Adoption polish: report effective review authority and superseded Devin bridge drift

[jeffhuber]

Part of stabilization epic #979 and roadmap #900.

Problem

Three smaller adoption inconsistencies make the first-run report noisier than the configured posture:

• Session and audit output can call Claude/Codex a "merge-authority lane" even when the active repository profile keeps the lane informational.
• Setup drift recognizes legacy Devin bridge workflow names but does not clearly report that the issue-comment bridge is superseded by the maintained Sessions API v3 transport.
• A normal hosted-agent doctor run can emit many optional-provider warnings without a concise view scoped to the intended posture.

Outcome

Rendered status describes the repository's effective authority and transport, and setup drift gives a precise migration action for superseded Devin bridge files.

Acceptance criteria

• Render "merge-authority" only from the effective lane configuration used for this run; otherwise render "informational" or equivalent.
• Keep immutable historical fixtures recognizable without using their old wording as the current configured posture.
• Detect the legacy Devin issue-comment bridge/labeler workflow pair during setup drift and report a bounded superseded-transport migration action without deleting files automatically.
• Provide a concise posture-scoped doctor view or summary that retains full detail in JSON and explicit advanced/campaign modes.
• Preserve the Claude + Codex default and keep optional provider setup out of the initial path.
• Add wording, drift, no-Devin, privacy, and backwards-compatibility tests.
• Deliver after Devin v1.4.0; this P3 polish does not block Release: publish and qualify Code Mower v1.4.0 with Devin peer support #912.

Evidence

Reported from a metadata-only v1.3.1 hosted adoption rehearsal; no P0/P1 impact.

Completion dependencies and PR map

One planned OSS PR, planned Code Mower Claude builder with independent eligible Code Mower Codex review. Consume #975's effective role-eligibility result rather than create another policy resolver. Required before Board integration #951 and Slack setup #922. Preserve informational repository policy and historical fixtures; availability/installation must not imply Devin orchestrator or reviewer qualification.

v1.4.0 adoption follow-up

Preserve the positively verified behavior: default Claude + Codex adoption emits no setup work for unselected Devin, Graphify, Slack or Coworker. Warnings and owner actions follow selected capabilities, not a target warning count. Reuse the already merged campaign-intent rule from #953/#966; do not duplicate it or equate ordinary CLI login with isolated campaign readiness.

Replace host-specific site-packages example paths in default Devin remediation with a portable supported command that selects the same configuration/profile. Keep explicit repository-config selection accurate; do not silently substitute the starter. Cover text/JSON privacy and command equivalence. Add concise opt-in Devin guidance to the prompt pack while #975 owns lease/role guidance there. This remains one adoption-polish PR before #915.

[jeffhuber]

Bounded Code Mower work order: adoption output and migration guidance

Execute after #975 is merged and its writer has released shared files. One Claude builder, one isolated branch and session lease, one draft PR closing #955; independent eligible Code Mower Codex review on the final head. Keep the PR draft for orchestrator-controlled merge after CI and the authoritative gate pass.

Shared contract and ownership

Consume #975's role_eligibility.decide_role decisions and the resulting session/readiness payload. It returns closed status/reason fields for product, role, transport, scope, capability, qualification, policy and runtime. Render computed effective authority; do not create another role-policy resolver or grant authority from installation, lane labels or provider identity. #975 owns admission and the prompt pack's role/lease section. This work owns presentation, optional setup guidance and superseded bridge drift.

Required behavior

1. Session and audit presentation describe the effective configured review authority. Informational policy remains informational even for otherwise qualified Claude/Codex lanes. Historical audit fixtures remain readable. Where Participants: enforce role-specific qualification for hosted builders #975 already fixes presentation, verify and reuse it rather than create a parallel implementation.
2. Setup drift recognizes the legacy Devin issue-comment bridge and labeler as superseded by the maintained Sessions API v3 transport. Produce an explicit bounded migration action and preview; never delete or rewrite repository-owned workflow files automatically.
3. Provide concise posture-scoped doctor output or summary while retaining complete checks, stable diagnostics and relevant detail in JSON and explicit advanced/campaign modes. Prioritize active failures and owner actions. Preserve Doctor: scope release-campaign auth readiness to campaign intent on headless hosts #953/Doctor: scope release-campaign auth readiness to campaign intent #966 campaign-intent behavior and quiet unselected integrations; do not optimize toward a fixed warning total.
4. Replace the default installed-package example path in Devin remediation with an equivalent portable supported command. Preserve the caller's selected configuration and profile, including explicitly supplied repository configs, custom lane names and paths containing spaces. A shorter command that selects the starter instead of the active repository config is incorrect.
5. Add concise optional Devin setup guidance to the orchestrator prompt pack using the supported transport selection and readiness commands. Keep generated setup as preview/staging followed by normal review; it does not change the active installed configuration until adopted. Explain only user-relevant operator decisions.

