Cognition source-first coverage refresh

Started 2026-11-05, before selecting new controls. This ledger supersedes the scope of the October census, whose Poke exclusion answered a narrower question about products created by Cognition. The requested scope is now all current Cognition products and common controls, including acquired products. Historical evidence in that census remains historical, not a claim of retrieval in this run.

Validation declaration: no tenants declared — Tier 0+1 only. No product login, enrollment, credential creation, integration connection or settings change is authorized. Documentation research, local fixtures and rendering do not earn ai-validated.

Baseline

Guide Version Leveled controls Existing pack types
Devin / common controls 0.1.0 11 API, Terraform
Devin CLI 0.1.0 8 CLI, config
Devin Desktop 0.1.0 14 API, config
DeepWiki 0.1.0 5 API, config, Terraform

All four start at ai-drafted. The baseline full-corpus validator reports five failure groups and six warning groups; its vendor argument still scans the whole corpus. Its reported Devin pack coverage is 7/11. The refresh will distinguish authored-control coverage from discovery coverage.

Product and ownership discovery

All URLs in the following initial inventory were read with web.run on 2026-11-05; each observation concerns the body, not only a page title or HTTP status.

Source-derived product/surface Observation and scope decision Evidence
Devin Cloud, Review, Security 2.0, Oncall, Auto-triage, Automations, DANA, Ask Devin, Outposts The current feature index lists these as Devin capabilities. Reconcile their different execution and integration boundaries within the hub instead of inventing duplicate tenants. Full index
Devin Desktop / Devin Local / Cascade; Windsurf Plugins The separate Desktop index still lists a Windsurf JetBrains plugin product, its administrator guide, releases, Cascade, remote indexing and MCP. Do not assume Desktop device policy configures the plugin. Desktop and plugin index
Devin CLI and companion commands Current index exposes system policy, team settings, SSH/forward, hooks and native config. Follow authentication/state/diagnostics and Local Hands separately. Index
DeepWiki Public knowledge/MCP and private Devin indexing remain distinct boundaries; recheck MCP operations, schema and access. Index
Federal / air-gapped Desktop + CLI Current index includes group/model APIs, offline licensing, OIDC, trust bundles and operational audit references. Older blanket exclusions require reconciliation against product-owned controls, not a claim of equivalent commercial cloud administration. Federal index section
Poke Cognition’s July 23 announcement explicitly says the personal texting agent continues. The current FAQ and developer documentation expose integrations, recipes, a first-party CLI, tunnels and an API. Acquired origin does not exclude it from the requested current-product scope. Cognition ownership announcement, FAQ, recipe documentation
Corridor October 28 announcement says its team joins Cognition to develop Devin Security. A continued independent Corridor product/admin plane is unverified, not assumed removed. Announcement
Dioxus, Blitz, Taffy, Subsecond The team-joining announcement describes continuing open-source app-development work. Generic application/framework hardening is outside PHILOSOPHY.md; any separately operated SaaS administration remains to be checked rather than inferred. Announcement
SWE models, Adaptive, Fusion, FrontierCode Models, routing/harness features and benchmark names are inventory entries, not evidence of independent tenant controls. Govern model availability in the actual Desktop/CLI/federal plane. Cognition announcement index

Source-first candidates

These candidates came from the current documentation indexes and linked configuration references independently of existing guide headings. The initial-state column preserves the research sequence; final dispositions are in the reconciliation below. No initial pending entry is a finding of absence.

Candidate / precise source Plane; conditions / lifecycle Initial disposition
Connect default-deny gateway Dedicated deployment; independently configured route allowlist and session security profile; tunnel token or PrivateLink principal; per-connection audit Gap: hub has Outposts/build boundaries but no Connect policy/identity lifecycle
Local Hands Cloud-session owner plus same-account local client; single-use ten-minute pairing; default private session; --public changes steering; per-tool approval can be widened Gap: local-computer connection and disconnect/containment controls absent
CLI troubleshooting Nonexpiring-by-default token; OS CA store; trace logs include HTTP/auth lifecycle; per-run logs persist and gzip after 48h Gap: product-owned state, credentials and diagnostics need direct treatment
CLI config Separate MCP files since v3000.3; user/project/local paths; Windows uses APPDATA; permissions and imports are distinct from sandbox Resolved: existing IDs/packs retained; Local Hands, proxy/CA, state/retention and version conflicts added
Automations, Oncall, Auto-triage Event sources, triggering actor, security profile, persistent sessions and session actions Resolved in reconciliation below: fetch configuration body and API/provider lifecycle
Slack, Teams, SCM Native integrations, channel/repository access, linked actors and offboarding Pending: integration-specific admission, actions and containment
Plugin ecosystem, MCP, Devin MCP Shared/personal scopes, executable header scripts, OAuth and management tools Pending: check controls beyond existing generic repository/MCP advice
Browser authentication, OIDC Persistent authenticated profiles versus short-lived workload identity; secrets scopes Pending: lifecycle and data-access boundary
Security 2.0, Review, DANA Scans/remediation, PR comment triggers and database tools Pending: security configuration rather than recommending scans as hardening
CMKs, attribution Provisioning-only Enterprise Assured dependency and generated-code filtering Resolved: product-specific CMK 4.3 and attribution 4.4, with provisioning/enablement conditions
Poke recipes, FAQ Shared recipe credentials, new-sign-up-only recipe changes, local tunnels; messaging/account deletion and Human boundary Gap: prior inventory explicitly excluded current acquired product; fetch full integration/API docs before guide selection

