1. TL;DR - Four-Track Convergence in Q4 First Week

On the fourth day of China’s National Day holiday, the Q4 2026 observation window opens. In the past 30 days, the AI programming tool landscape has produced four independent but synchronized evolution curves: collaborative IDE shape divergence (Cursor / GitHub Copilot Workspace / Claude Code three paradigms locking in), multi-model routing protocol standardization (Anthropic MCP, OpenAI Agents API, Google A2A converging), domestic end-cloud coordination (Alibaba Lingma, Zhipu CodeGeeX, Baidu Comate cumulative installs exceeding 8 million), and Software Engineering 3.0 compliance standardization (SBOM, VEX, SLSA L3, SSDF v1.1 formally landing in SOE procurement lists). This article uses the “holiday + Q4” dual time anchor to review the latest progress across the four tracks and their implications for the developer ecosystem.

2. Collaborative IDE Shape Divergence: Three Poles Lock In

2.1 Cursor: VS Code Kernel + Agent-First

Anysphere’s Cursor completed a Series D at a valuation of approximately USD 30 billion led by Thrive Capital in Q3, with ARR surpassing USD 500 million and enterprise paying customers growing from 15,000 to 48,000 (+220%). Cursor’s Composer-1, released in September, positions “multi-file planning + cross-file execution + automatic commit” as its differentiation; in internal testing it scored 78.4% on SWE-bench Verified, surpassing Claude Code single-agent mode (73.1%) for the first time.

2.2 GitHub Copilot Workspace: Task-Centric

GitHub upgraded Copilot Workspace to GA (General Availability) on September 23, positioning it as a “task planning canvas” rather than a code editor. Workspace treats Issues/PRs as first-class citizens; the Agent automatically decomposes an Issue into 3-7 Plan Steps, with humans approving each step before proceeding. Microsoft’s early data shows Workspace users’ PR merge rate is 41% higher than pure Copilot Chat users, PR review rounds dropped from 4.2 to 2.1, and code rollback rate fell 28%.

2.3 Claude Code: CLI + Skill Solo Deep-Work

Anthropic’s Claude Code completed two major upgrades in Q3: the July release of the “Skill” mechanism allows packaging repeatedly used prompts / toolchains / test scripts into reusable Skills; the September opening of the “Agent SDK” allows users to embed Claude Code as a sub-agent within local CLI processes. Claude Code currently accounts for 7%+ of all GitHub commits (vs. 2.4% at the beginning of 2026), and 60% of Anthropic’s internal PRs are drafted by Claude Code.

3. Multi-Model Routing Protocols: From Warring States to Convergence

3.1 The Three Protocols Face Off

  • Anthropic MCP (Model Context Protocol, open-sourced November 2024): a unified open protocol for tools, data, and prompts; officially registered MCP Servers surpassed 18,000 by end of Q3
  • OpenAI Agents API (GA March 2026): encapsulates Agent orchestration, state management, and tool invocation into a unified SDK; 36 leading SaaS providers joined in the first batch
  • Google A2A (Agent-to-Agent, open-sourced May 2026): focuses on capability discovery and task delegation between Agents; completed bridge-layer adaptation with MCP in Q3

3.2 Industry Organization Steps In

On September 28, the Linux Foundation announced the formation of the “Agent Protocol Working Group,” co-initiated by Anthropic, OpenAI, Google, Alibaba, Huawei, Salesforce, and SAP, with a goal of releasing a unified Agent-to-Agent communication specification draft before Q2 2027. The working group’s first meeting disclosed that the three major protocols differ by more than 60% in semantic meaning across the three core scenarios of “task scheduling,” “context passing,” and “error rollback”; unifying the specification requires an engineering effort equivalent to rewriting half of the Kubernetes control plane.

4. Domestic IDE End-Cloud Coordination: Install Base Explodes

4.1 Alibaba Lingma: From Plugin to IDE

Alibaba’s Lingma launched the standalone IDE “Lingma IDE” in Q3, with a September 30 announcement that the personal edition would be free forever and the enterprise edition billed by LDCU (Lingma Developer Compute Unit). Lingma disclosed key Q3 data: cumulative installs 3.87 million (+118% QoQ), 4,200 enterprise paying customers, 82 billion daily active Token invocations, and a model matrix covering Qwen3-Coder-Plus / Qwen3-Coder-30B / Qwen3-Coder-7B tiers.

4.2 CodeGeeX + Comate Dual-Line Push

Zhipu CodeGeeX released v6 on September 17, marking the first time it offered “in-house GLM-4.6 + DeepSeek-V4-Flash + Claude Sonnet 4.5” as selectable backends, with 1.45 million daily active users; Baidu’s Comate released “Comate 3.0 Multi-File Refactor Edition” in September, positioning code-base-level legacy migration as its main scenario, serving more than 21,000 enterprises, of which SOE customers grew from 87 in Q2 to 156 in Q3 (+79%).

4.3 Engineering Value of End-Cloud Coordination

IDC’s September report noted that end-cloud coordinated deployment in enterprise scenarios delivers average inference cost reduction of 41%, privacy compliance issue reduction of 67%, and first-Token latency drop from 1.2s to 220ms. Lingma, CodeGeeX, and Comate together have a cumulative installed base of 8.12 million, accounting for approximately 78% of the domestic AI programming tool market.

