chore: sync public mirror from internal

[evalops-mirror]

Summary

• sync the sanitized public tree from dx-corp/mono
• keep dx-corp/code as a generated public mirror of the private source of truth
• preserve public-owned CI and trusted-publishing workflows from the public checkout
• internal source SHA: 72cf6301da0c563c2873f00cc255dfa1acaa62b4
• last generated public sync base: 05c509f1dc8da64b61c29f2fedb78a366ab4eac6
• previewed public-tree drift: 160 file(s) to copy/update and 0 stale file(s) to delete
• public-only commits since last generated sync: 0
• to pause generated syncs while hand-editing this branch, apply the sync-hold label to this PR; the sync workflow skips every push while it is set

Source-of-truth status

Projection: deixic-code

• Source: dx-corp/mono@72cf6301da0c563c2873f00cc255dfa1acaa62b4

• Prior destination base: 05c509f

• Content SHA-256: b57dd8c902329ff02da9f15d8fca063f8a71533f15e6bcdda4fe4fe996345777

• Result: drift_detected; 160 changed, 0 deleted

• Destination-owned content is preserved. Destination CI is a separate health signal.

• copy/update .repository-projection.json

• copy/update Cargo.lock

• copy/update Cargo.toml

• copy/update packages/codemode-rs/BUILD.bazel

• copy/update packages/codemode-rs/Cargo.toml

• copy/update packages/codemode-rs/README.md

• copy/update packages/codemode-rs/src/lib.rs

• copy/update packages/codemode-rs/src/tests.rs

• copy/update packages/local-host-rs/src/agent/native_host.rs

• copy/update packages/local-host-rs/src/tools/mod.rs

• copy/update packages/local-host-rs/src/tools/registry.rs

• copy/update packages/local-host-rs/src/tools/registry/execute.rs

• copy/update packages/local-host-rs/src/tools/registry/tests.rs

• copy/update packages/local-host-rs/tests/embedding.rs

• copy/update packages/runtime-contracts-rs/src/tool_operation.rs

• copy/update packages/runtime-rs/Cargo.toml

• copy/update packages/runtime-rs/src/agent/native.rs

• copy/update packages/runtime-rs/src/agent/native/codemode.rs

• copy/update packages/runtime-rs/src/agent/native/codex.rs

• copy/update packages/runtime-rs/src/agent/native/context.rs

Drift sample

• copy/update .repository-projection.json
• copy/update Cargo.lock
• copy/update Cargo.toml
• copy/update packages/codemode-rs/BUILD.bazel
• copy/update packages/codemode-rs/Cargo.toml
• copy/update packages/codemode-rs/README.md
• copy/update packages/codemode-rs/src/lib.rs
• copy/update packages/codemode-rs/src/tests.rs
• copy/update packages/local-host-rs/src/agent/native_host.rs
• copy/update packages/local-host-rs/src/tools/mod.rs
• copy/update packages/local-host-rs/src/tools/registry.rs
• copy/update packages/local-host-rs/src/tools/registry/execute.rs
• copy/update packages/local-host-rs/src/tools/registry/tests.rs
• copy/update packages/local-host-rs/tests/embedding.rs
• copy/update packages/runtime-contracts-rs/src/tool_operation.rs
• copy/update packages/runtime-rs/Cargo.toml
• copy/update packages/runtime-rs/src/agent/native.rs
• copy/update packages/runtime-rs/src/agent/native/codemode.rs
• copy/update packages/runtime-rs/src/agent/native/codex.rs
• copy/update packages/runtime-rs/src/agent/native/context.rs

Public-only commits since last generated sync

• none detected since last generated sync

Validation

• generated by the sync-public-release-mirror workflow in public-tree mode

Test Plan

• generated by the maestro-sync-public-release-mirror workflow in public-tree mode
• public-source-provenance require-internal-pr confirms internal source PR lineage
• generated mirror PRs use the slim public CI path (fmt/clippy/smoke + provenance); full cargo test/evals already ran on internal main for this SHA
• bot review threads on generated mirror PRs are advisory and do not block the next sync update

Staged Rollout

• Staging is unnecessary for this generated mirror PR: it does not independently promote user-visible behavior. It mirrors already-reviewed internal source from dx-corp/mono@72cf6301da0c563c2873f00cc255dfa1acaa62b4, including existing hidden/evaluation surfaces, and keeps public package parity behind the established public-source-provenance gate.

[evalops-mirror]

Resolved 0 review-bot thread(s) on this generated public mirror PR.
Left 0 human-started thread(s) unresolved.

Review of mirrored code belongs on the mono source PR.
See https://github.com/dx-corp/mono/issues/9100 for the triage pattern.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​rquickjs@​0.13.0

View full report

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2a850c3678

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Use the public mirror path for agent-codemode

When maestro-dex-host builds its ../../vendor/dex-loop dependency, this path resolves to /workspace/code/vendor/products/maestro/packages/codemode-rs, which does not exist in the public mirror. Consequently a fresh dependency resolution/build of the Dex host (or vendor/dex-loop itself) cannot load agent-codemode; point this dependency at the mirrored packages/codemode-rs location instead.

Useful? React with 👍 / 👎.