DeepSeek Team 0.8.5

DeepSeek Team 0.8.5

This release enforces the delegation gate for substantial Auto work, records exact
write provenance, and documents preparation and recovery boundaries.

• Substantial Auto plans must register ordinary read and write deliverables with
  executor: "auto". An explicit coordinator or worker executor for ordinary work
  is rejected, while protected responsibilities, attested native exceptions, genuinely
  small concrete-scope tasks and saved manual profiles keep their explicit executors.
• The first recognized source inspection returns an early-planning reminder and records
  source_inspection as work; the next inspection is denied until a distribution exists.
  Duplicate tool-use identity stays idempotent, and status, bootstrap, instruction-read
  and control calls stay exempt.
• Protected coordinator scope no longer authorizes a source write. decision_artifacts
  is limited to exact in-scope .md, .rst or .txt files. Each integration
  write_scope file must be backed by actual file changes from a terminal worker or
  a currently accepted coordinator write named in integration_of. Symbolic and
  hard-link aliases are rejected.
• Matcher, diagnostics and setup guidance recognize qualified tool spellings such as
  functions.exec_command and collaboration.spawn_agent, and routing diagnostics
  report the true requested and resolved decisions.
• Authentic started legacy explicit plans remain valid under advisory, shadow and off
  routing modes.

Preparation and recovery follow the documented boundaries. A read-only HEAD preflight
(deepseek-team workspace check) reads committed names and modes only and creates no copy.
Pre-provider failures are classified with failure_stage: preparation and a
preparation_cause that separates environment failures from admission refusals. Failed
and unaccepted workspaces are preserved for explicit inspection and disposition; an old
failed copy without a baseline stays quarantined, and nothing retries automatically.

The final host suite passed all 903 tests without skips, with Codex 0.153.2 and
Claude Code 2.1.278 available. Real runtime fixtures use offline providers; Linux OS
sandbox checks also passed. The candidate wheel passed installation, replacement
and removal checks with pip, pipx and uv, preserving external configuration. Wheel
and sdist metadata passed twine check --strict.

Refresh managed hooks with deepseek-team hooks install --runtime codex (or
claude / both), then attached-project guidance with deepseek-team init --coordinator codex . (or claude / both). Worker OS isolation and existing
credentials/access settings are preserved.

DeepSeek Team 0.8.4

DeepSeek Team 0.8.4

This release consolidates reviewed fixes that were left in local development copies
and preserves the native-dispatch routing gates introduced in 0.8.3.

• Lifecycle hooks retain every unfinished task in a session. Updating an older
  completed record cannot hide pending work, and new coordinator or native work
  cannot bypass an older pending worker assignment.
• Source authorization, overlap checks and result invalidation share canonical
  path/glob matching. A file glob does not authorize deleting its parent directory.
• Declared checks support leading environment assignments such as
  PYTHONPATH=src python3 -m unittest; readiness parsing never executes the command
  on the host. Path dependency probes work with the POSIX shell.
• Selected source imports reject symlink traversal and linked destinations, use
  pinned directory descriptors and replace files atomically. If a later file
  fails, files already imported remain recorded as coordinator preparation.
• Project configuration changes validate managed instruction blocks before
  publishing the policy, roll back earlier writes on ordinary failures, and
  preserve user-authored content. An invalid explicit config show --path no
  longer silently selects the current directory.
• Managed workers installed in a Python virtual environment launch the provider
  bridge through the resolved interpreter. The real sandbox preflight now checks
  that interpreter before reading provider credentials.

Worker repositories remain independent copies under the private state directory;
their internal deepseek/<id> branches never become branches or registered worktrees
of the source project. Coordinator guidance prefers existing isolation or detached
worktrees and requires verification before removing owned temporary branches after
integration. This is coordinator workflow guidance, not an automatic deletion
service. Failed, unaccepted and foreign work is retained.

Refresh attached-project guidance after upgrading with deepseek-team init --coordinator codex . (or claude / both). Worker OS isolation and existing
credentials/access settings are preserved.

DeepSeek Team 0.8.3

DeepSeek Team 0.8.3

Generated coordinator instructions now require planning and routing for every delegated
subtask, including small read-only history, search and review work, before another agent
is assigned. In Auto, deliverables register executor: "auto" and a resolved worker
decision means DeepSeek. Ordinary short coordinator answers need no fake worker, wait and
control calls create no work, and sending new work to an already running agent also
requires routing.

Coordinator-native subagents are now an explicit exception:

• generic parallelism, isolated context or convenience alone is not a sufficient reason;
• a native deliverable needs a concrete delegation_reason and a native_exception, either
  {"code": "explicit_user_request", "evidence": "specific user request"} or
  {"code": "native_capability", "capability": "...tool unavailable to a DeepSeek worker", "evidence": "why it is required"};
• the coordinator attests that evidence; it is not mechanically proven user provenance;
• the native prompt or message must include [deepseek-team:TASK_ID:DELIVERABLE_ID] binding
  the registered native-agent scope, and its accepted or cancelled outcome is recorded like
  any other deliverable.

The parent PreToolUse hook enforces this binding before native launches and new work
messages, including structured text inputs. Missing, foreign or ambiguous markers,
worker-owned scopes, changed attestations, completed deliverables and revoked write
access are rejected. Recorded dispatches survive replanning and require an outcome.
Freeform patch targets are also checked against the registered source scope.

Architecture, security, integration, final verification, secrets/signing and publishing stay
coordinator-only. Hook guidance now states truthfully that the parent launch/message gate covers
only the events the runtime actually delivers, not every possible write; Codex and Claude coverage
is verified separately and universal coverage is never claimed. Where the runtime cannot intercept
an action, these instructions remain authoritative. The mandatory worker OS sandbox is unchanged.

