Epic: Devin peer participant and lifecycle support for v1.4.0

[jeffhuber]

Part of roadmap #900.

Devin peer participant, hosted lifecycle, context, builder, and reviewer support for v1.4.0

Problem

Code Mower v1.3.1 recognizes Devin as a participant, has a maintained local CLI builder/informational reviewer, and can create and poll hosted Devin v3 release-qualification sessions. It does not yet provide a reusable provider-neutral lifecycle for dispatch, progress, questions, answers, cancellation, recovery, result collection, or PR binding. Coworker context supports only Claude and Codex. The dormant hosted devin reviewer configuration also declares merge authority despite current documentation and calibration policy saying Devin is not promoted.

Outcome

A session started from Claude, Codex, or Devin can select Devin and use the same provider-neutral commands to dispatch a trusted work order, inspect state, answer a clarification, collect a verified PR/result, cancel, and recover after restart. Devin receives the same explicitly authorized Coworker or later Graphify context packet as other participants. Local CLI and hosted API remain distinct transports under one product identity. Both reviewer transports remain informational until calibration independently earns promotion.

Target user surface:

code-mower session dispatch SESSION.json --to devin --role builder --work-order WORK_ORDER --max-acu 2 --apply
code-mower session status SESSION.json --participant devin
code-mower session message SESSION.json --participant devin --message-stdin --apply
code-mower session collect SESSION.json --participant devin --apply
code-mower session cancel SESSION.json --participant devin --apply

Scope and sequence

1. Capability model and safe reviewer posture.
2. Reusable Devin v3 create/get/list-messages/send/terminate/archive client plus lifecycle state machine and uncertain-create reconciliation.
3. Provider-neutral session dispatch, status, message, cancel, collect, persistence, Board state, and recovery.
4. Hosted Devin work-order delivery, exact repository/issue/branch policy, completion schema, PR binding, provenance, and fix rounds.
5. Private context delivery to Devin orchestrator/builder/reviewer roles.
6. Local and hosted exact-head reviewer parity, kept informational pending calibration.
7. Devin host/skill/doctor and optional first-run setup.
8. Qualification and public sanitized scorecard.
9. v1.4.0 release, package rehearsal, campaign, Board refresh, and CodeMower.com metadata upload.

Architecture and safety contract

• Product identity is separate from devin_cli and devin_api_v3 transports.
• Capability declarations cover coordinate, build, review, message, cancel, context, and structured result behavior.
• Normalize lifecycle to received/dispatching/active/waiting-for-user/waiting-for-approval/succeeded/failed/cancelled/creation-unknown.
• Checkpoint before paid create. Reconcile uncertain creation through a unique bounded tag and created-after query; accept exactly one match. Never auto-retry a paid create.
• Require exact repository allowlisting, bounded response sizes/time, explicit --apply, and a positive ACU cap for live work.
• Keep credentials, context, prompts, messages, transcripts, and raw output in protected local state only. Board/cloud receive allowlisted metadata.
• Verify returned repository, issue, PR, author/provenance, and current head before accepting completion.
• Correct hosted reviewer merge authority immediately; selection never promotes a reviewer.

Dependencies

The lifecycle contract must stabilize before substantial Slack runtime work. Graphify #876 may run in parallel. The Graphify packet adapter later reuses the same context-recipient contract.

Delivery protocol

Each child issue produces one PR. Use a named Code Mower builder and an independent reviewer; exact-head evidence, focused tests, full relevant CI, privacy checks, and code-mower/gate are required. Once lane admission lands, use Devin itself for bounded subsequent child deliveries so the epic dogfoods the target capability.

