chore: sync public mirror from internal

[haasonsaas]

Summary

• sync the sanitized public tree from evalops/maestro-internal
• keep evalops/maestro as a generated public mirror of the private source of truth
• preserve public-owned CI and trusted-publishing workflows from the public checkout
• internal source SHA: c66741381c81eee913436ece1e31e7d74599e827
• last generated public sync base: 7bda477e930232512499927a5ce708a26de58df0
• previewed public-tree drift: 3 file(s) to copy/update and 0 stale file(s) to delete
• public-only commits since last generated sync: 0

Source-of-truth status

Public Mirror Drift Audit

• package: @evalops/maestro
• private source: https://github.com/evalops/maestro-internal@main (c66741381c81)
• public projection: https://github.com/evalops/maestro@main (7bda477e9302)
• files to copy or update: 3
• stale files to delete: 0
• result: drift detected
• invariant: public_projection_has_drift

Sample Changed Paths

• copy/update packages/control-plane-rs/src/a2a/push_notifications.rs
• copy/update packages/control-plane-rs/src/tests.rs
• copy/update test/web/platform-a2a-push-handler.test.ts

Guidance

Let internal main generate and merge the public sync PR before relying on public main.

Drift sample

• copy/update packages/control-plane-rs/src/a2a/push_notifications.rs
• copy/update packages/control-plane-rs/src/tests.rs
• copy/update test/web/platform-a2a-push-handler.test.ts

Public-only commits since last generated sync

• none detected since last generated sync

Validation

• generated by the sync-public-release-mirror workflow in public-tree mode

Test Plan

• generated by the sync-public-release-mirror workflow in public-tree mode
• public-source-provenance require-internal-pr check confirms internal source PR lineage
• CI, integration, rust-hosted-conformance, coverage, Socket, and Cursor checks must pass before merge
• Do not merge until Cursor Bugbot review completes — Bugbot catches bugs that CI guardrails may not cover yet. If Bugbot finds issues, address them on this branch before merging.

Staged Rollout

• Staging is unnecessary for this generated mirror PR: it does not independently promote user-visible behavior. It mirrors already-reviewed internal source from evalops/maestro-internal@c66741381c81eee913436ece1e31e7d74599e827, including existing hidden/evaluation surfaces, and keeps public package parity behind the established public-source-provenance gate.

Supersedes

• updates existing generated public sync PR chore: sync public mirror from internal #803 to internal source c66741381c81eee913436ece1e31e7d74599e827

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[cursor]

PR Summary

High Risk
Rust push callback auth no longer binds workspace HMAC tokens to payload workspace, widening acceptance of mismatched header/body workspaces on a security-sensitive endpoint while Node may still enforce binding.

Overview
Rust platform A2A push callbacks no longer run a second check that ties workspace-scoped workspace-v1.* notification tokens to a workspaceId embedded in the JSON body. After header auth (raw secret or HMAC from x-evalops-workspace-id / x-workspace-id), payloads are accepted without comparing body workspace markers. The payload workspace extraction helpers and the integration test that expected 401 when header and body workspaces disagree are removed.

Web handler tests are updated so workspace-scoped token scenarios explicitly put the hosted workspace on x-evalops-workspace-id when x-workspace-id carries a different value, matching EvalOps-first header ordering used in the Node handler.

^{Reviewed by Cursor Bugbot for commit aeac003. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: Workspace header precedence mismatch
  • Restored Node A2A push handling to prefer x-evalops-workspace-id over x-workspace-id and added regression coverage for conflicting headers.
• ✅ Fixed: Rust drops payload workspace binding
  • Reinstated Rust workspace-scoped token binding against the payload-derived workspace context and added a mismatch regression test.

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 569cf4a. Configure here.}