Read the Codex outcome from events instead of waiting for it

The previous version polled for Codex's thumbs-up, which held an Actions runner
for up to fifteen minutes on every pull request Claude approved. The reaction
turned out to be redundant: the clean path leaves a pull request comment too,
so every outcome Codex has been observed to produce leaves either a review or a
comment -- and both are workflow triggers.

So the watching moves to its own event-driven workflow and the wait disappears.

  found issues   review          -> reviewed it and left findings
  clean          comment         -> reviewed it and found nothing
  never ran      comment (quota) -> could not run

Only the quota notice is matched on its text; anything else Codex says counts
as having responded. That errs toward releasing the hold, which is the right
direction when the hold is timing-only -- it never changes what is required to
merge, so waiting too long costs more than releasing early.

The handoff is conditional, and a handoff that doesn't happen leaves Codex
nothing to respond to, so the review workflow now reports that case itself,
immediately. Silence is what makes an agent undeclarable.

Not covered: Codex being triggered and then saying nothing at all, which has
not been observed across 100 measured runs. Covering it would mean holding a
runner open again.

Author: davegaeddert

.github/workflows/claude-code-review.yml

@@ -99,82 +99,21 @@ jobs:
             echo "Claude review state: ${state:-<none>} — not handing off to Codex."
             exit 0
           fi
-          # Recorded before the trigger so the watcher below only counts what
-          # Codex does in RESPONSE to it -- a review or a quota notice left on
-          # an earlier commit must not be read as this run's outcome.
-          echo "since=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
-          comment_id=$(gh api "repos/$REPO/issues/$PR/comments" \
-            -f body="@codex review" --jq .id)
-          echo "comment_id=$comment_id" >> "$GITHUB_OUTPUT"
-          echo "Triggered Codex (comment $comment_id)"
+          gh pr comment "$PR" -R "$REPO" --body "@codex review"
 
-      # ADAPTER: turn whatever Codex did into a submitted review.
-      #
-      # Codex cannot be named as a PullApprove agent directly. It emits no check
-      # run at all, and signals a clean result with a 👍 reaction rather than a
-      # review, so there is nothing for PullApprove to read. This step watches
-      # those native signals and submits a review under this workflow's own
-      # identity -- so the account to declare in CODEREVIEW.toml is
-      # github-actions[bot], not Codex's.
-      #
-      # It reports on EVERY path, including "Codex never ran". That is the whole
-      # point: a declared agent that sometimes stays silent holds human review
-      # requests forever, which is worse than not declaring it. Roughly a third
-      # of Codex runs never execute at all (quota), and the handoff above is
-      # itself conditional -- so silence is the common case, not the edge case.
-      #
-      # `!cancelled()` rather than `always()`: a run superseded by a new push
-      # should leave the reporting to its replacement.
-      - name: Report the Codex outcome
-        if: ${{ !cancelled() && steps.pr.outputs.fork == 'false' }}
+      # When the handoff doesn't happen, Codex leaves nothing behind, so
+      # codex-outcome.yml never fires and the account that workflow reports as
+      # would stay silent on this pull request. A declared agent that sometimes
+      # stays silent holds human review requests forever -- so say so here
+      # instead, immediately and without waiting on anything.
+      - name: Report a skipped Codex handoff
+        if: ${{ !cancelled() && steps.codex.outputs.skipped != '' }}
         env:
           GH_TOKEN: ${{ github.token }}
           PR: ${{ github.event.pull_request.number || github.event.issue.number || inputs.pr_number }}
           REPO: ${{ github.repository }}
-          CODEX: "chatgpt-codex-connector[bot]"
-          COMMENT_ID: ${{ steps.codex.outputs.comment_id }}
-          SINCE: ${{ steps.codex.outputs.since }}
-          SKIPPED: ${{ steps.codex.outputs.skipped }}
-          TIMEOUT_SECONDS: "900"
+          REASON: ${{ steps.codex.outputs.skipped }}
         run: |
-          report() {
-            echo "Reporting: $1"
-            gh pr review "$PR" -R "$REPO" --comment --body "Codex second opinion — $1"
-            exit 0
-          }
-
-          [ -n "$SKIPPED" ] && report "not run: $SKIPPED."
-          [ -z "$COMMENT_ID" ] && report "not run: the review step did not finish."
-
-          deadline=$(( $(date +%s) + TIMEOUT_SECONDS ))
-          while [ "$(date +%s)" -lt "$deadline" ]; do
-            # Findings: Codex submits a review (always COMMENTED, never a
-            # verdict), with its findings as inline comments.
-            if gh api --paginate --slurp "repos/$REPO/pulls/$PR/reviews" \
-              | jq -e --arg u "$CODEX" --arg t "$SINCE" \
-                  'add | map(select(.user.login == $u and .submitted_at > $t)) | length > 0' \
-              >/dev/null 2>&1; then
-              report "reviewed it and left findings."
-            fi
-
-            # Clean: a 👍 on the trigger comment, and no review at all. This is
-            # the outcome that makes Codex undeclarable on its own.
-            if gh api "repos/$REPO/issues/comments/$COMMENT_ID/reactions" \
-              | jq -e 'map(select(.content == "+1")) | length > 0' >/dev/null 2>&1; then
-              report "reviewed it and found nothing."
-            fi
-
-            # Never ran: it says so in a PR comment. Same channel as the clean
-            # notice, so the reaction above has to be checked first.
-            if gh api --paginate --slurp "repos/$REPO/issues/$PR/comments" \
-              | jq -e --arg u "$CODEX" --arg t "$SINCE" \
-                  'add | map(select(.user.login == $u and .created_at > $t
-                                    and (.body | test("usage limits"; "i")))) | length > 0' \
-              >/dev/null 2>&1; then
-              report "could not run (Codex usage limits reached)."
-            fi
-
-            sleep 30
-          done
+          gh pr review "$PR" -R "$REPO" --comment \
+            --body "Codex second opinion — not run: $REASON."
 