Scorecard

Child	Builder	PR/head	Peer audit	Tests/gate	Live evidence	State
Capability/posture (#904)	Codex	#925 / 5782403b240c3a2512f0f6881d42288b5919bd53	Requested; both configured audit paths disabled	Focused checks pass; CI fixture correction remains local; gate awaits Claude	Metadata-only upload dry run passed; no live upload	needs-owner: Git metadata write denied and audit runner disabled
v3 lifecycle	pending	pending	pending	pending	bounded API	blocked by capability
Session lifecycle	pending	pending	pending	pending	recovery fixture	blocked
Builder/PR binding	pending	pending	pending	pending	bounded delivery	blocked
Context	pending	pending	pending	pending	private canary	blocked
Reviewer parity	pending	pending	pending	pending	calibration	blocked
Setup/doctor	pending	pending	pending	pending	fresh install	blocked
Qualification	pending	pending	pending	pending	scorecard	blocked
Release	pending	pending	pending	pending	v1.4.0	blocked

Definition of done

• Devin has peer-level session hosting, lifecycle control, local and hosted builder use, private context delivery, recoverability, and informational exact-head review.
• Hosted and local transports expose consistent states and safe reason codes while preserving product-specific differences.
• Five bounded delivery samples, two clean reviewer controls, two known-blocked catches, and adjudicated findings are recorded; reviewer authority changes only if the published promotion thresholds are met.
• Claude + Codex remains the initial default; Devin setup is optional and clear.
• v1.4.0 is published and installed, its qualification campaign passes, and allowlisted metadata is visible on CodeMower.com.

Delivery checklist

• Devin: capability model and safe reviewer posture #904 — D1 capability/posture
• Devin: reusable v3 client and lifecycle state machine #905 — D2 v3 lifecycle
• Sessions: provider-neutral remote lifecycle and recovery #906 — D3 provider-neutral sessions
• Devin: hosted builder work-order delivery and verified PR binding #907 — D4 hosted builder/PR binding
• Context: authorize and deliver private packets to Devin roles #908 — D5 private context
• Devin: local and hosted exact-head reviewer parity and calibration #909 — D6 reviewer parity/calibration
• Devin: optional setup, host guidance, and lifecycle doctor #910 — D7 setup/doctor
• Devin: peer-support qualification and public scorecard #911 — D8 qualification/scorecard
• Release: publish and qualify Code Mower v1.4.0 with Devin peer support #912 — D9 v1.4.0 release

[jeffhuber]

Codex delivered #925 for #904 on branch codex/904-devin-capabilities.

Pushed head: 5782403b240c3a2512f0f6881d42288b5919bd53. The PR closes #904 and carries builder:codex and needs-claude-audit.

Implementation: explicit Devin product/local/hosted transport capabilities, informational reviewer defaults, bounded legacy migration validation, session/doctor capability gaps, schema, catalogs, generated setup, and focused regression coverage.

Validation passed locally: 12 capability/migration tests; 24 participant/session tests; Ruff; privacy scan; compileall; actionlint for 12 generated workflows; package workflow guard; easy-mode smoke including a metadata-only cloud upload dry run; release readiness 14/14; materialized package capability/schema checks. The local full-suite run completed: 2,847 tests, 4 errors, 11 skips. It started before the final focused fixes; two errors were fixed in the pushed head and two are the release-hygiene fixture corrections described below. All four affected cases pass in targeted reruns; there is no clean full-suite result yet. GitHub CI found two legacy release-hygiene fixtures that still assumed implicit hosted Devin merge authority. Both fixtures have been corrected locally and their two tests now pass, but the correction is not committed or pushed.

Blocking command: git add tests/test_release_hygiene.py failed with fatal: Unable to create '.../.git/index.lock': Operation not permitted. Per the lane contract, I did not retry or bypass the sandbox. The local fix remains in tests/test_release_hygiene.py in the assigned working copy.

Independent review is also blocked: CODE_MOWER_LOCAL_AUDIT_RUNNER_ENABLED=false; LANE_MAC_RUNNER_ENABLED is unset. Local CLI Audits skipped, and the explicitly requested Claude audit run also skipped: https://github.com/codemower-ai/code-mower/actions/runs/34684538509. code-mower/gate is waiting for Claude. No exact-head Claude verdict has been obtained.

