Augment Code vs Cognition (2026)

Stands at F and the basis is now specific. Roughly seventeen named integrations spanning source control, ticketing, chat, observability, error monitoring, cloud, data warehouse, database, storage and business tools is the widest named set in this lane, wider than baz or zencoder, and the vendor claims hundreds of tools overall. The distinguishing detail is that the GitHub integration closes the loop rather than just opening pull requests: Devin picks up review feedback and CI results and works the pull request through to merge.

Cosmos (June 2026) introduces an agentic SDLC platform with specialized agents coordinating across triage, spec, implementation, review, testing, deployment, and feedback.

Stands at F, now on first-party evidence. Devin spins up a team of Devins for large tasks and runs a fleet of agents migrating repositories in parallel, which is genuine multi-agent coordination rather than the single-agent multi-step execution that took blink-new, gocodeo, charm, igent and proofs to P in this lane. The multi-week, multi-repo framing puts it alongside blitzy and warp at the top of this axis.

Upgraded from P: headless CI invocation, GitHub Actions, ACP clients, service accounts for scheduled and automated runs, and pipeable stdin are five distinct paths beyond the IDE. Recurring automations are documented as a solution.

Stands at F and is the strongest Trig cell in the lane, ahead of tembo, greptile and ellipsis. All three trigger classes are documented with named sources: events from Datadog incidents, CI failures, Slack bug reports and Linear tickets, schedules for daily QA and release notes, and channels across Slack, Teams, Linear and GitHub, with a public API and a named Automations product for programmatic invocation on top. Devin Review adds configurable run controls, manual only, on pull request open, or on every commit, which is a rare and genuinely useful degree of trigger control.

Stands at F. Two mechanisms rather than one: a knowledge layer the team curates, where Devin picks up tribal knowledge and proposes entries a human approves, and DeepWiki, which auto-generates documentation and system diagrams for legacy codebases the team did not write. Devin Desktop adds Codemaps for visualising code structure and Fast Context for retrieving the exact files an agent needs. The tribal-knowledge framing is the distinguishing part, since it captures what is not written down anywhere in the repository, which no other vendor in this lane documents.

Cosmos (June 2026) introduces shared memory across coordinating agents in the agentic SDLC platform.

Stands at F and the basis is materially stronger than the June note showed. The decisive fact is new: the vendor states Devin GETS BETTER OVER TIME BY READING PAST SESSION TRAJECTORIES, which is memory accumulating from the agent's own history rather than a persisted index. That is the mechanism cosine and greptile were graded F for and that took charm, zed, blitzy and moderne to P, all of which persist state without learning from it. Curated tribal knowledge with an approval step adds a second, human-governed memory layer, and Spaces share context across related agents and cloud sessions. Kept separable from Know, which rests on codebase understanding and DeepWiki rather than on retained trajectories.

Prior N said oversight was not documented as first class; the CLI product page names Tool Permissions and User & Repo Rules as shipped features, and the dependency review workflow shows a documented risk threshold routing work to a human. That was a retrieval failure rather than an absence.

Stands at F, and unlike the delivery-boundary cases downgraded elsewhere in this batch, there are shipped configurable mechanisms here rather than a stated posture. Devin Review's run controls, manual only, on pull request open, or on every commit, are a customer-set constraint on when the agent acts, and the vendor migrated existing every-commit users to the more conservative default rather than leaving spend open-ended. The knowledge approval step is a second gate: Devin proposes what it has learned and a human approves before it is retained, which is unusual and worth noting. Output still lands as a pull request a human merges.

CONFIRMED at F, now on real evidence rather than an internal rubric, and the control surface turns out to be among the deepest in the index. The conjunction is met comfortably: a published trust centre documenting compliance certifications alongside SOC 2 Type 2, with FedRAMP High reported as in-process from July 2026 and a dedicated federal compliance page, plus an unusually long list of named customer-facing controls. Two controls are worth singling out because almost nothing else in this lane ships them. AI GUARDRAILS screen user messages for prompt injection, data exfiltration and policy violations, which is an agent-specific safety control rather than a generic enterprise checkbox. ATTRIBUTION FILTERING screens Devin-generated code against public repositories and blocks matches before they are written, which addresses provenance risk in generated code that most vendors do not touch at all. SECURITY PROFILES restricting network, MCP, git and GitHub CLI access, bindable to orgs, automations and sessions, is a third. Confidence high on the controls, which are documented page by page. The SOC 2 Type 2 attestation itself is stated by the vendor and reported by partners but the trust centre contents were not fetched, so the certification is taken on the vendor's own claim rather than a retrieved report.

Downgraded from F. Streaming output, session sharing and markdown export are visibility into a live session, and enterprise service account usage monitoring is billing and volume telemetry; neither is a retained per action execution trace or audit log. The Sec cell separately credits audit logging as a governance control, and the same fact should not do work on both axes.

