Devin

SERVED 2026-09-14 (hello-20 `providerTails`, founder ruling F6): SessionInsightsResponse requires twelve fields; ten were already SessionResponse's, `session_size` has been derived on this host since the metrics family shipped, and the two that were missing are num_user_messages and num_devin_messages. DECISIONS 2026-08-20 [devin] refused all four rows on exactly those two - 'serving zeroes would be a lie (every session begins with a user prompt), and manufacturing counts or transcripts from content_seed would be invention' - and founder ruling F6 (decisions/2026-09-14-0202) mints `agent_session_turn`: an ordinal, an author and an instant, and NO BODY COLUMN. The counts are now a MEASUREMENT of rows the artifact really holds (reader.agentSessionTurnCounts(), counted in SQL so a long conversation costs one row out of the artifact rather than all of them) and not a word of prose is invented. THE TWO `/messages` ROWS ARE UNTOUCHED AND STILL REFUSED, which is the shape of the ruling rather than an oversight: a transcript of turns WITHOUT TEXT is not a transcript, and there is no column a SessionMessage could be built out of - conformance asserts the turn table's columns are exactly session/ord/author/at_epoch. `analysis` is null, which is the document's own value for an analysis that has not completed and the same class of authored prose the knowledge-note rows are refused on. `session_size` reads the SAME sessionSize(centi) the fleet histogram /metrics/sessions has bucketed by on every frozen pin since Phase 30, so an insight and the histogram beside it can never disagree - which is why F6's new counts deliberately do NOT enter the banding. Built on shapeSession rather than beside it, so the insight view and the session object agree field for field (asserted). Gated on reader.hasProviderTails(); an older artifact - the 127 pins frozen before hello-20, and live until the hello-20 cutover - answers the NAMED session-turn generation gap, because a page of sessions each reporting zero messages IS the lie the 2026-08-20 ruling refused. This row is the ENTERPRISE SINGLE READ; a session id this universe does not have is Devin's own 404.

SERVED 2026-09-14 (hello-20 `providerTails`, founder ruling F6): SessionInsightsResponse requires twelve fields; ten were already SessionResponse's, `session_size` has been derived on this host since the metrics family shipped, and the two that were missing are num_user_messages and num_devin_messages. DECISIONS 2026-08-20 [devin] refused all four rows on exactly those two - 'serving zeroes would be a lie (every session begins with a user prompt), and manufacturing counts or transcripts from content_seed would be invention' - and founder ruling F6 (decisions/2026-09-14-0202) mints `agent_session_turn`: an ordinal, an author and an instant, and NO BODY COLUMN. The counts are now a MEASUREMENT of rows the artifact really holds (reader.agentSessionTurnCounts(), counted in SQL so a long conversation costs one row out of the artifact rather than all of them) and not a word of prose is invented. THE TWO `/messages` ROWS ARE UNTOUCHED AND STILL REFUSED, which is the shape of the ruling rather than an oversight: a transcript of turns WITHOUT TEXT is not a transcript, and there is no column a SessionMessage could be built out of - conformance asserts the turn table's columns are exactly session/ord/author/at_epoch. `analysis` is null, which is the document's own value for an analysis that has not completed and the same class of authored prose the knowledge-note rows are refused on. `session_size` reads the SAME sessionSize(centi) the fleet histogram /metrics/sessions has bucketed by on every frozen pin since Phase 30, so an insight and the histogram beside it can never disagree - which is why F6's new counts deliberately do NOT enter the banding. Built on shapeSession rather than beside it, so the insight view and the session object agree field for field (asserted). Gated on reader.hasProviderTails(); an older artifact - the 127 pins frozen before hello-20, and live until the hello-20 cutover - answers the NAMED session-turn generation gap, because a page of sessions each reporting zero messages IS the lie the 2026-08-20 ruling refused. This row is the ENTERPRISE LIST, which the vendored document gives the same filter surface as /v3/enterprise/sessions (and no devin_id, so the narrowing is ignored here rather than invented).

