# AI providers — Codex & Antigravity.

Turn on AI providers and team.management brings Codex and Antigravity in alongside Claude as parallel collaborators at six decision points in the workflow. They run through the `codex` and `agy` CLIs — your existing subscriptions, no extra API keys — each reading the repo read-only in its own sandbox.

## The six phases

| Phase                  | Config flag                       | What the provider does                                                 |
| ---------------------- | --------------------------------- | ---------------------------------------------------------------------- |
| `code_review`          | `include_in_code_review`          | Parallel security/quality review of the diff, at the code-review gate. |
| `brainstorm`           | `include_in_brainstorm`           | Analysis alongside the six specialist agents.                          |
| `investigation`        | `include_in_investigation`        | Independent reading of task scope and risks.                           |
| `implementation`       | `include_in_implementation`       | Plan review before code is written.                                    |
| `research_exploration` | `include_in_research_exploration` | Independent exploration of the research question.                      |
| `refactoring_planning` | `include_in_refactoring_planning` | Review of the refactoring plan.                                        |

## How the providers run

team.management runs each enabled provider as a parallel Task agent — not an MCP server — dispatched in the same message as Claude’s own agent for that phase. Output is advisory: a provider failure degrades gracefully and never blocks the workflow. Claude’s pass always runs; the others are additive.

Enable providers globally with `ai_providers.enabled_providers` (e.g. `["codex", "agy"]`), then turn participation on per phase with the `include_in_*` flags — so you can run Codex on code-review only, or Antigravity everywhere. The wrappers enforce a fixed call deadline — codex 300 s, agy 330 s watchdog (the `ai_providers.timeout` config key is currently inert). See the [protocols](https://team.management/protocols.md) for where each phase sits.

## Credentials never leave the box

Before team.management injects a task description into any provider prompt, it passes through a credential filter — 17 named regex patterns (API keys, PEM blocks, bearer tokens, connection strings, `.env` contents) matched line-by-line. The first match wins; the whole line is replaced with `[REDACTED:<reason>]`. It’s defense-in-depth for the task-description channel — the codebase itself is read by the provider’s own read-only CLI sandbox.

## Custom prompt templates

Five of the six phases (everything except `code_review`) load their provider prompt from a markdown file, so you can tune it per project without touching code. Drop a `<provider>-<phase>.md` in `custom/providers/` (phase names hyphenated — e.g. `codex-investigation.md`, `agy-refactoring-planning.md`). A missing template is non-fatal: the engine falls back to its inline default and warns.

These variables are available to a template:

| Variable           | Resolves to                                                   |
| ------------------ | ------------------------------------------------------------- |
| `{task_name}`      | The active task's name.                                       |
| `{branch}`         | The task's git branch.                                        |
| `{task_file_path}` | Path to the task markdown file.                               |
| `{phase}`          | Human-readable phase name (e.g. “task investigation”).        |
| `{plan_summary}`   | The full task markdown, credential-filtered before injection. |

Legacy keys. `include_in_architecture`, `include_in_exploration`, and the old `gemini.*` provider keys (e.g. `gemini.default_model`) are deprecated — Antigravity is configured under `agy.*` now. Their values are never auto-forwarded — session-start emits a one-time warning when they appear so you can migrate deliberately.

## Choosing what to run them on

Which provider you enable is partly a question of what you already pay for. We keep dated side-by-side pages on that: [Claude Code and Codex](https://team.management/compare/claude-code-vs-codex.md), [Antigravity and Claude Code](https://team.management/compare/antigravity-vs-claude-code.md), and the [subscription tiers](https://team.management/compare/ai-coding-subscriptions.md) across all of them.

None of it changes how the engine behaves. The protocol runs the same steps and the same gates whichever models sit behind them — that is the point of keeping the process outside the model.