When something does not work in an agentic IDE, the temptation is to hunt for a single bug. But the product is built in layers, and a symptom almost never lives in the layer where it was noticed. Diagnosing at random is costly precisely because it tries the layers in a random order and spends hours where a minute in the right place would have done.
The naive move is to fix where you saw it. A command did not work - rewrite the command; the agent did not see a file - touch the file; a permission refused - lift the rule. Each such move treats the symptom without asking which layer it actually came from, and so often creates a second problem on top of the first.
It breaks on the fact that cause and symptom lie in different layers. A permission refusal may come from organizational policy, not your config; the agent does not see a file because it works in a remote CWD; a command is not found because it lives in another channel or moved to Next. Until the layer is named, any edit hits broadly and with equal probability misses the cause.
The professional mechanism is to walk the layers in order: version, identity, workspace, agent, customization, permission, runtime. Version: stable or Next, the changelog, a restart after an update. Identity: account, plan, team policy, a re-sign-in. Workspace: Restricted Mode, folder trust, Git status, the remote CWD. Agent: the selector, the enabled toggle, the connection status. Customization: rules, hooks, plugin, MCP auth. Permission: which layer gave the deny or ask. Runtime: shell, PATH, container, proxy, certificate. Seven layers are not a ritual but a route: walked in order, it almost always ends at a specific line rather than a general something broke.
Why this order. The layers run from the most general and cheapest to check to the most specific and expensive. A wrong version or team policy explains many symptoms at once, and checking them takes seconds. Diving straight into runtime without ruling out version and identity means fixing an effect while leaving the cause untouched, and almost certainly returning to it later at greater loss.
What helps in 3.7.16. A refusal reports which layer issued it - that points at once to where to look, instead of guessing between policy and a local rule. MCP logs are split by output channels, so the source is visible without guessing. A failed worktree shows the specific Git error, not a general it did not work. The product itself hints at the layer if you look at it rather than argue with the symptom. These hints are what make the layer-by-layer pass cheap: the product names the layer itself, and all that is left is to start from the top.
A separate case is ACP. Check the binary in PATH, the separate login and the environment variables, then reload the ACP connections from the command palette (check the exact name in your version). A third-party agent fails for its own reasons, and its layer is diagnosed by its own means, not by Devin's settings: someone else's execution chain requires someone else's checks, and hunting its failure in Devin's config is losing time in the wrong layer.
So that diagnosis is transferable rather than verbal, fill in the short report from the block below. It records the version and channel, the OS and remote layer, the path and Git status, the selected agent, Restricted Mode, the exact action and error, the shown permission source, the relevant output channel, a minimal reproduction and what changed since the last success. The filled-in report is half the solution by itself: it forces you to name the layer. And the same report turns your guess into a transferable fact: a colleague continues from where you stopped.
The cost of diagnosing off-layer is hours spent in the wrong layer. Rewriting a command when the matter is policy; churning runtime when the version is to blame; changing a rule when the deny came from above. Each such attempt also masks the real cause with new changes, so finding it afterward only gets harder and the rollback longer.
When a layer-by-layer pass is especially justified. Always, but especially when the symptom is vague and reproduces unstably. The less clear the breakage, the costlier guessing is and the more it pays to walk the cheap upper layers before digging deep: order here saves more than the speed of trial and error. A cheap upper layer ruled out in seconds is worth more than an hour spent in a deep one.
Verification here is the filled-in report itself. If every field is filled, you have either already found the layer where it breaks or obtained a reproduction you can hand on without losing context. The sign of unfinished diagnosis is simple: the failing layer and what changed since the last success are not named. Name them - and in most cases the cause turns out to be exactly where you stopped looking.
Диагностический отчёт
Desktop version/channel:
OS / remote layer:
Workspace path and Git status:
Selected agent:
Restricted Mode:
Exact action and error:
Permission source shown:
Relevant output channel:
Minimal reproduction:
What changed since last success: