chore: sync public mirror from internal

[evalops-mirror]

Summary

• sync the sanitized public tree from evalops/mono
• keep evalops/maestro as a generated public mirror of the private source of truth
• preserve public-owned CI and trusted-publishing workflows from the public checkout
• internal source SHA: b677c49a9453b0d892bdd4391fa074e52e559d2b
• last generated public sync base: f31d5dbf16f27e0bfd19a528cb379f92a43c2e13
• previewed public-tree drift: 43 file(s) to copy/update and 0 stale file(s) to delete
• public-only commits since last generated sync: 0
• to pause generated syncs while hand-editing this branch, apply the sync-hold label to this PR; the sync workflow skips every push while it is set

Source-of-truth status

Public Mirror Drift Audit

• package: @evalops/deixic-code
• private source: https://github.com/evalops/mono@main (b677c49a9453)
• public projection: https://github.com/evalops/maestro@main (f31d5dbf16f2)
• files to copy or update: 43
• stale files to delete: 0
• result: drift detected
• invariant: public_projection_has_drift

Sample Changed Paths

• copy/update CHANGELOG.md
• copy/update Cargo.lock
• copy/update deny.toml
• copy/update docs/protocols/hosted-runner-contract.md
• copy/update package-lock.json
• copy/update package.json
• copy/update packages/ai-rs/src/anthropic.rs
• copy/update packages/ai-rs/src/google.rs
• copy/update packages/ai-rs/src/kimi.rs
• copy/update packages/ai-rs/src/lib.rs
• copy/update packages/ai-rs/src/openai.rs
• copy/update packages/ai-rs/src/provider_matrix.rs
• copy/update packages/ai-rs/src/transform.rs
• copy/update packages/ai-rs/src/vertex.rs
• copy/update packages/local-host-rs/src/agent/mod.rs
• copy/update packages/local-host-rs/src/headless/messages/tests.rs
• copy/update packages/local-host-rs/src/headless/proto.rs
• copy/update packages/local-host-rs/src/headless/session.rs
• copy/update packages/local-host-rs/src/headless/supervisor.rs
• copy/update packages/local-host-rs/src/headless/supervisor/tests.rs
• copy/update packages/local-host-rs/src/headless/workspace_capabilities.rs
• copy/update packages/local-host-rs/src/headless/workspace_capabilities_test.rs
• copy/update packages/local-host-rs/src/hosted_runner.rs
• copy/update packages/local-host-rs/src/hosted_runner/config.rs
• copy/update packages/local-host-rs/src/hosted_runner/env_aliases.rs
• ... 18 more

Guidance

Let internal main generate and merge the public sync PR before relying on public main.

Drift sample

• copy/update CHANGELOG.md
• copy/update Cargo.lock
• copy/update deny.toml
• copy/update docs/protocols/hosted-runner-contract.md
• copy/update package-lock.json
• copy/update package.json
• copy/update packages/ai-rs/src/anthropic.rs
• copy/update packages/ai-rs/src/google.rs
• copy/update packages/ai-rs/src/kimi.rs
• copy/update packages/ai-rs/src/lib.rs
• copy/update packages/ai-rs/src/openai.rs
• copy/update packages/ai-rs/src/provider_matrix.rs
• copy/update packages/ai-rs/src/transform.rs
• copy/update packages/ai-rs/src/vertex.rs
• copy/update packages/local-host-rs/src/agent/mod.rs
• copy/update packages/local-host-rs/src/headless/messages/tests.rs
• copy/update packages/local-host-rs/src/headless/proto.rs
• copy/update packages/local-host-rs/src/headless/session.rs
• copy/update packages/local-host-rs/src/headless/supervisor.rs
• copy/update packages/local-host-rs/src/headless/supervisor/tests.rs

Public-only commits since last generated sync

• none detected since last generated sync

Validation

• generated by the sync-public-release-mirror workflow in public-tree mode

Test Plan

• generated by the maestro-sync-public-release-mirror workflow in public-tree mode
• public-source-provenance require-internal-pr confirms internal source PR lineage
• generated mirror PRs use the slim public CI path (fmt/clippy/smoke + provenance); full cargo test/evals already ran on internal main for this SHA
• bot review threads on generated mirror PRs are advisory and do not block the next sync force-update

Staged Rollout

• Staging is unnecessary for this generated mirror PR: it does not independently promote user-visible behavior. It mirrors already-reviewed internal source from evalops/mono@b677c49a9453b0d892bdd4391fa074e52e559d2b, including existing hidden/evaluation surfaces, and keeps public package parity behind the established public-source-provenance gate.

Supersedes

• updates existing generated public sync PR chore: sync public mirror from internal #1128 to internal source b677c49a9453b0d892bdd4391fa074e52e559d2b

[evalops-mirror]

Resolved 0 review-bot thread(s) on this generated public mirror PR.
Left 0 human-started thread(s) unresolved.

Review of mirrored code belongs on the mono source PR.
See https://github.com/evalops/mono/issues/9100 for the triage pattern.

[devin-ai-integration]

Devin Review found 2 potential issues.

[evalops-mirror]

Resolved 2 review-bot thread(s) on this generated public mirror PR (devin-ai-integration).
Left 0 human-started thread(s) unresolved.

Review of mirrored code belongs on the mono source PR.
See https://github.com/evalops/mono/issues/9100 for the triage pattern.