diff --git a/.github/scripts/codex-review.cjs b/.github/scripts/codex-review.cjs
new file mode 100644
index 00000000..0cf85940
--- /dev/null
+++ b/.github/scripts/codex-review.cjs
@@ -0,0 +1,192 @@
+'use strict';
+
+const CONTEXT = 'codex-review';
+const EVIDENCE = 'codex-review-evidence';
+const MAINTAINER_ID = 8227352;
+const CODEX = 'chatgpt-codex-connector[bot]';
+
+// Only a structured result from the connected app can satisfy the ordinary gate.
+function codexVerdict(comments, head) {
+  const summaries = comments.filter(comment => comment.user?.login === CODEX && comment.user?.type === 'Bot')
+    .sort((a, b) => Date.parse(b.updated_at) - Date.parse(a.updated_at));
+  for (const comment of summaries) {
+    if (!comment.body?.includes('<!-- codex-review-state:v1')) continue;
+    const malformed = { state: 'failure', description: 'The latest Codex summary is malformed' };
+    const match = comment.body.match(/<!-- codex-review-state:v1 (\{[^\n]*\}) -->/);
+    if (!match) return malformed;
+    let review;
+    try { review = JSON.parse(match[1]).code_review; } catch { return malformed; }
+    if (!review || typeof review.commit_sha !== 'string') return malformed;
+    if (review.commit_sha !== head) continue;
+    if (review.status !== 'completed') return { state: 'pending', description: 'Current-head Codex review is running' };
+    if (review.has_any_findings === false && review.has_unresolved_findings === false) {
+      return { state: 'success', description: 'Codex reviewed this exact head with no findings', target_url: comment.html_url };
+    }
+    return { state: 'failure', description: 'Codex findings or an incomplete verdict need attention', target_url: comment.html_url };
+  }
+  return { state: 'pending', description: 'A clean Codex review of this exact head is required' };
+}
+
+// A maintainer-published cross-model review is the documented alternative when
+// connected Codex is unavailable. It is review evidence, never a bypass flag.
+function fallbackReceipt(review, head) {
+  if (review.user?.id !== MAINTAINER_ID || review.user?.type !== 'User' ||
+      review.commit_id !== head || review.state !== 'COMMENTED') return false;
+  const match = review.body?.match(/^<!-- codexbar-review-fallback:v1 (\{[^\n]*\}) -->/);
+  if (!match) return false;
+  try {
+    const receipt = JSON.parse(match[1]);
+    return receipt.head === head && receipt.clean === true && receipt.provider === 'claude' &&
+      receipt.model === 'claude-opus-5-5' && ['hung', 'unavailable'].includes(receipt.codex);
+  } catch { return false; }
+}
+
+function eligibleEvent(context) {
+  if (context.eventName === 'issue_comment') {
+    const comment = context.payload.comment;
+    return !!context.payload.issue?.pull_request && comment?.user?.login === CODEX &&
+      comment.user.type === 'Bot';
+  }
+  if (context.eventName === 'pull_request_review') return context.payload.review?.user?.id === MAINTAINER_ID;
+  return true;
+}
+
+function triggerIncluded(context, comments, reviews) {
+  const event = context.payload;
+  const comment = event.comment;
+  if (comment?.user?.login === CODEX && comment.user.type === 'Bot') {
+    const actual = comments.find(item => item.id === comment.id);
+    if (event.action === 'deleted') return !actual;
+    if (!actual) return false;
+    if (Date.parse(actual.updated_at) > Date.parse(comment.updated_at)) return true;
+    return actual.updated_at === comment.updated_at && actual.body === comment.body;
+  }
+  const review = event.review;
+  if (review?.user?.id === MAINTAINER_ID) {
+    const actual = reviews.find(item => item.id === review.id);
+    return actual?.body === review.body && actual?.state.toUpperCase() === review.state.toUpperCase();
+  }
+  return true;
+}
+
+async function snapshot(github, owner, repo, number) {
+  const comments = await github.paginate(github.rest.issues.listComments, { owner, repo, issue_number: number, per_page: 100 });
+  const reviews = await github.paginate(github.rest.pulls.listReviews, { owner, repo, pull_number: number, per_page: 100 });
+  for (const comment of comments.filter(item => item.user?.login === CODEX && item.user?.type === 'Bot')) {
+    const { node } = await github.graphql(`query($id: ID!) { node(id: $id) { ... on IssueComment {
+      body updatedAt lastEditedAt author { login __typename } editor { login __typename }
+    } } }`, { id: comment.node_id });
+    const bot = actor => actor?.__typename === 'Bot' && actor.login === 'chatgpt-codex-connector';
+    comment.authenticated = !!node && bot(node.author) &&
+      (node.lastEditedAt ? bot(node.editor) : node.editor === null) &&
+      node.body === comment.body && node.updatedAt === comment.updated_at;
+  }
+  return { comments, reviews };
+}
+
+// Compare all mutable fields that can affect the decision, including deletion
+// and later maintainer reviews. Ordinary conversation cannot invalidate it.
