chore: sync public mirror from internal

[evalops-mirror]

Summary

• sync the sanitized public tree from evalops/maestro-internal
• keep evalops/maestro as a generated public mirror of the private source of truth
• preserve public-owned CI and trusted-publishing workflows from the public checkout
• internal source SHA: 8cf6ecfe7d61f85d47c0c6e79b8e3d195cbe1a77
• last generated public sync base: 03ba66ec12e8841c2e63b4ea18b154dff5e2980f
• previewed public-tree drift: 112 file(s) to copy/update and 28 stale file(s) to delete
• public-only commits since last generated sync: 1

Source-of-truth status

Public Mirror Drift Audit

• package: @evalops/maestro
• private source: https://github.com/evalops/maestro-internal@main (8cf6ecfe7d61)
• public projection: https://github.com/evalops/maestro@main (bf08782aeaa6)
• files to copy or update: 112
• stale files to delete: 28
• result: drift detected
• invariant: public_projection_has_drift

Sample Changed Paths

• copy/update .github/actions/setup-rust/action.yml
• copy/update .github/pull_request_template.md
• copy/update .gitignore
• copy/update AGENTS.md
• copy/update Cargo.lock
• copy/update Cargo.toml
• copy/update Dockerfile
• copy/update Makefile
• copy/update deny.toml
• copy/update docs/MODELS.md
• copy/update docs/design/GROK_BUILD_PARITY.md
• copy/update docs/superpowers/plans/2026-07-21-rust-only-runtime-cutover.md
• copy/update package.json
• copy/update packages/ai-rs/Cargo.toml
• copy/update packages/ai-rs/src/anthropic.rs
• copy/update packages/ai-rs/src/app_message.rs
• copy/update packages/ai-rs/src/client.rs
• copy/update packages/ai-rs/src/error.rs
• copy/update packages/ai-rs/src/google.rs
• copy/update packages/ai-rs/src/lib.rs
• copy/update packages/ai-rs/src/op_secret.rs
• copy/update packages/ai-rs/src/openai.rs
• copy/update packages/ai-rs/src/providers.rs
• copy/update packages/ai-rs/src/sanitize.rs
• copy/update packages/ai-rs/src/transform.rs
• ... 115 more

Guidance

Let internal main generate and merge the public sync PR before relying on public main.

Drift sample

• copy/update .github/actions/setup-rust/action.yml
• copy/update .github/pull_request_template.md
• copy/update .gitignore
• copy/update AGENTS.md
• copy/update Cargo.lock
• copy/update Cargo.toml
• copy/update Dockerfile
• copy/update Makefile
• copy/update deny.toml
• copy/update docs/MODELS.md
• copy/update docs/design/GROK_BUILD_PARITY.md
• copy/update docs/superpowers/plans/2026-07-21-rust-only-runtime-cutover.md
• copy/update package.json
• copy/update packages/ai-rs/Cargo.toml
• copy/update packages/ai-rs/src/anthropic.rs
• copy/update packages/ai-rs/src/app_message.rs
• copy/update packages/ai-rs/src/client.rs
• copy/update packages/ai-rs/src/error.rs
• copy/update packages/ai-rs/src/google.rs
• copy/update packages/ai-rs/src/lib.rs

Public-only commits since last generated sync

• bf08782 ci: parallelize native validation (ci: parallelize native validation #882)

Validation

• generated by the sync-public-release-mirror workflow in public-tree mode

Test Plan

• generated by the sync-public-release-mirror workflow in public-tree mode
• public-source-provenance require-internal-pr check confirms internal source PR lineage
• CI, integration, rust-hosted-conformance, coverage, Socket, and Cursor checks must pass before merge
• Do not merge until Cursor Bugbot review completes — Bugbot catches bugs that CI guardrails may not cover yet. If Bugbot finds issues, address them on this branch before merging.

Staged Rollout

• Staging is unnecessary for this generated mirror PR: it does not independently promote user-visible behavior. It mirrors already-reviewed internal source from evalops/maestro-internal@8cf6ecfe7d61f85d47c0c6e79b8e3d195cbe1a77, including existing hidden/evaluation surfaces, and keeps public package parity behind the established public-source-provenance gate.

---

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​uncurses@​0.0.1
	cargo/​pdf-extract@​0.7.12 ⏵ 0.12.0

View full report

[devin-ai-integration]

Devin Review found 6 potential issues.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 64e80dfe5e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Keep later tools behind deferred approvals

When a batch contains an approval-gated call followed by an auto-approved call, this continue leaves the first call in deferred_approval_calls and lets the loop execute or drain later calls before the approval is awaited. For example, a model-emitted write that needs approval followed by a read of the same path will now read the old/missing file before the user approves the write; similarly a gated bash/edit can be reordered relative to later safe calls. The previous in-place wait preserved tool-call order, so subsequent executions should be held until earlier approvals are resolved.

Useful? React with 👍 / 👎.