Cursor's Projects, Claude Code's hooks, and Windsurf's Devin Local compared on merge gates, audit trails, and who reviews a coordinator's delegation.
None of the three tools has solved the hardest governance problem in agentic coding: who checks an autonomous coordinator's decision about what to delegate, not just the code that decision eventually produces. Cursor, Claude Code, and Windsurf (rebranded Devin Desktop since June 2026) handle merge gates, audit trails, and spec-driven review in genuinely different ways, and those differences matter more than the speed and pricing comparisons that already crowd search results for these three names.
What governance means for a coding agent
Four questions decide whether an agent fits inside a process a compliance team or a careful engineering org can actually defend: does it support a merge gate that blocks bad work instead of just flagging it, does it leave an audit trail someone can reconstruct after the fact, does it support review against a written spec instead of a vibe check, and, since September 2026, who reviews an autonomous coordinator's own delegation choices. The last question is new because coordinator agents that plan and delegate without writing code did not exist before this year.
Cursor: Projects ships a coordinator, not a governor
Cursor rolled Projects out to all users starting September 10, 2026: a coordinator agent that takes on a body of work, such as a migration or a feature, holds context over months, and delegates tasks to subagents rather than writing code itself. Cursor's own description is direct about the division of labor: the coordinator plans and directs, other agents implement.
Sources: Introducing Projects, Cursor, Cursor Ships Projects Beta With Delegating Coordinator Agent, AI Weekly
The coordinator does not wait for a chat prompt to act. It can watch a Slack channel, run on a fixed schedule, or follow a repository's pull requests, fixing CI failures or picking up work whenever one opens or merges, all without a person starting the session.
Sources: Introducing Projects, Cursor
Cursor built one governance safeguard directly into the design: the coordinator does not push to the main branch on its own. Finished work comes back as a pull request for a human to approve. But Cursor's launch post is candid about what happens next: reviewers check every PR closely at first, then check less as the fixes hold up, while the coordinator keeps working through the same migration with less supervision each week.
Sources: Introducing Projects, Cursor
That built-in safeguard covers the output of a decision, not the decision itself. Nothing in the documented design reviews why the coordinator worked on one part of a migration before another, or how much scope it handed a given subagent. As review frequency falls, exactly as Cursor's own post says it will, the delegation layer becomes the least-checked part of the pipeline, even though it is the layer making the judgment calls.
Cursor already has a review layer: Bugbot
Bugbot, Cursor's automated PR reviewer, predates Projects and is what most Cursor teams already use as a merge gate. It runs on every PR update, leaves comments on bugs and security issues with fix suggestions, and posts a GitHub check that defaults to neutral. Turning that into an actual gate takes deliberate configuration: a team has to mark the Bugbot check as required and enable its fail-on-unresolved-issues setting, since it does not block a merge by default.
Sources: Bugbot, Cursor Docs
Claude Code: enforcement primitives, not a built-in gate
Claude Code does not ship a hosted review bot at all. Anthropic ships the pieces a team can wire into one instead: hooks that attach to lifecycle events like PreToolUse and PostToolUse, and subagents that run in isolated context windows with their own tool permissions.
Sources: Hooks reference, Claude Code Docs, Subagents, Claude Code Docs
The hook mechanism is what actually enforces a stop, not just a suggestion. A PreToolUse hook that exits with code 2 blocks the tool call outright, and the documentation is specific that this overrides even a JSON permission decision of allow. Enterprises can lock this down further with an allowManagedHooksOnly setting, which strips out every user, project, and local hook and leaves only policy hooks an administrator has set.
Sources: Hooks reference, Claude Code Docs
Subagents add the delegation half. Each one runs with its own system prompt, its own allow list or deny list of tools, and can be scoped to specific MCP servers, so a subagent doing a database migration never inherits credentials a subagent reviewing a frontend diff would need. Nested delegation is capped at three layers deep by default, and subagent output is scanned before the main agent reads it, specifically to blunt prompt injection carried back through a subagent's results.
Sources: Subagents, Claude Code Docs
What Claude Code does not give a team is a decision about what counts as a blocking issue. Hooks and subagents are enforcement mechanics: they can stop an action cold, but a team still has to write the policy that decides when they should fire.
Windsurf is now Devin Desktop, and Cascade is gone
Windsurf, as a separately branded product, stopped existing on June 2, 2026. Cognition, which builds Devin and acquired Windsurf in 2025, rebranded and relaunched it as Devin Desktop through an automatic update: no reinstall, no migration wizard, existing settings and extensions carried over. Most search demand and older comparison content still says Windsurf, but the product a reader installs today is Devin Desktop.
Sources: Windsurf is now Devin Desktop, Devin
Cascade, Windsurf's original agent, was retired alongside the rename. Its replacement is Devin Local, rewritten from scratch in Rust, which Cognition says is roughly 30 percent more token-efficient and adds subagent support plus OS-level sandboxing: writable file paths are derived from a permission scope, and network access can be restricted with domain allow and deny lists, enforced through bubblewrap on Linux, Seatbelt on macOS, or WSL2 on Windows. Cascade itself stayed available only as a legacy option through July 1, 2026.
