor, no behavior change.
2. Against the betas: add a FoundationModels-backed implementation gated if #available(macOS 27, *) — same pattern as LiquidGlassSupport.swift.
3. Tiered routing: on-device first for simple repairs, cloud (Claude) for hard cases. URLSession path remains the macOS 15–26 fallback.
4. Depends on the eval corpus (see Evaluations framework issue) to decide routing confidently.

https://claude.ai/code/session_01Nsiqm39oCwHkbrHytefnGM