chore: sync public mirror from internal

[evalops-mirror]

Summary

• sync the sanitized public tree from dx-corp/mono
• keep dx-corp/code as a generated public mirror of the private source of truth
• preserve public-owned CI and trusted-publishing workflows from the public checkout
• internal source SHA: 7ecee9b80257e93dd5ef17507266fa3268d6c407
• last generated public sync base: 5c545abe1956f271d1b8208dae40691248a37cf6
• previewed public-tree drift: 12 file(s) to copy/update and 0 stale file(s) to delete
• public-only commits since last generated sync: 0
• to pause generated syncs while hand-editing this branch, apply the sync-hold label to this PR; the sync workflow skips every push while it is set

Source-of-truth status

Projection: deixic-code

• Source: dx-corp/mono@7ecee9b80257e93dd5ef17507266fa3268d6c407

• Prior destination base: da7411a

• Content SHA-256: 2813efeb2fb9cae2d6ce2552d6c0f953c76911942cd8b48a97c7115c5ee92b7e

• Result: drift_detected; 12 changed, 0 deleted

• Destination-owned content is preserved. Destination CI is a separate health signal.

• copy/update .repository-projection.json

• copy/update Cargo.lock

• copy/update deny.toml

• copy/update packages/ambient-agent-rs/Cargo.toml

• copy/update packages/ambient-agent-rs/src/main.rs

• copy/update packages/maestro-rs/Cargo.toml

• copy/update packages/maestro-rs/src/main.rs

• copy/update packages/runtime-gateway-rs/Cargo.toml

• copy/update packages/runtime-gateway-rs/src/main.rs

• copy/update packages/tui-rs/src/bin/hosted_runner_conformance_fixture.rs

• copy/update packages/tui-rs/src/bin/maestro_hosted_runner.rs

• copy/update packages/tui-rs/src/main.rs

Drift sample

• copy/update .repository-projection.json
• copy/update Cargo.lock
• copy/update deny.toml
• copy/update packages/ambient-agent-rs/Cargo.toml
• copy/update packages/ambient-agent-rs/src/main.rs
• copy/update packages/maestro-rs/Cargo.toml
• copy/update packages/maestro-rs/src/main.rs
• copy/update packages/runtime-gateway-rs/Cargo.toml
• copy/update packages/runtime-gateway-rs/src/main.rs
• copy/update packages/tui-rs/src/bin/hosted_runner_conformance_fixture.rs
• copy/update packages/tui-rs/src/bin/maestro_hosted_runner.rs
• copy/update packages/tui-rs/src/main.rs

Public-only commits since last generated sync

• none detected since last generated sync

Validation

• generated by the sync-public-release-mirror workflow in public-tree mode

Test Plan

• generated by the maestro-sync-public-release-mirror workflow in public-tree mode
• public-source-provenance require-internal-pr confirms internal source PR lineage
• generated mirror PRs use the slim public CI path (fmt/clippy/smoke + provenance); full cargo test/evals already ran on internal main for this SHA
• bot review threads on generated mirror PRs are advisory and do not block the next sync update

Staged Rollout

• Staging is unnecessary for this generated mirror PR: it does not independently promote user-visible behavior. It mirrors already-reviewed internal source from dx-corp/mono@7ecee9b80257e93dd5ef17507266fa3268d6c407, including existing hidden/evaluation surfaces, and keeps public package parity behind the established public-source-provenance gate.

Supersedes

• updates existing generated public sync PR chore: sync public mirror from internal #1393 to internal source 7ecee9b80257e93dd5ef17507266fa3268d6c407

[evalops-mirror]

Resolved 0 review-bot thread(s) on this generated public mirror PR.
Left 0 human-started thread(s) unresolved.

Review of mirrored code belongs on the mono source PR.
See https://github.com/dx-corp/mono/issues/9100 for the triage pattern.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T13:01:15.932993Z	0146472	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5c545abe19

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[evalops-mirror]

Resolved 1 review-bot thread(s) on this generated public mirror PR (chatgpt-codex-connector).
Left 0 human-started thread(s) unresolved.

Review of mirrored code belongs on the mono source PR.
See https://github.com/dx-corp/mono/issues/9100 for the triage pattern.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0146472398

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Record the dependency chain actually present

When this exception is re-reviewed at expiry, the rationale directs maintainers to serde_yaml_ng 0.10.0, but a repo-wide manifest and lockfile check shows no such package: Cargo.lock has serde_yaml 0.9.34+deprecated directly pulling in unsafe-libyaml. Because this reason is the audit trail for deciding whether to extend the security exception, the incorrect package and version can lead to the wrong remediation decision; update the internal source-of-truth entry to describe the locked dependency chain.

AGENTS.md reference: AGENTS.md:L7-L9

Useful? React with 👍 / 👎.