code-mower 1.0.10__tar.gz → 1.0.11__tar.gz

{code_mower-1.0.10 → code_mower-1.0.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-mower
-Version: 1.0.10
+Version: 1.0.11
 Summary: Multi-reviewer AI code audit orchestration
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/codemower-ai/code-mower
@@ -241,7 +241,7 @@ agent report its actual host posture, exact installed version, doctor result,
 Board URL, and any owner-only click-list before it mutates the repo.
 
 The current package-index announcement entry point is the tagged
-[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v1.0.10/docs/try-in-10-minutes.md)
+[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v1.0.11/docs/try-in-10-minutes.md)
 guide. The v1.0 supervised-pilot release includes the native Board, the
 controller dry-run and policy contract, adoption and upgrade hardening from
 recent install rehearsals, package-index release checks, provider-diversity
@@ -285,6 +285,10 @@ provider-neutral delivery contract with bounded no-change and owner-action
 outcomes, process-group cleanup so a finished provider is not reported as a
 timeout, simpler first-run defaults, host-led participant sessions, and a
 published 20-sample provider calibration scorecard.
+The v1.0.11 patch moves canonical hosted Devin release campaigns onto the
+bounded, pollable Sessions API transport and keeps macOS Claude release
+qualification inside the maintained strict sandbox by using pip's
+TLS-verifying certifi certificate path.
 Package-only users can start from the public package rather than a source
 checkout.
 
@@ -317,7 +321,7 @@ Provider-contract baseline for the next release train:
 
 For release verification,
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the package-index procedure for `v1.0.10` / `code-mower==1.0.10`. The
+the package-index procedure for `v1.0.11` / `code-mower==1.0.11`. The
 GitHub release records the workflow and rehearsal evidence for the exact tag.
 After publication, [Release Qualification](docs/release-qualification.md)
 coordinates provider-specific install and operational checks without treating
@@ -472,6 +476,10 @@ or informational until your own calibration data proves it is useful: Gitar,
 Antigravity/Gemini, Muse, Hermes, CodeRabbit CLI, Cursor
 BugBot, Qodo, Greptile, Devin, local LLMs, and future ACP bridges.
 
+Hosted Devin dispatches use the Devin Sessions API v3. They require a service-user
+`DEVIN_API_KEY`, its opaque `DEVIN_ORG_ID`, and an exact repository acknowledgement
+in `CODE_MOWER_DEVIN_REPOSITORIES`; see `docs/release-qualification.md` for setup.
+
 Gemini CLI and Antigravity are distinct lane ids even though both are Google
 surfaces and may use Gemini model infrastructure. Keep their auth, model
 provenance, calibration evidence, and release notes separate.
@@ -507,8 +515,8 @@ measurement work.
 
 ## Installation Status
 
-The current package-index release baseline is `v1.0.10`, with pinned package
-install spec `code-mower==1.0.10`. Release evidence is recorded on the GitHub
+The current package-index release baseline is `v1.0.11`, with pinned package
+install spec `code-mower==1.0.11`. Release evidence is recorded on the GitHub
 release and in the first-user install rehearsal. The public repository is
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), and
 GitHub releases remain the auditable source for tags, build artifacts, and
@@ -587,6 +595,7 @@ first so local work exercises the same package entrypoint users install.
 - [v1.0.8 Release Notes](docs/v108-release-notes.md)
 - [v1.0.9 Release Notes](docs/v109-release-notes.md)
 - [v1.0.10 Release Notes](docs/v1010-release-notes.md)
+- [v1.0.11 Release Notes](docs/v1011-release-notes.md)
 - [Post-v0.8 Effectiveness Assessment](docs/post-v08-effectiveness-assessment.md)
 - [v1.0.1 Effectiveness Assessment](docs/v101-effectiveness-assessment.md)
 - [Demo Calibration Example](examples/demo-calibration/README.md)

{code_mower-1.0.10 → code_mower-1.0.11}/README.md

@@ -211,7 +211,7 @@ agent report its actual host posture, exact installed version, doctor result,
 Board URL, and any owner-only click-list before it mutates the repo.
 