Retrieval failures and fallbacks

Reconciled control design

The following decisions were made from configuration bodies before authoring the additional controls. The original IDs remain stable.

Verified finding Resulting control / disposition Conditions, defaults and recovery
FACTUAL ERROR — SSO is now self-service Rewrite Devin 1.1 Settings → Authentication; verify domain, test connection, disable weaker sign-in methods only after proving recovery; automatic membership is a separate default-on option
FACTUAL ERROR — direct/group roles are additive Correct Devin 1.3 One direct role does not describe all effective group grants; login-based synchronization and SCIM have different propagation
CHANGED BEHAVIOR — November 2 automation network updates Qualify Devin 2.2 Automation network edits now reach active sessions; do not generalize that exception to every security-profile field
OMISSION — Connect configuration and commands Add Devin 2.4; native config and gateway CLI; JSONL collection documented, exact detection schema unverified Dedicated deployment; two-sided default-deny routing; ports omitted means all; strict reload retains previous config; enrollment token reread per connection; private admin listener
OMISSION — Local Hands pairing and permissions Add Devin 2.5 and CLI 2.3 Gradual rollout; enterprise off/nonenterprise on by default; unavailable with a security profile; owner-only same-account pairing; ten-minute single-use code; revoke immediately/Ctrl+C; bypass persists in user config
OMISSION — Local Agent Controls Add Devin 2.6 Root policy and organization overrides; list overrides replace rather than append, so an org can lose root deny/ask entries; reset restores inheritance; gradual availability
OMISSION — automation authority, Oncall, auto-triage Add Devin 3.3; GET automation/responder inventory Triggers OR together, public SCM opt-in, trigger-channel read/write access, reply admission differs from trigger admission, limits and persistent scratchpad; Run now bypasses Preflight; stop future admission and inspect running work separately
OMISSION — shared MCP credentials and header scripts, DANA Add Devin 3.4 Personal versus organization OAuth; organization service account shared by all members; header Bash executes in session machine and fails the MCP call on error; enforce read-only database rights upstream
OMISSION — browser profile reuse Add Devin 3.5 Manage Org Blueprints; cookies/local storage reused by future sessions; removing setup does not revoke previously issued upstream sessions
OMISSION — managed plugin ecosystem Add Devin 3.6; reconcile CLI 5.1 Org manifest reaches primary-org local users; enterprise reaches all; transitive dependencies need explicit exemptions; governance fetch fails open; default-branch merges release to future sessions; classic Cascade excluded
OMISSION — Review rules, real approvals and Auto-Fix, Security 2.0 Add Devin 3.7 Separate enrollment/exclusions; Autoapprover beta; removing rule does not revoke posted approval; bot response setting is wider than one PR; scan/fix authority controlled by roles and repository grants
OMISSION — Memory and Dreaming Add Devin 3.8 Default-on personal memory, per-org preference and enterprise Default on/Always on/off policy; disabling does not delete stored notes
OMISSION — native public deployments Add Devin 3.9 Nonenterprise enablement, secure mode off, per-deployment approval; unavailable with enterprise/security-profile/network-policy conditions; customer CI remains a separate credential path
OMISSION — Data Controls, published terms Add Devin 4.5; Desktop telemetry cross-reference Nonenterprise training default; eligible paid-plan opt-out, Teams admin only; Enterprise express-consent commitment; provider ZDR is not deletion of product history/feedback or upstream integration data; exceptions remain
OMISSION — CMK lifecycle Add Devin 4.3 Enterprise Assured, KMS ARN fixed at tenant creation; customer retains key lifecycle; revocation causes availability consequences; no universal AWS principal guessed
OMISSION — attribution filtering Add Devin 4.4; CLI cross-reference Enterprise, default off, support-enabled; cloud edit fails closed on service/scrubbing failure; local behavior reverts matching edits/flags chat; not malware or prompt-injection prevention
OMISSION — native proxy/CA and diagnostics, configuration Add CLI 4.2 and 4.3 OS certificate trust, managed proxy conflict refuses startup; full HTTP traces and per-run logs; gzip after 48h is compression, not deletion; SQLite/file session storage contains conversation data
OMISSION — SSH/forward Add CLI 2.4 Logged-in credential authorizes VM SSH; forwarding is localhost until Ctrl+C; scope approvals to expected session; do not imply local sandbox constrains manual remote shell
OMISSION — Windsurf plugin admin, plugin MCP Expand Desktop applicability; add Desktop 5.3 Legacy portal remains separate; only documented common team toggles apply; JetBrains MCP action opens Cortex file, editor discovery is separate; Desktop ADMX/Linux editor policy is not JetBrains policy
OMISSION — federal groups, model resolution, air-gapped runbook New Devin Federal guide Separate multi-tenant federal portal versus air-gapped beta; group model union and highest-cap semantics; optional OIDC layered on license, local-only logout, expiry/skew propagation; locally hosted models and audit state
OMISSION — Poke integration settings, API, recipes, MCP, account merge New Poke guide Separate account/contract; no Devin SSO inheritance; V2 API injects action-capable context; shared recipe credentials and new-sign-up-only updates; local tunnel ends Ctrl+C; merge keeps selected memory/integrations and deletes other data after 30 days
RECHECKED — public DeepWiki, private management MCP, wiki generation Retain five controls; clarify authenticated management authority and deprecated SSE Public /mcp is credential-free; authenticated service exposes sessions, knowledge and schedules; generation instructions are not ACLs