+function fingerprint({ comments, reviews }) {
+  return JSON.stringify({
+    comments: comments.filter(item => item.user?.login === CODEX).map(item =>
+      [item.id, item.user, item.updated_at, item.body, item.authenticated]),
+    reviews: reviews.filter(item => item.user?.id === MAINTAINER_ID).map(item =>
+      [item.id, item.user, item.commit_id, item.state, item.body])
+  });
+}
+
+// A head-bound, Actions-authored watermark survives deletion and later dispatches.
+// A tamper/deletion latch clears only after a newer authenticated bot update.
+async function evidenceVerdict(github, owner, repo, head, context, evidence) {
+  const statuses = await github.paginate(github.rest.repos.listCommitStatusesForRef,
+    { owner, repo, ref: head, per_page: 100 });
+  const prior = statuses.find(item => item.context === EVIDENCE &&
+    item.creator?.login === 'github-actions[bot]' && item.creator?.type === 'Bot');
+  let watermark;
+  if (prior) {
+    try { watermark = JSON.parse(prior.description); } catch { throw new Error('Invalid review evidence watermark'); }
+    if (!Number.isSafeInteger(watermark.id) || !Number.isFinite(Date.parse(watermark.at))) {
+      throw new Error('Invalid review evidence watermark');
+    }
+  }
+  const summaries = evidence.comments.filter(item => item.user?.login === CODEX &&
+    (item.body?.includes('<!-- codex-review-state:v1') || item.id === watermark?.id))
+    .sort((a, b) => Date.parse(b.updated_at) - Date.parse(a.updated_at));
+  const latest = summaries[0];
+  const deleted = context.eventName === 'issue_comment' && context.payload.action === 'deleted' &&
+    (context.payload.comment.body?.includes('<!-- codex-review-state:v1') || context.payload.comment.id === watermark?.id);
+  const tampered = latest && (!latest.authenticated || !latest.body?.includes('<!-- codex-review-state:v1'));
+  const vanished = watermark && !evidence.comments.some(item => item.id === watermark.id) &&
+    (!latest || Date.parse(latest.updated_at) <= Date.parse(watermark.at));
+  const stale = watermark && latest && Date.parse(latest.updated_at) < Date.parse(watermark.at);
+  const latched = watermark && prior.state === 'failure' &&
+    (!latest || Date.parse(latest.updated_at) <= Date.parse(watermark.at));
+  if (deleted || tampered || vanished || stale || latched) {
+    // Preserve an existing latch timestamp on refresh, so a future legitimate
+    // bot update can recover without a human resetting or bypassing the gate.
+    const record = prior?.state === 'failure' ? watermark : {
+      id: context.payload.comment?.id ?? watermark?.id ?? latest.id, at: new Date().toISOString()
+    };
+    await github.rest.repos.createCommitStatus({ owner, repo, sha: head, context: EVIDENCE,
+      state: 'failure', description: JSON.stringify(record) });
+    return { state: 'failure', description: 'Review evidence was deleted, edited by another actor, or is stale' };
+  }
+  if (latest) {
+    await github.rest.repos.createCommitStatus({ owner, repo, sha: head, context: EVIDENCE,
+      state: 'success', description: JSON.stringify({ id: latest.id, at: latest.updated_at }) });
+  }
+  return codexVerdict(evidence.comments, head);
+}
+
+// Explicitly copy the repo getter; spreading Actions Context drops it.