-          report "did not respond within $((TIMEOUT_SECONDS / 60)) minutes."

.github/workflows/codex-outcome.yml

@@ -0,0 +1,70 @@
+name: codex-outcome
+
+# ADAPTER: turn whatever Codex did into a submitted review.
+#
+# Codex cannot be named as a PullApprove agent directly. It emits no check run
+# at all, and its clean result is a 👍 reaction rather than a review, so there
+# is nothing for PullApprove to read. This watches what it *does* leave behind
+# and submits a review under this workflow's own identity — so the account to
+# declare in CODEREVIEW.toml is github-actions[bot], not Codex's.
+#
+# Every outcome Codex has been observed to produce leaves either a review or a
+# pull request comment, and both are workflow triggers — so this is entirely
+# event-driven. An earlier version polled for the 👍, which held an Actions
+# runner for up to fifteen minutes per pull request; the reaction turned out to
+# be redundant, because the clean path leaves a comment too.
+#
+#   found issues   review          -> reviewed it and left findings
+#   clean          comment         -> reviewed it and found nothing
+#   never ran      comment (quota) -> could not run
+#
+# Only the quota notice is matched on its text. Anything else Codex says is
+# treated as "it responded", which errs toward releasing the hold: waiting too
+# long costs the whole point of the feature, while releasing early costs
+# minutes. The `[[agents]]` hold is timing-only — it never changes what is
+# required to merge — so that is the right direction to be wrong in.
+#
+# Not covered: Codex being triggered and then saying nothing at all. That has
+# not been observed across 100 measured runs (even the quota case comments),
+# and covering it would mean going back to holding a runner open.
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review:
+    types: [submitted]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  report:
+    # Only Codex's own activity, and only on pull requests. `issue_comment`
+    # fires for plain issues too, which have no review to submit.
+    if: >-
+      (github.event_name == 'issue_comment' &&
+       github.event.issue.pull_request &&
+       github.event.comment.user.login == 'chatgpt-codex-connector[bot]') ||
+      (github.event_name == 'pull_request_review' &&
+       github.event.review.user.login == 'chatgpt-codex-connector[bot]')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Report the Codex outcome
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR: ${{ github.event.issue.number || github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
+          EVENT: ${{ github.event_name }}
+          BODY: ${{ github.event.comment.body }}
+        run: |
+          if [ "$EVENT" = "pull_request_review" ]; then
+            outcome="reviewed it and left findings."
+          elif printf '%s' "$BODY" | grep -qi "usage limits"; then
+            outcome="could not run (Codex usage limits reached)."
+          else
+            outcome="reviewed it and found nothing."
+          fi
+
+          echo "Reporting: $outcome"
+          gh pr review "$PR" -R "$REPO" --comment \
+            --body "Codex second opinion — $outcome"