feat: add Devin (Cognition AI) as a gstack host (Phase 1 + Phase 2)

[louisCalderon888]

Summary

Adds Devin (Cognition AI) as a first-class gstack host — same drop-in pattern as Codex, Factory, OpenCode. After this lands, any project that commits a .cognition/skills/gstack-*/ directory gets the full gstack skill set (review, qa, ship, investigate, office-hours, design-shotgun, …) discoverable from any Devin session as /review, /qa, /ship, @skills:office-hours, etc.

This PR contains Phase 1 (host registration + skill regeneration) and Phase 2 (devin_mcp sub-sessions + Knowledge Notes for gbrain). Phase 3 (enter_test_mode + recording_* integration for /qa and /design-review) is tracked separately in docs/DEVIN.md.

Phase 1 — Host registration + Agent Skills generation

• hosts/devin.ts — typed HostConfig. Frontmatter allowlist (name, description, argument-hint, allowed-tools), conditional triggers: ["user"] for sensitive skills (careful, freeze, guard, unfreeze), Devin co-author trailer (devin-ai-integration[bot]@users.noreply.github.com), Devin-tuned boundary instruction naming the seven scanned dirs explicitly.
• hosts/index.ts — register devin in ALL_HOST_CONFIGS + re-export.
• setup — --host devin runs bun run gen:skill-docs --host devin and symlinks ~/.cognition/skills/gstack-* for local Devin CLI users. --local --host devin is the canonical flow (commits .cognition/skills/ into the user's repo so Devin VM sessions discover them on clone). --host auto detects devin on PATH alongside claude/codex/factory/opencode/kiro.
• docs/DEVIN.md (new) — full architecture walkthrough, generated-skill table, list of skipped skills with rationale, phased roadmap.
• AGENTS.md — multi-agent support table now lists Devin alongside Codex/Factory/etc with a pointer to docs/DEVIN.md.
• .gitignore — exclude .cognition/ from the gstack source tree (it's a generated output dir, on par with .agents/ / .factory/ / .opencode/).
• Tests — bumped host-config.test.ts host-count assertion 10 → 11 and extended the setup --host validation regression in gen-skill-docs.test.ts to include devin.

42 of the existing skills regenerate cleanly for Devin (root + 41 sub-skills with gstack- prefix). Phase 2 adds a 43rd Devin-only skill (/devin-setup).

Phase 2 — devin_mcp sub-sessions + Knowledge Notes (NEW)

Re-enables the 7 resolvers Phase 1 left suppressed and ports them to Devin's primitives:

Resolver	Phase 1 on Devin	Phase 2 on Devin
DESIGN_OUTSIDE_VOICES	suppressed	spawn child Devin session via devin_mcp devin_session_create (skill-specific prompts for plan-design-review / design-review / design-consultation)
ADVERSARIAL_STEP	suppressed	spawn child Devin session as adversarial reviewer; findings flow back into the same Fix-First pipeline
CODEX_SECOND_OPINION	suppressed	spawn child Devin session as second-opinion advisor (office-hours Startup/Builder mode preserved verbatim)
CODEX_PLAN_REVIEW	suppressed	spawn child Devin session as outside-voice plan reviewer with cross-model tension handling
REVIEW_ARMY	suppressed	parallel dispatch via single devin_session_create call with N session specs (one per specialist), parent polls each child via devin_session_interact action="get", JSON finding schema preserved
GBRAIN_CONTEXT_LOAD	suppressed	search Knowledge Notes via devin_mcp devin_knowledge_manage action="list" with pinned_repo filter
GBRAIN_SAVE_RESULTS	suppressed	persist results via devin_knowledge_manage action="create" with per-skill triggers (office-hours, investigate, plan-ceo-review, retro, plan-eng-review, ship, cso, design-consultation)

Helpers live in scripts/resolvers/devin-helpers.ts:

• devinSubSessionBlock(p) — generic child-session orchestration prose
• devinKnowledgeLoadBlock(p) — pre-skill Knowledge Notes search with skill-specific keyword extraction
• devinKnowledgeSaveBlock(p) — post-skill persistence with per-skill metadata mapping
• devinPlanReviewBlock(p) — plan-review variant of devinSubSessionBlock
• isDevinHost(ctx) — convenience helper

hosts/devin.ts: suppressedResolvers is now [] (resolvers branch on ctx.host === 'devin'). The comment block documents how to re-suppress an individual resolver if a future Devin variant lacks sub-session permissions.

New skill: /devin-setup (Devin-only). One-shot workspace wiring (run once per repo). Skipped from all other hosts via generation.skipSkills. Steps: verify devin_mcp reachability, derive repo identifier, register /ship + /land-and-deploy as Devin Playbooks via devin_playbook_manage create (with dedup-check), seed ETHOS.md + AGENTS.md as Knowledge Notes pinned to the repo, optional weekly /health schedule via devin_schedule_manage. Replaces /setup-gbrain for Devin.

