Devin Federal Hardening Guide

AI/ML Platform Last updated: 2026-11-05

Harden the separate federal portal and air-gapped beta: SSO, group/model limits, signed licenses, host OIDC, inference credentials, CA/proxy trust and structured local audit.

Product Docs API Docs

Code Packs: API Scripts CLI Scripts Config SIEM Queries

View:

Devin Federal — Requirements Cheat Sheet

All controls condensed. Click any requirement to jump to full implementation details.

Requirement	Description	Rationale

Overview

This is a product guide within the Cognition platform. Harden the separate federal portal and air-gapped beta: SSO, group/model limits, signed licenses, host OIDC, inference credentials, CA/proxy trust and structured local audit.

Intended Audience

Account and endpoint administrators
Integration/developer-platform owners
Security and GRC teams reviewing effective access and evidence

How to Use This Guide

L1 (Crawl): Establish identity ownership and protect sensitive state.
L2 (Walk): Restrict effective integration and execution authority.
Pilot changes in a disposable environment with recovery and approved rollback. Configuration evidence and denial tests are separate from policy intent.

Scope

Two related planes are deliberately separated: multi-tenant federal portal administration and air-gapped Desktop/CLI beta host files. Group APIs are multi-tenant gated; they do not configure an offline host. The air-gapped bundle does not inherit commercial cloud login, Cascade or automatic updates. Supported OS/architecture and feature availability must match the current air-gapped runbook. Third-party inference, IdP, MCP and SIEM administration remains with those owners.

Validation status: no tenants declared — Tier 0+1 only. This guide was researched from public configuration documentation and tested with local fixtures/stubs. No login, key creation, enrollment, integration, live product call or policy change was performed. It remains ai-drafted.

Federal Portal Identity & Policy
Air-gapped Authentication & Releases
Models & Network Trust
State & Audit Evidence

1. Federal Portal Identity & Policy

1.1 Enforce Federal Portal SSO, Roles and Service-Key Lifecycle

Profile Level: L1 (Crawl)

Description

Administer the federal portal through its own SSO, role and service-key workflow. Commercial Devin Authentication settings do not configure this plane.

Rationale

Why This Matters:

The federal portal requires Cognition-assisted OIDC/SAML SSO and inherits MFA from the IdP.
A displayed permission category can exist even when the corresponding portal feature is unavailable.

Attack Prevented: Excess portal privileges and surviving service credentials after offboarding.

Prerequisites

Federal deployment, portal/IdP administrator and account-team configuration. Use the actual assigned federal portal URL.

ClickOps Implementation

Configure portal SSO with Cognition and require MFA at the IdP; no email/password fallback is documented for the federal portal.
Open Settings → Role Management and grant only the required permissions; review Manage Team → Edit Role assignments. Do not interpret unavailable Indexing/Fine-Tuning/SSO permission tabs as available federal features.
Under Settings → Service Keys, review scopes and rotate by creating an approved replacement, updating consumers, verifying success, then deleting the old key. On offboarding remove roles and service keys, then delete the user/release the seat through Manage Team. Review the separate portal Auth Token workflow for current cloud CLI/Desktop login: a Profile API key is not that login token (federal changelog).

Automation: Federal group APIs and the portal-downloaded SDK use scoped service keys, but their existence does not prove a portal SSO/role-policy setter. These settings use the documented portal/account-team workflow; no commercial API or Terraform resource is substituted. Analytics is not a universal security-audit export.

Validation & Testing

Use an authorized pilot to confirm SSO/MFA and denied operations for a limited role. Review both user membership and associated keys. No portal login or credential creation was performed.

Compliance Mappings

Framework	Control	Mapping intent
SOC 2	CC6.1, CC7.2	Supports access and monitoring objectives
NIST SP 800-53 Rev. 5	AC-2, AC-6, IA-2, IA-5	Supports configuration and access objectives
ISO 27001:2022	A.5.15, A.8.9	Supports access and configuration management

Sources: Federal security administration (retrieved 2026-11-05; no live validation).

1.2 Reconcile Group Model Access and ACU Limits

Profile Level: L2 (Walk)

Description

In eligible multi-tenant federal deployments, compute effective model access and spending limits across team, group and manual user overrides.

Rationale

Why This Matters:

Nonempty group model selections combine by union and can widen access; an empty selection is no opinion.
Group ACU limits resolve to the highest group cap unless a manual user override applies; no applicable cap can mean unlimited within the team cap.

Attack Prevented: Unexpected model access or spend after overlapping group assignments.

Prerequisites

Multi-tenant self-hosted group feature; Teams Read-Only/Analytics Read for reads, Teams Update for writes and portal Settings access. Portal SDK download requires authorized access.

