chore: sync public mirror from internal

[haasonsaas]

Summary

• sync the sanitized public tree from evalops/maestro-internal
• keep evalops/maestro as a generated public mirror of the private source of truth
• preserve public-owned CI and trusted-publishing workflows from the public checkout
• internal source SHA: eb377e95240310db0f1cea07dca63a20e7e05ab6
• last generated public sync base: b8d4045732d34bddcb8ab6887bd18e99676cf93e
• previewed public-tree drift: 52 file(s) to copy/update and 0 stale file(s) to delete
• public-only commits since last generated sync: 1

Source-of-truth status

Public Mirror Drift Audit

• package: @evalops/maestro
• private source: https://github.com/evalops/maestro-internal@main (eb377e952403)
• public projection: https://github.com/evalops/maestro@main (6376aae98663)
• files to copy or update: 52
• stale files to delete: 0
• result: drift detected
• invariant: public_projection_has_drift

Sample Changed Paths

• copy/update README.md
• copy/update docs/MODELS.md
• copy/update docs/protocols/codex-operating-layer.json
• copy/update docs/protocols/codex-operating-layer.md
• copy/update docs/protocols/codex-parity-conformance.json
• copy/update package.json
• copy/update packages/ai/tsconfig.build.json
• copy/update packages/control-plane-rs/src/auth.rs
• copy/update packages/control-plane-rs/src/codex_compat.rs
• copy/update packages/control-plane-rs/src/main.rs
• copy/update packages/control-plane-rs/src/model_catalog.rs
• copy/update scripts/check-codex-operating-layer-conformance.mjs
• copy/update scripts/codex-a2a-bridge.py
• copy/update scripts/smoke-codex-app-server-live.mjs
• copy/update scripts/verify-build.ts
• copy/update src/agent/providers/codex-app-server.ts
• copy/update src/agent/transport.ts
• copy/update src/agent/transport/create-provider-stream.ts
• copy/update src/agent/types.ts
• copy/update src/app-server/session-api.ts
• copy/update src/bootstrap/auth-setup.ts
• copy/update src/bootstrap/model-resolution-setup.ts
• copy/update src/bootstrap/tools-setup.ts
• copy/update src/cli-tui/selectors/model-selector.ts
• copy/update src/cli/args.ts
• ... 27 more

Guidance

Let internal main generate and merge the public sync PR before relying on public main.

Drift sample

• copy/update README.md
• copy/update docs/MODELS.md
• copy/update docs/protocols/codex-operating-layer.json
• copy/update docs/protocols/codex-operating-layer.md
• copy/update docs/protocols/codex-parity-conformance.json
• copy/update package.json
• copy/update packages/ai/tsconfig.build.json
• copy/update packages/control-plane-rs/src/auth.rs
• copy/update packages/control-plane-rs/src/codex_compat.rs
• copy/update packages/control-plane-rs/src/main.rs
• copy/update packages/control-plane-rs/src/model_catalog.rs
• copy/update scripts/check-codex-operating-layer-conformance.mjs
• copy/update scripts/codex-a2a-bridge.py
• copy/update scripts/smoke-codex-app-server-live.mjs
• copy/update scripts/verify-build.ts
• copy/update src/agent/providers/codex-app-server.ts
• copy/update src/agent/transport.ts
• copy/update src/agent/transport/create-provider-stream.ts
• copy/update src/agent/types.ts
• copy/update src/app-server/session-api.ts

Public-only commits since last generated sync

• 6376aae Add Maestro local A2A bridge (Add Maestro local A2A bridge #399)

Validation

• generated by the sync-public-release-mirror workflow in public-tree mode

Test Plan

• generated by the sync-public-release-mirror workflow in public-tree mode
• public-source-provenance require-internal-pr check confirms internal source PR lineage
• CI, integration, rust-hosted-conformance, coverage, Socket, and Cursor checks must pass before merge

Staged Rollout

• Staging is unnecessary for this generated mirror PR: it does not independently promote user-visible behavior. It mirrors already-reviewed internal source from evalops/maestro-internal@eb377e95240310db0f1cea07dca63a20e7e05ab6, including existing hidden/evaluation surfaces, and keeps public package parity behind the established public-source-provenance gate.

[cursor]

PR Summary

Medium Risk
Medium risk because it changes build/install metadata (trustedDependencies, new smoke/check scripts) and adds new Rust identifier validation used for Codex tooling, which could affect CI/install behavior if misconfigured.

Overview
Updates Codex documentation to reflect ChatGPT sign-in via the Codex app-server and switches the described Codex model overlay API to openai-codex-app-server.

Adds a new Codex operating-layer protocol (docs/protocols/codex-operating-layer.*) plus a corresponding check:codex-operating-layer conformance script and wires it into lint:evals; also adds a live smoke script entrypoint smoke:codex-app-server-live.

Extends build/trust configuration by including src/codex/** in the AI package build and adding tree-sitter to trustedDependencies, and introduces Rust codex_compat helpers (with fixture-backed tests) for validating/reserving dynamic tool identifiers; includes a small refactor in auth.rs cancel-path parsing variable naming.

^{Reviewed by Cursor Bugbot for commit d2c6538. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​uuid@​11.0.0
	@​types/​mime-types@​3.0.1
	@​types/​js-yaml@​4.0.9
	@​types/​bcrypt@​6.0.0
	@​types/​jsonwebtoken@​9.0.10
	@​crosscopy/​clipboard@​0.2.8
	esbuild@​0.27.7
	@​types/​pdf-parse@​1.1.5
	@​vitest/​coverage-v8@​4.1.6
	concurrently@​9.2.1
	clipboardy@​4.0.0
	bcrypt@​6.0.0
	drizzle-orm@​0.45.2
	drizzle-kit@​1.0.0-beta.21
	@​bufbuild/​buf@​1.69.0
	dotenv@​16.6.1
	@​biomejs/​biome@​1.9.4
	@​bufbuild/​protoc-gen-es@​2.12.0
	@​sentry/​node@​10.53.1

View full report

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d2c6538261

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".