docs: sync documentation with post-v0.2 changes

plugins/devin/README.md

@@ -54,13 +54,25 @@ Requires Python ≥ 3.10. No third-party packages — the server is pure stdlib.
 | Tool | What it does |
 |---|---|
 | `sleep_status` | nights run so far + latest staged proposal |
-| `sleep_dry_run` | preview cycle — no staging, no changes |
+| `sleep_dry_run` | preview cycle — no staging; a real backend still makes provider calls |
 | `sleep_run` | full cycle; stages a proposal for review |
 | `sleep_adopt` | apply the staged proposal; syncs skill to the workspace |
 | `sleep_harvest` | debug: list the recurring tasks mined |
 | `sleep_schedule` | install a nightly cron entry (`--hour` / `--minute`) |
 | `sleep_unschedule` | remove the nightly cron entry |
 
-Default backend is `mock` (no API spend); `--backend claude|codex` uses your own
-budget. Same engine and `sleep_*` interface as the other plugins — all call
-`python -m skillopt_sleep`.
+Default backend is `mock` (no API spend); the `claude`, `codex`, and `copilot`
+backends use the corresponding authenticated CLI and budget. The seven tools
+call the same `python -m skillopt_sleep` actions as the other shared-engine
+integrations.
+
+## Data boundary
+
+The Devin harvester reads local ATIF transcripts, agentmemory, and skill files
+and converts them into the engine's session format. The `mock` backend keeps
+that workflow local. A real backend sends truncated excerpts and derived tasks
+to the selected provider for mining, replay, judging, and reflection. The
+conversion step is not a guarantee that outbound prompts contain no secrets;
+review sensitive sources and provider policy before enabling a real backend.
+See the [shared data-boundary guidance](../README.md#data-boundary) and
+[implemented CLI reference](../README.md#supported-cli-surface).

plugins/devin/devin-rules.snippet.md

@@ -3,17 +3,36 @@
 You have access to a nightly self-evolution cycle via the `skillopt-sleep` MCP
 server. Use these tools to improve your long-term skills over time:
 
-- **`sleep_status`** — how many nights have run + the latest staged proposal
-- **`sleep_dry_run`** — preview a cycle without changing anything
-- **`sleep_run`** — run a full cycle; stages a proposal for review
-- **`sleep_adopt`** — apply the staged proposal to `.devin/skills/skillopt-sleep-learned/SKILL.md`
+- **`sleep_status`** — refresh the converted local cache, then show how many
+  nights have run and the latest staged proposal
+- **`sleep_dry_run`** — refresh the converted local cache and preview a cycle
+  without engine staging/adoption; a real backend still makes provider calls
+- **`sleep_run`** — run a full cycle; stages a proposal by default, while an
+  explicit `auto_adopt` may also update live files
+- **`sleep_adopt`** — apply the staged proposal, then sync the managed skill to
+  `.devin/skills/skillopt-sleep-learned/SKILL.md` when `project` is the Devin
+  workspace and that workspace already contains a `.devin/` directory
 - **`sleep_harvest`** — debug: list the recurring tasks mined from recent sessions
-- **`sleep_schedule`** / **`sleep_unschedule`** — install/remove a nightly cron run
+- **`sleep_schedule`** / **`sleep_unschedule`** — low-level shared-engine cron
+  controls; the current scheduled command does not run Devin's conversion step,
+  so do not use it as an unattended Devin-harvest workflow
 
-When a user asks about the sleep cycle, skill evolution, or improving your
-long-term memory, prefer calling these tools over explaining the concept.
+When a user asks about the sleep cycle or skill evolution, prefer calling these
+tools over explaining the concept.
 
-Default backend is `mock` (no API spend). Pass `backend: "claude"` or
-`backend: "codex"` with your own API key for real LLM-driven optimization.
+Always pass the absolute Devin workspace as `project`, especially for
+`sleep_adopt`. Default backend is `mock` (no provider calls). The `claude`,
+`codex`, and `copilot` backend values use the corresponding installed and
+authenticated CLI; they do not require this plugin to implement a separate
+API-key flow.
+
+The Devin conversion and mock workflow stay local. A real backend sends
+truncated transcript excerpts and derived tasks to the selected provider for
+mining, replay, judging, and reflection; conversion is not a guarantee that
+outbound prompts contain no secrets. Review local sources and provider policy
+before selecting a real backend.
+
+For a reviewed task file, pass `tasks_file`; before using it with a real backend,
+inspect/redact it and ensure its metadata contains `"reviewed": true`.
 
 Place this file at `.devin/rules/skillopt-sleep.md` in your workspace.