pan-wizard 3.35.0 → 3.37.0

package/docs/specs/comp_analysis_markdown_v1.md

@@ -0,0 +1,149 @@
+# PAN Wizard: competitive landscape and strategic enhancement roadmap
+
+> **Status:** Reference — point-in-time competitive snapshot (market data current as of early 2026). Figures describe the landscape and PAN's capabilities at authoring time and are not maintained; for current PAN counts see `CLAUDE.md`.
+
+**PAN Wizard occupies a rare and defensible position in the AI coding tools market — it is the only open-source, zero-dependency workflow orchestration layer that installs across five major AI coding runtimes and enforces structured lifecycle phases.** This positions PAN not as a competitor to Claude Code or Cursor, but as an orchestration meta-layer that makes every underlying tool more effective. In a **$4B+ market** growing at 25–46% CAGR, where 84% of developers use AI tools but only 29% trust the output, PAN's lifecycle enforcement and quality verification directly address the industry's most critical gap: the transition from AI speed to AI quality.
+
+The competitive analysis reveals that multi-agent orchestration, context engineering, and verification are the three battleground capabilities defining market leaders in 2026. PAN already has structural advantages in all three areas. What follows is a detailed assessment of the competitive landscape, market positioning, technical innovation opportunities, and actionable recommendations for achieving market leadership.
+
+---
+
+## The competitive landscape has consolidated around three tiers
+
+The AI coding tools market in early 2026 has crystallized into distinct categories. Understanding where PAN fits requires mapping the full terrain.
+
+**Tier 1 — Market dominators (>$1B ARR each, 70%+ combined share):** GitHub Copilot leads enterprise adoption with **20M+ users and ~37% market share**, driven by Microsoft's distribution advantage. Cursor (Anysphere) dominates individual developers with its AI-native IDE, crossing $1B ARR by November 2025 at a **$29.3B valuation**. Claude Code, launched May 2025, became the most-loved tool within months, hitting $1B annualized revenue in six months — the fastest growth trajectory in the category. OpenAI's Codex CLI is growing explosively and already reaches **60% of Cursor's usage** despite launching later.
+
+**Tier 2 — Strong contenders with differentiated approaches:** Cline (**58.7K GitHub stars**, 4M+ VS Code installs) and Roo Code lead the open-source agentic space. Augment Code holds the best context engine for massive codebases (400K+ files). Devin (Cognition, $10.2B valuation) acquired Windsurf and leads autonomous coding. Factory AI's "Droids" scored **#1 on Terminal-Bench at 58.75%**, beating Claude Code's 43.2%.
+
+**Tier 3 — Specialized and emerging players:** Continue.dev excels at local codebase indexing, Aider dominates Git-native terminal workflows, Sourcegraph Cody leads multi-repository code search, and Amazon Q Developer serves AWS-heavy enterprises.
+
+### Where PAN Wizard sits in this landscape
+
+PAN is architecturally distinct from all of these tools. It does not generate code, provide autocomplete, or embed an AI model. Instead, it is a **workflow orchestration layer** — comparable to how Nx orchestrates monorepo builds or how Kubernetes orchestrates containers. The closest competitive analogy is Factory AI's multi-agent Droid architecture, but Factory is proprietary and enterprise-priced. No open-source tool currently provides PAN's combination of structured lifecycle enforcement, multi-runtime compatibility, and context rot prevention.
+
+| Capability | PAN Wizard | Codex CLI | Roo Code | Claude Code | Factory AI |
+|---|---|---|---|---|---|
+| Multi-runtime support | 5 runtimes | 1 (OpenAI) | 1 (VS Code) | 1 (Anthropic) | Multi-IDE |
+| Structured lifecycle phases | ✅ Enforced | ❌ Ad hoc | Partial (modes) | ❌ Ad hoc | ✅ Enforced |
+| Specialized agents | Multi-agent suite | Custom agents | 5 modes | Agent Teams | Droids |
+| Context rot prevention | Fresh 200K windows | Compaction | Diff-based edits | Compaction | Proprietary |
+| Persistent state | .planning/ directory | Session resume | Roo Cloud | CLAUDE.md | Durable memory |
+| Parallel execution | Wave-based | Subagent parallel | Roo Cloud | Agent Teams | Multi-Droid |
+| Compliance tracking | Built-in | ❌ | ❌ | ❌ | SOC II/GDPR |
+| Open-source | MIT | Yes (CLI) | Yes | No | No |
+| Zero dependencies | ✅ | No (Rust) | No | No | No |
+
+---
+
+## Multi-agent orchestration is the defining competitive dimension
+
+Anthropic's 2026 Agentic Coding Trends Report identifies the shift from single agents to "groups of specialized agents working in parallel under an orchestrator" as the key industry transition. GitHub's **Agent HQ** (announced February 2026) now lets developers run Claude, Codex, and Copilot simultaneously on the same task — validating the exact cross-runtime orchestration approach PAN already implements.
+
+The most mature multi-agent implementations include OpenAI Codex CLI's subagent system (custom agent definitions with parallel execution), Roo Code's mode-based orchestration (Architect, Code, Orchestrator, Ask, Debug modes that constrain tool access), and Claude Code's Agent Teams (shared task lists with inter-agent messaging). However, none of these enforce a structured project lifecycle. A McKinsey/QuantumBlack study (February 2026) found that **agents "routinely skipped steps, created circular dependencies, or got stuck in analysis loops" when allowed to self-orchestrate** on larger codebases — directly validating PAN's deterministic workflow enforcement.
