fix: fence Work claims during provider switches - #114
Merged
Conversation
Co-Authored-By: Codex <codex@openai.com>
0thernet
added a commit
that referenced
this pull request
Sep 6, 2026
## Summary - Add the official local Devin CLI as an isolated ACP v1 provider, pinned to CLI 3000.6.14 and `gpt-6-astra`. - Support foreground provider-owned login, native session creation/loading, text prompts, bounded transcript/tool/permission projection, cancellation, and supplied context usage/session cost. - Extend provider selectors, durable authority, additive SQLite v39 migration, cloud payloads, and explicit unsupported-operation guards. Preserve the Astra Codex defaults and historical preset contracts from #112 and the Work/provider-switch interlock from #114. - Keep subscription allowance/reset data explicitly unknown when Devin does not expose it. No credential reads, hidden paid usage prompts, account rotation, or raw thought projection. ## Review hardening Regression-first review repaired auth cancellation races, blocked-write cancellation, input queue bounds, duplicate permission decisions, credential/path redaction, queued-turn handoff, benign ACP update handling, and cumulative omission accounting. Optional-provider registry observations are decoupled from unrelated device commands. Invalid acceptance configuration, descriptors, and bounded receipt payloads now reject before touching machine-wide recovery, while valid execution retains the mandatory recovery gate. ## Verification - Focused auth: 9 passing tests. - Focused ACP client/protocol: 26 passing tests. - Focused Devin runtime adapter: 17 passing tests. - Focused Claude runtime adapter: 25 passing tests, including cancellation propagation. - Rebased historical/v39 migration checks: 7 passing tests. - Post-#114 Work/provider-switch and historical migration checks: 16 passing tests. - Cloud adapter regression suite: 82 passing tests. - Live-acceptance scenarios: 49 passing tests, including 11 regression-first invalid resume cases. - Focused browser tests: 18 passing; the local-only Devin login contract and strict URL policy are retained. - Complete affected service/storage suites: 452 passing; complete web/backend suites: 723 passing. - Receipt integration tests: 15 passing; a scoped test-only timeout repair removes a reproduced timeout/console-capture cascade without changing runtime limits or security assertions. - Focused lint and diff checks passed. - Installed CLI zero-token smoke passed: exact version, signed-out auth status, Astra startup, ACP v1, session loading advertised. - Exact-tree `bun run check` passed at `116767f8a7e1c850ee47df91c9e8cdb46428eae2`: installer pins, security inventory, lint, TypeScript, all test suites, generated-site check, app/CLI/site builds, complete governed-history package policy, isolated local/global installs, restored PTY shell, and global daemon lifecycle. Production-source suite: 2,401 passed; no test failures. - Independent review: exact commit `116767f8a7e1c850ee47df91c9e8cdb46428eae2`, tree `70f332439de23154382cd683191e5a9265fd5701`, no remaining findings. ## Limits No signed-in paid prompt was exercised. Live turn/tool/permission/cancellation/usage paths remain fixture-verified until a signed-in profile is available. Devin web login, attachments, in-turn steering, Fast tier, and subscription reset operations are intentionally unsupported. Co-authored-by: 0thernet <ben@substrate.run> Co-authored-by: Codex <codex@openai.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Why
The post-merge audit of #112 found a race in which a Work attempt could be claimed after provider-switch preflight but before the final route commit. The switch could then start and seed its target and release its source before SQLite rejected the rebind. The repair makes exclusion bidirectional at the durable SQLite boundary and keeps the service-layer checks for early, effect-free refusal.
This remains schema v38. Global attention delivery is still disabled by absence, no canary is enabled, and Phase 8C remains unstarted.
Validation
bun run checkpassed atbaa235b4d2201a0055ed151ff8cdc9300ef656e1, including all repository tests, builds, package policy, isolated local and global installs, restored PTY shell, and global daemon lifecycle