[poweruserz]

Adds .github/workflows/ai-review.yml, the caller for poweruserz/ai-review: GLM reviews every pull request head next to Codex, and a coordinator sets commit status ai-review (success, failure = findings for the Claude session, error). Same file as poweruserz/meteosfer#36, which passed the Mythos security gate.

The coordinator's issue_comment trigger runs from the default branch, so the full loop starts after this merges.

🤖 Generated with Claude Code

https://claude.ai/code/session_018sTpGTbWLyCYygSZ4GoHwv

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T08:23:39.525854Z	f7cab54	PR opened
🔒 Security Review	✅ Completed 2026-10-19T08:25:41.870320Z	f7cab54	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

GLM review

Commit f7cab54

I've analyzed the single change in this PR — the new .github/workflows/ai-review.yml integration with the external reusable workflow — against GitHub Actions semantics and the surrounding repo context. Key checks:

• Secret exposure via pull_request trigger: fork PRs never receive repo secrets (GitHub blanks them for pull_request from forks), and same-repo PR authors require push access — standard semantics for any PR-triggered workflow, and consistent with the documented threat model.
• issue_comment wake-up path (which does run from the default branch with secrets): the gate github.event.comment.user.login == 'chatgpt-codex-connector[bot]' is not spoofable — brackets are impossible in human usernames and GitHub App slugs are globally unique. The known pwn-request risk (bot commenting on a fork PR) is mitigated by the callee skipping fork PRs per the documented design; the caller side does what it can (author gate, explicit two-secret allowlist instead of inherit, least-privilege permissions).
• @​main instead of SHA pin: documented owner decision with a coherent same-trust-domain argument (the account that can push to poweruserz/ai-review can already write workflows here directly), so pinning adds no real security. Policy, not a bug.
• Expression/YAML validity: the if short-circuits for pull_request events; property access is lenient; brackets inside the quoted string are valid in a mid-string plain scalar. runner: '"ubuntu-latest"' matches the fromJSON input convention of the referenced project.
• No AGENTS.md "Code Review Rules" section covers .github/; the root rules concern app code.

All risk-bearing logic (fork skipping, checkout safety, concurrency) lives in the external reusable workflow, which this diff references deliberately and documents. I found no verifiable consequential problem: no wrong results, security hole, data loss/exposure, swallowed error, race, or unintended behavior change in this change.

VERDICT: CLEAN