Remaining source-derived catalog entries

These are dispositions of index/configuration leads, independent of the final control count.

Candidate and fetched source Final disposition
Dynamic Workflows Covered in Devin 3.3: enterprise enablement is off by default and grants in-session programmatic subagent orchestration; skills/scripts remain executable inputs governed by repository, runtime and secret boundaries. The documented Python runtime is not a general admin SDK.
Skills, AGENTS.md, playbooks, knowledge Covered by Devin 3.1/3.6 and CLI 5.1: nine discovery paths, permission-bearing frontmatter, automatic/user-only invocation and permissions persisting after invocation. Knowledge is deprecated and automatically migrates; new accounts from October 24 use Skills, and migrated Playbook APIs read/write skills. Provider handles exist but do not establish every account’s old UI/semantics.
Slack, Teams, GitHub, GitLab, Bitbucket Covered by Devin 3.1/3.3/3.4/3.7: upstream repository and app grants, linking actor, admission versus reply rights, delegated versus channel bot permissions, real approval/remediation authority and two-sided revocation. Disconnecting a delegated Microsoft account does not remove the channel bot.
Integrations index, DANA Covered by Devin 3.3/3.4: org-shared service identities, SQL rights enforced upstream, and issue/on-call event intake. Native connectors are not separate products; per-provider consent must be reviewed in its actual setup. No generic connector SDK is fabricated.
OIDC, Secrets Covered by Devin 3.2/3.5: scoped secret injection versus short-lived workload tokens versus durable browser cookies; provider-specific trust and archive revocation remain separate. Generic credential creation and credential archives deliberately excluded from packs.
Outposts reference, security profiles Covered by Devin 2.2/2.3/2.4: worker/build/session/gateway boundaries differ; a profile edit is generally future-session policy except the specifically documented automation-network exception. Generic host firewall hardening is excluded under PHILOSOPHY.md.
Enterprise security and commercial security overview Customer-configurable gates covered in hub; vendor-internal employee MFA, production access and certifications excluded as non-configurable customer controls. Broad Slack tagged-thread language is qualified by the more specific current automation/channel integration behavior, not treated as a universal data-access guarantee.
CLI hooks and 2026 release notes Covered by CLI 5.1: generic hook reference says errors other than exit 2 continue, while the October 22 stable note documents opt-in fail_closed. Version/conflict is explicit; do not silently assume either behavior for an unknown build.
Air-gapped SSO, models, updates Covered by Federal 2.1/2.2/3.1: optional OIDC layered on license, environment file overrides, timed claims/revalidation, release verification and external state preservation. Protected default files alone do not establish immutable policy.

