Baz vs Qodo (2026)

Stands at F and confidence normalised from a non-canonical 0.6 to 0.85. Breadth across classes is comfortably met with three source platforms, six ticketing systems, design, and two knowledge bases, all dated in the changelog. The detail worth carrying to comparison pages is the Works alongside positioning: Baz publishes dedicated solution pages for Claude Code, OpenAI Codex, Cursor and Devin, which is the super-harness framing, integrating with coding agents rather than competing with them, the same shape as sonar in this cohort.

Stands at F and confidence normalised from a non-canonical 0.6 to 0.85. Two things lift this beyond a standard multi-agent claim: the Planner loop runs BEFORE code exists, so orchestration covers plan generation, review and approval as well as implementation, and the Fixer agent closes its own loop by building an environment, validating and only committing when validation succeeds. Named infrastructure, the Agent Harness and Context Broker, is documented rather than implied, and Sessions trace the coordination.

Upgraded from P: Qodo 2.0 replaced single pass review with specialised agents running simultaneously on separate concerns, coordinated by a central rule system. That is multi agent orchestration as the core architecture, not a single loop.

Stands at F and confidence normalised from a non-canonical 0.55 to 0.85. All three trigger classes are documented and dated: events through pull request webhooks, schedules through Skills Maintainer scans every three days, weekly or fortnightly, and on-demand through comment commands, the CLI and a slash command invoked from inside another coding agent. That last one is the distinguishing detail, since it means a developer starts a Baz planning session without leaving Claude Code or Cursor.

Upgraded from P: invocation spans four git platforms on pull request events, two IDE families including pre commit local audits, and a CLI in pre commit hooks and CI gates. That is event driven breadth across the development lifecycle rather than a single trigger.

Stands at F and confidence normalised from a non-canonical 0.6 to 0.85. Grounding here is unusually broad because it spans three kinds at once: code structure through embeddings and graphs, organisational knowledge through Notion and Fibery, and product intent through six ticketing systems plus Figma. The Voyage AI code embeddings detail is a rare instance of a vendor naming its retrieval model. Cross-repository context with a visible cross repo tag on findings is the part most comparable to potpie-ai and greptile at F.

Stands at F and confidence normalised from a non-canonical 0.6 to 0.85. Two independent named memory systems is more than any other vendor in this lane documents, and both are dated and mechanically described rather than asserted: Reviewer Memory accumulates from repeated feedback and rewrites the reviewer's own system prompt with version history and rollback, and Module Memory persists implementation detail per module. The prompt-versioning-and-rollback detail is the part that makes this unambiguously F, since it means memory is a managed, inspectable artefact rather than a black box.

Upgraded from P: Review Standards learn from the codebase and PR history and persist as a single source of truth applied on every review, and the context engine is continuously updated. That is durable learned state, not session context.

Stands at F and confidence normalised from a non-canonical 0.6 to 0.85. Plan review approvals shipped 1 July 2026 and change the picture from the July basis, which credited only suggest-without-blocking and chat: a plan now goes through a dedicated approval workflow with versioning, pinned comments and approve or request-changes before implementation starts, which is a shipped gate ahead of code generation rather than review after it. Eighth distinct oversight architecture in this lane and the only one that gates the PLAN rather than the diff or the tool call.

Held at P. The oversight model here is structural rather than gated: Qodo is a review layer whose output is advisory findings on a pull request, so a human decides on every suggestion by construction. What is absent is a configurable approval gate or runtime guardrail on agent actions, because the agent does not take autonomous actions on the codebase. Graded on the mechanism rather than the posture.

Stands at F but the basis is materially rewritten, because the July basis graded partly from FOUNDER PEDIGREE, founded by cloud application security veterans, which is not evidence of anything the product or company does and should never have carried a grade. Re-retrieval found the real evidence the July build missed: SOC 2 certification stated in the site footer with a published trust centre at trust.baz.co and a security, privacy and compliance documentation page, plus role-based access control shipped September 2025. The conjunction is now met properly on attestation plus named controls. Confidence raised from a non-canonical 0.55 to 0.85 accordingly.

Upgraded from P: the axis conjunction is met twice over. Attestation is SOC 2 Type II through independent audit with a published trust centre at trust.qodo.ai, and named controls include SSO, SAML, audit logs, governance analytics and scoped context access. The May basis carried no URL; this is the Sec understatement pattern seen across this lane on vendors whose security page was never fetched.

Stands at F and confidence normalised from a non-canonical 0.55 to 0.85. Sessions are a retained, structured execution record covering invocation, tool calls, stages, outcome and cost, which is the F bar on this axis as applied to ellipsis and poolside, and they extend across every agent rather than one. The product-level timeline framing rather than raw logs is worth recording: the vendor is deliberately building auditability as a reviewable artefact. The July basis graded this F on the marketing phrase observable and explainable, not a black box; the grade was right and the basis was not.