SERVED 2026-09-14 (hello-20 `providerTails`, founder ruling F6): SessionInsightsResponse requires twelve fields; ten were already SessionResponse's, `session_size` has been derived on this host since the metrics family shipped, and the two that were missing are num_user_messages and num_devin_messages. DECISIONS 2026-08-20 [devin] refused all four rows on exactly those two - 'serving zeroes would be a lie (every session begins with a user prompt), and manufacturing counts or transcripts from content_seed would be invention' - and founder ruling F6 (decisions/2026-09-14-0202) mints `agent_session_turn`: an ordinal, an author and an instant, and NO BODY COLUMN. The counts are now a MEASUREMENT of rows the artifact really holds (reader.agentSessionTurnCounts(), counted in SQL so a long conversation costs one row out of the artifact rather than all of them) and not a word of prose is invented. THE TWO `/messages` ROWS ARE UNTOUCHED AND STILL REFUSED, which is the shape of the ruling rather than an oversight: a transcript of turns WITHOUT TEXT is not a transcript, and there is no column a SessionMessage could be built out of - conformance asserts the turn table's columns are exactly session/ord/author/at_epoch. `analysis` is null, which is the document's own value for an analysis that has not completed and the same class of authored prose the knowledge-note rows are refused on. `session_size` reads the SAME sessionSize(centi) the fleet histogram /metrics/sessions has bucketed by on every frozen pin since Phase 30, so an insight and the histogram beside it can never disagree - which is why F6's new counts deliberately do NOT enter the banding. Built on shapeSession rather than beside it, so the insight view and the session object agree field for field (asserted). Gated on reader.hasProviderTails(); an older artifact - the 127 pins frozen before hello-20, and live until the hello-20 cutover - answers the NAMED session-turn generation gap, because a page of sessions each reporting zero messages IS the lie the 2026-08-20 ruling refused. This row is the ORG-SCOPED SINGLE READ; {org_id} resolves through the shared org wrapper first, so an id this universe does not have is Devin's own 404 before the generation is consulted.

SERVED 2026-09-14 (hello-20 `providerTails`, founder ruling F6): SessionInsightsResponse requires twelve fields; ten were already SessionResponse's, `session_size` has been derived on this host since the metrics family shipped, and the two that were missing are num_user_messages and num_devin_messages. DECISIONS 2026-08-20 [devin] refused all four rows on exactly those two - 'serving zeroes would be a lie (every session begins with a user prompt), and manufacturing counts or transcripts from content_seed would be invention' - and founder ruling F6 (decisions/2026-09-14-0202) mints `agent_session_turn`: an ordinal, an author and an instant, and NO BODY COLUMN. The counts are now a MEASUREMENT of rows the artifact really holds (reader.agentSessionTurnCounts(), counted in SQL so a long conversation costs one row out of the artifact rather than all of them) and not a word of prose is invented. THE TWO `/messages` ROWS ARE UNTOUCHED AND STILL REFUSED, which is the shape of the ruling rather than an oversight: a transcript of turns WITHOUT TEXT is not a transcript, and there is no column a SessionMessage could be built out of - conformance asserts the turn table's columns are exactly session/ord/author/at_epoch. `analysis` is null, which is the document's own value for an analysis that has not completed and the same class of authored prose the knowledge-note rows are refused on. `session_size` reads the SAME sessionSize(centi) the fleet histogram /metrics/sessions has bucketed by on every frozen pin since Phase 30, so an insight and the histogram beside it can never disagree - which is why F6's new counts deliberately do NOT enter the banding. Built on shapeSession rather than beside it, so the insight view and the session object agree field for field (asserted). Gated on reader.hasProviderTails(); an older artifact - the 127 pins frozen before hello-20, and live until the hello-20 cutover - answers the NAMED session-turn generation gap, because a page of sessions each reporting zero messages IS the lie the 2026-08-20 ruling refused. This row is the ORG-SCOPED LIST, which additionally honours `devin_id` - the one query param the org-scoped operation declares and the enterprise one does not.