+
+### The agent orchestration framework landscape provides architectural insights
+
+Among general-purpose frameworks, **LangGraph** (v1.0, ~25K GitHub stars) offers the strongest state persistence with pluggable checkpointers and time-travel debugging. **CrewAI** (~20K stars, 12M+ monthly PyPI downloads) provides the most intuitive role-based agent design with native MCP support. The **Microsoft Agent Framework** (merging AutoGen and Semantic Kernel, RC released February 2026) brings enterprise-grade graph-based workflows with A2A, AG-UI, and MCP protocol support. **Google's Agent Development Kit** introduces the most sophisticated context engineering architecture, separating durable state (Sessions) from per-call views (Working Context).
+
+PAN's architecture aligns most closely with the pattern these frameworks are converging toward: **deterministic orchestration with bounded agent execution**. Rule-based workflow engines enforce phase transitions and manage dependencies, while agents handle creative work within defined constraints. This is precisely what PAN's research → plan → execute → verify lifecycle provides.
+
+### Three protocol standards are reshaping interoperability
+
+**MCP (Model Context Protocol)** has become the de facto standard for tool integration, with **97 million monthly SDK downloads** and **10,000+ active servers**. It was donated to the Linux Foundation's Agentic AI Foundation in December 2025. **A2A (Agent-to-Agent Protocol)**, launched by Google with 50+ partners, standardizes agent-to-agent communication. **AG-UI** is emerging for agent-to-user interface interactions. PAN should prioritize MCP integration immediately and monitor A2A adoption for future implementation.
+
+---
+
+## Context engineering has become the primary competitive differentiator
+
+The industry consensus is clear: **context engineering — not model quality — is the binding constraint on AI coding tool effectiveness.** Stanford and UC Berkeley research found model correctness drops around 32,000 tokens even for models with 1M+ token windows, due to the "lost-in-the-middle" phenomenon. Agents spend **over 60% of their first turn** just retrieving context rather than coding. Every AI agent's success rate decreases after **35 minutes** of continuous operation.
+
+PAN's approach of providing **fresh 200K-token windows** per agent invocation directly addresses context rot — the gradual degradation in output quality as context fills with accumulated history, failed attempts, and contradictory instructions. This approach aligns with Anthropic's own recommendation of multi-agent context isolation, which **outperformed single-agent approaches by 90.2%** on research tasks.
+
+### Five strategies define state-of-the-art context management
+
+The leading approaches to context engineering, synthesized from Anthropic, Faros AI, and LangChain research, form a hierarchy that PAN can adopt:
+
+1. **Context selection** uses semantic search, AST-based chunking via Tree-sitter, and hybrid keyword+semantic search with reranking to retrieve only relevant code. Aider's approach — combining Tree-sitter AST parsing with NetworkX graph analysis using PageRank — achieves the highest efficiency at **4.3–6.5% context utilization** versus Cursor's 14.7%.
+
+2. **Context compression** summarizes conversation history while preserving architectural decisions. Claude Code implements this by passing message history for compression, retaining only the 5 most recently accessed files when context reaches 80% capacity.
+
+3. **Context ordering** positions critical information at the beginning and end of context windows, where model attention is strongest, avoiding the "lost in the middle" problem.
+
+4. **Context isolation** — PAN's core approach — splits context across specialized agents, each with focused, smaller windows. This is architecturally validated as the highest-leverage technique.
+
+5. **Format optimization** structures information using XML tags, Markdown headers, and labeled sections to improve model comprehension.
+
+### Memory and state persistence patterns are rapidly maturing
+
+The taxonomy of agent memory has crystallized around three tiers: **working memory** (active context for current task), **session memory** (conversation history within a session), and **long-term memory** (persistent knowledge across sessions). PAN's .planning/ directory provides session and long-term memory, but could be enhanced with the emerging patterns from frameworks like Letta/MemGPT (hierarchical memory with explicit agent-driven management), Amazon Bedrock AgentCore (semantic + preference + summarization memory with 200ms retrieval), and Zep's temporal knowledge graph architecture.
+
+---
+
+## The market demands quality verification — PAN's biggest opportunity
+
+The AI coding quality crisis is the industry's most urgent problem and PAN's largest strategic opportunity. CodeRabbit's analysis of 470 open-source PRs found AI-authored code produces **1.7× more total issues**, **1.75× more logic errors**, and **1.57× more security findings** than human-written code. The Cortex 2026 Benchmark Report shows that while PRs per author increased 20% year-over-year, **incidents per PR increased 23.5%** and change failure rates rose 30%. The METR randomized controlled trial — the most rigorous study to date — found experienced developers took **19% longer** with AI tools, creating a 39-percentage-point gap between perceived and actual productivity.
+
+PAN's verify phase directly addresses this crisis. The industry is converging on CodeRabbit's recommendation of **"Zero Trust for AI Code"** — treating AI-generated code with the same rigor as untrusted third-party libraries. The emerging best practice is multi-agent layered validation: one agent codes, another critiques, another tests, another vets compliance. PAN's specialized agent suite can implement this pattern natively.
+
+### Enterprise compliance requirements create a natural moat
+
+Enterprises evaluate AI coding tools on a strict hierarchy: **SOC 2 Type II** certification is table stakes (73% of enterprise implementations fail security review without it). **ISO/IEC 42001:2023** (AI Management Systems) is the emerging gold standard — Augment Code claims the first certification among AI coding tools. **EU AI Act enforcement begins August 2026**, with fines up to €35 million or 7% of global turnover. PAN's built-in standards and compliance tracking is a significant differentiator that few competitors offer, particularly in the open-source space.
+
+Enterprise buyers specifically require zero data retention guarantees, on-premises deployment options, IP indemnification, immutable audit trails, and no training on customer data. PAN's architecture — running locally with zero runtime dependencies and no cloud component — inherently satisfies several of these requirements.
