chore: sync public mirror from internal

[evalops-mirror]

Summary

• sync the sanitized public tree from evalops/maestro-internal
• keep evalops/maestro as a generated public mirror of the private source of truth
• preserve public-owned CI and trusted-publishing workflows from the public checkout
• internal source SHA: 93b00336165e2f50a9efc4afc1ed66c61eac107a
• last generated public sync base: 03ba66ec12e8841c2e63b4ea18b154dff5e2980f
• previewed public-tree drift: 221 file(s) to copy/update and 28 stale file(s) to delete
• public-only commits since last generated sync: 1

Source-of-truth status

Public Mirror Drift Audit

• package: @evalops/maestro
• private source: https://github.com/evalops/maestro-internal@main (93b00336165e)
• public projection: https://github.com/evalops/maestro@main (bf08782aeaa6)
• files to copy or update: 221
• stale files to delete: 28
• result: drift detected
• invariant: public_projection_has_drift

Sample Changed Paths

• copy/update .github/actions/release-context/action.yml
• copy/update .github/actions/setup-rust/action.yml
• copy/update .github/pull_request_template.md
• copy/update .gitignore
• copy/update AGENTS.md
• copy/update Cargo.lock
• copy/update Cargo.toml
• copy/update Dockerfile
• copy/update Makefile
• copy/update SECURITY.md
• copy/update deny.toml
• copy/update docs/AGENT_INTERNALS.md
• copy/update docs/CONDUCTOR_BRIDGE.md
• copy/update docs/CONTRIBUTOR_RUNBOOK.md
• copy/update docs/CONVENTIONS/agent-citations.md
• copy/update docs/CUSTOM_AGENTS.md
• copy/update docs/MCP_GUIDE.md
• copy/update docs/MODELS.md
• copy/update docs/NATIVE_INTEROP_AND_EXTENSIONS.md
• copy/update docs/PROMPT_QUEUE.md
• copy/update docs/SAFETY.md
• copy/update docs/THREAT_MODEL.md
• copy/update docs/VSCODE_ARCHITECTURE.md
• copy/update docs/design/AGENT_RUNTIME_TASK_MAPPING.md
• copy/update docs/design/AGENT_STATE_MACHINE.md
• ... 224 more

Guidance

Let internal main generate and merge the public sync PR before relying on public main.

Drift sample

• copy/update .github/actions/release-context/action.yml
• copy/update .github/actions/setup-rust/action.yml
• copy/update .github/pull_request_template.md
• copy/update .gitignore
• copy/update AGENTS.md
• copy/update Cargo.lock
• copy/update Cargo.toml
• copy/update Dockerfile
• copy/update Makefile
• copy/update SECURITY.md
• copy/update deny.toml
• copy/update docs/AGENT_INTERNALS.md
• copy/update docs/CONDUCTOR_BRIDGE.md
• copy/update docs/CONTRIBUTOR_RUNBOOK.md
• copy/update docs/CONVENTIONS/agent-citations.md
• copy/update docs/CUSTOM_AGENTS.md
• copy/update docs/MCP_GUIDE.md
• copy/update docs/MODELS.md
• copy/update docs/NATIVE_INTEROP_AND_EXTENSIONS.md
• copy/update docs/PROMPT_QUEUE.md

Public-only commits since last generated sync

• bf08782 ci: parallelize native validation (ci: parallelize native validation #882)

Validation

• generated by the sync-public-release-mirror workflow in public-tree mode

Test Plan

• generated by the sync-public-release-mirror workflow in public-tree mode
• public-source-provenance require-internal-pr check confirms internal source PR lineage
• CI, integration, rust-hosted-conformance, coverage, Socket, and Cursor checks must pass before merge
• Do not merge until Cursor Bugbot review completes — Bugbot catches bugs that CI guardrails may not cover yet. If Bugbot finds issues, address them on this branch before merging.

Staged Rollout

• Staging is unnecessary for this generated mirror PR: it does not independently promote user-visible behavior. It mirrors already-reviewed internal source from evalops/maestro-internal@93b00336165e2f50a9efc4afc1ed66c61eac107a, including existing hidden/evaluation surfaces, and keeps public package parity behind the established public-source-provenance gate.

Supersedes

• updates existing generated public sync PR chore: sync public mirror from internal #886 to internal source 93b00336165e2f50a9efc4afc1ed66c61eac107a

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​tree-sitter@​0.25.10
	cargo/​tree-sitter-bash@​0.25.1
	cargo/​uncurses@​0.0.1
	cargo/​pdf-extract@​0.7.12 ⏵ 0.12.0

View full report

[devin-ai-integration]

Devin Review found 6 potential issues.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 64e80dfe5e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4121e8f9a4

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Remove the stale Bazel RBE workflow entrypoints

When the Bazel targets are removed here, the still-present .github/workflows/bazel-rbe.yml continues to run make bazel-check and make bazel-rbe-smoke on manual dispatch and on main pushes when BAZEL_RBE_ENABLED is true; I checked make -n bazel-check in this tree and it now exits with No rule to make target 'bazel-check'. This means the next enabled/manual Bazel RBE run fails before doing useful validation unless the workflow is removed or retargeted along with these Makefile deletions.

Useful? React with 👍 / 👎.