refuse — conversational content: the session transcript is what Devin and the engineer said to each other, and this universe does not invent it (the standing founder-adopted default; revisit if a client asks)

refuse — a snapshot blueprint and its builds exist only because a write created them, and this universe accepts no writes (invariant #3) — the async-artifact shape ruled in coverage/reviews/2026-09-01-jira-modes.md

refuse — a snapshot blueprint and its builds exist only because a write created them, and this universe accepts no writes (invariant #3) — the async-artifact shape ruled in coverage/reviews/2026-09-01-jira-modes.md

refuse — a snapshot blueprint and its builds exist only because a write created them, and this universe accepts no writes (invariant #3) — the async-artifact shape ruled in coverage/reviews/2026-09-01-jira-modes.md

refuse — a snapshot blueprint and its builds exist only because a write created them, and this universe accepts no writes (invariant #3) — the async-artifact shape ruled in coverage/reviews/2026-09-01-jira-modes.md

refuse — a snapshot blueprint and its builds exist only because a write created them, and this universe accepts no writes (invariant #3) — the async-artifact shape ruled in coverage/reviews/2026-09-01-jira-modes.md

refuse — Devin's code-scanning add-on is not enabled for this enterprise, and Devin answers 403 to every code-scan read for an enterprise without it — no scan, finding, metric or profile can exist here

refuse — Devin's code-scanning add-on is not enabled for this enterprise, and Devin answers 403 to every code-scan read for an enterprise without it — no scan, finding, metric or profile can exist here

refuse — Devin's code-scanning add-on is not enabled for this enterprise, and Devin answers 403 to every code-scan read for an enterprise without it — no scan, finding, metric or profile can exist here

refuse — Devin's code-scanning add-on is not enabled for this enterprise, and Devin answers 403 to every code-scan read for an enterprise without it — no scan, finding, metric or profile can exist here

refuse — Devin's code-scanning add-on is not enabled for this enterprise, and Devin answers 403 to every code-scan read for an enterprise without it — no scan, finding, metric or profile can exist here

refuse — the id half of the service-user pair: this universe's only non-human identity is the CI bot and it holds no Devin seat, so the service-user list is empty, so no id can resolve and Devin's own 404 is the only possible answer (the by-id shape ruled in DECISIONS 2026-09-01 [coverage/A0])

the org-scoped idp-users twin, held to the same answer by test. CORRECTED 2026-09-12 (hello-18 serving wave W-c). The 2026-09-10 correction already replaced this row's original reason - "this universe has no identity provider" - because hello-15's canon.IdentityProviderConfig and canon.IdentityGroup (packages/canon/src/ci-config.ts:359, :401) made it false: a SAML provider with SCIM enabled, the administrator who switched it on, the date it was switched on, and four groups derived from ACCESS facts, which renderer-circleci serves today (/organizations/{org_id}/groups, ruled 2026-09-07). Two of the three supporting clauses that correction left have since gone false in their turn, and this is the second correction this row has needed for the same reason: a ruling resting on an absence canon later filled. canon DOES attach a role to an identity group (hello-17's grants - a membership row with scope_kind 'group', reader.groupRole(), which renderer-circleci serves), and canon DOES bind a person to an external uid (hello-18's externalUid - person.external_uid, which GitLab's saml/{uid} and scim/{uid} resolve). The empty answer still stands, and it now stands on the FIRST clause alone - which is the one the vendored document actually asks about: `IdpGroupUser` is "a user whose membership is derived from IDP group assignments", and NO Devin membership here is derived that way. Every Devin seat is assigned DIRECTLY to a person by the organization, which is the same absence every member detail already reports as idp_role_assignments: []. THE ASK is now one fact rather than two: a Devin SEAT a person holds BECAUSE an identity group confers it. A directory identity on a person is not that, and a role on a group is not that either. NOTE for the next wave: the five idp-GROUPS rows in this fence still carry the falsified "canon attaches no role to an identity group" clause, and they are deliberately untouched here because on those rows the correction may be a re-SERVE rather than a re-word - `IdpGroup.role_assignments` is RoleAssignment[] and hello-17's groupRole() may now answer it - which is a ruling this wave cannot make alone

