Update Codex AI review model to gpt-5.4

[igerber]

Summary

• Update AI PR review workflow model from gpt-5.2-codex to gpt-5.4
• GPT-5.4 unifies coding capabilities into the base model (no -codex suffix needed) and is now the recommended default for Codex workflows

Methodology references (required if estimator / math changes)

• N/A - no methodology changes

Validation

• No test changes (CI workflow config only)

Security / privacy

• Confirm no secrets/PII in this PR: Yes

---

Generated with Claude Code

[github-actions]

Overall assessment: ✅ Looks good

Executive Summary

• The diff is a single workflow-config change at .github/workflows/ai_pr_review.yml:129, replacing model: gpt-5.2-codex with model: gpt-5.4.
• No estimator, weighting, variance/SE, identification-assumption, or default-behavior code changed, so the methodology cross-check against docs/methodology/REGISTRY.md:1 is not triggered for this PR.
• OpenAI documents gpt-5.4 as available in the Responses API and says it is rolling out in Codex; OpenAI also describes it as folding codex-specific coding capability into the mainline model family, so the naming change is upstream-consistent. citeturn5view0turn2view2
• The edge-case checklist items from PR Add base_period parameter to CallawaySantAnna for pre-treatment effects #97 are not implicated here because no data-processing or inference path changed.
• I do not see a code-quality, security, performance, or testing blocker in the introduced diff.

Methodology

• Severity: None. Impact: No methodology-affecting library code is touched; the PR only changes the Codex review model in .github/workflows/ai_pr_review.yml:129, so there is nothing to reconcile against docs/methodology/REGISTRY.md:1. Concrete fix: None.

Code Quality

• Severity: None. Impact: The change is minimal and localized; it preserves the existing openai/codex-action@v1 invocation, prompt path, sandboxing, and effort settings at .github/workflows/ai_pr_review.yml:122, .github/workflows/ai_pr_review.yml:125, .github/workflows/ai_pr_review.yml:126, and .github/workflows/ai_pr_review.yml:130. Concrete fix: None.

Performance

• Severity: None. Impact: No library runtime path, estimator hot path, or CI control flow is altered beyond model selection at .github/workflows/ai_pr_review.yml:129. Concrete fix: None.

Maintainability

• Severity: None. Impact: I do not see a compatibility blocker in the new model name; gpt-5.4 is an officially documented model for API use and is part of the current Codex rollout, which makes this update reasonable for the existing API-key-based workflow. citeturn5view0turn2view2 Concrete fix: None.

Tech Debt

• Severity: None. Impact: The PR does not introduce new parameters, branching, duplication, or partial pattern fixes; it is a one-line config substitution at .github/workflows/ai_pr_review.yml:129. Concrete fix: None.

Security

• Severity: None. Impact: Secret handling and sandbox posture are unchanged; the workflow still reads ${{ secrets.OPENAI_API_KEY }} and retains sandbox: read-only plus safety-strategy: drop-sudo at .github/workflows/ai_pr_review.yml:124, .github/workflows/ai_pr_review.yml:126, and .github/workflows/ai_pr_review.yml:127. Concrete fix: None.

Documentation/Tests

• Severity: None. Impact: No estimator or public library behavior changed, so I do not see a requirement for methodology doc updates or new library tests from this PR. Concrete fix: None.