ClickOps Implementation

Open Settings → Groups. Compare group membership and separate Cascade/Command model selections against the team’s upper-bound policy; CLI and Devin Local use Cascade policy.
Inspect team ACU limit, group defaults and Manage Team → user actions → Edit Custom Limit. Record the effective cap rather than taking the smallest group value. Legacy per-user caps can require Cognition support to remove.
Review partial-save warnings. Default-group membership applies to new users only; removing a group does not remove team access. Group deletion is irreversible and is not an offboarding operation.

Code Implementation

The API collector uses documented read-only JSON POSTs and follows every cursor; it records group effective/configured policy in a protected file. Group examples use nextPageToken while the API overview says next_page_token; the pack accepts either, rejects contradictions, and treats a missing cursor as unknown. The CLI wrapper invokes the actual portal-provided windsurf_analytics.py list-groups with an environment credential. The SDK itself is not available publicly in this run and is not replaced by a fake implementation. No commercial Terraform support is claimed.

Code Pack: API Script

hth-devin-federal-1.02-inventory-groups.sh View source on GitHub ↗

source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/common.sh"
hth_federal_init
cursor=''; pages=0
: > "$HTH_TEMP/groups.jsonl"; : > "$HTH_TEMP/cursors.jsonl"
while :; do
  # Credential enters jq through its environment, never command-line arguments.
  jq -n --arg cursor "$cursor" '{service_key:env.WINDSURF_SERVICE_KEY,page_size:100,page_token:$cursor}' > "$HTH_TEMP/request.json"
  hth_federal_post_read ListGroups "$HTH_TEMP/request.json" "$HTH_TEMP/page.json"
  # Group examples use camelCase; API overview says snake_case. Accept either,
  # but reject missing or contradictory cursors instead of silently truncating.
  jq -e '(.groups|type=="array") and
    ((has("nextPageToken") and (.nextPageToken|type=="string")) or
     (has("next_page_token") and (.next_page_token|type=="string"))) and
    (if has("nextPageToken") and has("next_page_token") then .nextPageToken==.next_page_token else true end) and
    all(.groups[]; (.groupId|type=="string") and (.groupId|length>0))' "$HTH_TEMP/page.json" >/dev/null || hth_unknown 'malformed or conflicting list/pagination envelope'
  jq -c '.groups[]' "$HTH_TEMP/page.json" >> "$HTH_TEMP/groups.jsonl"
  pages=$((pages+1)); cursor="$(jq -r '.nextPageToken // .next_page_token' "$HTH_TEMP/page.json")"
  [[ -n "$cursor" ]] || break
  (( pages < HTH_MAX_PAGES )) || hth_unknown 'pagination limit reached; partial evidence discarded'
  jq -se --arg c "$cursor" 'index($c)==null' "$HTH_TEMP/cursors.jsonl" >/dev/null || hth_unknown 'repeated pagination cursor'
  jq -nc --arg c "$cursor" '$c' >> "$HTH_TEMP/cursors.jsonl"
done
jq -se '([.[].groupId]|length)==([.[].groupId]|unique|length)' "$HTH_TEMP/groups.jsonl" >/dev/null || hth_unknown 'duplicate group IDs; inventory changed or pagination unreliable'
: > "$HTH_TEMP/details.jsonl"
while IFS= read -r group; do
  id="$(jq -r '.groupId' <<< "$group")"
  jq -n --arg id "$id" '{service_key:env.WINDSURF_SERVICE_KEY,group_id:$id}' > "$HTH_TEMP/request.json"
  hth_federal_post_read GetGroup "$HTH_TEMP/request.json" "$HTH_TEMP/detail.json"
  jq -e --arg id "$id" '(.group|type=="object") and .group.groupId==$id and (.group.cascadeModelUids|type=="array") and (.group.commandModelUids|type=="array")' "$HTH_TEMP/detail.json" >/dev/null || hth_unknown 'malformed/mismatched group detail'
  jq -c '.group|{groupId,name,memberCount,cascadeModelUids,commandModelUids,configuredCycleAcuLimit,effectiveCycleAcuLimit}' "$HTH_TEMP/detail.json" >> "$HTH_TEMP/details.jsonl"
done < "$HTH_TEMP/groups.jsonl"
jq -s '{scope:"groups visible to this key; group-scoped keys are not team-wide evidence",groups:.}' "$HTH_TEMP/details.jsonl" > "$HTH_TEMP/evidence.json"
hth_private_copy "$HTH_TEMP/evidence.json" "$HTH_OUTPUT_FILE"
printf 'COLLECTED %s visible groups; reconcile team bounds, user overrides and membership separately.\n' "$(jq '.groups|length' "$HTH_TEMP/evidence.json")"