the v3beta1 idp-users twin, held to the same answer by test. CORRECTED 2026-09-12 (hello-18 serving wave W-c). The 2026-09-10 correction already replaced this row's original reason - "this universe has no identity provider" - because hello-15's canon.IdentityProviderConfig and canon.IdentityGroup (packages/canon/src/ci-config.ts:359, :401) made it false: a SAML provider with SCIM enabled, the administrator who switched it on, the date it was switched on, and four groups derived from ACCESS facts, which renderer-circleci serves today (/organizations/{org_id}/groups, ruled 2026-09-07). Two of the three supporting clauses that correction left have since gone false in their turn, and this is the second correction this row has needed for the same reason: a ruling resting on an absence canon later filled. canon DOES attach a role to an identity group (hello-17's grants - a membership row with scope_kind 'group', reader.groupRole(), which renderer-circleci serves), and canon DOES bind a person to an external uid (hello-18's externalUid - person.external_uid, which GitLab's saml/{uid} and scim/{uid} resolve). The empty answer still stands, and it now stands on the FIRST clause alone - which is the one the vendored document actually asks about: `IdpGroupUser` is "a user whose membership is derived from IDP group assignments", and NO Devin membership here is derived that way. Every Devin seat is assigned DIRECTLY to a person by the organization, which is the same absence every member detail already reports as idp_role_assignments: []. THE ASK is now one fact rather than two: a Devin SEAT a person holds BECAUSE an identity group confers it. A directory identity on a person is not that, and a role on a group is not that either. NOTE for the next wave: the five idp-GROUPS rows in this fence still carry the falsified "canon attaches no role to an identity group" clause, and they are deliberately untouched here because on those rows the correction may be a re-SERVE rather than a re-word - `IdpGroup.role_assignments` is RoleAssignment[] and hello-17's groupRole() may now answer it - which is a ruling this wave cannot make alone

refuse — knowledge notes are authored free-text prose a human wrote, the same class of content as session messages, and this universe does not invent authored prose (the standing founder-adopted default; revisit if a client asks)

refuse — knowledge notes are authored free-text prose a human wrote, the same class of content as session messages, and this universe does not invent authored prose (the standing founder-adopted default; revisit if a client asks)

refuse — knowledge notes are authored free-text prose a human wrote, the same class of content as session messages, and this universe does not invent authored prose (the standing founder-adopted default; revisit if a client asks)

SERVED 2026-09-12 (post-hello-18 serving pass). The 2026-09-10 correction on this row named its own expiry: the empty stood because "canon attaches no role to an identity group and binds no person to an external uid", and THE ASK was exactly those two facts. Both have landed - hello-17's features.grants writes one membership row per identity group with scope_kind 'group' (reader.groupRole(), decisions/2026-09-11-2304-hello-17-grants.md), and hello-18's features.externalUid puts person.external_uid on every human (which GitLab's saml/{uid} and scim/{uid} resolve) - and the 2026-09-12 wave that re-worded the idp-USERS rows left the note this answers: "on those rows the correction may be a re-SERVE rather than a re-word". A GROUP IS REGISTERED WITH THIS ENTERPRISE WHEN CANON BINDS IT TO A ROLE: that binding is what registering one MEANS, canon records no Devin-side registration object, and gating all five rows on it is what keeps the three lists answering the same set. This row's old reason said "IdpGroup REQUIRES role_assignments, a Devin role the group confers, and canon attaches no role to an identity group at all", and that is the clause hello-17 falsified. ONE ASSIGNMENT PER GROUP, because a group's role is the FLOOR of its members' authority and canon writes exactly one scope_kind 'group' row per group; role_id is the SAME catalog row /v3/enterprise/roles publishes, so the reference resolves beside the answer that produced it; role_type follows canon's permission list (org:admin administers the whole organization, which is what an enterprise-scoped role is) and org_id follows role_type, the rule shapeUser already applies to a member's own assignments. EVERY MEMBER STILL REPORTS idp_role_assignments: [] AND THAT IS NOT A CONTRADICTION - it is the vendored document's own distinction: IdpRoleAssignment is a role "inherited via IDP group membership" and IdpGroupUser is a user whose "membership is derived from IDP group assignments", both facts about a SEAT, and every Devin seat here is assigned DIRECTLY by the organization (canon's ai_seat), which is the fact the idp-USERS rows were re-ruled onto on 2026-09-12. IdpGroup.role_assignments is what the GROUP confers, not what any member has received. Gated on groupRole(), so on every artifact without features.grants - the 127 pins frozen before hello-20 - the lists are Devin's empty envelope and the by-name reads are its 404, byte for byte what these rows served before; conformance asserts that on the hello-7 harness those pins ride.