+function workflowRunContext(context, number) {
+  return { ...context, repo: context.repo, payload: { pull_request: { number } } };
+}
+
+async function run({ github, context, core }) {
+  if (!eligibleEvent(context)) return;
+  const { owner, repo } = context.repo;
+  const number = context.payload.pull_request?.number ?? context.payload.issue?.number ?? Number(context.payload.inputs?.number);
+  if (!Number.isSafeInteger(number) || number <= 0) throw new Error('A pull request number is required');
+  const { data: pr } = await github.rest.pulls.get({ owner, repo, pull_number: number });
+  if (pr.state !== 'open' || pr.base.ref !== 'main') return;
+  const head = pr.head.sha;
+  const merge = pr.merge_commit_sha;
+  const shas = [...new Set([merge, head].filter(Boolean))];
+  const publish = async verdict => {
+    for (const sha of shas) {
+      await github.rest.repos.createCommitStatus({ owner, repo, sha, context: CONTEXT, ...verdict });
+    }
+  };
+  // Revoke previous success before reading mutable evidence. An API failure
+  // therefore leaves the gate pending rather than retaining cached consent.
+  await publish({ state: 'pending', description: 'Revalidating current-head review evidence' });
+  const first = await snapshot(github, owner, repo, number);
+  let verdict = { state: 'pending', description: 'Review evidence has not been validated' };
+  const latest = first.reviews.filter(review => review.user?.id === MAINTAINER_ID && review.commit_id === head).at(-1);
+  const fallback = latest && fallbackReceipt(latest, head) ? latest : null;
+  const fresh = await snapshot(github, owner, repo, number);
+  const unchanged = triggerIncluded(context, fresh.comments, fresh.reviews) && fingerprint(first) === fingerprint(fresh);
+  if (!unchanged) {
+    verdict = { state: 'pending', description: 'Review evidence changed; a fresh event must revalidate it' };
+  } else {
+    verdict = await evidenceVerdict(github, owner, repo, head, context, fresh);
+  }
+  if (unchanged && fallback && verdict.state === 'pending') {
+    const { data: permission } = await github.rest.repos.getCollaboratorPermissionLevel({ owner, repo, username: fallback.user.login });
+    if (['admin', 'maintain'].includes(permission.permission)) {
+      verdict = { state: 'success', description: 'Clean current-head Claude Opus fallback review', target_url: fallback.html_url };
+    }
+  }
+  if (!merge) verdict = { state: 'pending', description: 'Waiting for GitHub to compute the test merge commit' };
+  // Head evidence stays bound to the corresponding test merge revision.
+  const { data: live } = await github.rest.pulls.get({ owner, repo, pull_number: number });
+  if (live.state !== 'open' || live.head.sha !== head || live.merge_commit_sha !== merge) {
+    core.info('Head or test merge changed; no final verdict was published');
+    return;
+  }
+  await publish(verdict);
+  core.info(`${CONTEXT} ${head} / ${merge}: ${verdict.state}`);
+}
+
+module.exports = { codexVerdict, fallbackReceipt, eligibleEvent, triggerIncluded, workflowRunContext, run };
diff --git a/.github/scripts/codex-review.test.cjs b/.github/scripts/codex-review.test.cjs
new file mode 100644
index 00000000..4dc50076
--- /dev/null
+++ b/.github/scripts/codex-review.test.cjs
@@ -0,0 +1,175 @@
+'use strict';
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const { codexVerdict, fallbackReceipt, eligibleEvent, triggerIncluded, workflowRunContext, run } = require('./codex-review.cjs');
+const head = 'a'.repeat(40);
+const clean = { commit_sha: head, status: 'completed', has_any_findings: false, has_unresolved_findings: false };
+const summary = (result, user = { login: 'chatgpt-codex-connector[bot]', type: 'Bot' }) => ({
+  id: 42, node_id: 'comment42', user, body: `<!-- codex-review-state:v1 ${JSON.stringify({ code_review: result })} -->`, updated_at: '2026-10-22', html_url: 'https://github.com/review'
+});
+
+test('only a completed clean bot verdict for the exact head passes', () => {
+  assert.equal(codexVerdict([summary(clean)], head).state, 'success');