Evidence and boundaries

Add targeted tests for informational/effective authority, superseded bridge migration, default no-Devin/no-campaign behavior, selected/custom config command equivalence, text/JSON privacy and backwards compatibility. Run relevant documented-command/release-hygiene checks, regenerate committed package mirrors if required, and obtain final-head independent review plus normal CI/gate. Resolve all P0/P1/P2 findings before requesting merge.

The owner-supplied v1.4.0 adoption report is historical input: #966/#969 were merged after that package shipped. Do not reopen those implementations or perform owner token setup, enable repository auto-merge, apply another repository's generated setup, add paid sessions or broaden provider authority. This work is required before the stabilized v1.4.1 release #915; Board stop selector work remains #961 and isolated headless campaign authentication remains #983.

[jeffhuber]

Work Order: #955 adoption output and migration guidance

Execute after #975 is merged and its writer has released shared files. One Claude builder, one isolated branch and session lease, one draft PR closing #955; independent eligible Code Mower Codex review on the final head. Keep the PR draft for orchestrator-controlled merge after CI and the authoritative gate pass.

Shared contract and ownership

Consume #975's role_eligibility.decide_role decisions and the resulting session/readiness payload. It returns closed status/reason fields for product, role, transport, scope, capability, qualification, policy and runtime. Render computed effective authority; do not create another role-policy resolver or grant authority from installation, lane labels or provider identity. #975 owns admission and the prompt pack's role/lease section. This work owns presentation, optional setup guidance and superseded bridge drift.

Required behavior

1. Session and audit presentation describe the effective configured review authority. Informational policy remains informational even for otherwise qualified Claude/Codex lanes. Historical audit fixtures remain readable. Where Participants: enforce role-specific qualification for hosted builders #975 already fixes presentation, verify and reuse it rather than create a parallel implementation.
2. Setup drift recognizes the legacy Devin issue-comment bridge and labeler as superseded by the maintained Sessions API v3 transport. Produce an explicit bounded migration action and preview; never delete or rewrite repository-owned workflow files automatically.
3. Provide concise posture-scoped doctor output or summary while retaining complete checks, stable diagnostics and relevant detail in JSON and explicit advanced/campaign modes. Prioritize active failures and owner actions. Preserve Doctor: scope release-campaign auth readiness to campaign intent on headless hosts #953/Doctor: scope release-campaign auth readiness to campaign intent #966 campaign-intent behavior and quiet unselected integrations; do not optimize toward a fixed warning total.
4. Replace the default installed-package example path in Devin remediation with an equivalent portable supported command. Preserve the caller's selected configuration and profile, including explicitly supplied repository configs, custom lane names and paths containing spaces. A shorter command that selects the starter instead of the active repository config is incorrect.
5. Add concise optional Devin setup guidance to the orchestrator prompt pack using the supported transport selection and readiness commands. Keep generated setup as preview/staging followed by normal review; it does not change the active installed configuration until adopted. Explain only user-relevant operator decisions.

Evidence and boundaries

Add targeted tests for informational/effective authority, superseded bridge migration, default no-Devin/no-campaign behavior, selected/custom config command equivalence, text/JSON privacy and backwards compatibility. Run relevant documented-command/release-hygiene checks, regenerate committed package mirrors if required, and obtain final-head independent review plus normal CI/gate. Resolve all P0/P1/P2 findings before requesting merge.

The owner-supplied v1.4.0 adoption report is historical input: #966/#969 were merged after that package shipped. Do not reopen those implementations or perform owner token setup, enable repository auto-merge, apply another repository's generated setup, add paid sessions or broaden provider authority. This work is required before the stabilized v1.4.1 release #915; Board stop selector work remains #961 and isolated headless campaign authentication remains #983.

Current execution and exact file ownership

The prerequisite #975 merged as c542536. Code Mower Claude is the sole source builder for this work; Code Mower Codex brokers and independently reviews. Keep one draft PR closing #955. Do not merge or release. Start from current main, read docs/lanes/claude.md, and preserve the accepted role_eligibility API and role/lease guidance.

