chore: sync public mirror from internal

[haasonsaas]

Summary

• sync the sanitized public tree from evalops/maestro-internal
• keep evalops/maestro as a generated public mirror of the private source of truth
• preserve public-owned CI and trusted-publishing workflows from the public checkout
• internal source SHA: 7f7864b61297faa626405f2cd6e37966f1e51ae3
• last generated public sync base: 677a50a4cf816b3109d52e6a7488b8738bb59e5c
• previewed public-tree drift: 4 file(s) to copy/update and 0 stale file(s) to delete
• public-only commits since last generated sync: 0

Source-of-truth status

Public Mirror Drift Audit

• package: @evalops/maestro
• private source: https://github.com/evalops/maestro-internal@main (7f7864b61297)
• public projection: https://github.com/evalops/maestro@main (677a50a4cf81)
• files to copy or update: 4
• stale files to delete: 0
• result: drift detected
• invariant: public_projection_has_drift

Sample Changed Paths

• copy/update packages/tui-rs/.gitignore
• copy/update packages/tui-rs/Cargo.lock
• copy/update scripts/prepare-public-release-mirror.mjs
• copy/update test/scripts/prepare-public-release-mirror.test.ts

Guidance

Let internal main generate and merge the public sync PR before relying on public main.

Drift sample

• copy/update packages/tui-rs/.gitignore
• copy/update packages/tui-rs/Cargo.lock
• copy/update scripts/prepare-public-release-mirror.mjs
• copy/update test/scripts/prepare-public-release-mirror.test.ts

Public-only commits since last generated sync

• none detected since last generated sync

Validation

• generated by the sync-public-release-mirror workflow in public-tree mode

Test Plan

• generated by the sync-public-release-mirror workflow in public-tree mode
• public-source-provenance require-internal-pr check confirms internal source PR lineage
• CI, integration, rust-hosted-conformance, coverage, Socket, and Cursor checks must pass before merge

Staged Rollout

• Staging is unnecessary for this generated mirror PR: it does not independently promote user-visible behavior. It mirrors already-reviewed internal source from evalops/maestro-internal@7f7864b61297faa626405f2cd6e37966f1e51ae3, including existing hidden/evaluation surfaces, and keeps public package parity behind the established public-source-provenance gate.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	jszip@​3.10.1
	vscode-jsonrpc@​8.2.1
	partial-json@​0.1.7
	mammoth@​1.12.0
	smol-toml@​1.6.1
	google-auth-library@​9.15.1
	jsonc-parser@​3.3.1
	pdf-parse@​2.4.5
	minimatch@​10.2.5
	uuid@​14.0.0
	openai@​6.39.1

View full report