fix(release): finalize signed native artifacts from Mono

[haasonsaas]

Problem

The public release workflow built unsigned macOS binaries on hosted runners and then failed Developer ID verification. macOS signing and notarization credentials belong to the protected Mono release environment.

Change

Consume staged native artifacts from Mono, authenticate its exact main-branch Cosign identity, and require matching hashes, versions, smoke receipts, and accepted notarization receipts before packaging. Preserve the original Mono source SHA and passports. Public channel signing and npm publication retain their existing credentials. Publication runs after Mono stages artifacts or by explicit version retry; tag creation no longer starts unsigned builds. Preview schedules select existing signed drafts and dispatch the protected main workflow.

The branch includes the generated source from Mono commit 5c3df092ee454e65eba93d3c6718ae7494248f6b (public sync PR #1057). That source contains the verified Gradle stdin fix from evalops/mono#8471: CI now gives the non-interactive client EOF instead of allowing terminal job control to stop it after packaging.

Verification

• 86 release, channel, staged-artifact, and pipeline tests passed locally with GNU coreutils. The Linux-only pseudoterminal case was skipped on macOS and passed in the authoritative Linux suite (24 tests).
• The real Java 21 Gradle build completed all 27 tasks and exited normally with a controlling terminal. Full-workspace Clippy and Rust tests passed in Mono, including protected Buildkite #10873.
• Actionlint passed all three release entrypoints; git diff --check passed.
• The current branch tree 7126ece4ed244c9939115d09a70401d72a22a23e exactly matches the tested merge.
• Signed v0.10.74 artifacts passed Cosign, source-manifest, checksum, notarization, and all four platform smoke-receipt checks. Current-head public CI and registry publication remain required before completion.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T19:46:13.427402Z	7534d28	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: edf38e2775

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d44b3026b3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 45782263d1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f1c64811b1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7534d285da

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

[github-actions]

This PR changes mirrored Maestro source files in the public repo, but it does not link the matching private source-of-truth PR.

Add one of these to the PR body, then re-run the check:

• https://github.com/evalops/maestro-internal/pull/<number>
• evalops/maestro-internal#<number>
• maestro-internal#<number>

Mirrored files touched:

• packages/tui-rs/src/agent/compaction.rs
• packages/tui-rs/src/agent/native.rs
• packages/tui-rs/src/app.rs
• packages/tui-rs/src/app/command_handlers.rs
• packages/tui-rs/src/app/context_breakdown.rs
• packages/tui-rs/src/app/tests.rs
• packages/tui-rs/src/commands/mod.rs
• packages/tui-rs/src/commands/registry.rs
• packages/tui-rs/src/commands/registry/tests.rs
• packages/tui-rs/src/commands/types.rs
• packages/tui-rs/src/components/message.rs
• packages/tui-rs/src/harness.rs
• packages/tui-rs/src/model_dynamics.rs
• packages/tui-rs/src/tools/context_tools.rs
• packages/tui-rs/src/tools/registry.rs
• packages/tui-rs/src/tools/registry/coding_task/dispatcher_tests.rs
• packages/tui-rs/src/tools/registry/tool_registry.rs
• packages/tui-rs/src/tools/subagents.rs
• scripts/check-buildkite-pipeline.test.mjs
• scripts/run-buildkite-jetbrains.sh
• test/fixtures/tui-capture/context-guidance.json

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.