+  for (const result of [ { ...clean, commit_sha: 'b'.repeat(40) }, { ...clean, status: 'running' },
+    { ...clean, has_any_findings: true }, { ...clean, has_unresolved_findings: true },
+    { ...clean, has_any_findings: null }, { ...clean, has_unresolved_findings: undefined } ]) {
+    assert.notEqual(codexVerdict([summary(result)], head).state, 'success');
+  }
+  assert.equal(codexVerdict([], head).state, 'pending');
+  assert.equal(codexVerdict([summary(clean, { login: 'someone', type: 'User' })], head).state, 'pending');
+  assert.equal(codexVerdict([summary(clean, { login: 'chatgpt-codex-connector[bot]', type: 'User' })], head).state, 'pending');
+  assert.equal(codexVerdict([{ ...summary(clean), body: '<!-- codex-review-state:v1 {broken} -->' }], head).state, 'failure');
+});
+
+test('a later running or failed result replaces an earlier clean result', () => {
+  const later = { ...summary({ ...clean, status: 'running' }), updated_at: '2026-10-23' };
+  assert.equal(codexVerdict([summary(clean), later], head).state, 'pending');
+});
+
+const receipt = { head, clean: true, provider: 'claude', model: 'claude-opus-5-5', codex: 'hung' };
+const fallback = { user: { id: 8227352, login: 'HemSoft', type: 'User' }, commit_id: head, state: 'COMMENTED',
+  body: `<!-- codexbar-review-fallback:v1 ${JSON.stringify(receipt)} -->`, html_url: 'https://github.com/fallback' };
+test('fallback requires the named maintainer, exact head, model and explicit clean receipt', () => {
+  assert.equal(fallbackReceipt(fallback, head), true);
+  for (const change of [{ commit_id: 'b'.repeat(40) }, { state: 'CHANGES_REQUESTED' },
+    { user: { login: 'someone', type: 'User' } }, { body: 'clean' },
+    { body: `<!-- codexbar-review-fallback:v1 ${JSON.stringify({ ...receipt, clean: false })} -->` }]) {
+    assert.equal(fallbackReceipt({ ...fallback, ...change }, head), false);
+  }
+});
+
+const merge = 'c'.repeat(40);
+function client({ moved = false, mergeMoved = false, reviews = [], comments = [],
+  freshComments = comments, freshReviews = reviews, permission = 'admin', priorStatuses = [], statusError, payload = { pull_request: { number: 1 } } } = {}) {
+  const statuses = []; let reads = 0; let commentReads = 0; let reviewReads = 0;
+  const github = { graphql: async (_query, { id }) => {
+    const comment = [...freshComments, ...comments].find(item => item.node_id === id);
+    return { node: comment ? { body: comment.body, updatedAt: comment.updated_at,
+      author: { login: 'chatgpt-codex-connector', __typename: 'Bot' },
+      lastEditedAt: comment.editedAt ?? null, editor: comment.editor ?? null } : null };
+  }, paginate: async method => method(), rest: {
+    pulls: { get: async () => {
+      const later = reads++ > 0;
+      return { data: { state: 'open', base: { ref: 'main' }, head: { sha: moved && later ? 'b'.repeat(40) : head },
+        merge_commit_sha: mergeMoved && later ? 'd'.repeat(40) : merge } };
+    }, listReviews: async () => reviewReads++ ? freshReviews : reviews },
+    issues: { listComments: async () => commentReads++ ? freshComments : comments },
+    repos: { listCommitStatusesForRef: async () => priorStatuses, createCommitStatus: async value => {
+      if (statusError?.(value)) throw new Error('status write failed');
+      statuses.push(value);
+    }, getCollaboratorPermissionLevel: async () => ({ data: { permission } }) }
+  } };
+  return { github, statuses, context: { repo: { owner: 'hemsoft-dev', repo: 'codexbar' }, payload }, core: { info() {} } };
+}
+const result = fixture => fixture.statuses.at(-1).state;
+
+test('a concurrent head or merge change cannot publish success', async () => {
+  for (const change of [{ moved: true }, { mergeMoved: true }]) {
+    const fixture = client({ ...change, comments: [summary(clean)] }); await run(fixture);
+    const gates = fixture.statuses.filter(item => item.context === 'codex-review');
+    assert.equal(gates.length, 2);
+    assert.ok(gates.every(status => status.state === 'pending'));
+  }
+});