+
+---
+
+## Technical enhancement priorities for market leadership
+
+Based on the competitive analysis and market trends, seven technical enhancements would most significantly strengthen PAN's position:
+
+**1. MCP integration as a first-class primitive.** With 97M+ monthly SDK downloads and adoption by every major AI coding tool, MCP is the universal integration standard. PAN should both consume MCP servers (GitHub, Playwright, Context7, Filesystem, Docker, Sentry) and expose itself as an MCP server, enabling other tools to invoke PAN workflows. This single integration would dramatically expand PAN's utility and ecosystem reach.
+
+**2. Multi-model routing within agent workflows.** The research shows **30–70% cost reduction** is achievable through intelligent model routing. PAN's agents should support configurable model assignment — reasoning models (Claude Opus, GPT-5) for architecture and planning agents, mid-tier models (Sonnet, GPT-4.5) for coding agents, lightweight models (Haiku, GPT-4.5-mini) for verification and formatting agents. Stanford's FrugalGPT research demonstrated up to 98% cost reduction with cascade routing patterns.
+
+**3. AST-aware context engineering.** Enhance PAN's context management with Tree-sitter-based code parsing to build repository maps (following Aider's proven approach) and semantic chunking that preserves function boundaries. Tools like CocoIndex Code save ~70% of tokens through AST-based indexing. Combined with PAN's existing fresh-window approach, this would create the most sophisticated context management in the open-source space.
+
+**4. Spec-driven development artifacts.** The emerging pattern adopted by Kiro, Tessl, and GitHub Spec Kit uses structured specification files (requirements.md, design.md, tasks.md) as durable contracts that survive context window limits and session boundaries. PAN's .planning/ directory already provides infrastructure for this; formalizing it into an industry-compatible spec format would increase interoperability and adoption.
+
+**5. Mutation testing as a verification gate.** Standard code coverage is insufficient — a 100% coverage suite can have only 4% mutation score. Integrating mutation testing into PAN's verify phase would provide the most rigorous code quality gate in the AI coding space. This directly addresses the quality crisis that 66% of developers cite as their primary frustration.
+
+**6. A2A protocol support for cross-agent communication.** As PAN already spans five runtimes, implementing Google's Agent-to-Agent protocol would enable PAN-orchestrated agents to discover and communicate with agents from other frameworks, positioning PAN as the universal orchestration layer.
+
+**7. Checkpoint and rollback system.** Claude Code's `/rewind` command and LangGraph's time-travel debugging are highly valued features. PAN should implement per-phase checkpointing so developers can rollback to any lifecycle phase, inspect intermediate states, and replay from specific points.
+
+---
+
+## Community and ecosystem strategy for adoption
+
+The research reveals clear patterns for open-source developer tool success. **OpenCode** (from the SST team) grew from zero to **117K+ GitHub stars** in approximately 18 months through model-agnostic flexibility and active community engagement. Cline reached **58.7K stars and 4M+ installs** through open-source transparency, BYO-model support, and community governance. Aider maintains **41.6K stars** through consistent benchmark publishing and Git-native workflows.
+
+Five strategic priorities emerge for PAN's community growth:
+
+**Multi-form-factor distribution** is essential. The most successful tools offer VS Code extension + CLI + JetBrains plugin to capture developers regardless of environment. PAN already covers five CLI runtimes; adding a VS Code extension as a visual dashboard for .planning/ state would significantly broaden accessibility. npm distribution with `npm install -g pan-wizard` remains the standard for JavaScript/TypeScript developer tools.
+
+**"Ship in 5 minutes" onboarding** is the gold standard. PAN should provide a single-command setup that immediately demonstrates value on an existing project — ideally generating a visible .planning/ directory with a project analysis within the first interaction. Netflix and Dropbox's internal research shows that minimizing time-to-first-value is the strongest predictor of long-term tool retention.
+
+**Benchmark publishing** drives organic discovery. Aider's consistent publishing of LLM coding benchmarks is a primary growth driver. PAN should publish benchmarks comparing workflow outcomes (code quality metrics, defect rates, time-to-completion) with and without PAN orchestration across different AI runtimes.
+
+**Monetization should follow the open-core model.** The core PAN system should remain MIT-licensed and fully functional. Revenue opportunities include a managed cloud service for team state synchronization (following Roo Cloud's model), enterprise compliance dashboards and audit trail exports, and premium integrations (Jira, Linear, Slack). Usage-based pricing grows SaaS companies **38% faster** than strict subscriptions. Individual pricing below $10/month drives bottom-up adoption within organizations.
+
+**Community infrastructure** should include GitHub Discussions for roadmap feedback, a Discord server for real-time support, and a contributor program with clear governance. JetBrains' model of 200+ content creators demonstrates the value of investing in community advocacy.
+
+---
+
+## Standards and compliance as a strategic differentiator
+
+PAN's existing standards and compliance tracking positions it uniquely in a market where regulatory pressure is intensifying. The **EU AI Act** reaches full enforcement in August 2026, requiring organizations to demonstrate governance over AI systems used in software development. The **NIST AI Risk Management Framework** (AI RMF 1.0) with its Generative AI Profile provides the U.S. compliance framework. **77% of organizations** are actively working on AI governance, and **40% of enterprise applications** will embed AI agents by end of 2026.
+
+PAN should formalize its compliance capabilities into three tiers. First, **audit trail generation** — automatically logging every agent invocation, model used, context provided, output generated, and verification result in an immutable, exportable format compatible with SOC 2 and ISO 42001 requirements. Second, **policy enforcement** — configurable rules about which models can be used for which tasks, mandatory verification gates, and human approval requirements at phase transitions. Third, **compliance reporting** — generating reports mapping PAN workflows to specific regulatory requirements (EU AI Act Article 9–16 high-risk system requirements, NIST AI RMF GOVERN/MAP/MEASURE/MANAGE functions, OWASP Top 10 security controls).
