feat(guardrails): admit native deepseek provider

packages/guardrails/README.md

@@ -47,7 +47,7 @@ Current contents focus on the first thin-distribution slice:
 - packaged custom config dir profile
 - packaged plugin for runtime guardrail hooks
 - guarded `implement` and `review` agents plus packaged `/implement`, `/review`, `/ship`, and `/handoff` workflow commands
-- declarative provider admission policy for `zai`, `zai-coding-plan`, `openai`, and the isolated OpenRouter evaluation lane
+- declarative provider admission policy for `zai`, `zai-coding-plan`, `openai`, `deepseek`, and the isolated OpenRouter evaluation lane
 - scenario coverage for managed config precedence, project-local asset compatibility, plugin behavior, and workflow safety defaults
 
 Planned next slices are tracked in the fork:
@@ -93,7 +93,7 @@ It respects an existing `OPENCODE_CONFIG_DIR` so project- or environment-specifi
 
 The packaged profile defaults to the `implement` agent. Review and release-readiness work should run through the packaged `/review`, `/ship`, and `/handoff` commands so the workflow stays read-only at the gate layer.
 
-Provider admission is also packaged here. Standard confidential-code work is admitted on the `zai`, `zai-coding-plan`, and `openai` lane. `zai-coding-plan` is kept as a separate provider because Z.AI's official OpenCode guide tells Coding Plan subscribers to select `Z.AI Coding Plan` explicitly. OpenRouter-backed candidates are available only through the dedicated `provider-eval` lane so evaluation traffic does not silently become the default implementation path.
+Provider admission is also packaged here. Standard confidential-code work is admitted on the `zai`, `zai-coding-plan`, `openai`, and `deepseek` lane. `zai-coding-plan` is kept as a separate provider because Z.AI's official OpenCode guide tells Coding Plan subscribers to select `Z.AI Coding Plan` explicitly. OpenRouter-backed candidates remain available for evaluation and multi-vendor routing without replacing the default implementation path.
 
 ## Managed deployment
 

packages/guardrails/managed/opencode.json

@@ -5,6 +5,7 @@
     "zai",
     "zai-coding-plan",
     "openai",
+    "deepseek",
     "openrouter"
   ],
   "share": "disabled",
@@ -63,6 +64,14 @@
         "gpt-4.1"
       ]
     },
+    "deepseek": {
+      "whitelist": [
+        "deepseek-v4-flash",
+        "deepseek-v4-pro",
+        "deepseek-chat",
+        "deepseek-reasoner"
+      ]
+    },
     "openrouter": {
       "whitelist": [
         "anthropic/claude-haiku-4.5",

packages/guardrails/profile/opencode.json

@@ -13,6 +13,7 @@
     "zai",
     "zai-coding-plan",
     "openai",
+    "deepseek",
     "openrouter"
   ],
   "share": "disabled",
@@ -89,6 +90,14 @@
         "gpt-4.1"
       ]
     },
+    "deepseek": {
+      "whitelist": [
+        "deepseek-v4-flash",
+        "deepseek-v4-pro",
+        "deepseek-chat",
+        "deepseek-reasoner"
+      ]
+    },
     "openrouter": {
       "whitelist": [
         "anthropic/claude-haiku-4.5",

packages/guardrails/profile/plugins/guardrail-patterns.ts

@@ -94,6 +94,7 @@ export const paid: Record<string, Set<string>> = {
     "gpt-5.5",
     "gpt-5.5-pro",
   ]),
+  deepseek: new Set(["deepseek-v4-flash", "deepseek-v4-pro", "deepseek-chat", "deepseek-reasoner"]),
 }
 
 export const secEnvExempt = /\.env\.(example|sample|template)$/i

packages/guardrails/profile/plugins/guardrail.ts

@@ -571,9 +571,9 @@ export default async function guardrail(input: GuardrailInput, opts?: Record<str
           }
         }
         const providerTiers: Record<string, string[]> = {
-          high: ["zai-coding-plan", "openai"],
-          standard: ["zai-coding-plan", "openai", "openrouter"],
-          low: ["openrouter", "zai-coding-plan"],
+          high: ["zai-coding-plan", "openai", "deepseek"],
+          standard: ["zai-coding-plan", "openai", "deepseek", "openrouter"],
+          low: ["openrouter", "zai-coding-plan", "deepseek"],
         }
         const recommendedProviders = providerTiers[tier] ?? []
         if (recommendedProviders.length > 0 && !recommendedProviders.includes(provider)) {