 The current package-index announcement entry point is the tagged
-[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v1.0.10/docs/try-in-10-minutes.md)
+[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v1.0.11/docs/try-in-10-minutes.md)
 guide. The v1.0 supervised-pilot release includes the native Board, the
 controller dry-run and policy contract, adoption and upgrade hardening from
 recent install rehearsals, package-index release checks, provider-diversity
@@ -255,6 +255,10 @@ provider-neutral delivery contract with bounded no-change and owner-action
 outcomes, process-group cleanup so a finished provider is not reported as a
 timeout, simpler first-run defaults, host-led participant sessions, and a
 published 20-sample provider calibration scorecard.
+The v1.0.11 patch moves canonical hosted Devin release campaigns onto the
+bounded, pollable Sessions API transport and keeps macOS Claude release
+qualification inside the maintained strict sandbox by using pip's
+TLS-verifying certifi certificate path.
 Package-only users can start from the public package rather than a source
 checkout.
 
@@ -287,7 +291,7 @@ Provider-contract baseline for the next release train:
 
 For release verification,
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the package-index procedure for `v1.0.10` / `code-mower==1.0.10`. The
+the package-index procedure for `v1.0.11` / `code-mower==1.0.11`. The
 GitHub release records the workflow and rehearsal evidence for the exact tag.
 After publication, [Release Qualification](docs/release-qualification.md)
 coordinates provider-specific install and operational checks without treating
@@ -442,6 +446,10 @@ or informational until your own calibration data proves it is useful: Gitar,
 Antigravity/Gemini, Muse, Hermes, CodeRabbit CLI, Cursor
 BugBot, Qodo, Greptile, Devin, local LLMs, and future ACP bridges.
 
+Hosted Devin dispatches use the Devin Sessions API v3. They require a service-user
+`DEVIN_API_KEY`, its opaque `DEVIN_ORG_ID`, and an exact repository acknowledgement
+in `CODE_MOWER_DEVIN_REPOSITORIES`; see `docs/release-qualification.md` for setup.
+
 Gemini CLI and Antigravity are distinct lane ids even though both are Google
 surfaces and may use Gemini model infrastructure. Keep their auth, model
 provenance, calibration evidence, and release notes separate.
@@ -477,8 +485,8 @@ measurement work.
 
 ## Installation Status
 
-The current package-index release baseline is `v1.0.10`, with pinned package
-install spec `code-mower==1.0.10`. Release evidence is recorded on the GitHub
+The current package-index release baseline is `v1.0.11`, with pinned package
+install spec `code-mower==1.0.11`. Release evidence is recorded on the GitHub
 release and in the first-user install rehearsal. The public repository is
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), and
 GitHub releases remain the auditable source for tags, build artifacts, and
@@ -557,6 +565,7 @@ first so local work exercises the same package entrypoint users install.
 - [v1.0.8 Release Notes](docs/v108-release-notes.md)
 - [v1.0.9 Release Notes](docs/v109-release-notes.md)
 - [v1.0.10 Release Notes](docs/v1010-release-notes.md)
+- [v1.0.11 Release Notes](docs/v1011-release-notes.md)
 - [Post-v0.8 Effectiveness Assessment](docs/post-v08-effectiveness-assessment.md)
 - [v1.0.1 Effectiveness Assessment](docs/v101-effectiveness-assessment.md)
 - [Demo Calibration Example](examples/demo-calibration/README.md)

{code_mower-1.0.10 → code_mower-1.0.11}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "code-mower"
-version = "1.0.10"
+version = "1.0.11"
 description = "Multi-reviewer AI code audit orchestration"
 requires-python = ">=3.12"
 readme = "README.md"

{code_mower-1.0.10 → code_mower-1.0.11}/src/code_mower/__init__.py

@@ -1,3 +1,3 @@
 """Code Mower package."""
 
