chore: sync public mirror from internal

[haasonsaas]

Summary

• sync the sanitized public tree from evalops/maestro-internal
• keep evalops/maestro as a generated public mirror of the private source of truth
• preserve public-owned CI and trusted-publishing workflows from the public checkout
• internal source SHA: 8841ce66b1f96e5b5fa928bc6dbcdf4d253c16bd
• last generated public sync base: 47dd9a179bdfad928fb43bc674aefc03e52e1dc2
• previewed public-tree drift: 7 file(s) to copy/update and 1 stale file(s) to delete
• public-only commits since last generated sync: 1

Source-of-truth status

Public Mirror Drift Audit

• package: @evalops/maestro
• private source: https://github.com/evalops/maestro-internal@main (8841ce66b1f9)
• public projection: https://github.com/evalops/maestro@main (7be869fd63ad)
• files to copy or update: 7
• stale files to delete: 1
• result: drift detected
• invariant: public_projection_has_drift

Sample Changed Paths

• copy/update .github/BUGBOT.md
• copy/update .github/actions/setup-rust/action.yml
• copy/update packages/control-plane-rs/src/a2a/ledger.rs
• copy/update packages/control-plane-rs/src/tests.rs
• copy/update scripts/check-guardrail-regression-suite.mjs
• copy/update scripts/guardrail-regression-suite.json
• copy/update test/workflows/tag-release.test.ts
• delete test/scripts/check-guardrail-regression-suite-entry.test.ts

Guidance

Let internal main generate and merge the public sync PR before relying on public main.

Drift sample

• copy/update .github/BUGBOT.md
• copy/update .github/actions/setup-rust/action.yml
• copy/update packages/control-plane-rs/src/a2a/ledger.rs
• copy/update packages/control-plane-rs/src/tests.rs
• copy/update scripts/check-guardrail-regression-suite.mjs
• copy/update scripts/guardrail-regression-suite.json
• copy/update test/workflows/tag-release.test.ts
• delete test/scripts/check-guardrail-regression-suite-entry.test.ts

Public-only commits since last generated sync

• 7be869f chore: sync release mirror for main

Validation

• generated by the sync-public-release-mirror workflow in public-tree mode

Test Plan

• generated by the sync-public-release-mirror workflow in public-tree mode
• public-source-provenance require-internal-pr check confirms internal source PR lineage
• CI, integration, rust-hosted-conformance, coverage, Socket, and Cursor checks must pass before merge
• Do not merge until Cursor Bugbot review completes — Bugbot catches bugs that CI guardrails may not cover yet. If Bugbot finds issues, address them on this branch before merging.

Staged Rollout

• Staging is unnecessary for this generated mirror PR: it does not independently promote user-visible behavior. It mirrors already-reviewed internal source from evalops/maestro-internal@8841ce66b1f96e5b5fa928bc6dbcdf4d253c16bd, including existing hidden/evaluation surfaces, and keeps public package parity behind the established public-source-provenance gate.

Supersedes

• updates existing generated public sync PR chore: sync public mirror from internal #792 to internal source 8841ce66b1f96e5b5fa928bc6dbcdf4d253c16bd

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[cursor]

PR Summary

Medium Risk
Touches A2A task history merge semantics and release dispatch idempotency checks; changes are targeted but affect control-plane ledger behavior and release automation.

Overview
Docs & CI: Adds .github/BUGBOT.md with guidance for avoiding push races when Bugbot Autofix commits to PR branches. The shared Setup Rust action now exports CARGO_NET_RETRY=5 and CARGO_HTTP_TIMEOUT=30 to reduce flaky crates.io failures in CI.

A2A ledger: a2a_merge_history_parts now drops any existing part that has a string text field (via new a2a_history_part_has_text), not only strictly plain-text parts—so decorated parts (e.g. with partId) are replaced on transcript refresh while non-text attachments/data are kept. Tests assert stale partId text is not preserved.

Guardrails: Extends the regression manifest and REQUIRED_GUARDRAIL_IDS with five bug classes (A2A cancel canonical state, compound secret redaction, history rich-part refresh, learner transient quarantine, learner promote/repair consistency). The guardrail check script’s direct-run guard uses pathToFileURL(process.argv[1]) only; the Vitest entrypoint test for that script is removed.

Release workflow: Tag-release dispatch confirmation compares latest vs existing workflow run IDs with numeric -gt (and existing_latest_run_id:-0) instead of string inequality, with a matching workflow test update.

^{Reviewed by Cursor Bugbot for commit c260aed. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue. You can view the agent here.}

^{Reviewed by Cursor Bugbot for commit cbb6854. Configure here.}