OmniRoute/docs/DEVIN_CLAUDE_BRIDGE_PROGRESS.md

Devin Claude Bridge Progress

Updated: 2026-07-28

Baseline

• Fork version: 3.8.49.
• Starting branch: release/v3.8.49.
• Starting commit: ed7db3ee5f89a144b2d931d8605534522f83de30.
• Fixed runtime artifacts: Node 26.0.0, Claude Code 2.1.220, Devin CLI 3000.2.17.
• Existing devin-cli remains unchanged; the new path is the separate devin-cli-agentic provider.

Implemented architecture

• Claude Code runs only inside the non-root bridge container with its own empty config volume and local OmniRoute base URL.
• devin-cli-agentic preserves Anthropic messages, tool schemas, tool_use, and tool_result, then calls the official Devin CLI over ACP stdio.
• The executor starts devin acp --agent-type summarizer. This is the only fixed official ACP role in the pinned CLI that has no Devin-owned tools.
• The request is framed as an execution trace. Devin can return one strict client tool envelope; Claude Code executes that tool locally.
• Internal ACP tool_call events, unsupported blocks, invalid schemas, narrative actions, timeouts, cancellation, and process failure all fail closed.
• Provider and network policy prevent combo/auto/Anthropic fallback.

Offline proof

• Focused serializer, parser, executor, ACP lifecycle, wire-format, environment, and audit tests pass (39/39).
• The contract suite covers Anthropic JSON/SSE, tool_use, tool_result continuation, fragmented ACP frames, stderr, early exit, timeout, cancellation, and fail-closed provider loss.
• The production bridge image builds with the pinned CLIs.
• Real Claude Code offline E2E loads CLAUDE.md, the project skill and slash command, fires hooks, executes local tools over multiple turns, observes a failed test, repairs the file, reruns the test, and completes.
• The isolation verifier proves non-root/read-only execution, isolated mounts and config, blocked Anthropic/Claude access, no host credential mounts, local-only inference, and no fallback.

Evidence is generated under .sandbox/evidence and ignored by Git.

Regression status

• typecheck:core, focused ESLint, Prettier, shell/Node syntax, and the complete documentation accuracy suite pass.
• The broad npm run check is not reported as passed: after its lint phase, the repository test runner remained alive while an existing ioredis client repeatedly retried an unavailable local Redis endpoint after quota-redis-store.test.ts. The bridge-focused suites, production image build, offline E2E, isolation proof, and live gate do not use that Redis service and all pass.

Live Devin proof

Passed with the official in-container login and discovered model swe-1-7-lightning. The terminal live run completed all three scenarios:

1. Claude Code loaded the fixture instructions, issued client-owned Read calls, and returned a correct defect analysis.
2. Claude Code issued a real Edit changing subtraction to addition, then a client-owned Bash call running npm test; the test reported one pass and zero failures.
3. Claude Code initialization listed bridge-check and bridge-proof, read the corrected source and test, executed another client-owned npm test, and completed successfully.

The live evidence validator parses stream JSON and requires successful tool results. It does not accept a textual claim that a tool ran. It also rejects terminal summaries that report a blocker, incomplete work, or required next steps.

The final live gate reported:

PASS: validated Claude evidence for LIVE_ANALYSIS_COMPLETE
PASS: validated Claude evidence for LIVE_FIX_COMPLETE
PASS: validated Claude evidence for BRIDGE_E2E_COMPLETE
PASS: three live Devin-backed Claude Code scenarios completed
PASS: live model swe-1-7-lightning was discovered and validated by three scenarios

The same gate validated the network audit: only the Devin guard path was used, no internal Devin tool event was accepted, and the Claude egress audit remained empty.

Investigation conclusion

The initial default-agent hypothesis failed because ACP permission modes do not turn the default Devin agent into a raw inference backend. Even ask mode can emit Devin-owned tool_call events. A discovered allowed-tools: [] agent configuration was not consumed by devin acp in CLI 3000.2.17.

The working adaptation uses the official summarizer agent because it is structurally no-tools. Its fixed summarization behavior can produce intermediate prose, so the bridge frames requests as execution traces, detects future-action narration, performs at most one strict repair, and otherwise fails. Live validation also exposed transient ACP timeouts; the harness now spaces independent scenarios rather than weakening routing or retrying into another provider.

Safety record

No host Claude executable, configuration, login, OAuth token, Keychain, or Anthropic API was used. The dedicated Docker volumes remain role-separated. No credential value is written to the repository or evidence output.

During the early baseline, a focused test without isolated DATA_DIR initialized the repository's normal OmniRoute database at /Users/lucasisrael/.omniroute/storage.sqlite. It was not rolled back or touched again. Every bridge command now pins database and temporary paths under the worktree's .sandbox directory.

Remaining limits

• The no-tools backend has a summarizer system role rather than a neutral generation role.
• One client tool call per response is supported; parallel tool calls are rejected.
• ACP processes are per-turn and stateless.
• Live Devin availability can still produce explicit 502/504 failures.
• Images and unadvertised vision/effort/large-context capabilities remain unsupported.