Code Pack: CLI Script

hth-devin-federal-1.02-sdk-group-inventory.sh View source on GitHub ↗

set +x
set -Eeuo pipefail
umask 077
unknown() { printf 'UNKNOWN: %s\n' "$*" >&2; exit 2; }
case "${HTH_PROFILE_LEVEL:-1}" in 2|3|4) ;; *) unknown 'HTH_PROFILE_LEVEL=2..4 required before collection' ;; esac
[[ $# == 0 ]] || unknown 'configuration is supplied through environment, never a key argument'
[[ -f ${DEVIN_FEDERAL_SDK:-} && ! -L ${DEVIN_FEDERAL_SDK:-} ]] || unknown 'supply the trusted portal-downloaded windsurf_analytics.py path'
[[ "${DEVIN_FEDERAL_API_URL:-}" =~ ^https://[A-Za-z0-9][A-Za-z0-9.-]*(:[0-9]{1,5})?$ ]] || unknown 'supply the confirmed HTTPS origin'
[[ -n ${WINDSURF_SERVICE_KEY:-} ]] || unknown 'inject an existing scoped WINDSURF_SERVICE_KEY'
[[ -d ${HTH_EVIDENCE_DIR:-} && ! -L ${HTH_EVIDENCE_DIR:-} ]] || unknown 'supply a trusted existing evidence directory'
command -v python3 >/dev/null || unknown 'Python 3 required for the actual vendor SDK'
command -v jq >/dev/null || unknown 'jq required to recognize output'
out="$(mktemp -d "$HTH_EVIDENCE_DIR/federal-groups.XXXXXX")"
# This is a wrapper around the actual vendor SDK CLI, not a substitute SDK.
if ! python3 "$DEVIN_FEDERAL_SDK" list-groups --api-url "$DEVIN_FEDERAL_API_URL" > "$out/groups.json" 2> "$out/error.txt"; then
 unknown "vendor SDK failed; no complete evidence. Review ${out}/error.txt privately"
fi
jq -se 'length==1 and (.[0]|type=="object" and (.groups|type=="array"))' "$out/groups.json" >/dev/null 2>&1 || unknown 'unrecognized SDK output; not a policy pass'
printf 'COLLECTED visible group list only: %s/groups.json; no effective-policy verdict.\n' "$out"

Validation & Testing

Compare a pilot user in overlapping groups and one with a manual cap against router/model-picker behavior. Confirm missing-entitlement or malformed/partial responses fail unknown, not compliant. The wrapper was tested with argument stubs only; no real SDK or portal endpoint was called.

Compliance Mappings

Framework	Control	Mapping intent
SOC 2	CC6.1, CC7.2	Supports access and monitoring objectives
NIST SP 800-53 Rev. 5	AC-3, AC-6, SI-4	Supports configuration and access objectives
ISO 27001:2022	A.5.15, A.8.9	Supports access and configuration management

Sources: Groups, Model provisioning, ACU, Group APIs, SDK (retrieved 2026-11-05; no live validation).

2. Air-gapped Authentication & Releases

2.1 Require Air-gapped OIDC When License-Only Access Is Insufficient

Profile Level: L2 (Walk)

Description

Deploy the air-gapped auth.json with mode: sso and a required IdP group when user authentication is required. A signed license alone does not enforce organizational identity.

Rationale

Why This Matters:

A missing auth file defaults to license-only operation; OIDC is optional, not automatic.
Logout deletes the local token cache, while IdP revocation/group changes are observed through refresh/expiry with documented skew.

Attack Prevented: Use by an unauthorized local user holding a valid license and stale group authorization.

Prerequisites

Air-gapped beta, reachable approved IdP endpoints, public PKCE S256 OIDC client without client secret, required group and machine configuration management.

ClickOps Implementation

There is no native portal GUI for this host policy. Deploy strict JSON to /etc/devin/auth.json (Windows C:\ProgramData\Devin\auth.json) or the reviewed DEVIN_AUTH_FILE override; protect the file and parents against user modification.
Use the emitter’s confirmed HTTPS issuer, client ID and required group. Retain openid scope and exact additional endpoint hosts only where discovery requires them; the additional list does not relax TLS validation.
Configure the supported loopback callback at 127.0.0.1 with random port and /callback. Use short appropriate ID-token lifetimes and review offline-access/refresh behavior. Do not store a client secret in a public-client config.

