[TheGreatAxios]

Summary

• packages/codex-provider and packages/xai-provider port the upstream corbitsdev provider repos into private in-repo workspace packages (the ollama-adapter precedent): sources byte-identical to upstream except report-error-ignore annotations on the two deliberate degrade-by-contract catches, with all 14 upstream unit tests ported unchanged.
• Dependencies resolve through the pinned corbitsdev tags (@corbits/oauth-core#v0.1.1, @corbits/openai-responses#v0.1.0) plus workspace:* @intx/* and catalog arktype; upstream publish metadata and install instructions are dropped.
• The CodexQuirks-absent failure is pinned as a CodexQuirksError (instance-of asserted, not just toThrow), so a codex source missing productName/environmentTagName fails loudly at adapter resolution.
• tsconfig.build.json gains the two generated project references; the root workspaces glob picks up both packages.

Verification

• bun run check exits 0 (typecheck, lint, full test matrix, structural checks incl. tsconfig-references --check, catalog-pins, licenses, report-error).
• bun test packages/codex-provider packages/xai-provider: 14 pass / 0 fail.
• git grep proves zero references to the upstream provider repo URLs; the only github: deps are the two pinned corbitsdev tags.
• Independent review compared every ported file against the upstream sources (byte-identical modulo annotations) and mutation-tested the quirks assertion; returned clean.

Closes CL-7509

[linear-code]

CL-7509

[TheGreatAxios]

Self-review (code-review skill) returned clean. Reviewer-of-record checks (commit subject/body style audits, diff-stat binary scan, commit-scope check) ran in-session on the final history; the deeper behavioral read — including a byte-level port-fidelity comparison against both upstream sources and a mutation test of the quirks assertion — ran as an independent review round and returned clean.