GitHub @codex review rejects valid PR-head SHA as a missing git ref

What issue are you seeing?

The GitHub chatgpt-codex-connector fails to start a pull-request review because it treats the valid 40-character PR-head commit SHA as an unavailable git ref.

The connector recognizes the @codex review request and then posts:

Codex Review: Something went wrong. Try again later by commenting “@codex review”.

Provided git ref <redacted 40-character PR-head SHA> does not exist

The referenced SHA does exist. At the time of both failures, all of these GitHub surfaces resolved consistently:

• the PR head.sha equaled the referenced SHA;
• refs/heads/<feature-branch> pointed to the referenced SHA;
• refs/pull/<PR-number>/head pointed to the referenced SHA;
• GET /repos/{owner}/{repo}/commits/{sha} returned the commit;
• GET /repos/{owner}/{repo}/pulls/{pull_number}/commits included the commit.

The failure occurred twice on the same unchanged PR head, with the second manual request approximately 17 minutes after the first. The PR remained open and mergeable throughout.

The private repository name, PR number, branch name, and SHA are intentionally omitted from this public report. I can provide them privately to an OpenAI maintainer if needed.

What steps can reproduce the bug?

1. Use a private GitHub repository that is connected to Codex Cloud and has Code Review enabled.
2. Push a same-repository feature branch and open a pull request against the default branch.
3. Confirm that both refs/heads/<feature-branch> and refs/pull/<PR-number>/head resolve to the PR-head SHA.
4. Add a pull-request comment containing @codex review. In the observed case, an inert HTML operation marker followed the trigger.
5. Wait for the connector to process the request.
6. Observe that the review fails before producing findings with Provided git ref <PR-head SHA> does not exist.
7. Retry after the branch and commit have remained visible through GitHub's REST and Git protocols. The same failure occurs.

What is the expected behavior?

Codex should fetch the PR head through refs/pull/<PR-number>/head or the feature-branch ref, verify that it resolves to the PR-head SHA, and review that exact commit.

A valid commit object ID may identify the review head, but it should not be rejected merely because it is not itself the name of an advertised remote ref.

Additional information

• Component: Codex Cloud GitHub Code Review (chatgpt-codex-connector), not the Codex CLI.
• The request supplied @codex review; it did not supply the commit SHA. The connector selected the SHA from the PR context.
• This differs from #6771, where a post-review fix task cannot resolve a branch name.
• This differs from #33048, where the initial review webhook is silently dropped and a retry succeeds.
• This differs from #40755, where a completed review cites synthetic, unresolvable SHAs in findings.
• Impact: repositories that require an exact-head Codex review cannot satisfy their review gate even though GitHub resolves the PR head normally.

Start at the @codex review entry point in the chatgpt-codex-connector and trace how the PR head.sha is converted into a git ref. Reproduce with refs/pull//head and refs/heads/, then verify that the selected SHA is accepted and the exact commit is reviewed.