Owner actions:

1. Restore the Codex lane's permission to write its Git metadata, then resume Codex on existing PR Devin: separate transport capabilities and default reviews to informational #925. Preserve the local test-fixture fix and the single-writer branch; commit and push it to the same branch.
2. Enable one configured independent audit runner after confirming its owner-managed setup: either CODE_MOWER_LOCAL_AUDIT_RUNNER_ENABLED=true, or LANE_MAC_RUNNER_ENABLED=true for explicit Claude Mac audit duty. Re-request needs-claude-audit against the resulting current head.
3. Resolve any P0/P1/P2 audit findings, require passing CI and code-mower/gate, then clear needs-owner when these blockers are resolved.

Cloud evidence is a successful local metadata-only upload dry run; no live cloud upload was performed. No credentials, source, diffs, prompts, transcripts, private context, task/message prose, or raw provider output were added to cloud data. .code-mower/lane-outcome.json records owner_action. This unit is stopped; it is not merge-ready.

[jeffhuber]

D1 complete: #904 merged through PR #925 at final head b658d6f0967bafa04251930c6dcaf2e1a4cfd1b7 (merge 3fd6aa7cd2e6ea7c29bd07169a18dc17c60f684b).

Delivered explicit Devin product/transport capabilities, safe informational review defaults, no implicit merge authority, setup/session transport selection, aggregated migration diagnostics, doctor visibility, and schema/catalog consistency. CI passed across Python 3.12/3.13/3.14. Final exact-head Claude audit passed after the builder resolved one parsing regression and one validation-boundary finding; code-mower/gate passed.

D2 #905 is now dispatched to Codex for the reusable v3 lifecycle client. Paid create must remain single-attempt with pre-create reconciliation and credential-free persisted state.

Cloud posture remains metadata-only; no credentials, source, diffs, prompts, transcripts, private context, task/message prose, or raw provider output are eligible for upload.

[jeffhuber]

#905 v3 lifecycle delivery status — Codex builder

Outcome: needs-owner / owner_action, blocked before implementation by the lane sandbox's read-only .git permission. Branch creation was denied; the required owner actions are recorded on #905. Dependency #904 is closed.

• PR/head: no PR; unchanged checkout HEAD 3fd6aa7cd2e6ea7c29bd07169a18dc17c60f684b.
• Review: not run; no implementation commit exists to audit.
• Validation: dependency/checkout/lane/CI inspection only; tests, normal CI, and code-mower/gate remain pending.
• Outcome record: .code-mower/lane-outcome.json contains owner_action and the permission-blocker summary.
• Safe upload evidence: GitHub status metadata only; no live Devin calls or separate cloud upload. No credentials, source, diffs, prompts, transcripts, task/message prose, private context, or raw provider output uploaded.

Implementation and the full delivery protocol remain pending until the owner fixes the runner's Git metadata write permissions and redispatches #905.

[jeffhuber]

D2 complete: #905 closed via PR #927 at head 8ca1b0a2a5af8721c087953e16bfa6e33f82bb1d, merge commit 11c58a3e341be153312251b217a2b5c1f92a1e2f.

Builder: Code Mower Codex. Independent exact-head review: Code Mower Claude PASS. Validation: unittest-only offline endpoint/lifecycle/reconciliation suite on Python 3.12/3.13/3.14, 143 Devin tests, 433 release-campaign tests, 893 broader tests, Ruff, privacy scan, package workflow guard, wheel/sdist build, Twine, and normal CI/gate.

Outcome: reusable organization-scoped v3 create/get/list/send/terminate/archive/reconcile client; paid create checkpointed before request and never automatically retried. D3 #906 is next and will define the provider-neutral remote session contract used by later Devin and Slack work.

[jeffhuber]

Progress after D3

• D1 Devin: capability model and safe reviewer posture #904 / PR Devin: separate transport capabilities and default reviews to informational #925: merged; capability and safe reviewer posture.
• D2 Devin: reusable v3 client and lifecycle state machine #905 / PR devin: add reusable v3 session lifecycle client #927: merged; reusable Devin v3 lifecycle client.
• D3 Sessions: provider-neutral remote lifecycle and recovery #906 / PR Sessions: add provider-neutral remote lifecycle and recovery #928: merged at cad76b3fcf23; provider-neutral dispatch/status/message/cancel/collect and crash recovery.
• Exact-head review for Sessions: add provider-neutral remote lifecycle and recovery #928: Claude PASS at dbede0a7619d.
• Validation: Python 3.12/3.13/3.14 CI, package rehearsal, Gitar, and code-mower/gate passed.
• Metadata-only cloud upload after merge: https://github.com/codemower-ai/code-mower/actions/runs/34688008555
• Active next: D4 Devin: hosted builder work-order delivery and verified PR binding #907, Code Mower Codex builder, trusted work-order delivery and verified PR binding.