+
+No other open-source AI coding tool provides this compliance infrastructure. Given that enterprise security reviews terminate **73% of implementations** where vendors treat security as an afterthought, PAN's compliance-first approach could become its strongest enterprise selling point.
+
+---
+
+## Conclusion: PAN's path to market leadership
+
+The competitive analysis reveals three fundamental market truths that favor PAN's architecture. First, **the industry is converging toward deterministic orchestration with bounded agent execution** — precisely PAN's design philosophy — after discovering that autonomous agents fail on complex projects. Second, **context engineering has surpassed model quality as the primary differentiator**, and PAN's fresh-window approach is architecturally superior to the compaction-based alternatives used by most competitors. Third, **2026 is the year of AI code quality**, and PAN's structured verify phase with compliance tracking addresses the market's most urgent unmet need.
+
+The strategic path to market leadership requires executing on four parallel tracks: **protocol integration** (MCP first, A2A second) to become the universal orchestration layer; **context engineering depth** (AST-aware retrieval, multi-model routing) to maintain technical superiority; **community building** (benchmarks, "5-minute" onboarding, multi-form-factor distribution) to drive adoption; and **compliance formalization** (audit trails, policy enforcement, regulatory reporting) to unlock enterprise revenue. PAN's zero-dependency, MIT-licensed, multi-runtime architecture is not merely competitive — it is architecturally unique in the market, and the trends are moving decisively in its direction.

package/docs/specs/continuous_autonomous_execution_featureai.md

@@ -0,0 +1,304 @@
+# featureAI: Continuous/Autonomous Execution -- Competitive Intelligence
+
+> **Generated**: 2026-03-03
+> **Purpose**: Competitive analysis of how AI coding tools implement continuous, automated, and categorized workflow runners
+> **Status**: Research complete
+
+---
+
+## Executive Summary
+
+The industry is converging on a common pattern: **decompose -> execute -> verify -> iterate**, with the primary differentiators being (1) where execution happens (local vs. cloud), (2) how granular the safety controls are, and (3) whether work is categorized or treated as a homogeneous task stream. No tool has a mature "categorized work queue" system -- this represents a significant whitespace opportunity for PAN Wizard.
+
+---
+
+## Competitive Matrix
+
+### 1. Aider
+
+| Dimension | Details |
+|---|---|
+| **UX** | CLI-only. `--message "instruction" file.py` for single-shot. Shell loop (`for FILE in *.py; do aider --message "..." $FILE; done`) for batch. No built-in continuous runner. |
+| **Category system** | None. Each invocation is a standalone task. No concept of work types. |
+| **Loop control** | No native loop. `--message` executes one instruction then exits (exit code 0). User writes the outer loop in bash/python. |
+| **Safety** | `--yes` auto-approves all confirmations. `--dry-run` for preview. `--auto-commits` / `--no-auto-commits` to control git writes. No token budget or iteration cap. |
+| **Verification** | `--auto-lint` runs linter after every change. `--auto-test` runs test suite after every change. `--lint-cmd` and `--test-cmd` are configurable. Aider will attempt to fix lint/test failures automatically. |
+| **State persistence** | Git commits are the only state. No cross-session memory. No progress tracking file. |
+| **Known pitfalls** | Users report that batching many tasks in one invocation degrades quality -- "one command at a time" is the recommended pattern. No built-in rate limiting. The `--yes` flag has no granularity (all or nothing). Python API is undocumented and unstable. |
+| **Watch mode** | `--watch-files` monitors files for `ai` coding comments and acts on them -- a form of event-driven continuous execution. |
+
+**Key insight**: Aider is the most scriptable tool but provides zero orchestration. The user is the harness.
+
+---
+
+### 2. Cursor
+
+| Dimension | Details |
+|---|---|
+| **UX** | IDE-integrated. Agent mode is the default interaction mode. Background/Cloud agents can be triggered from: Cursor Desktop, Cursor Web, Slack (@cursor), GitHub (@cursor on PRs/issues), Linear (@cursor), or API. |
+| **Category system** | No explicit work categorization. However, Bugbot Autofix is a specialized agent for a single category (code review + fix). Subagents can spawn subagents creating a tree of coordinated work (Feb 2026). |
+| **Loop control** | Agent mode loops on failures automatically (generate -> test -> fix -> retest). No explicit iteration cap in agent mode. Cloud agents run until task completion or failure. Token budget is implicit via pricing tier (credits deplete faster with expensive models). Background agents require $10 minimum usage-based pricing. |
+| **Safety** | Guardrails defined in "Agentic layer" rules (confirmation before complex refactors). Plan mode shows blueprint before execution. Each file change and terminal command proposed before execution in local agent mode. Cloud agents work on separate branches (isolated). |
+| **Verification** | Agent mode: auto-runs tests, discovers failures, auto-fixes, retests in loop. Bugbot Autofix: reviews PRs automatically, posts fix comments, 76% resolution rate. Over 35% of autofix changes merged. 2M PRs/month scale. |
+| **State persistence** | Git branches for cloud agents. Session context within a conversation. No cross-session progress file. Rules/skills persist across sessions. |
+| **Known pitfalls** | "Agent stuck in continuous loop" is a known bug report. Token limits are opaque -- users confused by credit depletion. Plan mode sometimes auto-switches to agent mode against user wishes. Background agent error messages misleading. Context window competition from too many rules. |
+| **Event-driven** | Bugbot Autofix triggers on PR creation -- first production event-driven agent in a mainstream IDE. |
+
+**Key insight**: Cursor has the most mature event-driven agent (Bugbot) but no user-facing categorized work queue.