Code Implementation

The native emitter produces schema-version-0 OIDC policy with explicit required group and an empty additional-host list. Review the real IdP configuration, then deploy through host management; it never logs in or writes machine files. Reads use first-party auth status/doctor separately from commercial CLI.

Code Pack: Config

hth-devin-federal-2.01-oidc-policy.sh View source on GitHub ↗

set +x
set -Eeuo pipefail
umask 077
unknown() { printf 'UNKNOWN: %s\n' "$*" >&2; exit 2; }
case "${HTH_PROFILE_LEVEL:-1}" in 2|3|4) ;; *) unknown 'HTH_PROFILE_LEVEL=2..4 required before generation' ;; esac
command -v jq >/dev/null || unknown 'jq required'
[[ "${DEVIN_OIDC_ISSUER:-}" =~ ^https://[A-Za-z0-9][A-Za-z0-9.:-]*(/[A-Za-z0-9._~/-]*)?$ ]] || unknown 'issuer must be confirmed HTTPS without credentials, query or fragment'
[[ -n ${DEVIN_OIDC_CLIENT_ID:-} && -n ${DEVIN_OIDC_REQUIRED_GROUP:-} ]] || unknown 'set public client ID and explicit required group'
jq -n --arg issuer "$DEVIN_OIDC_ISSUER" --arg client "$DEVIN_OIDC_CLIENT_ID" --arg group "$DEVIN_OIDC_REQUIRED_GROUP" \
 '{schema_version:0,mode:"sso",issuer:$issuer,client_id:$client,scopes:["openid","profile","email"],groups_claim:"groups",required_group:$group,additional_endpoint_hosts:[]}'
printf 'EMITTED ONLY: review, deploy to protected auth.json, and test required-group denial with the real IdP.\n' >&2

Validation & Testing

On an authorized pilot test allowed and missing-group identities, issuer/endpoint restrictions and ID-token expiry. Include the documented DEVIN_AUTH_FILE environment override in that test: a protected default file alone does not prove users cannot select a different policy. Manage the actual launch environment and executable through host management; the fetched reference does not establish an immutable environment lock. Running sessions check validity every 60 seconds and force refresh at 15 minutes; expiry permits 120 seconds of skew, and refresh without a new ID token can retain cached claims for up to 24 hours. In-flight work is not instantaneously recalled. Local logout is not IdP-wide token revocation. Keep an approved recovery path rather than deleting the auth policy to bypass failures.

Compliance Mappings

Framework	Control	Mapping intent
SOC 2	CC6.1, CC7.2	Supports access and monitoring objectives
NIST SP 800-53 Rev. 5	IA-2, AC-3, IA-5	Supports configuration and access objectives
ISO 27001:2022	A.5.15, A.8.9	Supports access and configuration management

Sources: Air-gapped SSO (retrieved 2026-11-05; no live validation).

2.2 Protect Offline Licenses and Verified Release Bundles

Profile Level: L1 (Crawl)

Description

Manage signed per-seat licenses and air-gapped release bundles as controlled deployment artifacts. A valid offline license does not replace SSO or a review of the deployed version.

Rationale

Why This Matters:

The CLI validates the license locally, with expiry/skew and periodic revalidation rather than instant remote revocation.
Air-gapped Desktop bundles a matching CLI and lacks ordinary cloud auto-update assumptions.

Attack Prevented: Unauthorized license reuse and continued execution of an unreviewed or expired build.

Prerequisites

Portal license administrator, assigned seats, approved bundle source and release/change owner.

ClickOps Implementation

In the federal portal use Team → Airgapped licenses → Generate License only for approved labeled/assigned seats and duration. Revoke/reissue seats through the supported portal/support workflow.
Deploy the signed token at the documented machine path or reviewed DEVIN_LICENSE_FILE; keep machine folders administrator-owned. Verify the full release bundle against the vendor-provided checksums before transfer/install.
Inventory CLI/Desktop release versions and review the federal changelog before updating. Desktop and its bundled CLI come from the same commit; do not silently replace one with an unrelated commercial build. The portal serves one bundle at a time without a version picker or notification, so retain the approved prior package and its checksum for rollback. Quit clients before replacing the package; updates preserve external policy, history and SSO state. Revalidate models and license signing-key compatibility after updating.

Code Implementation

The first-party CLI wrapper only runs version, auth status, model validation and airgap doctor, saving private output. Those diagnostics can run without a valid license. It does not install licenses, download a release or start an agent. Portal-side revocation and installed offline expiry have different propagation.