SERVED 2026-09-12 (post-hello-18 serving pass). The 2026-09-10 correction on this row named its own expiry: the empty stood because "canon attaches no role to an identity group and binds no person to an external uid", and THE ASK was exactly those two facts. Both have landed - hello-17's features.grants writes one membership row per identity group with scope_kind 'group' (reader.groupRole(), decisions/2026-09-11-2304-hello-17-grants.md), and hello-18's features.externalUid puts person.external_uid on every human (which GitLab's saml/{uid} and scim/{uid} resolve) - and the 2026-09-12 wave that re-worded the idp-USERS rows left the note this answers: "on those rows the correction may be a re-SERVE rather than a re-word". A GROUP IS REGISTERED WITH THIS ENTERPRISE WHEN CANON BINDS IT TO A ROLE: that binding is what registering one MEANS, canon records no Devin-side registration object, and gating all five rows on it is what keeps the three lists answering the same set. The org-scoped twin, serving the same object as its enterprise twin: which endpoint you ask does not change what a group may do, the reading shapeOrgUser already takes one resource along. The parent still has to resolve - an {org_id} this universe does not have is Devin's 404 through the shared org wrapper. EVERY MEMBER STILL REPORTS idp_role_assignments: [] AND THAT IS NOT A CONTRADICTION - it is the vendored document's own distinction: IdpRoleAssignment is a role "inherited via IDP group membership" and IdpGroupUser is a user whose "membership is derived from IDP group assignments", both facts about a SEAT, and every Devin seat here is assigned DIRECTLY by the organization (canon's ai_seat), which is the fact the idp-USERS rows were re-ruled onto on 2026-09-12. IdpGroup.role_assignments is what the GROUP confers, not what any member has received. Gated on groupRole(), so on every artifact without features.grants - the 127 pins frozen before hello-20 - the lists are Devin's empty envelope and the by-name reads are its 404, byte for byte what these rows served before; conformance asserts that on the hello-7 harness those pins ride.

refuse — an automation INSTANCE exists only because somebody configured one, and this universe accepts no writes (invariant #3) - nobody here created a Devin automation. RE-WORDED 2026-09-14 (hello-20 wave W-devin): this reason used to end 'the vendor-fixed half of the surface - schemas and templates - is derived instead', and the wave that went to derive those two found that it cannot be done from this repository. Both of them are still backlog and each now carries the finding that stopped it - a PATCH semantics this read-only replica has none of, and condition field paths and a built-in template catalogue that are the VENDOR's identifiers, which the vendored document declares the shape of and never one instance of. The refusal on this row is untouched by that and rests on its own fact.