Corrected from N, which was the clearest error in this grid. The vendor's own enterprise page markets full auditability as a headline property, and audit logs and governance analytics are named Enterprise features. Reviews also leave a durable per finding record on the pull request with severity prioritisation. Held at F rather than P because the axis asks for a retained record of what the agent did and why, and a severity ranked review comment plus audit logs meets it.

Upgraded from N and confidence normalised from a non-canonical 0.45. The July basis said no on-premise or self-hosted option is documented, which was graded from absence and is now contradicted by two dated first-party entries the July builder did not reach: Private Mode shipped 25 December 2025, and private application review running inside the customer's own Kubernetes cluster shipped 29 July 2026. Held at P rather than F under the early access convention, since private application review is explicitly a limited technical preview, and because Private Mode governs analysis and retention rather than giving the customer a full self-hosted deployment. Would move to F when private application review reaches general availability.

Stands at F and confidence normalised from a non-canonical 0.6 to 0.85. Eleven named prebuilt agents and reviewers is the largest shipped agent suite in this lane, and the Awesome Reviewers corpus is an unusual second layer: a free public library of 5,132 review instructions across twelve domains that a customer fetches as a markdown bundle straight into a skill folder. That is vendor-supplied adoptable assets in exactly the form this axis rewards, and it is published openly rather than gated behind the product.

Stands at N and confidence normalised from a non-canonical 0.5 to 0.65. The July basis said Bedrock foundation models with no customer choice, which re-retrieval supports but also refines: the changelog names GPT-5-Codex with Sonnet 4.5 reflections as the reviewer stack, so the vendor mixes providers, but that is the vendor's routing decision, not the customer's. Nothing documents model selection, bring-your-own-key or a provider setting anywhere. Recorded honestly: like sonar in this cohort, a low Model grade here reflects a deliberate product design where the vendor owns model choice as part of guaranteeing review quality, and the vendor does disclose which models it uses, which is better than the provider-undisclosed case the conventions treat as N.

Upgraded from P: bring your own key across OpenAI, Anthropic, Azure OpenAI or self hosted models is buyer facing model choice at the strongest end of the scale, and premium model selection is exposed even on credit tiers. Gated to Enterprise for BYOK, which is recorded here.

DOWNGRADED from F on Mike's ruling of 2026-08-30, overturning my own August grade. Same error as zencoder: I held F while the basis itself recorded that no public REST API or SDK was retrieved, and flagged it as the weakest F on this axis in the lane rather than acting on that. Under the axis bar, full coverage means the platform is composable from outside through a documented API or SDK, with MCP as one form of evidence rather than the bar. The Baz surface is genuinely strong and that is why this is P rather than N: an MCP server exposing review tools to any IDE agent, a CLI with an interactive review loop, a slash command that starts Planner from inside another coding agent, and marketplace distribution. The Awesome Reviewers raw endpoints are a real documented API, but they serve a public corpus of review instructions rather than the Baz platform, which is the same distinction that correctly kept appfactor at P: MCP Bridge exposes the customer's systems, not AppFactor. Grade would move to F on a documented platform API or SDK. baz.ai/docs was not fetched on either pass and remains the cheap check at lane close.

Note a lineage change worth recording: PR-Agent was donated to community governance under Apache 2.0 and is now described in its own docs as a community maintained legacy project of Qodo, distinct from Qodo's primary offering. The record's claim that Qodo's core review engine is open source and self hostable is therefore now only partly true of the current commercial product.

Stands at F and confidence normalised from a non-canonical 0.55 to 0.85, and this is one of the very few genuine F grades on this axis in the lane. The Eval rule is that the axis measures what the CUSTOMER can test, not what the vendor tests internally, and Prompt Playground is exactly that: a shipped agent test lab where a customer edits a reviewer's prompt and runs it against real change requests before rollout. Evaluations closes the loop by classifying every comment as accepted, rejected or unaddressed and feeding that back into reviewer behaviour. Contrast the nine vendors held at P in this lane for agents that merely verify their own output.

Upgraded from P and this is the third genuine F on this axis in the lane, after goose and openhands, but for a different reason: here the axis and the product coincide. Test generation is Qodo's founding capability from its CodiumAI origins, Qodo Cover is an open source regression coverage tool, and the vendor publishes an AI code review benchmark. The customer points these at their own code and at agent output, which is what the axis measures.

Upgraded from P and confidence raised from a non-canonical 0.45 to 0.85. The July basis said computer use is limited to validation, which undersold it: this is the most thoroughly documented browser-driven capability found anywhere in this lane, built up across four dated releases from November 2025 to July 2026, and it is the product's differentiator rather than an accessory. The axis test is met exactly, since a rendered user interface has no programmatic interface and the agent operates it as a human would, clicking through flows and reading state off the screen. Contrast the thirteen downgrades in the June cohort, every one of which credited a terminal or sandbox; here the sandbox is where the browser runs, and the browser is the point.