docs(1b): Claude på Foundry er en TREDJE klientflate — FoundryChatClient kan ikke binde den

STATE bar påstanden «uverifisert: om FoundryChatClient kan binde en Claude-
deployment» som en bisetning. Operatøren ba om at slikt ikke får ligge. Målt mot
Microsoft Learn i stedet, og antakelsen er FALSIFISERT.

Claude-modeller solgt via Azure Marketplace kalles med Anthropics egen Messages
API på en egen endepunkt-form:

  https://<resource>.services.ai.azure.com/anthropic/v1/messages   <- Claude
  https://<resource>.services.ai.azure.com/api/projects/<project>  <- FoundryChatClient

Klienter: `anthropic`-pakka, `@anthropic-ai/foundry-sdk`, eller REST med
`anthropic-version: 2023-06-01`. Kun /v1/messages og /v1/messages/count_tokens er
eksponert på «Hosted on Azure»-versjonen. Deployment-navnet er `model`-parameteren.

Konsekvens for M1 (fase 1b), og den er en BESLUTNING, ikke en detalj:
- Microsoft-solgt modell (gpt-5-mini o.l.) -> 1b er REN KONFIG, azure-profilen
  som shippet er riktig søm, ingenting å bygge.
- Claude -> 1b krever en NY BACKEND-PROFIL i produksjonskode.

Samme klasse som notatet under «Endpoint format»: *.openai.azure.com og
*.cognitiveservices.azure.com er andre flater igjen. Tre flater, én ressurs-host.

Samme pass fanget forutsetningene som gater portalarbeidet: Marketplace-subscribe-
tillatelse, Contributor/Owner på ressursgruppa, prosjekt i støttet region, og data
retention PÅ abonnementet for Covered Models (ZDR gir 400, og Microsoft kan ikke
endre det for deg).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X737cbkG2uAXJ2Bvhf6X5M

docs/2026-07-15-foundry-auth-recipe.md

@@ -42,6 +42,41 @@ is accepted. The preflight requires `https://` + a host ending `.services.ai.azu
 **not** require the `/api/projects/` path. A `*.openai.azure.com` or `*.cognitiveservices.azure.com`
 endpoint is a **different** client surface (use `OpenAIChatClient`, not `FoundryChatClient`).
 
+## Claude models on Foundry are a THIRD client surface (measured 2026-08-13)
+
+Verified against Microsoft Learn (`microsoft_docs_search`, "Deploy and use Claude models in Microsoft
+Foundry" / "Claude models in Microsoft Foundry — API overview"), because the question came up while
+planning M1 and an assumption was cheaper to falsify than to inherit.
+
+**`FoundryChatClient` CANNOT serve a Claude deployment.** Claude models sold through the Azure
+Marketplace are called with Anthropic's own Messages API, on their own endpoint shape:
+
+```
+https://<resource>.services.ai.azure.com/anthropic/v1/messages     # Claude
+https://<resource>.services.ai.azure.com/api/projects/<project>    # FoundryChatClient
+```
+
+Clients: the `anthropic` Python package (or `@anthropic-ai/foundry-sdk`, or REST with the
+`anthropic-version: 2023-06-01` header). Only `POST /v1/messages` and `POST /v1/messages/count_tokens`
+are exposed on the *Hosted on Azure* version. The **deployment name** is what goes in the `model`
+parameter — same rule as the Foundry surface, different endpoint.
+
+**What this means for M1 (fase 1b):**
+
+- **A Microsoft-sold model** (`gpt-5-mini`, `gpt-4.1-mini`, …) → M1 is **configuration only**. The
+  `azure` profile as shipped is the right seam; nothing to build.
+- **A Claude model** → M1 needs a **NEW backend profile** (production code, `anthropic` SDK, Entra ID
+  or key auth). That is a decision to take before the portal work, not a discovery during it.
+
+This is the same class as the note under *Endpoint format*: `*.openai.azure.com` and
+`*.cognitiveservices.azure.com` are other surfaces again. Three surfaces, one resource host.
+
+**Extra prerequisites measured in the same pass** (they gate the portal work, not the code):
+Marketplace subscription permission, **Contributor or Owner on the resource group**, a project in a
+region the model supports, and — for Anthropic-designated *Covered Models* — data retention enabled
+on the subscription (zero-data-retention subscriptions get a 400 `invalid_request_error`, and
+Microsoft cannot change that setting for you).
+
 ## RBAC role
 
 Assign **`Foundry User`** (role GUID `53ca6127-db72-4b80-b1b0-d745d6d5456d`) to the identity, at the