Skills still skipped on Devin (generation.skipSkills)

Skill	Why	Status
/codex	Wraps codex exec. Devin uses the CODEX_SECOND_OPINION resolver branch instead — child Devin session is the second opinion. The /codex slash skill itself stays skipped because it's a Claude → Codex wrapper.	covered by Phase 2 resolver
/pair-agent	Pairs OpenClaw/Codex with the gstack browser sidebar over an ngrok tunnel. Devin already has a native browser/computer tool.	out of scope
/setup-gbrain	Cross-machine memory sync. Replaced by /devin-setup + Knowledge Notes.	replaced

Review & Testing Checklist for Human

This PR is yellow (host adaptation, no behavior changes to Claude/Codex/Factory). 5 items to verify end-to-end:

• Sanity-check hosts/devin.ts against hosts/codex.ts and hosts/factory.ts — pathRewrites, frontmatter allowlist, install.linkingStrategy. Confirm suppressedResolvers: [] is intentional (Phase 2 — resolvers branch on ctx.host === 'devin'). Spot-check the if (isDevinHost(ctx)) branches in review.ts, design.ts, gbrain.ts, review-army.ts — they MUST emit prose only (no behavior changes for non-Devin hosts).
• From a fresh clone, run bun run gen:skill-docs --host devin and confirm 43 skills emit (gstack root + 41 prefixed + 1 new gstack-devin-setup). Then run bun run gen:skill-docs --host claude and confirm devin-setup/SKILL.md is not generated (Devin-only).
• Run ./setup --host devin --local inside any other project repo and confirm .cognition/skills/gstack-*/SKILL.md lands with valid Agent Skills frontmatter (no voice triggers array, only triggers: ["user"] on sensitive skills).
• Open a Devin session against a repo with .cognition/skills/gstack-*/ committed and run /devin-setup. Confirm devin_playbook_manage create succeeds for /ship and /land-and-deploy (or skip with "already registered" if dedup-check matches), and devin_knowledge_manage create succeeds for ETHOS.md and AGENTS.md pinned to the repo. Then run /office-hours on a real product idea — confirm pre-skill Knowledge Notes search runs, outside voice spawns a child Devin session, and post-skill Knowledge Note is created with the documented trigger.
• Verify bun test test/host-config.test.ts test/gen-skill-docs.test.ts shows no new failures vs. main. 449 pass / 4 fail — the 4 failures are pre-existing baseline issues (golden-file regression > Claude ship, golden-file regression > Factory ship, gen-skill-docs > plan-review preamble budget, host-config-export.ts CLI > detect finds claude — fails when claude is not on PATH).

Notes

Why a separate scan path (.cognition/) instead of .agents/? Devin scans seven dirs at session start: .agents/, .github/, .claude/, .cursor/, .codex/, .cognition/, .windsurf/ (each as <dir>/skills/<name>/SKILL.md). gstack already writes to .agents/skills/ for the Codex sidecar. Writing Devin output to .cognition/skills/ lets --host all generate both Codex-formatted and Devin-formatted skills on the same repo without collision. Single-host Devin users can override localSkillRoot to .agents/skills/gstack if they prefer.

Phased rollout: Phase 1 (this PR) — host registration, skill regeneration, setup integration, docs. Phase 2 (this PR) — devin_mcp sub-sessions for cross-model resolvers, Knowledge Notes for gbrain memory, /devin-setup for Playbook + Knowledge Note seeding. Phase 3 (tracked in docs/DEVIN.md) — enter_test_mode + recording_* integration for /qa and /design-review to deliver video as proof-of-test.

Link to Devin session: https://app.devin.ai/sessions/2e94641ce54c4170badf46f8d8878727
Requested by: @louisCalderon888

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[louisCalderon888]

Phase 2 test report — all 6 tests passed

Devin session · static CLI generator validation (shell-only).

TL;DR — every adversarial assertion held

#	Test	Result
1	Devin office-hours/review emit devin_session_create (sub-session prose)	PASSED — 2x and 4x respectively
2	Devin memory-using skills emit devin_knowledge_manage (Knowledge Notes prose)	PASSED — 4x in all 8 skills (office-hours, investigate, cso, plan-ceo-review, retro, plan-eng-review, ship, design-consultation)
3	No leak — non-Devin hosts (Codex, Factory, OpenCode, Cursor, Claude in-tree) have 0 occurrences of Devin prose	PASSED — 20 leak checks, all 0
4	/devin-setup skill is Devin-only	PASSED — present in .cognition/skills/gstack-devin-setup/, absent from 7 other host paths and Claude in-tree, contains 4x devin_playbook_manage
5	review-army renders parallel sessions: array (Devin REST v3 concurrent dispatch)	PASSED — verbatim prose plus per-spec schema and Red Team sub-session block
6	Test suite baseline preserved	PASSED — 449 pass / 4 fail (matches documented pre-existing baseline; 0 new regressions)

Leak matrix (Test 3 evidence — 5 skills × 5 hosts)

.cognition/skills/gstack-office-hours/SKILL.md          leak=6   <-- Devin (intentional)
.cognition/skills/gstack-review/SKILL.md                leak=4   <-- Devin (intentional)
.cognition/skills/gstack-investigate/SKILL.md           leak=4   <-- Devin (intentional)
.cognition/skills/gstack-cso/SKILL.md                   leak=4   <-- Devin (intentional)
.cognition/skills/gstack-ship/SKILL.md                  leak=8   <-- Devin (intentional)
.agents/skills/gstack-{office-hours,review,investigate,cso,ship}/SKILL.md     all leak=0
.factory/skills/gstack-{office-hours,review,investigate,cso,ship}/SKILL.md    all leak=0
.opencode/skills/gstack-{office-hours,review,investigate,cso,ship}/SKILL.md   all leak=0
.cursor/skills/gstack-{office-hours,review,investigate,cso,ship}/SKILL.md     all leak=0

leak = count of devin_session_create | devin_knowledge_manage matches per file. The if (isDevinHost(ctx)) branch in scripts/resolvers/{review,design,gbrain,review-army}.ts is correctly host-scoped: Devin row is feature-correct, all 4 other hosts × 5 skills = 20 cells are 0.

Out of scope (Phase 3)

• Live Devin sub-session spawning at runtime
• Live Knowledge Notes API calls
• Live /qa browser flow

Phase 2 emits the prose that instructs a future Devin parent session to call those tools. Runtime behavior of the prose is Phase 3.

Full report attached in the Devin session. Ready for review.