chore: sync public mirror from internal

[haasonsaas]

Summary

• sync the sanitized public tree from evalops/maestro-internal
• keep evalops/maestro as a generated public mirror of the private source of truth
• preserve public-owned CI and trusted-publishing workflows from the public checkout
• internal source SHA: 5608dcf73bdfc5af1127a3b7978801e4fbdfa2d1
• last generated public sync base: 4ca1799fd53c8aa96219607635a02287c8eb3404
• previewed public-tree drift: 70 file(s) to copy/update and 0 stale file(s) to delete
• public-only commits since last generated sync: 1

Source-of-truth status

Public Mirror Drift Audit

• package: @evalops/maestro
• private source: https://github.com/evalops/maestro-internal@main (5608dcf73bdf)
• public projection: https://github.com/evalops/maestro@main (3feabe7a3fd3)
• files to copy or update: 70
• stale files to delete: 0
• result: drift detected
• invariant: public_projection_has_drift

Sample Changed Paths

• copy/update MODULE.bazel
• copy/update scripts/guardrail-regression-suite.json
• copy/update scripts/prepare-public-release-mirror.mjs
• copy/update src/agent/agent-resume.ts
• copy/update src/agent/mission-artifacts.ts
• copy/update src/agent/providers/codex-app-server.ts
• copy/update src/agent/providers/scripted.ts
• copy/update src/agent/providers/validation.ts
• copy/update src/app-server/daemon-lifecycle-api.ts
• copy/update src/app-server/external-agent-import-api.ts
• copy/update src/app-server/network-governance-api.ts
• copy/update src/app-server/plugin-bundle-api.ts
• copy/update src/app-server/policy-control-api.ts
• copy/update src/app-server/protocol-modes-api.ts
• copy/update src/cli-tui/client-tools/client-tool-controller.ts
• copy/update src/cli-tui/commands/undo-handlers.ts
• copy/update src/cli/commands/a2a.ts
• copy/update src/cli/headless-protocol.ts
• copy/update src/codex/app-server-client.ts
• copy/update src/codex/compatibility.ts
• copy/update src/context/manifest.ts
• copy/update src/conversation/render-model.ts
• copy/update src/evalops/agent-bootstrap.ts
• copy/update src/evalops/agent-mcp-metadata.ts
• copy/update src/mcp/config.ts
• ... 45 more

Guidance

Let internal main generate and merge the public sync PR before relying on public main.

Drift sample

• copy/update MODULE.bazel
• copy/update scripts/guardrail-regression-suite.json
• copy/update scripts/prepare-public-release-mirror.mjs
• copy/update src/agent/agent-resume.ts
• copy/update src/agent/mission-artifacts.ts
• copy/update src/agent/providers/codex-app-server.ts
• copy/update src/agent/providers/scripted.ts
• copy/update src/agent/providers/validation.ts
• copy/update src/app-server/daemon-lifecycle-api.ts
• copy/update src/app-server/external-agent-import-api.ts
• copy/update src/app-server/network-governance-api.ts
• copy/update src/app-server/plugin-bundle-api.ts
• copy/update src/app-server/policy-control-api.ts
• copy/update src/app-server/protocol-modes-api.ts
• copy/update src/cli-tui/client-tools/client-tool-controller.ts
• copy/update src/cli-tui/commands/undo-handlers.ts
• copy/update src/cli/commands/a2a.ts
• copy/update src/cli/headless-protocol.ts
• copy/update src/codex/app-server-client.ts
• copy/update src/codex/compatibility.ts

Public-only commits since last generated sync

• 3feabe7 chore: sync release mirror for main

Validation

• generated by the sync-public-release-mirror workflow in public-tree mode

Test Plan

• generated by the sync-public-release-mirror workflow in public-tree mode
• public-source-provenance require-internal-pr check confirms internal source PR lineage
• CI, integration, rust-hosted-conformance, coverage, Socket, and Cursor checks must pass before merge
• Do not merge until Cursor Bugbot review completes — Bugbot catches bugs that CI guardrails may not cover yet. If Bugbot finds issues, address them on this branch before merging.

Staged Rollout

• Staging is unnecessary for this generated mirror PR: it does not independently promote user-visible behavior. It mirrors already-reviewed internal source from evalops/maestro-internal@5608dcf73bdfc5af1127a3b7978801e4fbdfa2d1, including existing hidden/evaluation surfaces, and keeps public package parity behind the established public-source-provenance gate.

Supersedes

• updates existing generated public sync PR chore: sync public mirror from internal #797 to internal source 5608dcf73bdfc5af1127a3b7978801e4fbdfa2d1

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[cursor]

PR Summary

Medium Risk
Broad mirror sync touches many subsystems, but changes are mostly deduplication and targeted fixes; release-impact behavior affects versioning gates and deserves careful CI validation.

Overview
Generated public mirror sync (~70 files) from internal, including public Bazel module identity evalops_maestro via MODULE.bazel and mirror rewriting in prepare-public-release-mirror.mjs, plus a release-train guardrail for Rust test-module handling.

Release impact filtering now treats edits inside unguarded inline mod tests as package-impacting while still ignoring #[cfg(test)]-gated test modules, with regression coverage and a guardrail entry in guardrail-regression-suite.json.

Behavior fixes: agent transcript list() sorts by recency before applying limit; /checkpoint delete is implemented via ChangeTracker.deleteCheckpoint(); diff hunk apply skips leading context so splices align with the first removal.

Refactors: canonical isRecord in src/utils/json.js replaces many local copies; git URL parsing moves to url-extractor-git.ts. Substantial new unit tests cover resume, checkpoints, smart router, repo map, diff preview, undo, OAuth command keys, A2A work graph, and mirror/release scripts.

^{Reviewed by Cursor Bugbot for commit 52d0f7b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Cfg-gated Rust tests not stripped
  • stripRustTestModules now recognizes cfg(test) attributes across intervening blank/comment lines and regression coverage confirms inline test-only edits stay non-impacting.

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit e25db10. Configure here.}