Support configuring a custom auto-review model for approvals_reviewer = "auto_review"

[yusoofsh]

Area

• Catalog / models

What are you trying to accomplish?

With approvals_reviewer = "auto_review" enabled, route the automatic approval-review subagent through a user-chosen model (for example opencode-go/deepseek-v4-flash) instead of whatever OpenCodex/Codex resolves by default.

What prevents this today?

Upstream Codex only exposes two reviewer modes in approvals_reviewer: user and auto_review (legacy alias guardian_subagent) — no model argument. The model the auto-review subagent uses is decided per-model via the auto_review_model_override field on the model catalog entry of the currently running model (see codex-rs/core/src/guardian/review.rs and codex-rs/protocol/src/openai_models.rs in openai/codex).

OpenCodex regenerates opencodex-catalog.json from provider discovery during catalog sync, and routed entries are rebuilt from templates. There is no OpenCodex-managed way to express "use model X for auto review", so the only current approach is hand-editing the generated catalog file. That edit is undocumented and can be clobbered by a later sync.

What should OpenCodex do?

Provide a first-class, durable configuration for the auto-review model that survives catalog regeneration. For example:

• Accept a config option (e.g. in ~/.codex/config.toml or an OpenCodex-managed setting) such as auto_review_model = "opencode-go/deepseek-v4-flash".
• Have the catalog sync apply that value to auto_review_model_override on the relevant routed entries instead of leaving them at null, so the setting is not lost when entries are rebuilt.
• Document the option in the catalog / models docs.

Example usage or interface

approvals_reviewer = "auto_review"
auto_review_model = "opencode-go/deepseek-v4-flash"

Expected observable behavior: when an approval prompt needs review, the auto-review subagent runs against opencode-go/deepseek-v4-flash rather than the upstream default (codex-auto-review or gpt-5.6-luna), and the choice persists across opencodex catalog syncs.

Alternatives or workarounds

• Manually add "auto_review_model_override": "<model-slug>" to the model's entry in ~/.codex/opencodex-catalog.json. This works today (verified), but the catalog is regenerated by OpenCodex and routed entries are rebuilt from templates, so the edit can be silently dropped.
• Rely on the fallback: with no codex-auto-review entry in the OpenCodex catalog, upstream already falls back to the current turn model — but that is implicit and not controllable.

Additional context

• Upstream mechanism: guardian_review_session_config resolves the review model from turn.model_info.auto_review_model_override, defaulting to approval_review_preferred_model() (codex-auto-review, or gpt-5.6-luna under API-key auth).
• OpenCodex currently ships auto_review_model_override: null on every entry in src/codex/data/upstream-models.json and preserves unknown fields through ensureStrictCatalogFields, but offers no way to set the value.

Checks

• I searched existing issues and documentation.
• This request describes a concrete OpenCodex workflow rather than merely naming a desired technology.
• I removed secrets and personal data.

[github-actions]

_{Automated translation bookkeeping — detected language: unknown.}