feat: add verified Devin scout adapter

[dnth]

Intent

probe only

What Changed

• Added a verified Devin crew/scout adapter for Herdr, including dangerous-mode launch, model-effort composition, and explicit refusal for primary or secondmate launches.
• Added guarded project-local Devin Stop-hook installation with private per-task registries, generation-bound turn-end signaling, native Herdr busy/idle detection, and teardown cleanup.
• Expanded harness, backend, lifecycle, documentation, and adapter/live-E2E test coverage for the Devin integration.

Risk Assessment

⚠️ Medium: The core explicit Devin crew/scout launch path is present, but the optional documented dispatch configuration path remains rejected by a shared bootstrap validator.

Testing

Validated generation-bound Stop-hook publication, working/done crew-state reporting, permanent Devin primary/secondmate refusal with supported scout model-effort composition, exact Herdr Devin identity gating, and native busy/idle classification. The initial harness probe encountered an existing user-level Devin hook, so it was rerun with an isolated HOME and passed; no source changes were needed.

Evidence: Devin targeted behavioral evidence

ok - Devin native Stop hook publishes markers safely and crew-state reports working/done without unknown
ok - Devin primary/secondmate refusal and scout model-effort composition hold
ok - Devin composer accepts idle only with matching Herdr identity
ok - Herdr native busy applies fleet-wide, Devin also trusts native idle, and records outrank native state

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

⚠️ **Review** - 1 warning

• 🚨 bin/fm-devin-turnend-hook.sh:153 - The generated Stop hook recomputes the registry root from the hook process's XDG_CONFIG_HOME (bin/fm-devin-turnend-hook.sh:151-153), while spawn creates the task registry using Firstmate's current XDG_CONFIG_HOME (bin/fm-spawn.sh:3908). Herdr panes are launched by a long-lived daemon that does not inherit Firstmate's current environment, so with a custom XDG_CONFIG_HOME the hook falls back to $HOME/.config, cannot find the token, and silently drops every Devin turn-end marker. Embed the resolved registry directory in the generated hook (or otherwise pass it through the project-local registration) so runtime lookup uses the same path as installation.
• ⚠️ bin/fm-busy-lib.sh:358 - The new Devin idle path trusts only fm_backend_busy_state's status and never verifies the Herdr-reported agent identity (bin/backends/herdr.sh:3366-3369 only returns agent_status). If a task's recorded Devin pane is stale or reused by another agent that reports idle/done, fm_busy_classify accepts idle herdr-native at bin/fm-busy-lib.sh:358-364, allowing supervision to treat the wrong pane as a completed Devin task without an error. Require the Herdr identity to be devin before accepting either native idle or busy for this harness, at the shared backend boundary.

🔧 Fix: Fixed Devin hook registry embedding and Herdr identity validation
1 warning still open:

• ⚠️ bin/fm-spawn.sh:1683 - Devin is advertised and accepted as a verified crew profile in the changed spawn/configuration paths, but bin/fm-bootstrap.sh:1114 still defines the verified-harness allowlist without devin. A config/crew-dispatch.json selecting Devin is therefore reported as unverified harness: devin during bootstrap, so the newly supported dispatch route is rejected. Add Devin to that shared validator (and its effort validation as appropriate).

✅ **Test** - passed

✅ No issues found.

• bash tests/fm-devin-adapter.test.sh
• HOME=$(mktemp -d) XDG_CONFIG_HOME=$HOME/.config bash evidence/devin-target.test.sh
• Targeted test_devin_composer_requires_native_identity from tests/fm-backend-herdr.test.sh
• bash tests/fm-busy-state.test.sh

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.