Code Pack: CLI Script

hth-devin-federal-2.02-health-inventory.sh View source on GitHub ↗

set +x
set -Eeuo pipefail
umask 077
case "${HTH_PROFILE_LEVEL:-1}" in 1|2|3|4) ;; *) printf 'UNKNOWN: HTH_PROFILE_LEVEL must be 1..4.\n' >&2; exit 2 ;; esac
[[ $# == 0 || ( $# == 1 && "$1" == --probe ) ]] || { printf 'Usage: health-inventory.sh [--probe]\n' >&2; exit 2; }
[[ -d ${HTH_EVIDENCE_DIR:-} && ! -L ${HTH_EVIDENCE_DIR:-} ]] || { printf 'UNKNOWN: set a trusted existing HTH_EVIDENCE_DIR.\n' >&2; exit 2; }
command -v devin >/dev/null || { printf 'UNKNOWN: approved air-gapped devin required.\n' >&2; exit 2; }
out="$(mktemp -d "$HTH_EVIDENCE_DIR/federal-health.XXXXXX")"
failed=0
devin --version > "$out/version.txt" 2> "$out/version-error.txt" || failed=1
devin models validate > "$out/models.txt" 2> "$out/models-error.txt" || failed=1
# Auth status can refresh against IdP; doctor probes model/OIDC endpoints. Explicit only.
if [[ ${1:-} == --probe ]]; then
  devin auth status > "$out/auth.txt" 2> "$out/auth-error.txt" || failed=1
  devin airgap doctor > "$out/doctor.txt" 2> "$out/doctor-error.txt" || failed=1
fi
[[ "$failed" == 0 ]] || { printf 'UNKNOWN: at least one diagnostic failed; private evidence: %s\n' "$out" >&2; exit 2; }
printf 'COLLECTED private diagnostics: %s; review warnings. Not license, trust or SSO enforcement proof.\n' "$out"

Validation & Testing

Inspect a synthetic/approved pilot license expiry and configured path without logging the token. Document the expiry plus allowed clock-skew window (24 hours) and running-session revalidation before the next turn; do not claim immediate offline revocation. OS/Git email attribution is not cryptographic SSO identity.

Compliance Mappings

Framework	Control	Mapping intent
SOC 2	CC6.1, CC7.2	Supports access and monitoring objectives
NIST SP 800-53 Rev. 5	CM-8, SI-2, IA-5	Supports configuration and access objectives
ISO 27001:2022	A.5.15, A.8.9	Supports access and configuration management

Sources: Air-gapped overview, Licenses, Updates and rollback, Federal changelog (retrieved 2026-11-05; no live validation).

3. Models & Network Trust

3.1 Restrict Model Endpoints and Credential References

Profile Level: L2 (Walk)

Description

Maintain a reviewed machine-level models file with approved HTTPS inference endpoints, bounded model context and environment-referenced credentials.

Rationale

Why This Matters:

All configured models can expose prompts/code to the chosen endpoint.
Plaintext static authorization headers and a wrong process environment can disclose or fail credentials.

Attack Prevented: Sensitive context sent to an unintended model host and stored API secrets in shared configuration.

Prerequisites

Air-gapped beta; approved model, inference API type/context size and secret delivery to the actual CLI/Desktop process.

ClickOps Implementation

There is no cloud administration substitute for the native model file. Deploy the reviewed schema-version-0 /etc/devin/models.json (Windows ProgramData equivalent) or DEVIN_MODELS_FILE override.
Use api_key.env references and supported API types; do not store Authorization/Proxy-Authorization secrets in static headers. Supply the environment variable even when the selected endpoint does not require a real secret.
For Desktop deliver the environment to the launched agent (devin.acp.agentEnv where documented) and restart the agent process. Confirm only the approved model is the default.

Code Implementation

The emitter produces one real operator-supplied model entry, refuses URL credentials/query/fragment and references a named environment variable without reading its value. Current model reference text permits query strings, but the newer November 3 changelog says query/fragment values now fail MDL010; this pack follows the stricter released behavior. Run devin models validate for the installed build.