-__version__ = "1.0.10"
+__version__ = "1.0.11"

{code_mower-1.0.10 → code_mower-1.0.11}/src/code_mower/campaign_adapters.py

@@ -57,6 +57,7 @@ import argparse
 import copy
 import json
 import os
+import platform
 import shlex
 import shutil
 import subprocess
@@ -174,6 +175,58 @@ def _claude_sandbox_settings(package_source: str) -> dict[str, Any]:
             "network": {"allowedDomains": list(allowed_domains)},
         },
     }
+
+
+#: Strips ambient pip configuration from the disposable qualification install:
+#: no inherited index URLs, no user/site pip configuration file, and pip's own
+#: ``--isolated`` mode for every other ambient setting.
+PIP_AMBIENT_CONFIG_STRIP = "env -u PIP_INDEX_URL -u PIP_EXTRA_INDEX_URL PIP_CONFIG_FILE=/dev/null"
+PIP_ISOLATED_BASE = f"{PIP_AMBIENT_CONFIG_STRIP} .venv/bin/python -m pip --isolated"
+PIP_DEFAULT_BASE = ".venv/bin/python -m pip"
+#: pip 24.2+ verifies certificates through the platform trust store. On macOS
+#: that path calls Security.framework, which the maintained strict Claude OS
+#: sandbox denies (``OSStatus -26276``) even with the package index allowlisted.
+#: ``legacy-certs`` keeps TLS verification fully enabled: it only moves pip back
+#: to its bundled certifi trust store, which needs no Security.framework call.
+PIP_LEGACY_CERTS_FLAG = "--use-deprecated=legacy-certs"
+
+
+def claude_macos_certificate_path_required(provider: str, *, platform_system: str = "") -> bool:
+    """True only for a Claude campaign run on macOS.
+
+    This is the exact scope of the upstream Claude Code macOS sandbox
+    certificate-validation defect. Linux Claude runs and every other provider
+    keep pip's default certificate path.
+    """
+    system = platform_system or platform.system()
+    return provider == "claude" and system.strip().lower() == "darwin"
+
+
+def build_qualification_pip_command(
+    *,
+    provider: str,
+    package_source: str = DEFAULT_PACKAGE_SOURCE,
+    platform_system: str = "",
+) -> str:
+    """Return the pip command the qualification prompt tells the agent to run.
+
+    A macOS Claude run always gets the ambient-configuration strip as well as
+    :data:`PIP_LEGACY_CERTS_FLAG`, so the certificate path is chosen by this
+    adapter rather than by whatever pip configuration happens to be on the
+    host.
+    """
+    legacy_certs = claude_macos_certificate_path_required(
+        provider, platform_system=platform_system
+    )
+    if package_source == "testpypi" or legacy_certs:
+        command = PIP_ISOLATED_BASE
+    else:
+        command = PIP_DEFAULT_BASE
+    if legacy_certs:
+        command = f"{command} {PIP_LEGACY_CERTS_FLAG}"
+    return command
+
+
 ANTIGRAVITY_MODEL_ENV_NAMES = ("CODE_MOWER_ANTIGRAVITY_MODEL", "ANTIGRAVITY_MODEL")
 ANTIGRAVITY_AMBIENT_HOME_ENV = "ANTIGRAVITY_CLI_USE_AMBIENT_HOME"
 MUSE_MODEL_ENV_NAMES = ("CODE_MOWER_MUSE_MODEL", "MUSE_MODEL", "META_MUSE_MODEL")
@@ -385,6 +438,7 @@ def build_qualification_prompt(
     package_source: str = DEFAULT_PACKAGE_SOURCE,
     python_bin: str = "python3",
     target_runtime: str = "",
+    platform_system: str = "",
 ) -> str:
     """Build the shared release-qualification prompt for one provider run.
 
