Provider registry M2+M3: claude-code and codex Strict backends

[tzhouam]

Part of #80 (RFC — provider registry). Completes the declared backends: M2 claude-code and M3 codex, plus the tool bridge now serving the on-demand repo_map and a doc_search output fix. Follows #81 (M1: registry + tool bridge + cursor).

claude-code (M2) — live-verified on subscription auth

Headless claude -p --output-format json: iteration budget → --max-turns, our step contract replaces the vendor system prompt (--system-prompt + --exclude-dynamic-system-prompt-sections), prompt on stdin. Governance is fully preventive — built-ins denied wholesale (--disallowedTools) and only the MCP bridge allowed (--mcp-config + --strict-mcp-config + --allowedTools mcp__infermatrix-tools), so every tool call flows through tools.dispatch; per-session cost and served model come from the CLI's JSON result.

Live e2e (Strict review of vllm-omni#6175 through the real thin-server → reserved-subprocess flow): the light pass found nothing on the 1-line PR, the zero-yield escalation kicked in, and the 2-lens standard ensemble ran entirely on the harness — 3 sessions (17/18/24 turns), claude-fable-5 served, ~$2.0–2.7/session tracked, 53/53 tool calls bridged (grep×20, list_dir×17, read_file×16 in bridge_trace.jsonl), zero native tools. The review validated the pytest import-mode mechanism and found a second broken importer beyond the PR description. Run: run-20260814-181055-4df62f.

codex (M3) — offline-tested; readiness gate live-verified

codex exec --json -s read-only --skip-git-repo-check, bridge wired purely via -c mcp_servers.* config overrides (nothing written into the session tree), prompt on stdin. The read-only sandbox is the preventive layer for writes/network; broad sandbox reads are a documented limitation of this backend class. The dev machine has no ChatGPT login, so the transport is exercised offline against recorded codex-cli 0.145.0 event shapes, and the new auth_gap() check makes the live behavior honest:

Strict mode is not ready: codex CLI is not logged in — run: codex login (ChatGPT subscription auth) — verified live through the thin server, refused before any run is reserved.

Also in this PR

• sanitized_env() shared in providers/base.py (cursor now uses it too); auth_gap() on the transport contract, wired into strict_readiness and doctor (cursor + codex implement it).
• Tool bridge serves repo_map (rebuilt from the bridge spec via the same runtime factory, dispatched with the in-process extra-tool semantics) and resolves the repo knowledge slice through the adapter manifest; fixed doc_search printing a nonexistent hit field. Still in-process-only: skill_search/memory_search (cross-process candidate writes deliberately not opened).
• Registry: all four ids resolve transports; the _UNSHIPPED milestone mechanism is kept (empty) for future backends.

Verification

• Full offline suite green — 9 new tests for claude-code (fake CLI mirroring the live-probed JSON contract: flags, env sanitization, bridge-trace delta accounting, timeout, tool-less one-shots) and codex (JSONL parse, sandbox/MCP flags, auth-gap, timeout), plus updated registry/readiness tests.
• ruff check clean on all new/authored code.
• Live e2e as above; api and cursor backends were live-verified in Provider registry: subscription-auth harness backends; cursor-agent Strict backend (M1) #81's e2e round and are untouched by this change apart from the shared env helper (their tests pass unchanged).

🤖 Generated with Claude Code