chore: sync public mirror from internal

[haasonsaas]

Summary

• sync the sanitized public tree from evalops/maestro-internal
• keep evalops/maestro as a generated public mirror of the private source of truth
• preserve public-owned CI and trusted-publishing workflows from the public checkout
• internal source SHA: d8894bf42184134bda64d93353d3bd78b7534187
• last generated public sync base: 78c2e99aa3228c18fe2b8b8ba00496e08537c2dd
• previewed public-tree drift: 8 file(s) to copy/update and 0 stale file(s) to delete
• public-only commits since last generated sync: 4

Source-of-truth status

Public Mirror Drift Audit

• package: @evalops/maestro
• private source: https://github.com/evalops/maestro-internal@main (d8894bf42184)
• public projection: https://github.com/evalops/maestro@main (6f61ff670edd)
• files to copy or update: 8
• stale files to delete: 0
• result: drift detected
• invariant: public_projection_has_drift

Sample Changed Paths

• copy/update CHANGELOG.md
• copy/update docs/protocols/release-surface-conformance.json
• copy/update docs/protocols/release-surface-conformance.md
• copy/update package.json
• copy/update scripts/check-release-surface-conformance.mjs
• copy/update scripts/plan-ci-checks.mjs
• copy/update test/scripts/ci-guardrails.test.ts
• copy/update test/scripts/release-surface-conformance.test.ts

Guidance

Let internal main generate and merge the public sync PR before relying on public main.

Drift sample

• copy/update CHANGELOG.md
• copy/update docs/protocols/release-surface-conformance.json
• copy/update docs/protocols/release-surface-conformance.md
• copy/update package.json
• copy/update scripts/check-release-surface-conformance.mjs
• copy/update scripts/plan-ci-checks.mjs
• copy/update test/scripts/ci-guardrails.test.ts
• copy/update test/scripts/release-surface-conformance.test.ts

Public-only commits since last generated sync

• 6f61ff6 Merge pull request chore: release v0.10.48 #697 from evalops/codex/release-0.10.48-updater-20260530
• e35401a fix: refresh maestro from release metadata on startup (fix: refresh maestro from release metadata on startup #695)
• 1c951bd Merge pull request fix: make npm deprecation reruns idempotent #694 from evalops/codex/npm-deprecate-idempotent-20260529
• 8306c6d Merge pull request fix: bundle Codex app-server integration #693 from evalops/codex/public-codex-auth-integration-20260529

Validation

• generated by the sync-public-release-mirror workflow in public-tree mode

Test Plan

• generated by the sync-public-release-mirror workflow in public-tree mode
• public-source-provenance require-internal-pr check confirms internal source PR lineage
• CI, integration, rust-hosted-conformance, coverage, Socket, and Cursor checks must pass before merge

Staged Rollout

• Staging is unnecessary for this generated mirror PR: it does not independently promote user-visible behavior. It mirrors already-reviewed internal source from evalops/maestro-internal@d8894bf42184134bda64d93353d3bd78b7534187, including existing hidden/evaluation surfaces, and keeps public package parity behind the established public-source-provenance gate.

Supersedes

• updates existing generated public sync PR chore: sync public mirror from internal #696 to internal source d8894bf42184134bda64d93353d3bd78b7534187

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: af6e4eb0f9

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​uuid@​11.0.0
	nx@​22.6.5
	husky@​9.1.7
	@​types/​mime-types@​3.0.1
	vscode-jsonrpc@​8.2.1
	@​types/​js-yaml@​4.0.9
	@​openai/​codex@​0.135.0
	@​types/​bcrypt@​6.0.0
	@​types/​jsonwebtoken@​9.0.10
	@​crosscopy/​clipboard@​0.2.8
	@​types/​diff@​7.0.2
	@​types/​pdf-parse@​1.1.5
	openai@​6.39.1
	@​vitest/​coverage-v8@​4.1.7
	tsx@​4.22.3
	mammoth@​1.12.0
	ajv-formats@​3.0.1
	postgres@​3.4.9
	smol-toml@​1.6.1
	clipboardy@​4.0.0
	bcrypt@​6.0.0
	otplib@​13.4.0
	string-width@​8.2.1
	fflate@​0.8.3
	glob@​11.1.0 ⏵ 13.0.6	-4			+35
	mime-types@​3.0.2
	@​opentelemetry/​api@​1.9.1
	tree-sitter-bash@​0.25.1
	tree-sitter@​0.25.0
	jose@​6.2.3
	jiti@​2.7.0
	@​opentelemetry/​resources@​2.7.1
	diff@​8.0.4
See 22 more rows in the dashboard

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm ioredis is 96.0% likely obfuscated Confidence: 0.96 Location: Package overview From: package.json → npm/ioredis@5.11.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ioredis@5.11.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report