No credentials, task prose, provider messages, source, diffs, private context, or raw provider output are included in this progress evidence.

[jeffhuber]

Progress update

• D1 Devin: capability model and safe reviewer posture #904 / PR Devin: separate transport capabilities and default reviews to informational #925 merged.
• D2 Devin: reusable v3 client and lifecycle state machine #905 / PR devin: add reusable v3 session lifecycle client #927 merged.
• D3 Sessions: provider-neutral remote lifecycle and recovery #906 / PR Sessions: add provider-neutral remote lifecycle and recovery #928 merged.
• D4 Devin: hosted builder work-order delivery and verified PR binding #907 / PR Devin: deliver trusted hosted work orders #930 merged after exact-head Claude PASS and green Python 3.12/3.13/3.14, package, Gitar, privacy, and Code Mower gate checks.
• Cloud metadata upload for D4: https://github.com/codemower-ai/code-mower/actions/runs/34689016024
• D5 Context: authorize and deliver private packets to Devin roles #908 is now running through the merged hosted devin_api_v3 work-order lifecycle with a 5-ACU cap and no merge authority. Dispatch evidence: Context: authorize and deliver private packets to Devin roles #908 (comment)

The live D5 dispatch is also bounded acceptance evidence for D4. Its result will be accepted only through the independent GitHub repository/issue/author/branch/exact-head binding and a separate Code Mower peer audit.

[jeffhuber]

Progress after D6

• D1 Devin: capability model and safe reviewer posture #904 through D4 Devin: hosted builder work-order delivery and verified PR binding #907 are merged.
• D6 Devin: local and hosted exact-head reviewer parity and calibration #909 merged through PR Devin: normalize local and hosted review evidence #931 at exact head 945c6223ff04d6776af789667cda8ca279d353b2 after Code Mower Claude PASS and green Python 3.12/3.13/3.14, package, privacy, and Code Mower gate checks.
• Metadata-only cloud upload after the merge: https://github.com/codemower-ai/code-mower/actions/runs/34690077526
• D5 Context: authorize and deliver private packets to Devin roles #908 was delivered by the live hosted Devin work-order path and opened PR Devin: deliver authorized context packets to Devin roles and hosted builder input #932 at d62300a0e14bd051ce6e21ca89c4fc63b748e64c. The branch is being brought current with main; completion still requires lifecycle collection, repository/issue/author/branch/head binding, and an independent exact-head peer audit.

No credentials, context, prompts, messages, source, diffs, transcripts, or raw provider output are included in this progress evidence.

[devin-ai-integration]

D5 #908 progress (round 5)

• Builder: hosted Devin work order, sole writer branch devin/908-context-packets, PR Devin: deliver authorized context packets to Devin roles and hosted builder input #932.
• Current exact head: 7cfaece38fc389360b19193193dfafa262891d29 (contains current origin/main ancestry).
• Independent reviews: Codex audits at cb71a34, bcf5aa1, and a6305bd returned BLOCKED (P2; P2×2; P1+P2). Every finding, plus the supplemental P1 on packet/evidence pairing and the explicit UNKNOWN/paused public projection, is addressed at 7cfaece; the exact-head Codex audit for that head is pending.
• Validation at 7cfaece: privacy scan pass, ruff pass, compileall pass, unittest discover 2978 tests OK (12 skipped), easy-mode smoke pass; normal CI green (package, package_matrix 3.12/3.13/3.14, label, publish gate status); code-mower/gate pending the audit lane.
• Outcome: PR open, not merged; awaiting exact-head audit and gate.

No credentials, context, prompts, messages, source, diffs, transcripts, or raw provider output are included in this progress evidence.