+test('missing evidence publishes pending on both head and test merge', async () => {
+  const fixture = client(); await run(fixture);
+  assert.deepEqual(fixture.statuses.slice(-2).map(status => status.sha), [merge, head]);
+  assert.equal(result(fixture), 'pending');
+});
+test('clean review publishes success on head and test merge', async () => {
+  const fixture = client({ comments: [summary(clean)] }); await run(fixture);
+  assert.deepEqual(fixture.statuses.slice(-2).map(status => [status.sha, status.state]), [[merge, 'success'], [head, 'success']]);
+});
+test('fallback also verifies live maintainer permission', async () => {
+  const allowed = client({ reviews: [fallback] }); await run(allowed); assert.equal(result(allowed), 'success');
+  const refused = client({ reviews: [fallback], permission: 'write' }); await run(refused); assert.equal(result(refused), 'pending');
+});
+test('fallback cannot hide Codex findings or a later non-clean maintainer review', async () => {
+  const findings = client({ reviews: [fallback], comments: [summary({ ...clean, has_any_findings: true })] });
+  await run(findings); assert.equal(result(findings), 'failure');
+  const later = client({ reviews: [fallback, { ...fallback, body: 'P2: fix this' }] });
+  await run(later); assert.equal(result(later), 'pending');
+});
+test('the maintainer may rename without trusting an unrelated account with the old login', () => {
+  assert.equal(fallbackReceipt({ ...fallback, user: { ...fallback.user, login: 'renamed' } }, head), true);
+  assert.equal(fallbackReceipt({ ...fallback, user: { ...fallback.user, id: 1 } }, head), false);
+});
+test('summary or fallback mutation or deletion before publication leaves pending', async () => {
+  for (const freshComments of [[], [summary({ ...clean, status: 'running' })], [summary({ ...clean, has_any_findings: true })]]) {
+    const fixture = client({ comments: [summary(clean)], freshComments }); await run(fixture);
+    assert.equal(result(fixture), 'pending');
+  }
+  for (const freshReviews of [[], [{ ...fallback, body: 'findings' }]]) {
+    const fixture = client({ reviews: [fallback], freshReviews }); await run(fixture);
+    assert.equal(result(fixture), 'pending');
+  }
+});
+test('a stale API snapshot cannot ignore the triggering edit or deletion', async () => {
+  const old = { ...summary(clean), id: 42 };
+  const edited = { ...old, body: 'running', updated_at: '2026-10-23' };
+  for (const [action, comment] of [['edited', edited], ['deleted', old]]) {
+    const fixture = client({ comments: [old], payload: { issue: { number: 1 }, action, comment } });
+    await run(fixture); assert.equal(result(fixture), 'pending');
+  }
+  assert.equal(triggerIncluded({ payload: { action: 'deleted', comment: old } }, [], []), true);
+});
+
+test('a newer malformed summary cannot resurrect an older clean result', () => {
+  for (const body of ['<!-- codex-review-state:v1 {broken} -->', '<!-- codex-review-state:v1 {} -->',
+    '<!-- codex-review-state:v1 {"code_review":null} -->', '<!-- codex-review-state:v1 truncated']) {
+    assert.equal(codexVerdict([summary(clean), { ...summary(clean), body, updated_at: '2026-10-24' }], head).state, 'failure');
+  }
+});
+test('unrelated comments and reviews cannot revoke a clean gate', async () => {
+  for (const eventName of ['issue_comment', 'pull_request_review']) {
+    const fixture = client({ comments: [summary(clean)], payload: { issue: { number: 1, pull_request: {} },
+      comment: { user: { login: 'guest', type: 'User' }, body: 'ordinary conversation' },
+      review: { user: { id: 1 } } } });
+    fixture.context.eventName = eventName;
+    await run(fixture); assert.equal(fixture.statuses.length, 0);
+  }
+  assert.equal(eligibleEvent({ eventName: 'issue_comment', payload: { issue: { pull_request: {} }, comment: summary(clean) } }), true);
+});
+
+const watermark = (id, at, state = 'success') => ({ context: 'codex-review-evidence', state,
+  creator: { login: 'github-actions[bot]', type: 'Bot' }, description: JSON.stringify({ id, at }) });