The November source-derived omissions above are resolved in guide prose or verified packs. Current complete API/settings export, private enterprise interfaces, the gated federal SDK runtime and independent Corridor/private SkyVM administration remain unverified. These research limits prevent a claim of complete product discovery.

Ownership and bounded exclusions

Automation census

Retrieved 2026-11-05. Documented means the operation/configuration exists in fetched sources; it does not mean it was executed. Unverified is deliberately different from a catalog-bounded negative. Each row has read and write decisions.

Plane Terraform resources / data REST / GraphQL First-party CLI / daemon SDK Native config / policy SIEM
Commercial Devin Official provider v0.5.0, latest release October 26: 23 resources, 9 data sources; read inventories and selected guarded writers. devin_schedule deprecated: new creation rejected for migrated orgs, use devin_automation. No resource silently substituted for unavailable controls. v3 GET/write families and beta settings/profiles; actual auth/RBAC and cursor pagination. Current 1.49MB OpenAPI rendered in browser but export/read truncated; complete pinned provider OpenAPI used for automation shapes. No GraphQL documented in the fetched API catalog; private/unlisted GraphQL unverified. devin cloud/SSH/forward/Local Hands plus distinct gateway validate-config, doctor, serve. Packs use read/validation; no agent starts or enrollment. Dynamic Workflows documents an in-session Python orchestration runtime; it is not evidence of a downloadable general administrator SDK. General commercial admin SDK remains unverified; federal SDK is separate. Managed plugin manifests and strict Connect YAML documented; no generic secret writer or universal network enforcement template. Enterprise audit GET; Connect JSONL stdout. Read filters only; no invented universal event schema or log-enable toggle.
CLI / Devin Local Provider does not document local policy resources/data; do not infer commercial org settings cover device state. Shared model API is documented separately; not a local-config writer. GraphQL unverified. devin stable line; local auth/config/MCP/plugins, cloud connection and forwarding. Packs read/preview only unless existing explicit apply requested. No separate local SDK found in the fetched CLI index; unlisted interface unverified. user/project/local JSON, dedicated MCP files, root-owned system JSON; org-enforced permissions, sandbox, registries; malformed system policy fails open while conflicting proxies refuse startup. Per-run diagnostic logs are not the federal structured audit stream; no standard commercial local security-event schema asserted.
Desktop / Windsurf Plugins No IDE/JetBrains resources/data in provider v0.5.0. v2alpha model GET and ETag-guarded write; legacy analytics/SCIM documented. GraphQL unverified. Desktop’s bundled Local uses CLI; JetBrains plugin is separate. No first-party plugin admin CLI identified in fetched admin/feature index. No public plugin/IDE admin SDK found in fetched catalogs; private interfaces unverified. Desktop policy/hook files versus JetBrains Cortex MCP file and IDE proxy/cert settings; scope documented explicitly. Diagnostic logs contain sensitive context; no universal tenant audit export asserted for the plugin.
DeepWiki devin_repository_indexing writer, repository data; existing inventory packs retained. Public MCP read tools versus authenticated Devin MCP with writes. No public DeepWiki ACL REST/GraphQL documented in fetched DeepWiki reference. Client configuration is native to each chosen MCP client; no invented deepwiki command. No separate admin SDK in fetched reference; unverified beyond it. .devin/wiki.json generation, MCP client file; not server ACL policy. No public-service tenant audit interface documented in fetched DeepWiki reference; private Devin audit remains separate.
Federal multi-tenant No federal resources/data in commercial provider v0.5.0. Service-key JSON POST read/write endpoints (reads are not GET); key scope and Teams Read-Only/Update checked. GraphQL unverified. Portal-downloaded SDK is itself a CLI; an HTH wrapper uses its real read command and env credential. First-party windsurf_analytics.py documented, portal download access unavailable; no replacement fake SDK. Wrapper existence/argv tested, SDK internals/live result unverified. Group/model/ACU settings in portal, not air-gapped host policy. SDK analytics is not a security audit log. No federal cloud audit exporter inferred.
Federal air-gapped beta Not applicable to host files; no provider support claimed. Host files/CLI, no cloud management API documented in runbook; configured inference/OIDC/MCP endpoints are not tenant admin APIs. devin auth status, models validate, airgap doctor, diagnostics/version; read/offline commands only in packs. Federal analytics SDK does not configure local air-gapped files. License, strict schema-version-0 auth/models, CA bundle, machine proxy, isolated Desktop state, token cache. OIDC optional; no file means license-only. Always-on local schema-version-1 JSONL, 10MiB rotation and 10 rotated files; copy/forward before eviction. Filter tolerates unknown events, rejects incompatible envelope.
Poke No provider linked in fetched Poke developer catalog; third-party/private provider unverified. Documented V2-key action POST, deprecated legacy webhook; no administrative read/GraphQL endpoint documented in fetched API page. No call executed. First-party npx poke login/logout/whoami, mcp add, tunnel; wrapper refuses automatic installation and reads identity only. Tunnels are live exposure and are not started. No distinct SDK linked in fetched developer catalog; not claimed absent universally. Custom MCP and recipe configuration are real UI/CLI inputs; no invented enterprise MDM/SSO settings. No security audit export/retention API documented in fetched API/FAQ; provider logs and private evidence needed; private enterprise capability unverified.