@@ -394,14 +448,19 @@ def build_qualification_prompt(
     directory it creates itself. ``package_source`` is the closed vocabulary
     (``pypi``/``testpypi``); when it is ``testpypi`` the prompt keeps candidate
     retrieval exclusive to TestPyPI and dependency resolution exclusive to
-    production PyPI.
+    production PyPI. ``platform_system`` defaults to the running host and
+    exists so the macOS-only Claude certificate path is testable off macOS.
     """
     python_cmd = shlex.quote(python_bin or "python3")
+    legacy_certs = claude_macos_certificate_path_required(
+        provider, platform_system=platform_system
+    )
+    pip = build_qualification_pip_command(
+        provider=provider,
+        package_source=package_source,
+        platform_system=platform_system,
+    )
     if package_source == "testpypi":
-        pip = (
-            "env -u PIP_INDEX_URL -u PIP_EXTRA_INDEX_URL PIP_CONFIG_FILE=/dev/null "
-            ".venv/bin/python -m pip --isolated"
-        )
         steps = [
             "1. In the current disposable directory, run "
             f"`{python_cmd} -m venv .venv`. Use only `.venv/bin/python` and installed "
@@ -438,11 +497,11 @@ def build_qualification_prompt(
             "1. In the current disposable directory, run "
             f"`{python_cmd} -m venv .venv`. Use only `.venv/bin/python` and installed "
             "entry points for the remaining steps.\n"
-            f"2. Install the starting version with `.venv/bin/python -m pip install"
+            f"2. Install the starting version with `{pip} install"
             " "
             f"{package_identity}=={starting_version}` to rehearse "
             f"an upgrade from exactly that version.\n"
-            f'3. Upgrade with `.venv/bin/python -m pip install "{package_spec}"`.'
+            f'3. Upgrade with `{pip} install "{package_spec}"`.'
         )
         verification_step = 4
     else:
@@ -450,7 +509,7 @@ def build_qualification_prompt(
             "1. In the current disposable directory, run "
             f"`{python_cmd} -m venv .venv`. Use only `.venv/bin/python` and installed "
             "entry points for the remaining steps.\n"
-            f"2. Install the exact release with `.venv/bin/python -m pip install"
+            f"2. Install the exact release with `{pip} install"
             f' "{package_spec}"`. No other version is acceptable.'
         )
         verification_step = 4
@@ -472,6 +531,27 @@ def build_qualification_prompt(
                 "run and any call to them ends the session without a result.",
             ]
         )
+    if legacy_certs:
+        # macOS-only Claude sandbox defect: pip's default trust store calls
+        # Security.framework, which this sandbox denies (OSStatus -26276).
+        lines.extend(
+            [
+                "Every pip command in the procedure below already carries "
+                f"`{PIP_LEGACY_CERTS_FLAG}`, because pip's default macOS trust",
+                "store is unreachable from this sandbox. Certificate verification",
+                "stays fully enabled; only the trust store changes. If this pip",
+                "build rejects that option as an invalid choice, rerun the identical",
+                "command without it and change nothing else. Never add",
+                "`--trusted-host`, never disable or skip TLS verification, and never",
+                "run any command outside the sandbox. If an install still fails",
+                "certificate verification, report the `package_install` step with",
+                "`failure_reason` `network`: a certificate-validation failure is",
+                "always `network`, never `sandbox_permission` and never",
+                "`package_index`. Use `package_index` only for an index response",
+                "that is not a certificate failure, such as a 404 or a missing",
+                "version.",
+            ]
+        )
     lines.extend(
         [
             "",