UPGRADED from P to F, and I flagged this as plausibly understated, which it was. Session Insights is a documented product that analyses past Devin sessions and returns actionable feedback, which means sessions are retained as inspectable objects rather than discarded, and it pairs with the vendor's first-party statement that Devin reads past session trajectories. Consumption is metered per session and queryable through a service-key API at team, group and per-user granularity, with Personal Analytics letting individual users see their own usage. That is the retained-record standard ellipsis and poolside meet, and it is stronger than the reporting-only surfaces that correctly sit at P on graphite, cubic, zencoder, charm and blitzy. Kept separable from Mem, which rests on the agent LEARNING from trajectories; this cell rests on those sessions being retained, analysable and metered by the customer. Confidence held at medium because the Session Insights and audit pages were not fetched individually, and the per-session audit log detail comes from a Cognition enablement partner rather than the vendor.

UPGRADED from P to F, and I flagged this as plausibly understated, which it was. The decisive fact is DEVIN OUTPOSTS, documented across five pages as self-hosted infrastructure running sessions on the customer's own machines with self-hosted workers, an orchestration guide, an API and CLI reference and partner integrations. That is genuine execution on customer-owned hardware, not just tenant isolation, and it did not exist in the record at all. With Outposts the deployment surface is five shapes: Enterprise Cloud multi-tenant, Customer Dedicated single-tenant VPC over AWS PrivateLink or IPSec, Enterprise Assured adding customer-managed AWS KMS keys, Devin Outposts on customer infrastructure, and a separate federal deployment. Recorded honestly and worth a buyer's attention: the BRAIN ALWAYS RESIDES IN COGNITION'S CLOUD in the two hosted models, described by the vendor as a stateless cloud service similar to GitHub Copilot's architecture, with egress and a persistent secure WebSocket required. So this is not the air-gapped position blitzy or poolside occupy; it is closer to tembo, also at F.

Upgraded from P: Custom Commands build reusable specialised agents, and the site publishes ten named solution workflows plus a workflows library, which is a shipped catalogue rather than customer authored templates alone.

UPGRADED from N to F, and the April grade was badly wrong rather than marginally so. This is now among the strongest Pack cells in the lane, alongside zencoder, baz and moderne. Four separate distribution surfaces are documented: a PLUGIN MARKETPLACE in the web app for installing and requiring bundles of skills across an org or enterprise, a governed plugin ecosystem for building and hosting a shared set, PLAYBOOKS explicitly described as building a library of reusable prompts for your organization, and an MCP MARKETPLACE. A use-case gallery and a tutorial library sit alongside them. This is exactly the adoptable-catalogue bar Mike ratified: assets the customer browses, installs and shares, not internal machinery. Worth noting against blitzy, whose three thousand agent roles correctly sit at P because the customer never selects them, and against my own earlier reasoning here, which considered MultiDevin and Custom Devins and rightly found them insufficient. The actual evidence was in the documentation index, not on the marketing pages.

UPGRADED from N to F, and I called this the cell most likely to be wrong on the record, which it was. The April grade cited only an internal rubric. First-party documentation carries a dedicated Models page describing available models and how to configure them, an Adaptive model router that automatically selects the best model per task, and federal Model Provisioning letting admins control model availability by team and group. Under the ruled line that customer or admin control separates Partial from Full, both halves are present: the user configures models on the CLI surface, and admins govern which models a group may use. The limit is named rather than glossed: the enterprise deployment FAQ states plainly that Devin is a compound AI system and DOES NOT CURRENTLY SUPPORT THIRD-PARTY LLM API KEYS, so there is no bring-your-own-key path. That does not reach the Full bar under the ruled convention, which tracks who chooses rather than whether the customer supplies the credential. Confidence held at medium rather than high because this is graded from the documentation index entries and their descriptions rather than from fetching the model pages themselves, so the specific provider list is unconfirmed.

Stands at F and clears Mike's Ext bar of 30 August squarely: a documented public API for the vendor's own platform, which is exactly what zencoder and baz lacked when they were corrected to P. Devin Automations sits alongside it as a no-code programmatic surface, and Devin Desktop adds Agent Client Protocol support, the open standard zed authored, which means third-party agents run inside Devin Desktop and Devin can be driven from other ACP clients. Recorded honestly: the Devin API is limited to the Teams and Enterprise tiers, so the lowest paid tiers cannot drive Devin programmatically.

Held at P per the axis rule applied across this lane. Test coverage and CI failure workflows are the agent acting on the customer's code and verifying its own output; no harness for evaluating or regression testing agent behaviour is documented.

Stands at P on the lane-wide reading, seventeenth and final application in this lane. Devin writes and runs unit and end-to-end tests, performs visual QA on its own output and fixes its own CI failures, which is the agent verifying its own work, the pattern that earned P for google-jules, github-copilot, ellipsis, poolside, refact-ai, appfactor, charm, igent, proofs and blitzy. Security Swarm, newly launched, is closer to a customer-facing quality product and may warrant a second look, but it reads as security review of the customer's code rather than a harness for evaluating agent behaviour. F would need what goose and openhands ship, a harness the customer points at their own workload. Held at P rather than higher on that basis.

Stands at F and is now evidenced rather than asserted; the April basis cited only an internal research report. This is the strongest Comp cell in the lane and one of only three genuine ones, alongside baz and refact-ai. The vendor names full browser AND DESKTOP use as a headline capability, which is broader than any other vendor here documents, and lists repetitive browser task automation and web research as first-class use cases. Worth contrasting with the thirteen June-cohort corrections: those credited terminals and sandboxes as computer use, whereas Devin drives a rendered interface a human would otherwise click through, which is exactly what the axis measures.