Code Pack: Config

hth-devin-federal-3.01-model-policy.sh View source on GitHub ↗

set +x
set -Eeuo pipefail
umask 077
unknown() { printf 'UNKNOWN: %s\n' "$*" >&2; exit 2; }
case "${HTH_PROFILE_LEVEL:-1}" in 2|3|4) ;; *) unknown 'HTH_PROFILE_LEVEL=2..4 required before generation' ;; esac
command -v jq >/dev/null || unknown 'jq required'
[[ "${DEVIN_MODEL_NAME:-}" =~ ^[A-Za-z0-9][A-Za-z0-9._:/-]*$ ]] || unknown 'supply approved model name'
[[ "${DEVIN_MODEL_BASE_URL:-}" =~ ^https://[A-Za-z0-9][A-Za-z0-9.:-]*(/[A-Za-z0-9._~/-]*)?$ ]] || unknown 'HTTPS base URL required without credentials, query or fragment'
[[ "${DEVIN_MODEL_KEY_ENV:-}" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || unknown 'supply credential environment variable NAME, not its value'
[[ "${DEVIN_MODEL_CONTEXT:-}" =~ ^[1-9][0-9]{0,8}$ ]] || unknown 'positive context token limit required'
[[ "${DEVIN_MODEL_API:-chat_completions}" == chat_completions || "${DEVIN_MODEL_API:-}" == responses ]] || unknown 'unsupported API type'
jq -n --arg name "$DEVIN_MODEL_NAME" --arg url "$DEVIN_MODEL_BASE_URL" --arg env "$DEVIN_MODEL_KEY_ENV" \
 --arg api "${DEVIN_MODEL_API:-chat_completions}" --argjson context "$DEVIN_MODEL_CONTEXT" \
 '{schema_version:0,models:[{name:$name,base_url:$url,api_key:{env:$env},api:$api,max_context_tokens:$context,default:true}]}'
printf 'EMITTED ONLY: merge reviewed model policy, protect host file and run installed devin models validate.\n' >&2

Validation & Testing

Validate offline shape then use first-party validation on an authorized installed build. Test the documented DEVIN_MODELS_FILE environment override: ownership of the default file alone does not prove the endpoint selection is immutable. Manage the real launch environment and executable through host management; no tamper-proof environment lock was verified. Confirm the real endpoint, trust and environment separately; model-file parsing does not prove secret delivery, router authorization or data residency. Restore the approved prior file through configuration management if deployment fails.

Compliance Mappings

Framework	Control	Mapping intent
SOC 2	CC6.1, CC7.2	Supports access and monitoring objectives
NIST SP 800-53 Rev. 5	AC-6, SC-7, IA-5	Supports configuration and access objectives
ISO 27001:2022	A.5.15, A.8.9	Supports access and configuration management

Sources: Model schema, November 3 change (retrieved 2026-11-05; no live validation).

3.2 Validate Air-gapped CA and Proxy Policy

Profile Level: L2 (Walk)

Description

Use OS trust plus the documented DEVIN_CA_BUNDLE where private PKI is needed, and govern the machine proxy and no-proxy exceptions.

Rationale

Why This Matters:

The custom CA bundle applies to model, OIDC and diagnostic connections, not just inference.
An invalid bundle can warn and fall back to OS roots at runtime while doctor reports CFG004; a warning is not evidence the intended CA loaded.

Attack Prevented: Trusting the wrong endpoint or silently losing intended private-CA/proxy configuration.

Prerequisites

Approved CA bundle, endpoint/network administrator and access to installed air-gapped diagnostics.

ClickOps Implementation

No product GUI deploys this machine trust policy. Manage the approved root bundle and protected path through endpoint tooling; set DEVIN_CA_BUNDLE for the actual process. Keep TLS verification enabled.
Review HTTPS endpoints and exact OIDC endpoint-host exceptions. HTTP is documented only for loopback development endpoints; this guide recommends HTTPS for managed services.
Use native system proxy policy and reviewed no_proxy; system policy overrides conflicting user configuration by refusing startup. Validate CLI and Desktop process environments independently.

Automation: Native CA-file/env and system-proxy policy are documented; the CLI system policy pack covers the shared proxy schema, while Federal 2.2 diagnostics run first-party doctor. No CA trust-disable key, cloud API or SDK setter is invented.

Validation & Testing

On an authorized pilot run airgap doctor and test expected endpoint trust. Treat invalid-bundle warnings, CFG004 or conflicting proxies as a failed deployment. Do not remove TLS checks to hide the failure.

Compliance Mappings

Framework	Control	Mapping intent
SOC 2	CC6.1, CC7.2	Supports access and monitoring objectives
NIST SP 800-53 Rev. 5	SC-8, SC-17, SC-7	Supports configuration and access objectives
ISO 27001:2022	A.5.15, A.8.9	Supports access and configuration management

Sources: Air-gapped networking and trust (retrieved 2026-11-05; no live validation).

4. State & Audit Evidence

4.1 Protect Token, History and Isolated Desktop State

Profile Level: L1 (Crawl)

Description

Inventory the actual federal token, conversation and isolated Desktop directories, preserving administrator-controlled host policy and owner-only sensitive user state.

Rationale

Why This Matters:

sso_tokens.toml and cli-federal/sessions.db contain reusable identity and conversation data outside the workspace.
Air-gapped Desktop isolates state and MCP configuration; its shared config symlink does not mean every cloud/local file is shared.

Attack Prevented: Credential/history disclosure through backups, other users or incorrect cleanup.

Prerequisites

Known XDG/Windows paths, endpoint retention policy and an incident-hold decision.

ClickOps Implementation

Resolve $XDG_DATA_HOME/devin or ~/.local/share/devin (Windows %APPDATA%\devin); restrict sso_tokens.toml, cli-federal conversation/audit state and backups to approved owners.
Inventory Desktop ~/.devin-airgap-config, isolated extensions and its separate user-data/language-server folders. Only the documented config link is shared; MCP files are not automatically shared. Existing regular files can override the expected symlink behavior.
Use approved retention and reinstall procedures. Do not delete shared folders, active databases or machine auth/models policy to troubleshoot. Review diagnostics before exporting, even though the supported redacted report omits secrets/prompts.

Automation: The native runbook documents file layout and protection, but no universal retention writer. Existing host policy/diagnostic packs do not prove filesystem ACLs, backup retention or running-client state. No destructive cleanup script or commercial-state-path substitution is supplied.

Validation & Testing

Inspect owner/mode or Windows ACLs and the actual Desktop link/file resolution on a disposable installed profile. Verify local logout removes the token cache while treating upstream IdP tokens and history/backups separately. No real token or database was read in this refresh.

Compliance Mappings

Framework	Control	Mapping intent
SOC 2	CC6.1, CC7.2	Supports access and monitoring objectives
NIST SP 800-53 Rev. 5	AU-9, IA-5, SI-12	Supports configuration and access objectives
ISO 27001:2022	A.5.15, A.8.9	Supports access and configuration management

Sources: On-disk formats and isolated Desktop state (retrieved 2026-11-05; no live validation).

4.2 Collect and Interpret Local Structured Audit Events

Profile Level: L2 (Walk)

Description

Forward the always-on air-gapped JSONL audit stream before its bounded local rotation evicts evidence. Parse schema-version-1 events while retaining unknown fields/event types.

Rationale

Why This Matters:

Local rotation is about 110 MiB across active plus ten rotated files, not durable enterprise retention.
File events describe permission scope, not verified I/O; actor attribution requires joining to session_start.

Attack Prevented: Loss of activity evidence and incorrect attribution or claims of completed file access.

Prerequisites

Air-gapped build, authorized collector account/root, protected SIEM retention and reviewed user/group/path data handling.

ClickOps Implementation

Collect the always-on stream at cli-federal/audit/audit*.jsonl from every relevant user’s actual state path; preserve owner-only permissions instead of chmodding logs for a collector.
Use supported Filebeat/Splunk ingestion and keep unknown fields/events. Schema 1 has ts, pid, event; auth uses event=auth with an action, not event=sso_login_denied.
Join tool/file/model events by session_id to session_start for actor identity. Treat missing session_end as abnormal exit possibility, not certain malicious activity. Keep paths and IdP group names protected.

Code Implementation

The Filebeat fragment uses a dedicated devin namespace to avoid the ECS event type collision, watches rotated files and uses the documented 64-byte fingerprint behavior. Replace paths/output using the real deployment. The Splunk query inventories authentication actions including refusals/revalidation failures; it is a SIEM-resident query, not a collector or retention setter.

Code Pack: Config

hth-devin-federal-4.02-filebeat.yml View source on GitHub ↗

# Merge with existing Filebeat configuration; keep only actual OS/XDG paths.
# Collector must run as authorized owner/root; do not weaken audit-file permissions.
filebeat.inputs:
  - type: filestream
    id: devin-airgap-audit
    paths:
      - /home/*/.local/share/devin/cli-federal/audit/audit*.jsonl
      - /Users/*/.local/share/devin/cli-federal/audit/audit*.jsonl
    prospector.scanner.fingerprint.length: 64
    parsers:
      - ndjson:
          target: devin
          add_error_key: true
    processors:
      - timestamp:
          field: devin.ts
          layouts:
            - "2006-01-02T15:04:05.999Z"
# Preserve future fields/events. Namespace avoids ECS event-object type conflicts.
# Timestamp processor is beta; test installed Filebeat or parse devin.ts at ingest.
# Supply real TLS-authenticated output and retention separately; no output configured here.