code_mower-1.0.11/src/code_mower/devin_api.py

@@ -0,0 +1,259 @@
+#!/usr/bin/env python3
+"""Bounded Devin Sessions API v3 transport for release campaigns."""
+
+from __future__ import annotations
+
+import copy
+import hashlib
+import json
+import os
+import re
+import socket
+import urllib.error
+import urllib.request
+from typing import Any, Callable, Mapping
+
+from .campaign_adapters import (
+    ADOPTION_RESULT_JSON_SCHEMA,
+    DEFAULT_PACKAGE_SOURCE,
+    build_qualification_prompt,
+)
+
+API_BASE = "https://api.devin.ai"
+DEVIN_API_KEY_ENV = "DEVIN_API_KEY"
+DEVIN_ORG_ID_ENV = "DEVIN_ORG_ID"
+DEVIN_REPOSITORIES_ENV = "CODE_MOWER_DEVIN_REPOSITORIES"
+REQUEST_TIMEOUT_SECONDS = 30.0
+MAX_RESPONSE_BYTES = 512 * 1024
+
+_ORG_ID_RE = re.compile(r"^org-[A-Za-z0-9_-]+$")
+# Session ids are opaque API references. Accept any bounded RFC 3986
+# unreserved token instead of assuming Devin will retain one prefix forever.
+_SESSION_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._~-]{0,127}$")
+_REPO_RE = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
+
+SAFE_ERROR_CODES = frozenset(
+    {
+        "devin_api_rejected",
+        "devin_api_unavailable",
+        "devin_session_failed",
+        "devin_waiting_for_owner",
+        "hosted_result_rejected",
+    }
+)
+
+ApiRunner = Callable[[str, str, Mapping[str, Any] | None, Mapping[str, str]], Any]
+
+
+class DevinApiError(Exception):
+    """API failure carrying only a closed, persistence-safe reason code."""
+
+    def __init__(self, code: str) -> None:
+        self.code = code if code in SAFE_ERROR_CODES else "devin_api_unavailable"
+        super().__init__(self.code)
+
+
+def _validate_org_id(org_id: str) -> bool:
+    return bool(_ORG_ID_RE.fullmatch(org_id))
+
+
+def _validate_session_id(session_id: str) -> bool:
+    return bool(_SESSION_ID_RE.fullmatch(session_id))
+
+
+def repository_scope_acknowledged(
+    repo_slug: str,
+    *,
+    env: Mapping[str, str] | None = None,
+) -> bool:
+    """Require an exact local acknowledgement for the requested GitHub repo.
+
+    Devin v3 accepts an exact ``repos`` list on create but exposes no read-only
+    endpoint that proves GitHub connection scope before paid work starts. This
+    local acknowledgement closes that gap. The full configured inventory is
+    never returned, printed, persisted, or uploaded.
+    """
+    if not _REPO_RE.fullmatch(repo_slug):
+        return False
+    current_env = os.environ if env is None else env
+    configured = {
+        item.strip().casefold()
+        for item in str(current_env.get(DEVIN_REPOSITORIES_ENV) or "").split(",")
+        if item.strip()
+    }
+    return repo_slug.casefold() in configured
+
+
+def credentials_from_env(
+    env: Mapping[str, str] | None = None,
+) -> tuple[str, str, str]:
+    """Return ``(api_key, org_id, missing_variable)`` without logging values."""
+    current_env = os.environ if env is None else env
+    api_key = str(current_env.get(DEVIN_API_KEY_ENV) or "").strip()
+    org_id = str(current_env.get(DEVIN_ORG_ID_ENV) or "").strip()
+    if not api_key:
+        return "", "", DEVIN_API_KEY_ENV
+    if not org_id:
+        return "", "", DEVIN_ORG_ID_ENV
+    if not _validate_org_id(org_id):
+        return "", "", DEVIN_ORG_ID_ENV
+    return api_key, org_id, ""
+
+
+def make_api_request(
+    method: str,
+    path: str,
+    api_key: str,
+    body: Mapping[str, Any] | None = None,
+    *,
+    api_runner: ApiRunner | None = None,
+    request_timeout: float = REQUEST_TIMEOUT_SECONDS,
+) -> dict[str, Any]:
+    """Make one request and return a bounded JSON object.
+
+    The injected runner keeps tests entirely offline. Raw error bodies and
+    exception messages never cross this boundary.
+    """
+    url = f"{API_BASE}{path}"
+    headers = {"Authorization": f"Bearer {api_key}", "Accept": "application/json"}
+    if body is not None:
+        headers["Content-Type"] = "application/json"
+    try:
+        if api_runner is not None:
+            value = api_runner(method, url, body, headers)
+        else:
+            encoded = (
+                json.dumps(dict(body), separators=(",", ":")).encode("utf-8")
+                if body is not None
+                else None
+            )
+            request = urllib.request.Request(url, data=encoded, headers=headers, method=method)
+            with urllib.request.urlopen(request, timeout=request_timeout) as response:
+                raw = response.read(MAX_RESPONSE_BYTES + 1)
+            if len(raw) > MAX_RESPONSE_BYTES:
