Codex
Review what Codex changed.
Codex runs asynchronously and hands you a finished pull request. It is the most honest of the delivery models, because nothing about it lets you feel you have already reviewed the change. It is also the one where the agent could not ask you anything.
It could not ask you a question
An async agent working off your machine hits every ambiguity alone and resolves it alone. Those resolutions are assumptions, and assumptions do not arrive labelled — they arrive as code, usually as a new file that encodes a decision about how your system should work. The pull request looks complete because it is complete. That is not the same as being right about the things it had to guess.
What to check first
Read every new file as a decision it made without you.
Assumptions crystallise into files. A new abstraction is the agent concluding your architecture needed one, which is a judgement call it made with no access to the argument your team already had about it.
Check new dependencies before anything else.
A package added to solve a two-line problem is a permanent supply-chain decision made by something that will not maintain it. It is one line in a manifest among hundreds of changed lines, and it outlives the feature.
Read the migration, every time.
A schema change is the one thing in the pull request you cannot undo by reverting the pull request, and its blast radius includes code the analysis cannot see — other services, jobs, analytics queries.
Questions
The PR description already summarises the change. Why analyse it?
Because the description is written by the same system that wrote the code, from the same understanding, and it describes intent rather than result. A structural analysis is computed from the commits: it can disagree with the description, which is the entire reason it is worth having.
Can it run on the pull request by number?
Yes — pass the number and it resolves the base as the merge-base, which is the diff the pull request page shows. It reads git objects locally and never downloads a diff.
Does it need access to my Codex account?
No. It reads the repository and the commits. It has no knowledge of which agent produced them and no integration with any agent's account.
The method behind all of this is in how to review a pull request your AI agent wrote, and a real report on a public pull request is the output on something you can go and check.