[github-actions]

Closes #1848. Submitted by @maneeshv.

Ready for artifact review. The reviewer will resolve the submitted source and complete the registry listing.

Submission: submissions/1848.json.
Git references are optional. Use a supplied reference; otherwise resolve main during review. Git updates are submitted manually.

[paseo-bot]

Codex Voice’s icon update is approved, @maneeshv. I updated the pin, retained both screenshots at permanent commit-pinned URLs, and removed the intake file. Your description and overview remain in use; nothing is required from you.

Review data

• Policy: main REVIEW.md blob 3c5e763c9565b93ea33fa48c9aeb83e415c72d67. Reviewed registry head 721f8429ef9963b17e5dd0f03bacf34ff6d4c0e5. Read this PR, submission #1848, and original review #1775. Submitter/source-owner API identity agrees: account ID 10337336.
• Independently fetched exact Git root trees from https://github.com/maneeshv/paseo-codex-voice.git: 478ef762b518a7c28b3a523ad935bb9bc25bb48b → fc355f988941fa5e9f0f515d1eb412e4413caf9f, without hooks or submodules. Checked archive paths and types before confined extraction. SHA-256: old 25663e2dfe759f17b6ceffd77205acf3b58243d56a230a81c73889e39db20790, new fd1fb74d93bdcca34f620f8c700ab39faf1584d154ff1054a7cff3908b153c2b.
• Compared all changed files. Production entries, client/server/shared modules and author overview are byte-identical; changes comprise icon artwork/declaration, screenshots, README installation text, package files inclusion and development dependency/lock updates. Viewed the new 1024-pixel PNG and retained ready/live screenshots; both listing URLs return HTTP 200/image/png. The editable SVG contains static shapes/gradients only and is not used as listing media. English description/overview retained; no translations or registry fallback needed.
• No runtime dependencies, manifest preparation command or acquisition lifecycle script. All 260 development-lock package entries resolve to registry.npmjs.org; none is a production dependency. Development esbuild/fsevents installation hooks are not invoked by this Git installation. The reported React development peer conflict therefore does not affect plugin acquisition. No plugin/dependency code installed, built, imported or executed; author tests were not rerun.
• Re-read unchanged Codex process, session initialization and browser audio paths against the earlier full review. Start voice acquires microphone audio and negotiates WebRTC through the existing Codex CLI. server/codex.ts:27 launches a fixed argument-array app-server using existing host sign-in/configuration. server/sessions.ts:82 passes selected workspace/agent context into an ephemeral coordinator, requesting read-only sandbox and disabled shell tools; inherited MCP tools are not isolated, as the overview explains. Worker/task data reaches the configured provider. No new credential access, network destination, subprocess construction, filesystem mutation or software acquisition is introduced by this update.
• Registry edits: exact artifact/repository pin, review timestamp, retained images pinned to the reviewed commit, removed submissions/1848.json. Trusted current-main validation passes: 463 well-formed records, one matching changed artifact, zero skipped. Registry machinery matches main.
• Limits: static review and image inspection; no live microphone, Codex service, MCP, worker or platform QA. Unchanged implementation/host-provider internals rely on the prior review rather than a new exhaustive audit. No concrete serious safety concern or factory-policy conflict identified.