+                raise DevinApiError("devin_api_unavailable")
+            value = json.loads(raw.decode("utf-8"))
+    except DevinApiError:
+        raise
+    except urllib.error.HTTPError as exc:
+        code = "devin_api_rejected" if 400 <= exc.code < 500 else "devin_api_unavailable"
+        raise DevinApiError(code) from exc
+    except (urllib.error.URLError, socket.timeout, TimeoutError, OSError, ValueError) as exc:
+        raise DevinApiError("devin_api_unavailable") from exc
+    if not isinstance(value, dict):
+        raise DevinApiError("devin_api_unavailable")
+    return dict(value)
+
+
+def build_devin_session_payload(
+    *,
+    campaign_id: str,
+    release_tag: str,
+    package_spec: str,
+    package_identity: str,
+    normalized_version: str,
+    qualification_context: str,
+    starting_version: str,
+    repo_slug: str,
+    package_source: str = DEFAULT_PACKAGE_SOURCE,
+    target_runtime: str = "",
+) -> dict[str, Any]:
+    """Build the exact-repo create body using Devin's v3 field names."""
+    if not _REPO_RE.fullmatch(repo_slug):
+        raise ValueError("repo_slug must be OWNER/REPO")
+    prompt = build_qualification_prompt(
+        provider="devin",
+        release_tag=release_tag,
+        package_spec=package_spec,
+        package_identity=package_identity,
+        normalized_version=normalized_version,
+        qualification_context=qualification_context,
+        starting_version=starting_version,
+        package_source=package_source,
+        python_bin="python3",
+        target_runtime=target_runtime,
+    )
+    reconciliation_tag = hashlib.sha256(
+        f"{campaign_id}:{release_tag}:{repo_slug}".encode("utf-8")
+    ).hexdigest()[:16]
+    return {
+        "prompt": prompt,
+        "repos": [repo_slug],
+        "structured_output_required": True,
+        "structured_output_schema": copy.deepcopy(ADOPTION_RESULT_JSON_SCHEMA),
+        "tags": ["code-mower", "release-qualification", f"cm-{reconciliation_tag}"],
+        "title": f"Code Mower {release_tag} qualification"[:128],
+    }
+
+
+def create_devin_session(
+    org_id: str,
+    payload: Mapping[str, Any],
+    api_key: str,
+    *,
+    api_runner: ApiRunner | None = None,
+) -> tuple[str, str]:
+    """Create one paid session, returning a bounded reason on failure."""
+    if not _validate_org_id(org_id):
+        return "", "devin_api_rejected"
+    try:
+        data = make_api_request(
+            "POST",
+            f"/v3/organizations/{org_id}/sessions",
+            api_key,
+            payload,
+            api_runner=api_runner,
+        )
+    except DevinApiError as exc:
+        return "", exc.code
+    session_id = data.get("session_id")
+    if not isinstance(session_id, str) or not _validate_session_id(session_id):
+        return "", "devin_api_unavailable"
+    return session_id, ""
+
+
+def poll_devin_session(
+    org_id: str,
+    session_id: str,
+    api_key: str,
+    *,
+    api_runner: ApiRunner | None = None,
+) -> tuple[str, dict[str, Any] | None, str]:
+    """Read one session snapshot.
+
+    Returns ``(state, structured_output, reason)`` where state is one of
+    ``running``, ``complete``, ``owner_action``, or ``failed``. Campaign watch
+    owns repeated polling and the one-hour deadline.
+    """
+    if not _validate_org_id(org_id) or not _validate_session_id(session_id):
+        return "failed", None, "devin_api_rejected"
+    try:
+        data = make_api_request(
+            "GET",
+            f"/v3/organizations/{org_id}/sessions/{session_id}",
+            api_key,
+            api_runner=api_runner,
+        )
+    except DevinApiError as exc:
+        return "failed", None, exc.code
+    status = str(data.get("status") or "")
+    detail = str(data.get("status_detail") or "")
+    if detail in {"waiting_for_user", "waiting_for_approval"}:
+        return "owner_action", None, "devin_waiting_for_owner"
+    if status == "exit" or detail == "finished":
+        result = data.get("structured_output")
+        if isinstance(result, dict):
+            return "complete", dict(result), ""
+        return "failed", None, "hosted_result_rejected"
+    if status in {"error", "suspended"} or detail in {
+        "error",
+        "usage_limit_exceeded",
+        "out_of_credits",
+        "out_of_quota",
+        "no_quota_allocation",
+        "payment_declined",
+        "org_usage_limit_exceeded",
+        "total_session_limit_exceeded",
+    }:
+        return "failed", None, "devin_session_failed"
+    return "running", None, ""