Provider resource inventory: automation, blueprint, blueprint_file, enterprise_blueprint, enterprise_idp_group_role, enterprise_knowledge_note, enterprise_playbook, enterprise_service_user_role, git_permission, idp_group, ip_access_list, knowledge_note, oncall_responder, org_group_limits, org_idp_group_role, org_service_user_role, org_tags, org_user_role, organization, playbook, repository_indexing, schedule, secret. Data sources: git_connections, idp_groups, knowledge_folders, oncall_schemas, organizations, repositories, roles, service_users, users. Release, resource index, data index, complete pinned schema were fetched through the GitHub connector, not merely cited from memory.

Control-level read/write decisions

The source-first candidates above establish discovery; this matrix records implementation decisions for the resulting controls. Related controls share a row only where their surface verdict is the same. Sources are the fetched plane catalogs above plus each control’s precise source links. All documented handles below are available unless explicitly marked beta/deprecated. No handle was executed live.

Devin controls Terraform API First-party CLI / daemon SDK Native config / policy SIEM
1.1 SSO B-TF U-API U-CLI U-SDK UI connection/sign-in methods; no file setter Audit R; no W
1.2 SCIM R users/IdP groups packs; W IdP-group/role resources exist but do not enforce IdP deprovisioning R membership; W SCIM lifecycle documented, not exercised U-CLI U-SDK IdP provisioning mapping; reviewed UI W, no generic template Audit R; no W
1.3 roles/service users R roles/service_users packs; W direct/group role resources available R roles/service-users pack; W grants are separate reviewed operations U-CLI U-SDK UI; direct and group union must be reconciled Audit R; no W
1.4 human PAT policy B-TF for human PAT policy U-API; service-user API is not this policy Local login tokens are a different plane; U-CLI setter U-SDK UI enterprise policy Audit R; no W
2.1 inbound IP W ip_access_list pack; no dedicated independent data source in index R GET enterprise/ip-access-list pack; requires ManageIPWhitelist despite GET; W documented separately U-CLI U-SDK UI; no local firewall substitute Audit R; no W
2.2 session profiles B-TF R beta default/profile audit pack; W beta profile API documented, no generic writer shipped Local sandbox commands do not set cloud profile U-SDK UI mandatory default; version/active-session caveat Audit R; no W
2.3 build/Outposts B-TF R/W build-default and fleet families documented; no universal infrastructure firewall writer Worker operations are not local CLI policy; enforcement infrastructure-specific U-SDK Outpost contract and actual customer network; generic host hardening excluded Audit R; worker-specific exporter unverified
2.4 Connect B-TF U-API gateway administration R validate-config pack; doctor probes and serve exist but not invoked U-SDK W strict deny-all YAML emitter; token/PrivateLink and both route boundaries R JSONL stdout documented; exact detection schema unverified
2.5 Local Hands B-TF U-API org gate R/W documented pairing/disconnect; live connection pack excluded U-SDK W user preference in CLI 2.3; UI org gate, not equivalent enforcement Diagnostic; no W
2.6 root/org local policy B-TF U-API generic override; model API is narrower Client reads policy, U-CLI admin setter U-SDK UI root/replace-list overrides; actual managed device policy in product guides Diagnostic; no W
3.1 repository/MCP access W git_permission pack; additive grant, not authoritative deny; R repositories data R/W repository delegation families; upstream SCM consent remains separate Native MCP config in local product; not SCM tenant enforcement U-SDK UI/profile plus upstream GitHub/GitLab/Bitbucket scopes Audit R; no W
3.2 secrets/OIDC W secret resource exists; excluded to avoid generic credential/state writer; no secret-values audit pack R/W secret families documented; secret values intentionally not collected Local env binding is not cloud trust configuration U-SDK W provider-specific blueprint OIDC actions; no unrestricted generic trust Audit R; no secret-value detection
3.3 automations/oncall/triage W disabled-by-default automation pack; R oncall_schemas data; schedule deprecated/migrated creation rejected R paginated automation/responder pack; W CRUD families documented Dynamic Workflows in-session runtime is not an admin CLI U-SDK; Python orchestration runtime documented, not substituted UI triggers/limits/actor; secrets excluded from output Audit R; source webhook/provider evidence separate
3.4 shared MCP/DANA/messaging B-TF Integration reads do not prove credential writer; U-API W Header Bash and local MCP exist; no tenant credential CLI established U-SDK UI OAuth scope; executable header script; SQL rights upstream Audit R; provider-side action logs separate
3.5 browser profiles W blueprint/blueprint_file available; credential archives intentionally excluded Blueprint families documented; no sensitive archive collection Blueprint tooling documented; credential extraction excluded U-SDK W reviewed archive/init workflow, upstream revocation separate Audit R; no generic cookie detection
