chore: sync public mirror from internal

[haasonsaas]

Summary

• sync the sanitized public tree from evalops/maestro-internal
• keep evalops/maestro as a generated public mirror of the private source of truth
• preserve public-owned CI and trusted-publishing workflows from the public checkout
• internal source SHA: d0a913b54d0434d3289864623e5c1e3c994614dd
• last generated public sync base: a3cb3297030263864ac069bf216a924605ff7fc3
• previewed public-tree drift: 7 file(s) to copy/update and 0 stale file(s) to delete
• public-only commits since last generated sync: 0

Source-of-truth status

Public Mirror Drift Audit

• package: @evalops/maestro
• private source: https://github.com/evalops/maestro-internal@main (d0a913b54d04)
• public projection: https://github.com/evalops/maestro@main (a3cb32970302)
• files to copy or update: 7
• stale files to delete: 0
• result: drift detected
• invariant: public_projection_has_drift

Sample Changed Paths

• copy/update .github/actions/release-context/action.yml
• copy/update scripts/ci-nx-tests.sh
• copy/update scripts/plan-ci-checks.mjs
• copy/update scripts/plan-nx-test-command.mjs
• copy/update scripts/release-impact-filter.mjs
• copy/update test/scripts/ci-guardrails.test.ts
• copy/update test/scripts/release-impact-filter.test.ts

Guidance

Let internal main generate and merge the public sync PR before relying on public main.

Drift sample

• copy/update .github/actions/release-context/action.yml
• copy/update scripts/ci-nx-tests.sh
• copy/update scripts/plan-ci-checks.mjs
• copy/update scripts/plan-nx-test-command.mjs
• copy/update scripts/release-impact-filter.mjs
• copy/update test/scripts/ci-guardrails.test.ts
• copy/update test/scripts/release-impact-filter.test.ts

Public-only commits since last generated sync

• none detected since last generated sync

Validation

• generated by the sync-public-release-mirror workflow in public-tree mode

Test Plan

• generated by the sync-public-release-mirror workflow in public-tree mode
• public-source-provenance require-internal-pr check confirms internal source PR lineage
• CI, integration, rust-hosted-conformance, coverage, Socket, and Cursor checks must pass before merge

Staged Rollout

• Staging is unnecessary for this generated mirror PR: it does not independently promote user-visible behavior. It mirrors already-reviewed internal source from evalops/maestro-internal@d0a913b54d0434d3289864623e5c1e3c994614dd, including existing hidden/evaluation surfaces, and keeps public package parity behind the established public-source-provenance gate.

[chatgpt-codex-connector]

💡 Codex Review

maestro/scripts/release-impact-filter.mjs

Lines 361 to 364 in 971359f

	if (path.startsWith("packages/") && path.endsWith(".rs")) {
	const oldProduction = rustProductionContent(change.oldContent ?? "");
	const newProduction = rustProductionContent(change.newContent ?? "");
	return oldProduction !== newProduction;

Treat unguarded Rust test modules as package-impacting

isPackageImpactingChange compares Rust files via rustProductionContent, which strips every mod tests { ... } block regardless of whether it is gated by #[cfg(test)]. That creates a false negative when a package Rust file has an unguarded mod tests module (or any non-test-only mod tests block): edits inside that module are ignored and packageChangedSinceTag can return false, allowing a tag mismatch to pass without a required version bump even though compiled package sources changed.

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".