+test('a collaborator edit is not trusted on either an event or manual refresh', async () => {
+  for (const eventName of ['issue_comment', 'workflow_dispatch']) {
+    const forged = { ...summary(clean), editedAt: '2026-10-22', editor: { login: 'writer', __typename: 'User' } };
+    const fixture = client({ comments: [forged], payload: { issue: { number: 1, pull_request: {} }, comment: forged, action: 'edited' } });
+    fixture.context.eventName = eventName;
+    await run(fixture); assert.equal(result(fixture), 'failure');
+  }
+  const restored = { ...summary(clean), editedAt: '2026-10-22', editor: { login: 'chatgpt-codex-connector', __typename: 'Bot' } };
+  const fixture = client({ comments: [restored] }); await run(fixture); assert.equal(result(fixture), 'success');
+});
+test('deletion latches failure instead of reviving an older clean summary on refresh', async () => {
+  const deleted = { ...summary({ ...clean, has_any_findings: true }), id: 43, updated_at: '2026-10-23' };
+  const fixture = client({ comments: [summary(clean)], payload: { issue: { number: 1, pull_request: {} }, comment: deleted, action: 'deleted' } });
+  fixture.context.eventName = 'issue_comment';
+  await run(fixture); assert.equal(result(fixture), 'failure');
+  const latch = fixture.statuses.find(item => item.context === 'codex-review-evidence');
+  const refresh = client({ comments: [summary(clean)], priorStatuses: [{ ...latch, creator: { login: 'github-actions[bot]', type: 'Bot' } }] });
+  await run(refresh); assert.equal(result(refresh), 'failure');
+});
+test('a missing recorded summary fails even if its deletion event was not delivered', async () => {
+  const fixture = client({ comments: [summary(clean)], priorStatuses: [watermark(43, '2026-10-23')] });
+  await run(fixture); assert.equal(result(fixture), 'failure');
+});
+test('a newer authenticated bot update recovers a deletion latch', async () => {
+  const fixture = client({ comments: [{ ...summary(clean), id: 44, updated_at: '2026-10-24' }],
+    priorStatuses: [watermark(43, '2026-10-23', 'failure')] });
+  await run(fixture); assert.equal(result(fixture), 'success');
+});
+test('partial pending publication cannot retain evaluated merge success', async () => {
+  const fixture = client({ comments: [summary(clean)], statusError: value => value.sha === head });
+  await assert.rejects(run(fixture), /status write failed/);
+  assert.deepEqual(fixture.statuses.map(item => [item.sha, item.state]), [[merge, 'pending']]);
+});
+test('workflow-run dispatch preserves an inherited Actions repo getter', async () => {
+  const fixture = client({ comments: [summary(clean)] });
+  const original = Object.assign(Object.create({ get repo() { return { owner: 'hemsoft-dev', repo: 'codexbar' }; } }),
+    { eventName: 'workflow_run', payload: {} });
+  fixture.context = workflowRunContext(original, 1);
+  await run(fixture); assert.equal(result(fixture), 'success');
+});
diff --git a/.github/scripts/require-merge-checks.py b/.github/scripts/require-merge-checks.py
new file mode 100644
index 00000000..0c8785f2
--- /dev/null
+++ b/.github/scripts/require-merge-checks.py
@@ -0,0 +1,49 @@
+#!/usr/bin/env python3
+"""Add required checks without changing any other main protection setting."""
+import argparse
+import json
+import subprocess
+
+
+def api(path, method="GET", payload=None):
+    command = ["gh", "api", path, "--method", method]
+    if payload is not None:
+        command += ["--input", "-"]
+    result = subprocess.run(command, input=None if payload is None else json.dumps(payload),
+                            text=True, capture_output=True, check=True)
+    return json.loads(result.stdout)
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--apply", action="store_true", help="Apply the additive status requirement")
+    args = parser.parse_args()
+    repo = "hemsoft-dev/codexbar"
+    path = f"repos/{repo}/branches/main/protection/required_status_checks"
+    # The checks source is discovered from a real CI result, not a user's status.