+
+---
+
+### 3. Cline
+
+| Dimension | Details |
+|---|---|
+| **UX** | VS Code extension. Interactive mode (approval per action) or Auto-Approve mode. CLI 2.0 adds terminal mode with `-y` (YOLO) flag for full autonomy. |
+| **Category system** | No work categorization. Auto-approve has granular *action type* categories (read files, edit files, execute commands, browser, MCP) but not *work type* categories. |
+| **Loop control** | Max API requests setting (configurable cap before re-approval). Note: v3.35 removed the max requests limit, making it always-on. No iteration count, time, or budget-based stop. Desktop notifications when task complete or approval needed. 30-second warning on long-running terminal commands. |
+| **Safety** | Granular auto-approve per action type. YOLO mode disables ALL safety checks. Checkpoints recommended for rollback. Version control as safety net. "Human-in-the-loop design" but defeatable. No sandboxing. |
+| **Verification** | Multi-step task execution with approval gates between steps. Can run tests/linters via terminal commands. No built-in verification loop (relies on the model deciding to test). |
+| **State persistence** | Task context within conversation only. No cross-session memory. No progress file. |
+| **Known pitfalls** | "Maximum requests reached causes task lockout" (issue #3480). YOLO mode is explicitly called dangerous in docs. No budget controls. Changing max requests mid-task doesn't work (issue #4907). Rate limiting issues (issue #923). |
+
+**Key insight**: Cline has the most granular action-type permissions but zero work-type awareness. The removal of max requests in v3.35 removes the only loop control mechanism.
+
+---
+
+### 4. Windsurf / Cascade
+
+| Dimension | Details |
+|---|---|
+| **UX** | IDE-based. Cascade is the default agent. Turbo Mode for fully autonomous terminal command execution. Parallel multi-agent sessions (Wave 13, Dec 2025) with git worktree support and side-by-side panes. |
+| **Category system** | No explicit work categorization. Memories system implicitly categorizes knowledge (architectural patterns, naming conventions, config quirks). |
+| **Loop control** | Iterative debugging: if tests fail, Cascade tries different approach and loops until task is done. Turbo Mode auto-executes commands not on a "Deny" list. No explicit iteration cap, token budget, or time limit documented. |
+| **Safety** | Turbo Mode deny list for dangerous commands. Semi-autonomous by default (approval for writes). Memories are workspace-scoped (no cross-workspace leakage). Human can interrupt at any time. |
+| **Verification** | Iterative debugging loop: try fix -> run tests -> if fail -> try different approach -> repeat. Can run terminal commands for builds/tests. |
+| **State persistence** | **Memories system** -- autonomously generates and stores memories about codebase across sessions. Two types: user-generated (rules) and auto-generated. Workspace-scoped. Editable. Survives across conversations. |
+| **Known pitfalls** | Devin/Cognition acquired Windsurf (July 2025) -- strategic direction uncertain. Memories can accumulate noise. No explicit budget controls. "Semi-autonomous" framing masks that Turbo Mode is effectively YOLO. |
+
+**Key insight**: Windsurf's Memories system is the most mature cross-session state persistence among IDE tools. The Devin acquisition may merge these capabilities.
+
+---
+
+### 5. GitHub Copilot (Agent Mode + Coding Agent)
+
+| Dimension | Details |
+|---|---|
+| **UX** | Two modes: (a) Local Agent Mode in VS Code -- synchronous, interactive. (b) Coding Agent -- asynchronous background agent in GitHub Actions. Coding agent triggered by assigning issues, @copilot mentions on PRs/issues, or via GitHub UI. |
+| **Category system** | No explicit categorization. Issues serve as implicit task type (bug, feature, chore via labels). The coding agent works from GitHub Issues -- inherits whatever categorization the repo uses. |
+| **Loop control** | Agent mode: iterates until task done or user stops. Coding agent: runs in GitHub Actions (inherits Actions timeout limits). No explicit iteration cap. Draft PR serves as checkpoint. Regular commits during work. |
+| **Safety** | Local agent mode: every file change and command proposed before execution. Coding agent: works on separate branch, draft PRs require human approval, Actions workflows need write-permission user approval. Sandbox with firewall-controlled internet. Custom IAM via Actions environment. |
+| **Verification** | Agent mode: runs tests, analyzes failures, self-heals. Coding agent: runs full CI (Actions), pushes commits, updates PR description with progress. "Plan mode" shows blueprint before execution. |
+| **State persistence** | Git commits (regular pushes during work). PR description updated with progress. GitHub Issues track overall task. No proprietary progress file. |
+| **Known pitfalls** | Coding agent limited to GitHub Actions runners (resource/time constraints). Only works with GitHub repos. Autopilot mode can execute without confirmation (needs explicit opt-in). Plan mode available in VS Code, JetBrains, Eclipse, Xcode but behavior varies. |
+
+**Key insight**: The only tool with a true async background agent running in cloud CI infrastructure. GitHub Issues as implicit work queue is powerful but not purpose-built for categorized continuous work.