5. Software Engineering 3.0 Standardization: Regulation-Driven

5.1 SBOM + VEX Enter the Mandatory Period

The revised “Regulations on the Administration of Network Product Security Vulnerabilities,” effective September 1, 2026, requires operators of critical information infrastructure to provide SBOM (Software Bill of Materials) in CycloneDX or SPDX format for procured software, and high-severity vulnerabilities must be accompanied by a VEX (Vulnerability Exploitability eXchange) document. CISA’s KEV catalog has recorded 1,247 actually-exploited open-source component vulnerabilities, 67% of which are concentrated in the npm and PyPI ecosystems.

5.2 SLSA L3 + SSDF v1.1 Dual-Track

NIST SSDF (Secure Software Development Framework) v1.1, released in September, lists “threat modeling,” “artifact signing,” and “dependency auditing” as mandatory for enterprise development teams; SLSA (Supply-chain Levels for Software Artifacts) formally opened L3 certification to open-source projects in August, with GitHub, the Linux Kernel, TensorFlow, and 25 other projects passing first.

5.3 SOE Procurement List

The “Central Enterprise Software Supply Chain Compliance White List” released by SASAC at the end of Q3 includes 312 domestic software tools, of which 28 are AI programming tools—Lingma, Comate, Wenxin Kuaima, and CodeGeeX all made the list. The procurement list requires: 100% of new software procurement contracts from 2027 to include SBOM + VEX documentation, and existing contracts must complete compliance remediation by the end of 2028.

6. Inflection Signals from the Four-Track Convergence

  • Tool layer: Cursor, Copilot Workspace, and Claude Code have locked in their paradigms; “collaborative IDE” has moved from concept to a deliverable form
  • Protocol layer: MCP / Agents API / A2A have started unification under the LF framework, with a de facto standard expected by 2027
  • Domestic layer: Lingma, CodeGeeX, and Comate end-cloud coordination installs exceeded 8 million, capturing 78% of the domestic AI programming market
  • Compliance layer: SBOM + VEX + SLSA L3 + SSDF v1.1 have entered the SOE mandatory period, elevating software supply chain security from “advisory” to “access threshold”

7. FAQ (High-Frequency Questions)

Q1: Why is Q4 described as the “Collaborative IDE Four-Track Era” for AI programming? A: Four independent curves took shape within 30 days—collaborative IDE paradigm lock-in, multi-model routing protocol unification launch, domestic end-cloud coordination install base explosion, and compliance standard entry into the mandatory period. No single dimension can explain the overall change in Q4 software engineering; the four tracks stacked together are the essence of this window.

Q2: How do Cursor, Copilot Workspace, and Claude Code differ in positioning? A: Cursor is a “VS Code kernel + Agent-first” full-scenario IDE, with Composer-1 emphasizing multi-file planning; Copilot Workspace is a “task canvas” that automatically decomposes an Issue into Plan Steps around Issue/PR; Claude Code is a “CLI + Skill” solo deep-work mode that accumulates team experience through Skills. The three cover the three core workflows of “editor / project management / command line.”

Q3: What does multi-model routing protocol standardization mean for developers? A: In the past, integrating each model vendor required writing a separate set of adaptation code. After MCP / Agents API / A2A converge, developers can integrate multi-model backends once and schedule by cost / latency / quality optimization through a routing layer. The Linux Foundation working group’s goal is to make “switching model vendors” as standardized as “switching databases.”

Q4: What is the core advantage of domestic IDE end-cloud coordination? A: Three dimensions: ① inference cost reduction of 41% (lightweight tasks run locally); ② privacy compliance issue reduction of 67% (sensitive code never leaves the enterprise network); ③ first-Token latency of 220ms (local response, cloud fallback). These three points correspond to the “cost + compliance + experience” triangle that enterprise IT procurement cares about most.

Q5: How significant is the impact of the SBOM + VEX mandatory period on small and mid-sized software companies? A: The direct impact is limited (most SMB software companies are not direct procurement targets for critical infrastructure operators), but the indirect impact is huge—large customers will transmit SBOM + VEX obligations to upstream suppliers via contract terms. From 2027 onward, it is expected that 80%+ of software procurement contracts from China’s Fortune 500 enterprises will include SBOM clauses.

8. Key Terminology

  • Collaborative IDE: A new IDE form that treats AI Agents as first-class citizens of the editor, supporting multi-file planning, cross-file execution, and automatic commit, represented by Cursor
  • MCP: Model Context Protocol, an open protocol led by Anthropic that unifies the access specification for tools, data, and prompts; registered Servers surpassed 18,000 by end of Q3
  • A2A: Agent-to-Agent, a Google-led Agent-to-Agent communication protocol focusing on capability discovery and task delegation
  • SBOM: Software Bill of Materials, recording component composition in CycloneDX or SPDX format, entering the mandatory period on 2026/9/1
  • VEX: Vulnerability Exploitability eXchange, a vulnerability exploitability exchange document noting whether a vulnerability affects the product
  • SLSA L3: Supply-chain Levels for Software Artifacts Level 3 certification, requiring an auditable and reproducible build process
  • SSDF: Secure Software Development Framework, a security software development framework published by NIST; v1.1 lists threat modeling / artifact signing / dependency auditing as mandatory
  • End-Cloud Coordination: Cloud handles training + complex generation, terminal handles high-frequency / real-time / privacy-sensitive local inference; IDC data shows enterprise-scenario average inference cost reduction of 41%
  • LDCU: Lingma Developer Compute Unit, the billing unit for Alibaba Lingma’s enterprise edition

9. References

Industry Reports

Official Documentation

Authoritative Media