derive — NOT SERVED, and deliberately still backlog rather than `refuse`: REAL DEVIN ANSWERS 200 HERE for every organization - the operation lists Devin's BUILT-IN templates, which are the vendor's product catalogue rather than anything this organization created - so a refusal would be a lie about the provider, and `{templates: []}` would claim Devin ships none, which the create endpoint's own description contradicts (template_id values are accepted there). The 2026-09-01 classification read `derive` off 'the vendor-fixed half of the surface'; the hello-20 serving wave that went to derive it found the vendor half is not in this repository to derive FROM. AutomationTemplateResponse requires template_id, name, description, category, required_integrations, required_mcps, triggers and actions, and the vendored document declares the SHAPE of a template and not one instance: no example, no default, no enum of ids, and a nullable docs_url that would point into Devin's own documentation. A template_id is an identifier a client USES at create time, which decisions/2026-09-14-0202 puts on the FACTUAL side of the catalogue line (a name a client asks for is factual; prose that decorates the story is ours to write) - and the ids, the names and the docs_urls are all on that side and all unobserved. THE ASK is a CAPTURE of Devin's template catalogue - not a canon entity.

the org-scoped playbook twin: nobody here ever wrote a playbook, so the playbook list is empty

refuse — the id half of the playbook pair: nobody here ever wrote a playbook, so the playbook list is empty, so no id can resolve and Devin's own 404 is the only possible answer (the by-id shape ruled in DECISIONS 2026-09-01 [coverage/A0])

the org-scoped service-user twin: this universe's only non-human identity is the CI bot and it holds no Devin seat, so the service-user list is empty

refuse — the id half of the service-user pair: this universe's only non-human identity is the CI bot and it holds no Devin seat, so the service-user list is empty, so no id can resolve and Devin's own 404 is the only possible answer (the by-id shape ruled in DECISIONS 2026-09-01 [coverage/A0])

refuse — the git-provider connection is an install-time OAuth object on Devin's side, and this universe's repositories are served by our own GitHub/GitLab mirrors rather than through a Devin-held provider grant

SERVED 2026-09-14 (hello-20 wave W-devin): RepoIndexingStatusResponse - the by-path half of `.../repositories/indexing`, and a DIFFERENT schema from it (the list publishes RepositoryIndexingResponse - path, enabled, branches - while this operation publishes enabled plus the index jobs), read off the vendored document rather than assumed from the sibling. All four members follow from ONE measurement rather than four choices: canon carries no Devin index, no index JOB and no indexing setting, and this universe accepts no writes, so indexing_enabled is false, latest_indexes is empty and both latest_completed_* are null. Conformance asserts all four, so the day canon grows an index the row reds instead of carrying a stale `false`. {repository_path} is `owner/repo` and therefore SPANS A SLASH, so the route carries Hono's regex path param and resolves the escaped `%2F` spelling to the same repository - verified rather than assumed, and with NO decodeURIComponent, which would be wrong twice and THROWS a bare 500 on a malformed escape where the document declares a 404 (decisions/2026-09-12-2239). Registered after the list route, which keeps answering the list. A path this organization does not have is Devin's own resource 404 rather than a status object for a repository that is not there (invariant #5). NO GENERATION GATE, deliberately: it answers off listRepos(), which every artifact since hello-1 carries, and the fact it reports is as true of a frozen pin as of live - asserted on hello-7 and hello-20 alike.