3.6 plugins/skills B-TF managed manifest; legacy playbook/knowledge handles have migration conditions Playbook API becomes skill API for migrated accounts; generic managed-policy setter unverified R/plugin lifecycle commands documented; managed manifest is authoritative input U-SDK W required/optional/forbidden manifest pack; permission-bearing skills; fetch failure unenforced Diagnostic and Audit R; no fabricated supply-chain event schema
3.7 review/security B-TF enrollment/Autoapprover R scan/result families; enrollment/Autoapprover W unverified U-CLI tenant setting U-SDK UI Autoapprover beta, exclusions and bot response; SCM approvals require separate revocation Audit R; SCM events separate
3.8 Memory/Dreaming B-TF U-API policy/deletion Local Git memory format is not an org-policy setter U-SDK UI personal/org/enterprise gates; off retains notes Audit R; exact change event unverified
3.9 native public deployment B-TF U-API toggle/unpublish Customer CI/credentials are a different deployment path U-SDK UI org gate and per-publish approval; conditional availability Audit R; hosting logs separate
4.1 audit No audit data source in v0.5.0 index R paginated enterprise/audit-logs pack; no log-enable W asserted U-CLI cloud audit export U-SDK Collector private output; no invented log-enable file R collection/filtering, no enforcement
4.2 guardrails B-TF R violations via shared audit pack and documented violation API; W policy not established U-CLI U-SDK UI enterprise action dropdown; kill_session historical only R ai_guardrail_violation, no W
4.3 CMK B-TF Devin binding; AWS infrastructure is a separate approved workflow U-API binding/data source U-CLI U-SDK Assisted Assured provisioning only; ARN fixed at creation Audit R; KMS evidence upstream
4.4 attribution B-TF U-API enablement Local filtering behavior exists; not a client toggle substitute U-SDK Assisted enterprise enablement; off by default Diagnostic; no universal violation schema
4.5 Data Controls B-TF U-API preference/readback U-CLI U-SDK UI paid-plan/Teams admin opt-out; Enterprise agreement scope Retention evidence separately required; no W
CLI controls Terraform API First-party CLI SDK Native config / policy SIEM
1.1 identity/proxy B-TF Tenant API does not prove device identity R auth/config inventory pack; no login in audit U-SDK W root-owned system device/proxy emitter; malformed policy fails open Diagnostic
1.2 organization permissions B-TF U-API generic managed permission setter R effective config via pack; no interactive bypass proof U-SDK W native managed baseline plus user fragment; user allow cannot weaken org deny Diagnostic
2.1 sandbox; 2.2 workspace trust B-TF N/A local runtime/trust R/W documented native settings; config auditors retained U-SDK W sandbox/permissions fragments; workspace trust remains user workflow, not global enterprise enforcement Diagnostic
2.3 Local Hands B-TF U-API organization gate Pair/disconnect available; live connection excluded U-SDK W false user bypass preference pack; not immutable managed deny Diagnostic
2.4 SSH/forward B-TF Session identity API is not a tunnel firewall R/W ssh/forward documented; no automatic connection pack U-SDK Loopback forwarding until Ctrl+C; remote shell independent of local sandbox Diagnostic
3.1 MCP; 3.2 imports B-TF U-API local file management R config auditors and documented MCP lifecycle U-SDK W dedicated MCP/import policy fragments, exact scope and paths Diagnostic
4.1 sensitive files B-TF N/A local path permissions R native config audit U-SDK W deny matchers; ignore files are not OS ACLs Diagnostic
4.2 CA/proxy B-TF N/A OS trust and managed proxy R native config cross-reference; OS CA validation operational U-SDK W documented proxy schema; CA store via approved endpoint management Diagnostic; no structured security exporter verified
4.3 diagnostics/state B-TF N/A local retention policy R documented troubleshooting/status; no destructive cleanup U-SDK R paths/log settings; no universal retention writer established Diagnostic; gzip after 48h is not deletion
5.1 plugins/hooks B-TF N/A local execution gate R config audit; plugin/hook lifecycle documented U-SDK W fragments; generic hook fail-open versus versioned fail_closed conflict explicit Diagnostic
Desktop / Plugins controls Terraform API First-party CLI SDK Native config / policy SIEM
1.1 approval; 1.2 workspace; 3.1 MCP; 3.2 deploys; 4.3 sharing B-TF U-API tenant setters in fetched admin reference U-CLI; bundled Local is a different runtime U-SDK UI team toggles; plugins only where their admin doc lists the same control Diagnostic
1.3 shell; 2.1 extensions; 2.2 marketplace; 2.3 updates; 4.2 telemetry B-TF U-API device policy setters Local settings inspection is not MDM deployment U-SDK W native editor policy fragments; OS/release-specific managed deployment, not JetBrains Diagnostic
4.1 context exclusion B-TF N/A repository file R/W filesystem content; no admin CLI inferred U-SDK W native ignore fragment; no security ACL assertion Diagnostic
4.4 model allow; 5.2 model audit B-TF W ETag-guarded model pack; R model GET pack U-CLI tenant setter U-SDK UI defaults/overrides; model removal is not client-device attestation Diagnostic
5.1 device audit B-TF N/A disk/device state R native config comparator, not server API U-SDK R typed expected/actual policy; W enrollment outside audit Diagnostic
5.3 Windsurf Plugins B-TF Legacy portal analytics/SCIM do not establish MCP setting API U-CLI plugin admin U-SDK W Cortex MCP JSONC fragment; empty document is not authoritative removal; UI allowlist/env-match limitations Diagnostic
