Add Devin peer-support qualification scorecard

[devin-ai-integration]

Closes #911. Part of #901. Builder: Devin (hosted Code Mower work order, rounds 0–2).

Summary

• Adds docs/devin-peer-support-qualification.md recording, in separate sections: the five fixed local Devin CLI builder rows from Builder calibration: five bounded deliveries each for Cursor, Muse, Antigravity, and Devin #659; the hosted Devin: deliver authorized context packets to Devin roles and hosted builder input #932 and Devin: one optional setup and readiness path for local CLI and hosted v3 #940/Devin: optional setup, host guidance, and lifecycle doctor #910 delivery-and-recovery rows and chronologies (cap, returned ACU, public wall time, work-order round, exact-head audit cycles, sanitized trusted-orchestrator intervention field, verified PR/head); the 4/4 synthetic reviewer contract controls for devin_cli and devin_api_v3 with merge_authority=false; the trusted-orchestrator offline synthetic protected-path context canary (metadata-only outcomes); a separate sanitized live Coworker canary; setup/package qualification posture; and limitations.
• The document keeps local vs. hosted evidence, transport parity vs. live model quality, informational adapters vs. merge-authority reviewers, wall time vs. active time, and known vs. unavailable ACU/cost separate. It claims no productivity lift, no broad model accuracy, no context relevance, no live Coworker-to-Devin delivery, and no reviewer promotion; Claude + Codex defaults are unchanged.
• Round 1: merged origin/main at cd26b9a (Graphify context: bind a local graph to its revision and fail closed on everything else #926, clean merge); canary scoped as offline synthetic protected-path; explicit intervention statements for Devin: deliver authorized context packets to Devin roles and hosted builder input #932 and Devin: one optional setup and readiness path for local CLI and hosted v3 #940; final Devin: one optional setup and readiness path for local CLI and hosted v3 #940 Claude PASS recorded with its one nonblocking P3 advisory and disposition; prerequisite recovery references named consistently by issue and PR; Board inspection, cloud dry-run inspection, and metadata-only upload marked as pending trusted-orchestrator steps; public task-class descriptions marked as documentation, never cloud metadata.
• Round 2: added the trusted-orchestrator live Coworker canary on cd26b9a as a separate section with sanitized metadata only (PASS for retrieval/authorization/normalization/protected storage/replay; counts, elapsed time, byte size, cleanup, zero mutations), and the material limitation that the saved connection does not authorize devin:builder, so live Coworker-to-Devin delivery remains unqualified.
• Discoverability: README documentation index, docs/provider-calibration-scorecard.md, docs/devin-review-parity.md, and the package_manifest.py doc entries link to the new page.

Validation

• tests/test_devin_review.py::DevinReviewTests::test_calibration_transport_parity on the current head: passed, 4 subtests (both transports, all four controls).
• ruff check ., scripts/privacy_scan.py, tests/test_release_hygiene.py clean on the round-2 head; compileall src scripts, scripts/guard_package_workflows.py, release-readiness --json (0 warnings) clean on earlier rounds.
• Full suite after merging main (round 1): python -m unittest discover -s tests Ran 3249 tests, OK (skipped=7). Round 2 is a docs-only change.
• Round 0: python -m build sdist + wheel, twine check PASSED for both. Docs are not packaged, consistent with existing docs.
• Python 3.13/3.14 fresh-wheel installs and code-mower/gate are exercised by CI on this head.

Risk / Rollback

• Documentation and one manifest doc entry only; no runtime behavior change. Revert the commits to roll back.

Data Or Secret Exposure

• This change does not add source, raw diffs, raw transcripts, raw provider output, tokens, or machine-specific paths to public artifacts.

Link to Devin session: https://app.devin.ai/sessions/2dd356f312354c2b9d1bfea38068b6f1
Open in Devin Desktop: https://app.devin.ai/desktop/session/2dd356f312354c2b9d1bfea38068b6f1?variant=devin

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[jeffhuber]

Claude audit (merge-authority lane)

Head SHA: 0a1c25adaf59ee6c1c1cab5bfbc826be07801a16
Findings: P0=0, P1=0, P2=0, P3=0 (blocker policy: any P0/P1/P2 -> BLOCKED)

Claude Audit: PASS

Summary:

Documentation-only PR adding a Devin peer-support qualification scorecard doc, cross-linking it from two existing docs, and registering it in the package manifest. No code logic changes; the manifest entry follows the existing pattern and the referenced new file is included in the same diff. No security, data-loss, or contract issues found.

Findings: none.

[jeffhuber]

Codex audit (merge-authority lane)

Head SHA: 0a1c25adaf59ee6c1c1cab5bfbc826be07801a16
Findings: P0=0, P1=0, P2=0, P3=0 (blocker policy: any P0/P1/P2 → BLOCKED)

Codex Audit: PASS

Summary:

No actionable regressions were identified; git diff --check passed.

Findings: none.