SERVED 2026-09-14 (hello-20 `auditActor`): reader.listPersonAuditEvents() - the PERSON half of `admin_audit_event`, which hello-20 writes (91 rows at 90 days, every instant an existing act's instant and every actor an existing person). NEVER reader.listAuditEvents(): the bare three accessors default to the SUPPORT DESK's register, and a Devin surface publishing a Zendesk instance's account audit under this enterprise's path would be a different organization's register on the wrong host. THIS HOST PUBLISHES 3 OF THE 91, AND THAT IS TWO GATES RATHER THAN A SLICE TAKEN TO BE SAFE. GATE 1, the rule the GitLab twin states for the same table: the audited object must be an object THIS HOST publishes. Devin publishes the ORGANIZATION (/v3/enterprise/organizations, whose created_at IS reader.orgCreatedEpoch(), so a `create_org` row says in a second place what that endpoint says in the first), the enterprise's MEMBERS, the REPOSITORIES, and the caller's own API KEY - /v3/self has rendered a canon `personal-token` credential as api_key_id + api_key_name since hello-17, so `create_pat` and `revoke_pat` are published for a holder of a Devin seat, whose member id /v3/enterprise/members/users/{user_id} resolves (invariant #5). GATE 2, and it is Devin-specific: AuditLogAction is a CLOSED enum of acts performed INSIDE Devin, where GitLab's event_name is free text - an act with no member in that enum cannot be published here without inventing a value the vendored document forbids (invariant #2). So the 44 membership rows are NOT published, because this universe's Devin membership IS THE SEAT (members() is exactly the ai_seat holders and enterprise_joined_at is the seat's own instant, and Devin's enum distinguishes add_enterprise_member from add_member) and canon writes no audit row for a seat assignment; the 4 team rows are not, because Devin has no team (its idp-groups are DIRECTORY groups); the 2 protected-ref rows are not, because this host publishes no ref; the 1 repo row is not, because every repository act in the enum is an act of CONNECTING a repository to Devin, which canon does not record; and 37 credential rows are not, because an SSH key, a GPG key and a deploy or resource token are git-host credentials Devin neither holds nor publishes. Conformance asserts BOTH directions and the exclusions: every published row is a canonical act, every qualifying canonical act is published, and canon really holds rows of each excluded family - an empty family would make the exclusion vacuous. `data` is the EMPTY OBJECT: the document declares it additionalProperties with no properties and names no key inside it, and this repository holds no capture of Devin's own spellings, so a key invented here would be this replica asserting a wire shape nobody verified (the reason the GitLab twin CAN fill its `details` - GitLab documents custom_message, target_details and ip_address by name). Everything the row knows has a declared field of its own and is in it. `order` defaults to desc, which is the document's own default and the reverse of the artifact's order, and anything but asc/desc is the caller's 422; `action`, `time_after` and `time_before` narrow rather than being ignored. Gated on reader.hasAuditActor(); an older artifact - the 127 pins frozen before hello-20, and live until the hello-20 cutover - answers the NAMED hello-20 gap rather than `[]`, which would claim this enterprise has never been administered while the same artifact publishes the organization, the members and the API key that administration produced. This row is the ORG-SCOPED register, and it answers the SAME rows as the enterprise one, because every act in the register happened in the one organization this enterprise has - the reading /v3/enterprise/consumption/daily/organizations/{org_id} already takes. An {org_id} this universe does not have is Devin's own 404 through the shared org wrapper, before the generation is consulted.

refuse — guardrails are an enterprise-security beta this org never turned on, and Devin answers 403 to guardrail-violation reads for an enterprise with no guardrail policy configured

SERVED 2026-09-12: the single read of the same OrganizationResponse the list publishes, through the shared {org_id} resolution - so an id this universe does not have is Devin's own 404

refuse — the org-scoped Devin Review twin, and the same fact: no Devin Review exists in this universe - a review record is created by a trigger through the API and this universe accepts no writes (invariant #3), and canon's ai_pull rows attribute AUTHORSHIP rather than review (the two pulls Devin produced were reviewed by people, person-14 and person-04); Devin's own answer when no review exists for the resolved commit is its 404, which the operation's own description states. RULED by the founder 2026-09-12

SERVED 2026-09-10 (hello-16): the same row plus canon's permission list — reader.listMembershipRoles() (reader.ts:3042) — which is the whole difference the operation declares ("Get a single role AND ITS PERMISSIONS"). `permissions` is canon's closed `scope:level` vocabulary, which the schema types `array<string>` with no enum, so re-spelling it into Devin permission identifiers would be a table nothing in canon could hold us to. A role id the catalog does not carry is Devin's own problem+json 404, never the coverage miss

refuse — a schedule exists only because somebody created one, and this universe accepts no writes (invariant #3) — nobody here scheduled a recurring Devin run

with no organization tag defined there is no default tag set either — the twin of the org-tags row. Devin's DefaultTagResponse is a nullable SCALAR, so this row's empty shape is `default_tag: null` (empty-shape.ts NULL_KEYS), not an empty list