chore: sync public mirror from internal

[evalops-mirror]

Summary

• sync the sanitized public tree from evalops/mono
• keep evalops/maestro as a generated public mirror of the private source of truth
• preserve public-owned CI and trusted-publishing workflows from the public checkout
• internal source SHA: 9fad8a93acc99914a481498f6e24ef9edcf0fb77
• last generated public sync base: acafe0f6539bbf6e8ae001a7932d2a27ec2bee4d
• previewed public-tree drift: 39 file(s) to copy/update and 0 stale file(s) to delete
• public-only commits since last generated sync: 1
• to pause generated syncs while hand-editing this branch, apply the sync-hold label to this PR; the sync workflow skips every push while it is set

Source-of-truth status

Public Mirror Drift Audit

• package: @evalops/deixic-code
• private source: https://github.com/evalops/mono@main (9fad8a93acc9)
• public projection: https://github.com/evalops/maestro@main (008bf475ebea)
• files to copy or update: 39
• stale files to delete: 0
• result: drift detected
• invariant: public_projection_has_drift

Sample Changed Paths

• copy/update CHANGELOG.md
• copy/update Cargo.lock
• copy/update docs/MODELS.md
• copy/update docs/protocols/codex-subagent-dispatch-table-v1.json
• copy/update package-lock.json
• copy/update package.json
• copy/update packages/ai-rs/src/model_capabilities.rs
• copy/update packages/ai-rs/src/openai.rs
• copy/update packages/ambient-agent-rs/src/pr_creator.rs
• copy/update packages/local-host-rs/src/agent/mod.rs
• copy/update packages/local-host-rs/src/agent/native_admission_tests.rs
• copy/update packages/local-host-rs/src/codex_cli.rs
• copy/update packages/local-host-rs/src/config.rs
• copy/update packages/local-host-rs/src/credential_mode.rs
• copy/update packages/local-host-rs/src/doctor.rs
• copy/update packages/local-host-rs/src/headless/remote_transport/tests.rs
• copy/update packages/local-host-rs/src/headless/supervisor/tests.rs
• copy/update packages/local-host-rs/src/headless_server.rs
• copy/update packages/local-host-rs/src/hosted_runner.rs
• copy/update packages/local-host-rs/src/hosted_runner/tests.rs
• copy/update packages/local-host-rs/src/hosted_runner/tests/transport_flush.rs
• copy/update packages/local-host-rs/src/model_catalog.rs
• copy/update packages/local-host-rs/src/model_catalog_data.json
• copy/update packages/maestro-rs/Cargo.toml
• copy/update packages/runtime-gateway-rs/src/a2a/mod.rs
• ... 14 more

Guidance

Let internal main generate and merge the public sync PR before relying on public main.

Drift sample

• copy/update CHANGELOG.md
• copy/update Cargo.lock
• copy/update docs/MODELS.md
• copy/update docs/protocols/codex-subagent-dispatch-table-v1.json
• copy/update package-lock.json
• copy/update package.json
• copy/update packages/ai-rs/src/model_capabilities.rs
• copy/update packages/ai-rs/src/openai.rs
• copy/update packages/ambient-agent-rs/src/pr_creator.rs
• copy/update packages/local-host-rs/src/agent/mod.rs
• copy/update packages/local-host-rs/src/agent/native_admission_tests.rs
• copy/update packages/local-host-rs/src/codex_cli.rs
• copy/update packages/local-host-rs/src/config.rs
• copy/update packages/local-host-rs/src/credential_mode.rs
• copy/update packages/local-host-rs/src/doctor.rs
• copy/update packages/local-host-rs/src/headless/remote_transport/tests.rs
• copy/update packages/local-host-rs/src/headless/supervisor/tests.rs
• copy/update packages/local-host-rs/src/headless_server.rs
• copy/update packages/local-host-rs/src/hosted_runner.rs
• copy/update packages/local-host-rs/src/hosted_runner/tests.rs

Public-only commits since last generated sync

• 008bf47 ci: run maestro CI on GitHub Actions owned runners; retire Buildkite (ci: run maestro CI on GitHub Actions owned runners; retire Buildkite #1123)

Validation

• generated by the sync-public-release-mirror workflow in public-tree mode

Test Plan

• generated by the maestro-sync-public-release-mirror workflow in public-tree mode
• public-source-provenance require-internal-pr confirms internal source PR lineage
• generated mirror PRs use the slim public CI path (fmt/clippy/smoke + provenance); full cargo test/evals already ran on internal main for this SHA
• bot review threads on generated mirror PRs are advisory and do not block the next sync force-update

Staged Rollout

• Staging is unnecessary for this generated mirror PR: it does not independently promote user-visible behavior. It mirrors already-reviewed internal source from evalops/mono@9fad8a93acc99914a481498f6e24ef9edcf0fb77, including existing hidden/evaluation surfaces, and keeps public package parity behind the established public-source-provenance gate.

Supersedes

• updates existing generated public sync PR chore: sync public mirror from internal #1122 to internal source 9fad8a93acc99914a481498f6e24ef9edcf0fb77

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6ce14ec906

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dd392c208e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b0d2a0c9f6

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ae7251ddd3

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5e715c4e10

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[devin-ai-integration]

Devin Review found 2 potential issues.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5975c2d053

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6103733007

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[haasonsaas]

Resolved the 11 review-bot threads to unblock the mirror sync: this PR mirrors code already reviewed and merged in evalops/mono, and the required unresolved-review-threads check had held the public mirror at maestro#1121 since 2026-09-12. The substantive findings are forwarded for triage against the mono source in https://github.com/evalops/mono/issues/9100.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T05:17:32.481158Z	67e64a4	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 67e64a4084

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Normalize the managed namespace before matching shipped routes

When a supported mixed-case route such as EVALOPS/gemini-3.8-flash is selected, ProviderRegistry::descriptor accepts the namespace because it lowercases provider IDs, but these case-sensitive strip_prefix calls leave shipped unset. managed_env then falls back to the session's existing provider and credential instead of the new model's Google route and deixic-llm-gateway-gemini38 credential, so an otherwise valid managed route can be sent through the wrong upstream or fail admission. Canonicalize only the provider namespace before looking up MANAGED_MODELS.

Useful? React with 👍 / 👎.