fix(sandbox): resolve codex-prefixed pull request roles

services/api/src/sandbox/orchestrator.ts

@@ -3255,8 +3255,15 @@ function readOnlyRepositoryMode(mode: string) {
   );
 }
 
-function githubPullRequestMode(mode: string) {
-  return ["review", "address_review", "ci_doctor"].includes(mode.replace(/-/g, "_"));
+// Codex agents carry a `codex-` prefix by convention (see the seeded
+// `codex-architect`/`codex-builder`), and `runs.mode` is the agent's name. Strip
+// it here exactly as the sibling role predicates do, so a Codex-engine reviewer
+// or repair agent resolves to the same governed role as its Claude counterpart
+// and still receives the pull request's branch.
+export function githubPullRequestMode(mode: string) {
+  return ["review", "address_review", "ci_doctor"].includes(
+    mode.replace(/^codex-/, "").replace(/-/g, "_"),
+  );
 }
 
 function receiptProvider(engine: string): FacilityReceipt["provider"] {

services/api/test/sandbox.test.ts

@@ -40,6 +40,7 @@ import type { SandboxDriver } from "../src/sandbox/driver.js";
 import {
   dispatchRun,
   finishRun,
+  githubPullRequestMode,
   reconcileSandboxes,
   repairExpectedHeadSha,
   runDeliveryRefMismatch,
@@ -99,6 +100,30 @@ describe("run delivery integrity binding", () => {
     );
     expect(repairExpectedHeadSha("builder", { pullRequest: { headSha: webhook } })).toBeNull();
   });
+
+  it("resolves pull-request roles identically for Claude and Codex agents", () => {
+    for (const role of ["review", "address-review", "ci-doctor"]) {
+      expect(githubPullRequestMode(role)).toBe(true);
+      expect(githubPullRequestMode(`codex-${role}`)).toBe(true);
+    }
+    expect(githubPullRequestMode("builder")).toBe(false);
+    expect(githubPullRequestMode("codex-builder")).toBe(false);
+    expect(githubPullRequestMode("codex-architect")).toBe(false);
+  });
+
+  it("keeps the checked-out branch and the pinned head in agreement for repair agents", () => {
+    // A repair agent that pins an admitted head must also be given the pull
+    // request's branch. Disagreement clones the default branch and then fails
+    // the runner's head verification with repository_head_sha_mismatch.
+    const admitted = "c".repeat(40);
+    for (const mode of ["address-review", "codex-address-review", "ci-doctor", "codex-ci-doctor"]) {
+      const pinsHead = Boolean(
+        repairExpectedHeadSha(mode, { ciDoctor: { admittedHeadSha: admitted } }),
+      );
+      expect(pinsHead).toBe(true);
+      expect(githubPullRequestMode(mode)).toBe(pinsHead);
+    }
+  });
 });
 
 async function canConnect() {