chore: sync public mirror from internal

[haasonsaas]

Summary

• sync the sanitized public tree from evalops/maestro-internal
• keep evalops/maestro as a generated public mirror of the private source of truth
• preserve public-owned CI and trusted-publishing workflows from the public checkout
• internal source SHA: 9a6ae0f9ff2cebeea0b65088fb346acc5abcdde7
• last generated public sync base: d74e169b3ff16d74a62558f91ff002b49d103f4b
• previewed public-tree drift: 34 file(s) to copy/update and 2 stale file(s) to delete
• public-only commits since last generated sync: 2

Source-of-truth status

Public Mirror Drift Audit

• package: @evalops/maestro
• private source: https://github.com/evalops/maestro-internal@main (9a6ae0f9ff2c)
• public projection: https://github.com/evalops/maestro@main (29fc6cccb370)
• files to copy or update: 34
• stale files to delete: 2
• result: drift detected
• invariant: public_projection_has_drift

Sample Changed Paths

• copy/update .github/dependabot.yml
• copy/update .husky/pre-commit
• copy/update CHANGELOG.md
• copy/update openapi.json
• copy/update package.json
• copy/update packages/ai/package.json
• copy/update packages/consumer-sdk/package.json
• copy/update packages/contracts/package.json
• copy/update packages/core/package.json
• copy/update packages/desktop/package.json
• copy/update packages/github-agent/package.json
• copy/update packages/github-agent/src/workflows/maestro-review-workflow.test.ts
• copy/update packages/github-agent/src/workflows/maestro-review-workflow.ts
• copy/update packages/governance-mcp-server/package.json
• copy/update packages/governance/package.json
• copy/update packages/memory/package.json
• copy/update packages/slack-agent-ui/package.json
• copy/update packages/slack-agent/package.json
• copy/update packages/tui/package.json
• copy/update packages/vscode-extension/package.json
• copy/update packages/web/package.json
• copy/update scripts/pr-feedback-audit.mjs
• copy/update src/agent/swarm/executor.ts
• copy/update src/agent/validation-contract.ts
• copy/update src/installers/maestro-review-workflow.ts
• ... 11 more

Guidance

Let internal main generate and merge the public sync PR before relying on public main.

Drift sample

• copy/update .github/dependabot.yml
• copy/update .husky/pre-commit
• copy/update CHANGELOG.md
• copy/update openapi.json
• copy/update package.json
• copy/update packages/ai/package.json
• copy/update packages/consumer-sdk/package.json
• copy/update packages/contracts/package.json
• copy/update packages/core/package.json
• copy/update packages/desktop/package.json
• copy/update packages/github-agent/package.json
• copy/update packages/github-agent/src/workflows/maestro-review-workflow.test.ts
• copy/update packages/github-agent/src/workflows/maestro-review-workflow.ts
• copy/update packages/governance-mcp-server/package.json
• copy/update packages/governance/package.json
• copy/update packages/memory/package.json
• copy/update packages/slack-agent-ui/package.json
• copy/update packages/slack-agent/package.json
• copy/update packages/tui/package.json
• copy/update packages/vscode-extension/package.json

Public-only commits since last generated sync

• 29fc6cc chore: sync release mirror for main
• 0a3cef9 chore: sync release mirror for main

Validation

• generated by the sync-public-release-mirror workflow in public-tree mode

Test Plan

• generated by the sync-public-release-mirror workflow in public-tree mode
• public-source-provenance require-internal-pr check confirms internal source PR lineage
• CI, integration, rust-hosted-conformance, coverage, Socket, and Cursor checks must pass before merge
• Do not merge until Cursor Bugbot review completes — Bugbot catches bugs that CI guardrails may not cover yet. If Bugbot finds issues, address them on this branch before merging.

Staged Rollout

• Staging is unnecessary for this generated mirror PR: it does not independently promote user-visible behavior. It mirrors already-reviewed internal source from evalops/maestro-internal@9a6ae0f9ff2cebeea0b65088fb346acc5abcdde7, including existing hidden/evaluation surfaces, and keeps public package parity behind the established public-source-provenance gate.

Supersedes

• updates existing generated public sync PR chore: sync public mirror from internal #817 to internal source 9a6ae0f9ff2cebeea0b65088fb346acc5abcdde7

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.