+
+---
+
+### 6. Claude Code
+
+| Dimension | Details |
+|---|---|
+| **UX** | CLI-native. Interactive mode (default) or Headless mode (`-p` flag). Session resume via `--session-id` + `--resume`. Can be embedded in CI/CD via GitHub Actions, cron jobs, shell scripts. Agent SDK available as Python and TypeScript packages. |
+| **Category system** | None built-in. The `-p` flag treats each invocation as a single task. No work-type awareness. |
+| **Loop control** | No native continuous loop. Each `-p` invocation is one-shot. Multi-turn sessions possible via `--session-id` but user controls the loop. Rolling weekly rate limits. No iteration cap, budget system, or time limit. External wrappers (Ralph) add loop control. |
+| **Safety** | Permission system for file/command operations. Headless mode disables all user interaction. `--allowedTools` flag restricts available tools. Rolling rate limits prevent extreme overuse. No sandboxing in local mode. |
+| **Verification** | Agent can run tests, lint, type-check. No built-in verification-between-iterations pattern. User or wrapper script must orchestrate verify-then-continue. |
+| **State persistence** | Session IDs for multi-turn continuity. Git commits. No built-in progress file. Anthropic's own recommendation: `claude-progress.txt` + `feature_list.json` (from "Effective Harnesses" engineering post). |
+| **Known pitfalls** | No daemon mode -- every invocation starts fresh context. Context window limits mean long-running work requires session management. 60%+ of enterprise users use headless mode for CI/CD. No categorized work system. |
+
+#### Ralph Wrapper Pattern (Community)
+
+| Dimension | Details |
+|---|---|
+| **UX** | Shell wrapper (`ralph` command). Global install. Runs Claude Code in a loop with `ralph_loop.sh`. |
+| **Loop control** | Dual-condition exit: requires BOTH completion indicators AND explicit EXIT_SIGNAL from Claude. Rate limiting: 100 calls/hour (configurable). Circuit breaker with error detection. |
+| **Safety** | Rate limiting prevents runaway. Circuit breaker stops on repeated errors. Session expiration (24h default). Configurable max iterations. |
+| **State persistence** | Automatic session management. Context preservation across loop iterations. Session expiration and reset. |
+
+**Key insight**: Anthropic's own engineering team recommends the `claude-progress.txt` + `feature_list.json` pattern. Ralph is the community answer to the missing native loop. The Agent SDK is the building block but not the solution.
+
+---
+
+### 7. Devin
+
+| Dimension | Details |
+|---|---|
+| **UX** | Cloud-based IDE. Triggered via Slack (@Devin), Jira tickets, web UI, or API. Fully asynchronous -- assign task and walk away. Multiple agents can work in parallel. |
+| **Category system** | Implicit through compound architecture: Planner, Coder, Critic, Browser, Debugger are specialized agents. Work flows through task queue. No user-facing categorization of work types, but internal pipeline routes bugs to Debugger, new code to Coder, etc. |
+| **Loop control** | Plan -> Implement chunk -> Test -> Fix -> Checkpoint review -> Next chunk. Internal loop runs until Critic approves. Checkpoints at each significant phase require human review. No explicit iteration cap documented. "80% time savings" expectation (not 100%). |
+| **Safety** | Sandboxed environment (own terminal, editor, browser). Custom IAM roles. Development/staging access only (no production). Readonly API keys where possible. Critic agent reviews code before execution. |
+| **Verification** | Critic agent (adversarial model) reviews for security/logic before execution. Debugger agent handles failures. End-to-end in sandbox. Opens PR for human review. Knowledge base stores feedback for future runs. |
+| **State persistence** | Devin Wiki (auto-generated codebase docs). Devin Search (query the code). Knowledge management system (codified team feedback). Session list serves as task queue. |
+| **Known pitfalls** | Expensive ($500/mo originally, now $20/mo Core). Quality varies -- "assign low-priority bugs before sleep" is the recommended use pattern. Cognition acquired Windsurf (July 2025) -- product direction shifting. Multiple feedback cycles expected for complex work. |
+
+**Key insight**: Devin is the only tool with a true compound agent architecture (Planner/Coder/Critic/Debugger). The knowledge management system is the most sophisticated state persistence. But it's cloud-only and opaque.
+
+---
+
+### 8. OpenAI Codex
+
+| Dimension | Details |
+|---|---|
+| **UX** | Cloud-based (Codex Web) + macOS Desktop app. Multiple agents run in parallel on separate tasks. Each task gets its own cloud sandbox. Launched Feb 2026. |
+| **Category system** | No explicit categorization. Users can spawn parallel agents for different task types (features, bugs, questions, PRs) but no structured queue. |
+| **Loop control** | Each task runs in its own sandbox until completion. Can run test harnesses, linters, type checkers. No explicit iteration cap or budget. Tasks run to completion or failure. |
+| **Safety** | Native system-level sandboxing (open-source, configurable). Agents limited to editing files in their folder/branch. Cached web search only (no arbitrary internet). Verifiable evidence: citations of terminal logs and test outputs. |
+| **Verification** | Traces each step with citations. Can run tests, linters, type checkers in sandbox. Opens PRs for human review. |
+| **State persistence** | Git branches per task. PR as progress artifact. No cross-session memory system documented. |
+| **Known pitfalls** | macOS only for desktop app. Cloud-only execution. Usage doubled after GPT-5.2-Codex model (Dec 2025) but quality reports mixed. |
+
+**Key insight**: Codex has the best parallel execution model (each task in its own sandbox) but no orchestration layer for categorized, prioritized work.
+
+---
+
+## Cross-Tool Comparison Matrix
+
+| Feature | Aider | Cursor | Cline | Windsurf | Copilot | Claude Code | Devin | Codex |
+|---|---|---|---|---|---|---|---|---|
+| **Continuous runner** | No (script it) | Agent loop | Auto-approve | Turbo mode | Coding agent | No (script it) | Always-on | Per-task |
+| **Background/async** | No | Cloud agents | No | Multi-pane | GitHub Actions | Headless + CI | Cloud | Cloud sandbox |
+| **Work categorization** | None | None (Bugbot=1 type) | Action types only | None (memories) | GitHub labels | None | Internal pipeline | None |
+| **Iteration cap** | None | Credits | Removed (v3.35) | None | Actions timeout | Rate limit | Checkpoints | Per-sandbox |
+| **Budget control** | None | Token credits | None | None | Actions billing | Weekly rate | Subscription | Token billing |
+| **Auto-verify** | Lint + test | Test loop | Manual | Debug loop | CI pipeline | Manual | Critic agent | Sandbox tests |
+| **Cross-session state** | Git only | Rules | None | Memories | Issues + PRs | Session ID | Wiki + Knowledge | Git only |
+| **Event-driven** | Watch files | Bugbot (PR) | No | No | Issue assign | CI/CD hooks | Slack/Jira | No |
+| **Sandboxed** | No | Cloud agents | No | No | Actions runner | No | Yes | Yes |
+| **Category-aware queue** | No | No | No | No | No | No | Implicit | No |
+
+---
+
+## Key Patterns Identified
+
+### Pattern 1: The Verify-Fix Loop
+Every tool that attempts continuous execution implements some form of: `execute -> run tests -> if fail -> auto-fix -> retest`. This is table stakes. Cursor, Windsurf, Devin, and Copilot all do this natively. Aider does it via `--auto-test`. Claude Code requires the wrapper to orchestrate it.
