chore: sync public mirror from internal

[evalops-mirror]

Summary

• sync the sanitized public tree from evalops/maestro-internal
• keep evalops/maestro as a generated public mirror of the private source of truth
• preserve public-owned CI and trusted-publishing workflows from the public checkout
• internal source SHA: 87c4241f8022f67f14f3fd920e11e6f9ae1f933b
• last generated public sync base: c92cf096bba27bd402ed361505ebc0be50855288
• previewed public-tree drift: 42 file(s) to copy/update and 0 stale file(s) to delete
• public-only commits since last generated sync: 0
• to pause generated syncs while hand-editing this branch, apply the sync-hold label to this PR; the sync workflow skips every push while it is set

Source-of-truth status

Public Mirror Drift Audit

• package: @evalops/maestro
• private source: https://github.com/evalops/maestro-internal@main (87c4241f8022)
• public projection: https://github.com/evalops/maestro@main (c92cf096bba2)
• files to copy or update: 42
• stale files to delete: 0
• result: drift detected
• invariant: public_projection_has_drift

Sample Changed Paths

• copy/update Cargo.lock
• copy/update Cargo.toml
• copy/update Dockerfile
• copy/update package.json
• copy/update packages/ai-rs/src/client.rs
• copy/update packages/ai-rs/src/openai.rs
• copy/update packages/maestro-rs/Cargo.toml
• copy/update packages/maestro-rs/src/lib.rs
• copy/update packages/runtime-rs/Cargo.toml
• copy/update packages/runtime-rs/fixtures/headless-protocol-v1.json
• copy/update packages/runtime-rs/fixtures/hosted-launch-spec-v1.json
• copy/update packages/runtime-rs/src/boundary.rs
• copy/update packages/runtime-rs/src/launch_spec.rs
• copy/update packages/runtime-rs/src/lib.rs
• copy/update packages/runtime-rs/src/protocol.rs
• copy/update packages/tui-rs/Cargo.toml
• copy/update packages/tui-rs/src/agent/codex_app_server_turns.rs
• copy/update packages/tui-rs/src/agent/message_queue.rs
• copy/update packages/tui-rs/src/agent/native.rs
• copy/update packages/tui-rs/src/headless/messages.rs
• copy/update packages/tui-rs/src/headless/mod.rs
• copy/update packages/tui-rs/src/headless/proto.rs
• copy/update packages/tui-rs/src/headless/supervisor.rs
• copy/update packages/tui-rs/src/headless/supervisor/tests.rs
• copy/update packages/tui-rs/src/headless_server.rs
• ... 17 more

Guidance

Let internal main generate and merge the public sync PR before relying on public main.

Drift sample

• copy/update Cargo.lock
• copy/update Cargo.toml
• copy/update Dockerfile
• copy/update package.json
• copy/update packages/ai-rs/src/client.rs
• copy/update packages/ai-rs/src/openai.rs
• copy/update packages/maestro-rs/Cargo.toml
• copy/update packages/maestro-rs/src/lib.rs
• copy/update packages/runtime-rs/Cargo.toml
• copy/update packages/runtime-rs/fixtures/headless-protocol-v1.json
• copy/update packages/runtime-rs/fixtures/hosted-launch-spec-v1.json
• copy/update packages/runtime-rs/src/boundary.rs
• copy/update packages/runtime-rs/src/launch_spec.rs
• copy/update packages/runtime-rs/src/lib.rs
• copy/update packages/runtime-rs/src/protocol.rs
• copy/update packages/tui-rs/Cargo.toml
• copy/update packages/tui-rs/src/agent/codex_app_server_turns.rs
• copy/update packages/tui-rs/src/agent/message_queue.rs
• copy/update packages/tui-rs/src/agent/native.rs
• copy/update packages/tui-rs/src/headless/messages.rs

Public-only commits since last generated sync

• none detected since last generated sync

Validation

• generated by the sync-public-release-mirror workflow in public-tree mode

Test Plan

• generated by the sync-public-release-mirror workflow in public-tree mode
• public-source-provenance require-internal-pr confirms internal source PR lineage
• generated mirror PRs use the slim public CI path (fmt/clippy/smoke + provenance); full cargo test/evals already ran on internal main for this SHA
• bot review threads on generated mirror PRs are advisory and do not block the next sync force-update

Staged Rollout

• Staging is unnecessary for this generated mirror PR: it does not independently promote user-visible behavior. It mirrors already-reviewed internal source from evalops/maestro-internal@87c4241f8022f67f14f3fd920e11e6f9ae1f933b, including existing hidden/evaluation surfaces, and keeps public package parity behind the established public-source-provenance gate.

Supersedes

• updates existing generated public sync PR chore: sync public mirror from internal #1006 to internal source 87c4241f8022f67f14f3fd920e11e6f9ae1f933b

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4ca4244442

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e06e76cc77

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c79ce24102

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 49a41c6672

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​crossterm@​0.28.1 ⏵ 0.29.0
	cargo/​ratatui@​0.29.0 ⏵ 0.30.2	+1		-1

View full report

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 23632d6d73

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".