+    checks = api(f"repos/{repo}/commits/main/check-runs")["check_runs"]
+    app_ids = {check["app"]["id"] for check in checks if check["name"] == "security-scan"}
+    if len(app_ids) != 1:
+        raise RuntimeError("Cannot identify the CI GitHub App from main's security-scan")
+    app_id = app_ids.pop()
+    protection = api(f"repos/{repo}/branches/main/protection")
+    existing = protection.get("required_status_checks", {})
+    required = {check["context"]: check for check in existing.get("checks", [])}
+    for name in existing.get("contexts", []):
+        required.setdefault(name, {"context": name, "app_id": -1})
+    for name in ["build", "security-scan", "rust (windows-latest)", "rust (macos-latest)",
+                 "rust (ubuntu-latest)", "codex-review"]:
+        required[name] = {"context": name, "app_id": app_id}
+    payload = {"strict": existing.get("strict", False), "checks": list(required.values())}
+    print(json.dumps(payload, indent=2))
+    if args.apply:
+        # This endpoint changes only required statuses. It never replaces review,
+        # conversation, admin-enforcement or bypass settings.
+        result = api(path, "PATCH", payload)
+        assert {(c["context"], c["app_id"]) for c in payload["checks"]}.issubset(
+            {(c["context"], c["app_id"]) for c in result["checks"]})
+        print("Required checks verified")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 497d1072..8755cba9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -97,6 +97,9 @@ jobs:
           node-version: '20'
           cache: 'npm'
 
+      - name: Test Codex review policy
+        run: node --test .github/scripts/codex-review.test.cjs
+
       - name: Install markdownlint-cli
         run: npm ci
 
diff --git a/.github/workflows/codex-review.yml b/.github/workflows/codex-review.yml
new file mode 100644
index 00000000..46ef189b
--- /dev/null
+++ b/.github/workflows/codex-review.yml
@@ -0,0 +1,62 @@
+name: Codex review gate
+
+# Metadata only. Never check out or execute a pull request's code with this token.
+on:
+  pull_request_target:
+    branches: [main]
+    types: [opened, reopened, synchronize, ready_for_review]
+  issue_comment:
+    types: [created, edited, deleted]
+  pull_request_review:
+    types: [submitted, edited, dismissed]
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
+  workflow_dispatch:
+    inputs:
+      number:
+        description: Pull request number whose review evidence should be refreshed
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  pull-requests: read
+  issues: read
+  statuses: write
+
+jobs:
+  review:
+    if: >-
+      (github.event_name != 'issue_comment' ||
+        (github.event.issue.pull_request &&
+         github.event.comment.user.login == 'chatgpt-codex-connector[bot]' &&
+         github.event.comment.user.type == 'Bot')) &&
+      (github.event_name != 'pull_request_review' || github.event.review.user.id == 8227352)
+    concurrency:
+      group: codex-review-${{ github.event.pull_request.number || github.event.issue.number || inputs.number || github.event.workflow_run.pull_requests[0].number || github.run_id }}
+      cancel-in-progress: false
+      queue: max
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Use trusted main, including for review/comment events on a fork.
+          ref: ${{ github.event.repository.default_branch }}
+          persist-credentials: false
+      - uses: actions/github-script@v8
+        with:
+          script: |
+            const helper = './.github/scripts/codex-review.cjs';
+            if (!require('node:fs').existsSync(helper)) {
+              core.notice('Bootstrap: trusted main does not contain the review helper yet; no review status issued');
+              return;
+            }
+            const { run, workflowRunContext } = require(helper);
+            if (context.eventName === 'workflow_run') {
+              for (const pr of context.payload.workflow_run.pull_requests) {
+                await run({ github, context: workflowRunContext(context, pr.number), core });
+              }
+            } else {
+              await run({ github, context, core });
+            }
diff --git a/docs/MERGE_POLICY.md b/docs/MERGE_POLICY.md
new file mode 100644
index 00000000..fe4aada5
--- /dev/null
+++ b/docs/MERGE_POLICY.md
@@ -0,0 +1,90 @@
+# Merge policy
+
+Main requires these checks from GitHub Actions: `build`, `security-scan`,
+`rust (windows-latest)`, `rust (macos-latest)`, `rust (ubuntu-latest)` and
+`codex-review`. Conversation resolution and enforcement for administrators
+remain enabled. There is no admin bypass and no additional human approval
+requirement. A clean comment-only Codex review is sufficient review evidence.
