feat: add Devin ACP provider

[0thernet]

Summary

• Add the official local Devin CLI as an isolated ACP v1 provider, pinned to CLI 3000.6.14 and gpt-6-astra.
• Support foreground provider-owned login, native session creation/loading, text prompts, bounded transcript/tool/permission projection, cancellation, and supplied context usage/session cost.
• Extend provider selectors, durable authority, additive SQLite v39 migration, cloud payloads, and explicit unsupported-operation guards. Preserve the Astra Codex defaults and historical preset contracts from feat: default Codex to Astra Ultra and stage inactive attention #112 and the Work/provider-switch interlock from fix: fence Work claims during provider switches #114.
• Keep subscription allowance/reset data explicitly unknown when Devin does not expose it. No credential reads, hidden paid usage prompts, account rotation, or raw thought projection.

Review hardening

Regression-first review repaired auth cancellation races, blocked-write cancellation, input queue bounds, duplicate permission decisions, credential/path redaction, queued-turn handoff, benign ACP update handling, and cumulative omission accounting. Optional-provider registry observations are decoupled from unrelated device commands. Invalid acceptance configuration, descriptors, and bounded receipt payloads now reject before touching machine-wide recovery, while valid execution retains the mandatory recovery gate.

Verification

• Focused auth: 9 passing tests.
• Focused ACP client/protocol: 26 passing tests.
• Focused Devin runtime adapter: 17 passing tests.
• Focused Claude runtime adapter: 25 passing tests, including cancellation propagation.
• Rebased historical/v39 migration checks: 7 passing tests.
• Post-fix: fence Work claims during provider switches #114 Work/provider-switch and historical migration checks: 16 passing tests.
• Cloud adapter regression suite: 82 passing tests.
• Live-acceptance scenarios: 49 passing tests, including 11 regression-first invalid resume cases.
• Focused browser tests: 18 passing; the local-only Devin login contract and strict URL policy are retained.
• Complete affected service/storage suites: 452 passing; complete web/backend suites: 723 passing.
• Receipt integration tests: 15 passing; a scoped test-only timeout repair removes a reproduced timeout/console-capture cascade without changing runtime limits or security assertions.
• Focused lint and diff checks passed.
• Installed CLI zero-token smoke passed: exact version, signed-out auth status, Astra startup, ACP v1, session loading advertised.
• Exact-tree bun run check passed at 116767f8a7e1c850ee47df91c9e8cdb46428eae2: installer pins, security inventory, lint, TypeScript, all test suites, generated-site check, app/CLI/site builds, complete governed-history package policy, isolated local/global installs, restored PTY shell, and global daemon lifecycle. Production-source suite: 2,401 passed; no test failures.
• Independent review: exact commit 116767f8a7e1c850ee47df91c9e8cdb46428eae2, tree 70f332439de23154382cd683191e5a9265fd5701, no remaining findings.

Limits

No signed-in paid prompt was exercised. Live turn/tool/permission/cancellation/usage paths remain fixture-verified until a signed-in profile is available. Devin web login, attachments, in-turn steering, Fast tier, and subscription reset operations are intentionally unsupported.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
hra	Ready	Preview	Sep 6, 2026 2:30am UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
hra-app	Ignored		Sep 6, 2026 2:30am UTC

[0thernet]

Final integration evidence

• Merged commit: 27d4722ad10cabb2b459c87cd7012c072cbc7d65.
• Tree: 70f332439de23154382cd683191e5a9265fd5701, byte-identical to independently reviewed candidate 116767f8a7e1c850ee47df91c9e8cdb46428eae2.
• Exact local bun run check passed, including isolated local/global installs, restored PTY shell, and daemon lifecycle.
• PR CI, post-main CI, and post-main CodeQL passed. Both macOS and Ubuntu gates passed. These CI runs completed on attempt 1; no bypasses were used.
• The Git-linked production app deployment is verified at the merged SHA and live at app.hra.sh. The website deployment is READY, but canonical hra.sh has not been manually promoted.
• The exact v39-bearing main source has been handed to PR feat: adopt personal provider sessions #113's adoption owner for v40 convergence. No v0.6.0 tag, npm publication, Convex deployment, or manual alias promotion was performed; coordinated release prerequisites remain outstanding.
• Devin's signed-out, zero-token CLI/ACP smoke passed. Signed-in paid turn/tool/permission/cancellation/usage behavior remains fixture-verified only; account quota/reset data remains explicitly unavailable.