DeepWiki controls Terraform API First-party CLI SDK Native config / policy SIEM
1.1 data classification N/A human classification; repository grants belong to hub Public MCP is not private ACL; authenticated Devin separate No dedicated CLI in fetched reference U-SDK N/A ACL file; reviewed client/tool boundary Public tenant audit unverified
1.2 indexing W repository_indexing available; R repositories pack R paginated indexing pack; W indexing family documented No dedicated CLI established U-SDK UI private repository access, not public MCP policy Commercial audit boundary separate
2.1 endpoint; 2.2 tool isolation B-TF client policy R public three-tool MCP; authenticated MCP has management W and must be isolated No dedicated CLI; actual chosen client’s native config U-SDK W public-MCP fragment; R profile audit pack; deprecated SSE recorded No public tenant audit exporter established
3.1 wiki generation B-TF file generation policy Wiki query is not ACL configuration No dedicated CLI established U-SDK R wiki.json validator; W reviewed repository generation input, not ACL No public tenant audit exporter established
Federal controls Terraform API First-party CLI SDK Native config / policy SIEM
1.1 portal identity B-TF federal Service-key body auth documented; SSO/role-policy setter unverified Portal AuthToken login is separate from service key, not SSO policy SDK analytics is not SSO/role management UI/account-team SSO/MFA and service-key revocation Cloud security-audit export unverified
1.2 groups/models/ACU B-TF federal R ListGroups/GetGroup POST collector; W group/model provisioning documented, no writer shipped R real SDK CLI wrapper R list/get documented; W group commands documented; actual portal SDK unavailable UI group union, caps and manual overrides; no airgap-file equivalence Analytics is not universal security audit
2.1 airgap OIDC beta B-TF host policy N/A cloud API; OIDC provider is upstream R auth status/doctor only on explicit probe; login/logout documented, not run Federal analytics SDK not applicable W auth.json emitter; required group, public client, file/env override limits R schema-1 auth events; no remote enforcement
2.2 release/license beta B-TF Portal license workflow; offline license not instantly revoked R version/models default pack; –probe adds endpoint/refresh checks N/A analytics SDK Signed license and verified bundle W through approved deployment; no installer/license writer supplied R session_start version; rollout evidence only
3.1 model endpoint beta B-TF Inference endpoint is not admin API R models validate through health pack N/A analytics SDK W models.json emitter; newest query/fragment rejection, env-name reference only R model_call metadata; no content read asserted
3.2 CA/proxy beta B-TF N/A OS/file policy R doctor explicit probe; warns/falls back for invalid CA N/A analytics SDK W CA env/file and managed proxy; actual process environment/ACL validation required R diagnostics; no invented trust-change event
4.1 state beta B-TF N/A product-owned local files R path/diagnostic procedures; no cleanup writer N/A analytics SDK R/W approved file protection/retention workflow, not guessed native retention setting Owner-only state/backup handling; audit separate
4.2 audit beta B-TF N/A always-on local stream No invented enable-audit command N/A analytics SDK W native Filebeat fragment; real OS/XDG paths, TLS output separately required R schema-1 SPL pack; exact auth action/error fields, unknown fields retained
Poke controls Terraform API First-party CLI SDK Native config / policy SIEM
1.1 connected authority No provider linked in fetched catalog; private support unverified Admin inventory/revoke U-API; message ingress is not setter No integration inventory/revoke command established U-SDK UI integration review/disconnect; upstream grants separate No export established in fetched API/FAQ
1.2 identity/lifecycle Same catalog boundary Account deletion/merge U-API R whoami private-output pack; login/logout documented, not run U-SDK UI account merge/delete; retention conditions documented No export established
2.1 action ingress Same catalog boundary W documented V2 message endpoint; explicit –send only, no admin R; legacy V1 deprecated N/A administrator CLI U-SDK; Python HTTP example is not SDK evidence Upstream authenticated admission/dedup; no native policy file invented Upstream caller/action evidence; Poke audit export unverified
2.2 recipes Same catalog boundary Existing-subscriber revocation/update API unverified Development commands do not establish subscriber enforcement U-SDK UI Kitchen shared credentials; changes affect new signups Provider-side credential/activity review; no universal export
3.1 custom MCP Same catalog boundary Admin read/write U-API W documented mcp add; secret-bearing args excluded from pack U-SDK UI server/authentication, header is not authentication by itself Actual MCP server logs separately configured
3.2 tunnels Same catalog boundary N/A local transport lifecycle W documented attended tunnel; preview default, –start explicit and package auto-install disabled U-SDK Loopback origin/name validation in wrapper; server process separate Actual local/server evidence; no fabricated Poke audit event

