Review mode tool calls never reach rollout logs

What version of Codex is running?

codex-cli 0.44.0

Which model were you using?

gpt-5-codex

What platform is your computer?

Darwin 24.6.0 arm64 arm

What steps can reproduce the bug?

1. Start codex in a repository and ensure rollouts are enabled (default).
2. Trigger review mode with /review and give instructions like “Run ls and write the output to review.log.”
3. Approve the exec request that review mode issues.
4. Exit Codex and inspect the newest rollout-*.jsonl under ~/.codex/sessions/**. No exec/function-call events from review mode are present.
5. Resume the same session with codex resume --last. The transcript contains no record of the review-mode command either.

What is the expected behavior?

Review mode should persist (and later replay) the same tool-call events as normal turns so that auditors can see what commands the reviewer executed.

What do you see instead?

Review mode runs with full privileges but records nothing beyond a synthetic “review summary” message. Once the session closes, there is no forensic record of any shell commands, patches, or tool calls executed during the review.

Additional information

• review_turn_context clones the parent sandbox, cwd, and approvals, so review mode has the same access as the main session.
• Tool calls are appended only to review_thread_history and never passed through record_conversation_items/persist_rollout_items, so nothing hits the rollout log.
• On exit, the code writes a single <user_action>review</user_action> message, losing all granular detail.
• Relevant code: codex-rs/core/src/codex.rs:1552, codex-rs/core/src/codex.rs:1800, codex-rs/core/src/codex.rs:732, codex-rs/core/src/codex.rs:3253.
• Rationale: review mode is treated as a safe auditing phase, but without logging it becomes impossible to verify what the reviewer executed, nullifying the audit trail.
• Concern: a malicious or compromised reviewer could exfiltrate data or tamper with the repo using review mode, and incident responders would have no visibility once the session ends.

(Code references with rust-v0.44.0 tag checked out)