Research mixed-provider trees through Codex CLI and Claude Code CLI

## Goal

Determine whether one CodeCanopy tree can safely route individual nodes through Codex CLI or Claude Code CLI while preserving one provider-neutral contract.

Both CLIs expose non-interactive execution modes, but that alone does not prove safe orchestration. This issue is research until the full boundary is validated.

## Questions to answer

- Can Codex invoke a bounded Claude Code node and can Claude Code invoke a bounded Codex node without sharing or rewriting credentials?
- Can each adapter accept the same request envelope and return the same structured result and proof receipt?
- How are working directory, sandbox, permission prompts, timeouts, cancellation, cost limits, and model availability represented?
- How does a project select provider and model per node while keeping the lead responsible for integration?
- What failure state is returned when a CLI, model, login, or capability is unavailable?

## Required prototype

- One mixed-provider tree with disjoint read-only or isolated write scopes.
- Explicit command and output schemas for both adapters.
- Redacted logs with no tokens, auth files, or conversation history.
- Timeouts and non-zero exit handling.
- A capability check before dispatch.
- A documented rollback path that leaves the current Codex-only adapter unchanged.

## Non-goals

- No credential broker.
- No claim that Claude models become native Codex models or vice versa.
- No persistent service until a CLI prototype proves the contract and safety boundaries.

No files or tests are named, so first inspect the repository layout for the adapter/runtime entry points that execute Codex nodes and traverse trees, then locate where request/response envelopes, execution results, and failure handling are defined. Run the current single-provider execution flow as the baseline for behavior, timeouts, and rollback behavior. Done means there is a documented mixed-provider prototype with bounded nodes, explicit adapter schemas, timeout/non-zero-exit handling, capability checks, redacted logs, and a clear rollback path to Codex-only behavior.

索引モデルが issue の本文から書いたものです。