+
+### Pattern 2: Two-Phase Architecture (Anthropic's Recommendation)
+From Anthropic's "Effective Harnesses for Long-Running Agents" (2025):
+- **Initializer agent**: Sets up environment, writes context files, runs once
+- **Coding agent**: Reads progress files, picks highest-priority incomplete item, works on one feature, updates progress, exits
+- **Harness**: Outer loop that spawns coding agent sessions, checks completion, handles errors
+- **State artifacts**: `claude-progress.txt` (log), `feature_list.json` (structured items with pass/fail), git history
+- JSON preferred over Markdown for state files ("model less likely to inappropriately change JSON")
+
+### Pattern 3: Event-Driven Triggering
+Emerging pattern: agents triggered by repository events rather than manual invocation.
+- Cursor Bugbot: triggers on PR creation (2M PRs/month)
+- GitHub Copilot Coding Agent: triggers on issue assignment
+- Devin: triggers on Slack @mention or Jira ticket
+- Aider: triggers on file change (watch mode)
+
+### Pattern 4: Dual-Signal Exit Detection (Ralph Pattern)
+Community solution to "when to stop":
+- Require BOTH a completion indicator AND an explicit signal
+- Natural language "done" causes false positives -- need explicit protocol
+- Rate limiting (calls/hour) as secondary safety
+- Circuit breaker on repeated errors
+
+### Pattern 5: Cloud Sandbox Isolation
+Tools moving to cloud execution for safety:
+- Cursor Cloud Agents: isolated VMs, separate branches
+- GitHub Copilot Coding Agent: GitHub Actions runners, firewall
+- Devin: sandboxed environment with own terminal/browser/editor
+- OpenAI Codex: per-task cloud sandbox, system-level sandboxing
+- Local tools (Aider, Cline, Claude Code) have no sandboxing
+
+### Pattern 6: Memory / Knowledge Persistence
+Three tiers of sophistication:
+1. **Git only**: Aider, Codex (commits are the only state)
+2. **Session + Rules**: Cursor (rules persist), Claude Code (session resume), Cline (nothing)
+3. **Active Memory**: Windsurf Memories (auto-generated, workspace-scoped), Devin Wiki + Knowledge Base (team-curated)
+
+---
+
+## Whitespace Analysis: What Nobody Does Well
+
+### 1. Categorized Work Queue
+**No tool has a structured, user-visible work queue with categories** (cleanup, features, tests, tech debt, docs). Devin's internal pipeline routes work through specialized agents, but users can't see or manage the queue. GitHub Issues provide implicit categorization via labels, but there's no agent-native awareness of work types.
+
+**PAN Wizard opportunity**: The focus-scan / focus-plan / focus-exec pipeline with priority levels (P0-P4), effort sizes (XS-XL), and focus modes (balanced, full, micro) already provides categorization that no competitor has.
+
+### 2. Budget-Aware Execution
+**No tool has a meaningful budget system for continuous execution.** Cursor uses opaque credit depletion. Cline removed its only cap. Claude Code has weekly rate limits but no per-task budget. Ralph has calls/hour but that's a blunt instrument.
+
+**PAN Wizard opportunity**: The `--budget N` flag and context-budget module already exist. A continuous runner that says "spend 50 points on cleanup, 30 on tests, 20 on docs" would be unique.
+
+### 3. Priority-Driven Selection
+**No tool automatically selects what to work on next based on priority, effort, and reality score.** Anthropic's harness pattern uses `feature_list.json` but with no prioritization algorithm. Devin's Planner decides internally but the user has no control.
+
+**PAN Wizard opportunity**: `computeRealityScore()`, `sortByPriority()`, `allocateBudget()` in focus.cjs already implement this. Wrapping them in a continuous runner would be first-of-kind.
+
+### 4. Structured Progress Persistence
+**Most tools rely on git commits as the only state.** Anthropic recommends JSON progress files but provides no tooling. Windsurf Memories are unstructured. Devin Wiki is auto-generated docs, not task tracking.
+
+**PAN Wizard opportunity**: `.planning/state.md`, `.planning/roadmap.md`, phase-level frontmatter tracking, and the focus-scan output already provide structured progress state that survives across sessions and tools.
+
+### 5. Cross-Runtime Orchestration
+**Every tool is siloed to its own runtime.** Cursor agents only work in Cursor. Copilot agents only work on GitHub. Devin only works in Devin's cloud. Claude Code only works with Claude.
+
+**PAN Wizard opportunity**: 5-runtime support (Claude Code, OpenCode, Gemini CLI, Codex, Copilot CLI) means PAN Wizard could be the orchestration layer that any runtime executes through.