Own doctor.py, doctor_checks presentation/remediation modules, devin_readiness.py presentation/remediation, narrow init.py superseded-drift/setup-command rendering, optional prompt-pack setup guidance, and related tests/docs. Session rendering may be changed only for an observed effective-authority gap. AuditConfig construction and comment rendering in claude_audit_pr.py and codex_audit_pr.py are available for effective merge_authority propagation. #963 owns audit_pr/_do_audit_pr entry admission after trusted PR metadata/head fetch and before provider execution, shared provider_runners exclusion helpers, contributor validation and provenance inputs; do not edit those blocks. In init.py, leave _author_exclusion_payload and generated gate/labeler resolver context to #963. Also avoid lane_delivery, lane_handoff, runner templates, gate/controller/labelers, builder lineage, Graphify context runtime, operational_evidence.py and release_qualify.py.

Preserve complete configuration/profile selection rather than inferring it from a provider label. Reuse maintained computed authority and role decisions. Keep existing setup and campaign intent rules, current privacy behavior, default no-Devin/no-campaign posture, and historical evidence. Do not add owner credential setup or hosted Devin work. No test should invoke a paid provider. Run focused meaningful checks, regenerate package mirrors through maintained tooling only if necessary, push the draft PR, and report the exact head and checks. Public evidence is limited to repository/issue/PR/head and sanitized results; keep local paths, raw output, credentials, personal identities and provider references private.

[jeffhuber]

Claude builder lane: #955 delivered as a draft PR

PR: #988 (draft, builder:claude, needs-codex-audit, closes #955)
Head SHA: e4c88c8

What was implemented

1. Effective review authority. New review_authority module renders the
   computed posture from the selected review lane declaration plus
   role_eligibility.decide_role. No second policy resolver: a lane that
   declares merge authority renders informational whenever the maintained role
   decision narrows it. The Claude and Codex audit wrappers resolve the comment
   posture from the repository configuration this run uses instead of defaulting
   to merge authority; an explicit flag/env override still wins and is reported
   as the source, an explicitly selected --code-mower-config is never replaced
   by the starter, and a checkout that configures no lanes keeps the maintained
   lane default. Session reviewer wording is single-sourced through the same
   helper. Recorded audit headers stay readable evidence and are not treated as
   the current configured posture.
2. Superseded Devin bridge drift. Setup drift recognizes the legacy
   issue-comment bridge, its labeler and the dispatched script, and reports a
   bounded migration to the maintained devin_api_v3 Sessions API transport
   with a preview command, naming only the observed files. Nothing is deleted or
   rewritten; it appears in the text view and in the JSON payload as
   superseded_bridge.
3. Concise posture-scoped doctor view. doctor --concise leads with active
   failures and owner actions and counts remaining warnings by group. Every
   check still runs; --json and the explicit --advanced / --campaign modes
   keep full detail. Campaign-intent behavior and the quiet default for
   unselected integrations are unchanged, and nothing optimizes toward a warning
   count.
4. Devin remediation commands. Verified rather than rewritten: the
   maintained remediation already generates portable pinned commands that
   preserve the caller's configuration, profile and custom lane names, with
   shell quoting for paths containing spaces. No installed-package example path
   remains anywhere in the shipped guidance, so no replacement was needed. Test
   coverage was added pinning the reported selection option to the option
   devin_readiness owns.
5. Prompt pack. Added an opt-in optional Devin setup prompt using the
   supported transport-selection and readiness commands, keeping generated setup
   as preview/staging followed by normal review, and referring to
   docs/participant-qualification.md for role and lease guidance rather than
   restating it.

Checks run

New tests/test_adoption_polish_955.py (30 tests) covering wording/effective
authority, superseded-bridge migration, default no-Devin behavior, explicit
configuration selection, text/JSON privacy and backwards compatibility. Also
ran the Claude and Codex wrapper suites, release hygiene, setup-drift, doctor
output/privacy, participant sessions, provider-runner comments, and role
eligibility. All pass except two pre-existing environmental failures in
test_role_eligibility.py::HostedRoleAdmissionTests that fail identically on
unmodified main in this checkout (the context store refuses state inside a Git
repository).

The committed package manifest was regenerated through the maintained
code_mower.package tooling for the new module.

Remaining

• Independent eligible Codex review on this head (needs-codex-audit applied).
• CI and the authoritative gate; the PR is intentionally left as a draft for
  orchestrator-controlled merge.
• No CHANGELOG entry was added: the file has no open unreleased section and
  adding one is a release-hygiene decision rather than part of this polish.
• No owner action required for this unit.