{code_mower-1.0.10 → code_mower-1.0.11}/src/code_mower/doctor_checks/adoption.py

@@ -933,12 +933,12 @@ def check_adoption_campaign_readiness(
         elif lane.driver in {"hosted_bridge", "saas_event"}:
             has_credentials, missing_var = _check_credentials(lane, env=current_env)
             transport_ready, transport_var = _check_hosted_transport(
-                lane, env=current_env
+                lane, env=current_env, repo_slug=repo_slug
             )
             # Closed dispatch profile: auth, installation, trigger,
             # trusted responder, and result return are reported
             # independently, so one verified dimension never masks another.
-            dispatch_profile = hosted_dispatch_profile(lane, env=current_env)
+            dispatch_profile = hosted_dispatch_profile(lane, env=current_env, repo_slug=repo_slug)
             dispatch_blockers = hosted_dispatch_blockers(dispatch_profile)
             dispatch_summary = {
                 name: bool(entry.get("ready")) for name, entry in dispatch_profile.items()
@@ -1034,8 +1034,12 @@ def check_adoption_campaign_readiness(
                         message=f"{canonical} hosted campaign transport is not verified",
                         detail=detail,
                         remediation=(
-                            f"Verify the {canonical} GitHub integration can answer campaign "
-                            f"comments, then set {transport_var}=1."
+                            str(
+                                dispatch_profile.get("installation", {}).get(
+                                    "remediation"
+                                )
+                            )
+                            or f"Verify {canonical} transport for {repo_slug}."
                         ),
                     )
                 )

{code_mower-1.0.10 → code_mower-1.0.11}/src/code_mower/migration_install.py

@@ -195,7 +195,29 @@ def classify_package_install_failure(*, exception: Exception, steps: list[dict[s
         "operation not permitted",
     )
 
+    # Certificate-validation failures: the transport could not establish trust.
+    # These are checked ahead of every other category, so a certificate failure
+    # is always `network`. It outranks the permission indicators because a
+    # platform trust store evaluated inside a strict OS sandbox (macOS
+    # Security.framework reports OSStatus -26276) fails with wording that also
+    # matches "operation not permitted"/EPERM, and it outranks the index
+    # indicators because an untrusted connection served nothing to classify.
+    # `package_index` stays the reason for a non-certificate index response.
+    certificate_indicators = (
+        "certificate verify failed",
+        "certificate_verify_failed",
+        "sslcertverificationerror",
+        "osstatus -26276",
+        "sectrustevaluate",
+        "unable to get local issuer certificate",
+        "self signed certificate",
+        "self-signed certificate",
+    )
+
     # Check in priority order: most specific first
+    if any(indicator in error_text for indicator in certificate_indicators):
+        return "network"
+
     if any(indicator in error_text for indicator in sandbox_permission_indicators):
         return "sandbox_permission"
 

{code_mower-1.0.10 → code_mower-1.0.11}/src/code_mower/package_manifest.py

@@ -276,6 +276,7 @@ PACKAGE_FILES = (
     ("tools/code_mower_prompts.py", "src/code_mower/prompts.py", "core"),
     ("src/code_mower/release_qualify.py", "src/code_mower/release_qualify.py", "core"),
     ("src/code_mower/release_campaigns.py", "src/code_mower/release_campaigns.py", "core"),
+    ("src/code_mower/devin_api.py", "src/code_mower/devin_api.py", "core"),
     ("src/code_mower/campaign_discovery.py", "src/code_mower/campaign_discovery.py", "core"),
     ("src/code_mower/campaign_adapters.py", "src/code_mower/campaign_adapters.py", "core"),
     ("src/code_mower/release_readiness.py", "src/code_mower/release_readiness.py", "core"),

{code_mower-1.0.10 → code_mower-1.0.11}/src/code_mower/provider_registry.py

@@ -226,11 +226,14 @@ REFERENCE_PROVIDERS: dict[str, ProviderLane] = {
         trigger_policy="manual",
         spend_policy="paid",
         provider_config={
-            "bot_authors": ("devin-ai-integration", "devin-ai-integration[bot]"),
-            "bot_authors_env": "DEVIN_BOT_AUTHORS",
-            "trigger_comments": ("@devin run", "devin run"),
-            "campaign_transport_ready_env": "CODE_MOWER_DEVIN_CAMPAIGN_TRANSPORT_READY",
+            "campaign_transport": "devin_api_v3",
+            "campaign_required_env_all": ("DEVIN_API_KEY", "DEVIN_ORG_ID"),
+            "campaign_repository_scope_env": "CODE_MOWER_DEVIN_REPOSITORIES",
             "campaign_response_timeout_seconds": 3600,
+            "status": (
+                "hosted Devin v3 Sessions API transport; "
+                "issue marker is optional audit evidence"
+            ),
         },
     ),
     "greptile": ProviderLane(