Sources: Devin Local Agent, Devin Docs, Windsurf is now Devin Desktop, Devin
The review-gate role Bugbot plays for Cursor is filled by Devin Review, which Cognition shipped into Windsurf as well: it groups a pull request's changes into logically connected hunks, runs an automated bug and edge-case pass across both the diff and the surrounding codebase, and offers one-click inline fixes on GitHub and GitLab. Like Bugbot, it is a review layer bolted onto the pull request, not a runtime gate inside the agent itself.
Sources: Fast and Comprehensive Code Review, Now in Windsurf, Devin
On the enterprise side, Devin Desktop carries forward Windsurf's SSO, group-based role access, and admin-visible audit logs of login and agent activity, configured through the same Devin admin console regardless of whether a developer works in Devin Desktop, Devin Cloud, or Devin CLI.
Sources: SSO Onboarding Guide, Devin Docs
Governance side by side
| Governance capability | Cursor | Claude Code | Windsurf (Devin Desktop) |
|---|---|---|---|
| Vendor-hosted automated PR review bot | Yes, Bugbot | No, build your own via hooks | Yes, Devin Review |
| Runtime hook that blocks a tool call before it executes | No, Rules are advisory context | Yes, PreToolUse exit code 2 | Partial, OS-level sandbox allow/deny lists |
| Coordinator agent that delegates without writing code itself | Yes, Projects | Subagents delegate; the main agent can still write code | Agent Command Center manages agents; no fixed non-coding role |
| Org-wide policy an individual developer cannot override | Yes, enforced Privacy Mode and model controls | Yes, allowManagedHooksOnly | Yes, admin console with SSO, RBAC, SCIM |
| Enterprise audit log of agent actions | Yes, Enterprise dashboard | Yes, managed hook and policy telemetry | Yes, login and action logs |
| Human sign-off required before work reaches main by default | Yes by design, no autonomous push to main | Configurable, depends on permission mode | Configurable, depends on auto-execution level |
The question none of them has answered
Right now, nobody's delegation layer gets reviewed the way its code output does. Cursor's coordinator, Claude Code's subagent orchestration, and Windsurf's Agent Command Center all leave a record of what got built. None of them leaves a record of why a particular task got prioritized, scoped, or handed to a particular subagent instead of held back for a person to look at first.
A coordinator that never writes a line of code still makes a judgment call every time it delegates: what to work on, in what order, with how much scope. A pull request can be diffed line by line. Reviewing the pull requests it produces checks the work; it does not check the judgment behind them, and that decision, so far, cannot be diffed at all.
- Does a human see every pull request before merge, or only the ones the tool flags as risky?
- Is the review cadence enforced by a gate, or does it just quietly loosen as trust builds, the way Cursor's own launch post describes?
- Can you reconstruct why the coordinator prioritized one task over another, not only what it changed?
- Does the underlying agent support a runtime block, such as a hook or a sandbox, or only an advisory rule a model can choose to ignore?
- Who is accountable when a coordinator delegates a task that turns out to be scoped wrong, the tool vendor, the team that turned it on, or nobody?
Spec-driven review narrows the gap; it does not close it
A written contract of intended behavior, agreed before an agent starts working, gives a human something concrete to check a delegation decision against instead of trusting the coordinator's judgment after the fact. That is the core idea behind spec-driven development: the spec exists so a reviewer has a fixed target to compare the agent's actual scope and output against, rather than reasoning about intent from the diff alone.
TLM Forge takes that approach on the review-of-output half of this problem, and only for Claude Code, where it is built to run on the same hooks and subagents described above. A spec and a goal contract need explicit sign-off before an agent writes anything, a red-team reviewer and a threat-modeler working in fresh context attack the design and the diff instead of rubber-stamping it, and a scored merge gate, the convergence gate, blocks the commit until every critical finding clears, and test-driven development is enforced so a passing suite is a result a reviewer can rerun, not a claim taken on trust. It does not extend that gate to Cursor's or Windsurf's coordinator layer, and it does not yet answer who reviews a delegation decision before any code exists. It answers the half of the question a merge gate can actually reach.
Frequently asked questions
01Does Cursor's Projects coordinator push code straight to production?
No. Per Cursor's own launch post, the coordinator plans and delegates but does not write code or push to main itself; finished work comes back as a pull request for a human to approve first.
02Can Claude Code block a merge automatically like a CI gate?
Not by itself. Its hooks can block a tool call with exit code 2, and enterprises can lock that in, but turning it into a merge gate takes wiring it into CI or a tool built on top, since Anthropic does not ship a hosted review bot.
03Is Windsurf still called Windsurf?
Only informally. Cognition rebranded Windsurf to Devin Desktop on June 2, 2026, through an automatic update; existing settings, extensions, and rules files carried over without a reinstall.
04What replaced Cascade in Windsurf?
Devin Local, a Rust rewrite of the agent that Cognition says is about 30 percent more token-efficient and adds subagent support and OS-level sandboxing. Cascade itself stayed available only through July 1, 2026.
05Which of the three has the strongest audit trail for compliance?
All three now offer enterprise audit logs of agent or login activity. None of them logs the reasoning behind an autonomous coordinator's delegation choices, only the actions taken after that choice is made.