+
+---
+
+## Recommended Architecture for PAN Wizard Continuous Runner
+
+Based on competitive analysis, the ideal system combines:
+
+1. **Anthropic's two-phase pattern**: Initializer sets up context, Runner works one item per iteration
+2. **Ralph's dual-signal exit**: Require both completion marker and explicit signal to stop
+3. **Categorized queue** (PAN Wizard's unique advantage): work items tagged by type, sorted by priority, budgeted by effort
+4. **Verify-fix loop** (table stakes): run tests/lint between iterations
+5. **Structured progress file** (JSON, not Markdown): tracks items, status, budget spent, errors encountered
+6. **Event-driven triggers** (stretch): watch for git events, file changes, or CI signals
+7. **Safety harness**: iteration cap, budget cap, time cap, circuit breaker on repeated errors, rate limiting
+
+---
+
+## Sources
+
+- [Aider Scripting Documentation](https://aider.chat/docs/scripting.html)
+- [Aider Options Reference](https://aider.chat/docs/config/options.html)
+- [Aider Linting and Testing](https://aider.chat/docs/usage/lint-test.html)
+- [Cursor Agent Mode Review 2025](https://skywork.ai/blog/cursor-ai-review-2025-agent-refactors-privacy/)
+- [Cursor Agent Complete Guide 2026](https://eastondev.com/blog/en/posts/dev/20260110-cursor-agent-complete-guide/)
+- [Cursor Background Agents Docs](https://docs.cursor.com/en/background-agent)
+- [Cursor Background Agents Changelog](https://linear.app/changelog/2025-08-21-cursor-agent)
+- [Cursor Bugbot Autofix Blog](https://cursor.com/blog/bugbot-autofix)
+- [Cursor Bugbot 70% Resolution Rate](https://www.adwaitx.com/cursor-bugbot-ai-code-review-agent-2026/)
+- [Cursor Feature Request: Auto Mode Loop](https://forum.cursor.com/t/the-agent-selector-needs-an-auto-mode-for-fully-autonomous-loops/146362)
+- [Cursor Agent Loop Bug Report](https://forum.cursor.com/t/agent-stuck-in-a-continuous-loop/129624)
+- [Cline Auto Approve Docs](https://docs.cline.bot/features/auto-approve)
+- [Cline Review 2026](https://vibecoding.app/blog/cline-review-2026)
+- [Cline v3.35 Native Tool Calling](https://cline.ghost.io/cline-v3-35/)
+- [Cline CLI 2.0 DevOps.com](https://devops.com/cline-cli-2-0-turns-your-terminal-into-an-ai-agent-control-plane/)
+- [Cline GitHub: Max Requests Issue](https://github.com/cline/cline/discussions/1375)
+- [Windsurf Cascade Docs](https://docs.windsurf.com/windsurf/cascade/cascade)
+- [Windsurf Cascade Memories Docs](https://docs.windsurf.com/windsurf/cascade/memories)
+- [Windsurf Review 2026 SecondTalent](https://www.secondtalent.com/resources/windsurf-review/)
+- [Windsurf Turbo Mode Tweet](https://x.com/windsurf_ai/status/1891981446698656142)
+- [GitHub Copilot Agent Mode Announcement](https://github.com/newsroom/press-releases/agent-mode)
+- [GitHub Copilot Coding Agent Docs](https://docs.github.com/en/copilot/concepts/agents/coding-agent/about-coding-agent)
+- [GitHub Copilot Coding Agent 101 Blog](https://github.blog/ai-and-ml/github-copilot/github-copilot-coding-agent-101-getting-started-with-agentic-workflows-on-github/)
+- [GitHub Copilot CLI GA](https://github.blog/changelog/2026-02-25-github-copilot-cli-is-now-generally-available/)
+- [Claude Code Headless Mode Docs](https://code.claude.com/docs/en/headless)
+- [Claude Code Agent SDK Quickstart](https://platform.claude.com/docs/en/agent-sdk/quickstart)
+- [Claude Code Agent SDK Blog](https://blog.promptlayer.com/building-agents-with-claude-codes-sdk/)
+- [Claude Code Automation Guide 2025](https://www.eesel.ai/blog/claude-code-automation)
+- [SFEIR Claude Code CI/CD Tutorial](https://institute.sfeir.com/en/claude-code/claude-code-headless-mode-and-ci-cd/tutorial/)
+- [Anthropic: Effective Harnesses for Long-Running Agents](https://www.anthropic.com/engineering/effective-harnesses-for-long-running-agents)
+- [Agent Harnesses: From DIY to Product](https://paddo.dev/blog/agent-harnesses-from-diy-to-product/)
+- [Ralph Claude Code (GitHub)](https://github.com/frankbria/ralph-claude-code)
+- [Ralph Wiggum Autonomous Loops](https://paddo.dev/blog/ralph-wiggum-autonomous-loops/)
+- [Devin AI Docs](https://docs.devin.ai/)
+- [Devin AI Guide 2026](https://aitoolsdevpro.com/ai-tools/devin-guide/)
+- [Devin Agents 101](https://devin.ai/agents101)
+- [Devin 2.0 Features](https://www.analyticsvidhya.com/blog/2025/04/devin-2-0/)
+- [OpenAI Codex App Features](https://developers.openai.com/codex/app/features/)
+- [OpenAI Introducing Codex](https://openai.com/index/introducing-codex/)
+- [OpenAI Codex Desktop App VentureBeat](https://venturebeat.com/orchestration/openai-launches-a-codex-desktop-app-for-macos-to-run-multiple-ai-coding)
+- [Anthropic 2026 Agentic Coding Trends Report](https://resources.anthropic.com/hubfs/2026%20Agentic%20Coding%20Trends%20Report.pdf)
+- [Complete Guide to Agentic Coding 2026](https://www.teamday.ai/blog/complete-guide-agentic-coding-2026)
+- [Qodo State of AI Code Quality 2025](https://www.qodo.ai/reports/state-of-ai-code-quality/)
+- [Addy Osmani LLM Coding Workflow 2026](https://addyosmani.com/blog/ai-coding-workflow/)