+
+The review gate reads the connected Codex bot's structured summary, not a
+comment that merely says `@codex review`, an eyes reaction, or another user's
+copy of a result. The gate authenticates the summary's author and last editor using GraphQL.
+A collaborator's edit cannot become a bot verdict, including on manual or CI
+refresh. The summary must name the complete current head SHA, be
+completed, and report no findings. Running, malformed, missing, or old-head
+results cannot pass. Each new head needs its own review. The workflow reads
+GitHub metadata and executes only the script from trusted main, never PR code.
+
+Request `@codex review` once per head. If it remains hung for an hour, or the
+integration explicitly refuses the review, use the maintainer-authorized
+Claude Opus 5.5 fallback. Fix findings and repeat review until clean. Publish
+its clean result as a COMMENT review on the exact commit, as the trusted maintainer, GitHub user ID `8227352`, with
+this first-line receipt, followed by the review's scope and evidence:
+
+```text
+<!-- codexbar-review-fallback:v1 {"head":"FULL_40_CHARACTER_SHA","clean":true,"provider":"claude","model":"claude-opus-5-5","codex":"hung"} -->
+```
+
+Use `unavailable` instead of `hung` for an explicit integration refusal.
+The gate verifies the review's actual commit, stable author ID and live
+maintainer permission using the author's current login.
+The latest review from that user on that head must carry the clean receipt. It cannot
+override Codex's completed findings. This is a reviewed alternative to a hung
+integration, not a switch that skips review. Unresolved threads still block
+merge through native conversation protection.
+
+The gate refreshes on PR head changes, bot comment updates, reviews and CI
+completion. It publishes to both the reviewed head and its current test merge
+revision, and rejects a concurrent change to either. It revokes prior success
+on the test merge revision first, then the head, before evaluation. It checks
+that the triggering edit or deletion is visible,
+and reads mutable evidence again immediately before publishing a verdict. A
+maintainer can refresh existing evidence with
+`gh workflow run codex-review.yml -f number=PR_NUMBER`. This does not request a
+review or change the evidence requirements. There is no polling or schedule.
+
+The Actions-authored `codex-review-evidence` status on the reviewed head records
+which summary and update the gate observed. It is an audit watermark, not a
+substitute required check. Deleting recorded evidence, or a deletion event for
+another review summary, latches failure rather than reviving older clean text.
+A newer authenticated bot update clears the latch. Refreshes preserve it.
+Unrelated public comments and reviews are excluded before job concurrency.
+Eligible jobs use the documented `queue: max` mode so pending evidence events
+are queued rather than replaced. The installed actionlint 1.7.12 does not yet
+recognize that field; validation suppresses only its specific unknown-key
+error. See GitHub's [concurrency syntax](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#concurrency).
+
+## Required check setup
+
+During the initial PR, review events can run its workflow before the helper
+exists on trusted main. That bootstrap case emits a notice and issues no
+review status. It cannot satisfy a required `codex-review` check. Never load
+the helper from a PR branch to work around the bootstrap.
+
+After the review workflow has merged to main, preview the additive settings:
+
+```sh
+python3 .github/scripts/require-merge-checks.py
+```
+
+Then apply them with `--apply`. The helper discovers GitHub Actions' app ID
+from main's security job and changes only required statuses. It preserves
+existing requirements and strictness, conversation resolution, administrator
+enforcement, review settings and bypass policy. Read back
+`gh api repos/hemsoft-dev/codexbar/branches/main/protection` and verify the six
+contexts and source app IDs. Repository settings are live configuration;
+merging this document alone does not activate them.
+
+The path-filtered Package workflow is deliberately not globally required.
+GitHub can leave a required check pending when its workflow is skipped by a
+path filter. Packaging changes still run Package, and its applicable results
+must pass before merge. Normal CI and the review status run for every PR.
+
+Validate the live protection with a disposable PR: missing review must leave
+`codex-review` pending, and an old-head result must not pass its successor.
+Confirm `mergeStateStatus` is blocked with missing/failed requirements. Close
+the fixture without merging. Never attempt an admin merge to test protection.
+
+Policy references: [required status checks](https://docs.github.com/en/pull-requests/how-tos/merge-and-close-pull-requests/troubleshooting-required-status-checks),
+[protected branches](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches),
+and [safe metadata workflows](https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target).