External baseline and threat sweep

2026-11-05 searches of CIS, CISA and DISA sources for Devin/Cognition/Windsurf/Poke found no product-specific prescriptive baseline. This is a bounded search result, not proof that every unpublished or gated baseline is absent. DISA catalog coverage remains unverified behind its access limitations; no STIG numbers or SCuBA policy IDs were invented. NSA/ACSC product-specific coverage remains unverified. NIST mappings are supporting objectives, not certifications.

Standing-list research was swept for the preceding twelve months, with historical Devin research retained for context. Wiz GhostApproval reports symlink-mediated misleading/pre-authorization operations, including Windsurf; it motivates testing real permission boundaries, not claiming a current patch version. The article body and disclosure table were fetched; its tested-version status is not a current patch guarantee. Johann Rehberger’s Devin demonstration (August 2025) documents remote content inducing command execution; current permission/network controls are verified independently in Tier 1. No exploit was run. Search-result snippets and unrelated similarly named products are not evidence of a current Cognition vulnerability.

Verification results

The refresh retains all original IDs and adds 32 controls, including separate Poke and Federal guides. Authored coverage is distinct from source discovery: the unverified areas above remain open research boundaries.

Guide Leveled controls Controls with a pack include Distinct pack files Rendered pack accordions
Devin / common 24 10 13 14
Devin CLI 12 9 12 12
Desktop / Plugins 15 10 10 10
DeepWiki 5 4 5 5
Poke 6 3 3 3
Federal 8 5 7 7
Total 70 41 50 51

There are 17 new pack files. The shared audit pack renders for two hub controls, explaining the extra accordion. CLI read checks do not establish device enforcement; native fragments and preview emitters require reviewed deployment. The census records documented handles deliberately excluded from generic writers as well as interfaces still unverified.

No VERIFIED-LIVE product surface, real provider plan/apply, live API/CLI/SDK, IdP, license, messaging delivery, tunnel, integration enrollment or SIEM ingestion was exercised. All six guides remain ai-drafted; no maturity promotion is earned by these checks.