chore: sync public mirror from internal

[evalops-mirror]

Summary

• sync the sanitized public tree from evalops/maestro-internal
• keep evalops/maestro as a generated public mirror of the private source of truth
• preserve public-owned CI and trusted-publishing workflows from the public checkout
• internal source SHA: 976dc7f5f3c83a7d4bb72d3c3b9b920a530a982b
• last generated public sync base: a2f2b2cc6e958cfe8b32330258e6e3157d3e8800
• previewed public-tree drift: 78 file(s) to copy/update and 0 stale file(s) to delete
• public-only commits since last generated sync: 4
• to pause generated syncs while hand-editing this branch, apply the sync-hold label to this PR; the sync workflow skips every push while it is set

Source-of-truth status

Public Mirror Drift Audit

• package: @evalops/maestro
• private source: https://github.com/evalops/maestro-internal@main (976dc7f5f3c8)
• public projection: https://github.com/evalops/maestro@main (586abc2ce38d)
• files to copy or update: 78
• stale files to delete: 0
• result: drift detected
• invariant: public_projection_has_drift

Sample Changed Paths

• copy/update .buildkite/advisory.yml
• copy/update .buildkite/pipeline.yml
• copy/update .env.example
• copy/update AGENTS.md
• copy/update CHANGELOG.md
• copy/update Cargo.lock
• copy/update docs/ENTERPRISE.md
• copy/update docs/SESSIONS.md
• copy/update docs/THREAT_MODEL.md
• copy/update docs/protocols/secure-session-transfer.json
• copy/update docs/protocols/secure-session-transfer.md
• copy/update package-lock.json
• copy/update package.json
• copy/update packages/ai-rs/src/client.rs
• copy/update packages/ai-rs/src/providers.rs
• copy/update packages/maestro-rs/Cargo.toml
• copy/update packages/runtime-gateway-rs/src/auth.rs
• copy/update packages/runtime-gateway-rs/src/extended.rs
• copy/update packages/runtime-gateway-rs/src/lib.rs
• copy/update packages/runtime-gateway-rs/src/tests.rs
• copy/update packages/tui-rs/src/agent/native.rs
• copy/update packages/tui-rs/src/app.rs
• copy/update packages/tui-rs/src/app/command_handlers.rs
• copy/update packages/tui-rs/src/app/input_handlers.rs
• copy/update packages/tui-rs/src/app/tests.rs
• ... 53 more

Guidance

Let internal main generate and merge the public sync PR before relying on public main.

Drift sample

• copy/update .buildkite/advisory.yml
• copy/update .buildkite/pipeline.yml
• copy/update .env.example
• copy/update AGENTS.md
• copy/update CHANGELOG.md
• copy/update Cargo.lock
• copy/update docs/ENTERPRISE.md
• copy/update docs/SESSIONS.md
• copy/update docs/THREAT_MODEL.md
• copy/update docs/protocols/secure-session-transfer.json
• copy/update docs/protocols/secure-session-transfer.md
• copy/update package-lock.json
• copy/update package.json
• copy/update packages/ai-rs/src/client.rs
• copy/update packages/ai-rs/src/providers.rs
• copy/update packages/maestro-rs/Cargo.toml
• copy/update packages/runtime-gateway-rs/src/auth.rs
• copy/update packages/runtime-gateway-rs/src/extended.rs
• copy/update packages/runtime-gateway-rs/src/lib.rs
• copy/update packages/runtime-gateway-rs/src/tests.rs

Public-only commits since last generated sync

• 586abc2 fix: do not retarget preview GitHub releases to detached commits
• 8193ac5 fix: skip missing files during preview channel version bump (fix: skip missing files during preview channel version bump #1034)
• c326c67 fix: resolve preview installs from signed channel pointers (fix: resolve preview installs from signed channel pointers #1033)
• e9516e2 feat: publish alpha and beta channels (feat: publish alpha and beta channels #1032)

Validation

• generated by the sync-public-release-mirror workflow in public-tree mode

Test Plan

• generated by the sync-public-release-mirror workflow in public-tree mode
• public-source-provenance require-internal-pr confirms internal source PR lineage
• generated mirror PRs use the slim public CI path (fmt/clippy/smoke + provenance); full cargo test/evals already ran on internal main for this SHA
• bot review threads on generated mirror PRs are advisory and do not block the next sync force-update

Staged Rollout

• Staging is unnecessary for this generated mirror PR: it does not independently promote user-visible behavior. It mirrors already-reviewed internal source from evalops/maestro-internal@976dc7f5f3c83a7d4bb72d3c3b9b920a530a982b, including existing hidden/evaluation surfaces, and keeps public package parity behind the established public-source-provenance gate.

Supersedes

• updates existing generated public sync PR chore: sync public mirror from internal #1035 to internal source 976dc7f5f3c83a7d4bb72d3c3b9b920a530a982b

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.