Code Pack: SIEM Queries

hth-devin-federal-4.02-auth-actions.spl View source on GitHub ↗

index=devin sourcetype="devin:airgap:audit" schema_version=1 event=auth
| eval action=coalesce(action,"(absent)"), error_code=coalesce(error_code,"(none)"), actor_user=coalesce('actor.sso_user','actor.os_user',"(unknown)"), issuer=coalesce('actor.sso_issuer',"(absent)")
| stats count min(_time) AS first_seen max(_time) AS last_seen
  by action error_code issuer actor_user

Validation & Testing

On an authorized pilot start/end a harmless session and locate matching events in the SIEM, then verify rotation continuity and alert routing. Test parsing with synthetic future event fields. No live audit events or collector were accessed here; ingestion/retention and beta timestamp processing remain deployment validation.

Compliance Mappings

Framework	Control	Mapping intent
SOC 2	CC6.1, CC7.2	Supports access and monitoring objectives
NIST SP 800-53 Rev. 5	AU-2, AU-6, AU-9, AU-12	Supports configuration and access objectives
ISO 27001:2022	A.5.15, A.8.9	Supports access and configuration management

Sources: Audit schema and supported collection (retrieved 2026-11-05; no live validation).

5. Compliance Quick Reference

Mappings support control objectives; they are not a product benchmark or certification. The bounded November search found no product-specific prescriptive CIS/SCuBA baseline; gated/unpublished coverage is unverified.

Framework	Objectives	Controls
SOC 2	CC6 access, CC7 monitoring	All controls as mapped individually
NIST SP 800-53 Rev. 5	AC/IA, CM, SC and AU families	See each control’s specific mapping
ISO 27001:2022	Access and secure configuration	A.5.15, A.8.9 objectives

Appendix A: Edition and Deployment Compatibility

Surface	Applicability
Federal portal	Cognition-assisted SSO and portal RBAC/service keys; commercial SSO settings do not apply
Groups/model/ACU	Eligible multi-tenant deployment and documented read/update permissions
Air-gapped beta	Supported macOS/Linux/Windows build; local signed license always required
OIDC	Optional layered authentication; no auth file means license-only
Native audit	Air-gapped local JSONL only; not a claim of equivalent commercial CLI auditing
Portal-downloaded SDK	Authorized download unavailable in this run; wrapper tests cover dispatch, not SDK behavior

Appendix B: References and Automation Coverage

The November source-first inventory records product naming, precise configuration evidence, six automation surfaces, read/write differences and retrieval failures. Unverified is not verified absence. The Code Pack contains native or documented first-party interfaces only. No GraphQL, fabricated SDK, generic SQL, or guessed enterprise console is supplied. No live evidence or maturity promotion is claimed.

Changelog

Date	Version	Maturity	Changes	Author
2026-11-05	0.1.0	ai-drafted	Initial source-first 8-control guide with separate identity/deployment boundaries and offline-tested packs; live product verification unavailable.	Codex (GPT-6)

Contributing

Report corrections through GitHub issues and the contribution guide. Share redacted version-specific evidence without tokens, account data or proprietary content.

Devin Federal Hardening Guide

Overview

Intended Audience

How to Use This Guide

Scope

Table of Contents

1. Federal Portal Identity & Policy

1.1 Enforce Federal Portal SSO, Roles and Service-Key Lifecycle

Description

Rationale

Prerequisites

ClickOps Implementation

Validation & Testing

Compliance Mappings

1.2 Reconcile Group Model Access and ACU Limits

Description

Rationale

Prerequisites

ClickOps Implementation

Code Implementation

Validation & Testing

Compliance Mappings

2. Air-gapped Authentication & Releases

2.1 Require Air-gapped OIDC When License-Only Access Is Insufficient

Description

Rationale

Prerequisites

ClickOps Implementation

Code Implementation

Validation & Testing

Compliance Mappings

2.2 Protect Offline Licenses and Verified Release Bundles

Description

Rationale

Prerequisites

ClickOps Implementation

Code Implementation

Validation & Testing

Compliance Mappings

3. Models & Network Trust

3.1 Restrict Model Endpoints and Credential References

Description

Rationale

Prerequisites

ClickOps Implementation

Code Implementation

Validation & Testing

Compliance Mappings

3.2 Validate Air-gapped CA and Proxy Policy

Description

Rationale

Prerequisites

ClickOps Implementation

Validation & Testing

Compliance Mappings

4. State & Audit Evidence

4.1 Protect Token, History and Isolated Desktop State

Description

Rationale

Prerequisites

ClickOps Implementation

Validation & Testing

Compliance Mappings

4.2 Collect and Interpret Local Structured Audit Events

Description

Rationale

Prerequisites

ClickOps Implementation

Code Implementation

Validation & Testing

Compliance Mappings

5. Compliance Quick Reference

Appendix A: Edition and Deployment Compatibility

Appendix B: References and Automation Coverage

Changelog

Contributing