Local offline-provider fixtures verified actual native-launch denial in Codex 0.153.2
and Claude Code 2.1.278. A separate paid DeepSeek live diagnostic passed with the OS
sandbox enabled; primary coordinator configuration and authentication were preserved.

After upgrading, run deepseek-team hooks install --runtime codex (or claude / both),
then deepseek-team init --coordinator codex . (or claude / both) in attached
projects to refresh generated instructions. Existing user text and saved settings are preserved.

DeepSeek Team 0.8.2

DeepSeek Team 0.8.2

Worker reasoning effort now uses DeepSeek's distinct levels: low, high and max. Previously, both medium and high selected the provider's high level, and max was unavailable.

• auto remains the default policy: the coordinator selects low for bounded or mechanical work, high for normal assignments, and max for difficult debugging, cross-file reasoning or adversarial review.
• A worker launched under auto without a concrete selection falls back to high.
• Existing medium settings and commands remain valid as a compatibility alias for high.
• Configuration, worker runtimes, routing feature cards and generated coordinator instructions use the same effort levels. English and Russian documentation explains the updated behavior.

The worker model remains deepseek-flash, with thinking enabled. Access permissions and the required Linux sandbox are unchanged.

After upgrading, run deepseek-team init --coordinator codex . (or claude / both) in attached projects to refresh generated instructions. Existing user instructions and saved settings are preserved.

DeepSeek Team 0.8.1

DeepSeek Team 0.8.1

The PyPI distribution is now deepseek-team, matching the CLI name and support for both Codex and Claude Code.

• Install with pipx install deepseek-team, uv tool install deepseek-team, or python -m pip install deepseek-team in a virtual environment.
• English and Russian READMEs document installation, updates and removal through PyPI. The banner, language switch and MIT license are preserved.
• Coordinator summaries distinguish personal work, accepted DeepSeek results and native subagent contributions, including rework and failures. Any approximate contribution split is explicitly labelled as a subjective estimate, never a measured saving.
• Package metadata, installer checks and registry links use the neutral distribution name. Publication supports verified release artifacts with a private Twine token; optional GitHub Trusted Publishing requires separate owner setup.

If you installed the earlier codex-deepseek-team distribution, uninstall it with the same package manager before installing deepseek-team. Uninstalling the Python package preserves saved project settings and credentials; do not run auth remove to change package names.

Linux and Python 3.11+ are required. DeepSeek workers retain the required Linux OS sandbox.

DeepSeek Team 0.8.0

DeepSeek Team 0.8.0

This release provides immediate useful delegation, a FIFO worker queue and standard Python package installation through a single current interface.

• English and Russian READMEs now focus on current installation, first-session delegation, everyday commands and maintenance, with the banner, language switch and MIT license retained.
• Auto immediately assigns eligible bounded small/medium work. Quality and price uncertainty remain visible without delaying eligible first-session work. Supported poor measured economics still veto admission. Explicit permissions, manual 25/50/75 profiles and off retain priority; fresh Auto access is read-only. Opt in to full-access for implementation.
• A rejection or three distinct rework cases within the cooldown window pause the family. failure_cooldown_seconds defaults to 300. One rework remains recorded without a pause, and failed implementation never retries automatically. routing status reports admission.active_cooldowns.
• Concurrency defaults to eight, configurable from 1 to 64 with config set --project --max-workers N, --global, or one-job worker --max-workers N. Busy slots queue launches FIFO while assignments remain worker-owned. --no-wait returns capacity code 75; explicit timeout includes queue time. The default total timeout is unlimited. Queued launches recheck off/access/routing/HEAD before secrets or provider launch.
• Routing uses one admission path. Private state/status/export use format 3 and routing-v3.sqlite3. Older database files remain untouched and are neither read nor migrated; unsupported versions in the current database are rejected. External evidence snapshots retain their separate schema-1 import contract.
• Coordinator and native deliverables require explicit current results before completion. Coordinators review actual diffs and checks, report accepted work and rework, and retain final verification and integration without invented contribution percentages or savings.
• Install with pipx, uv or pip in a venv. The distribution remains codex-deepseek-team; its executable is deepseek-team. Setup detects coordinators and checks Git, command availability, the required OS sandbox and local runtime capabilities before credential access. setup --with-sandbox explicitly permits privileged Ubuntu package/profile installation; ordinary setup never invokes sudo.
• setup --no-key defers authentication without reading credentials. Setup without a required key reports incomplete readiness. Existing project attachment and native hook trust remain separate from package installation.
• Installation checks exercise current-version install, replacement and uninstall with isolated homes and retained user-state sentinels. Version-tag releases build and verify artifacts before separate Trusted Publishing jobs.
• Workers always require the Linux OS sandbox. DEEPSEEK_TEAM_DISABLED is the environment switch for disabling delegation. Managed copies retain their sparse filesystem, private network and fixed provider relay.

PyPI availability depends on the owner completing the publishing setup. A GitHub release does not itself publish the package to PyPI. Linux and Python 3.11+ remain required. Credentials and native hook trust stay under their existing boundaries.

DeepSeek Team 0.7.1

DeepSeek Team 0.7.1

Highlights

• Auto delegation now runs automatic per-task-category stages. The stage is chosen for each task category from that category's own recorded evidence; there is no manual stage switch and no separate stage command.
• Bootstrap stage (active). For a small, low-risk, local task category with too little local evidence, Auto can actively admit the task to a worker so evidence can start accumulating. A bootstrap assignment is an ordinary reviewed task with concrete checks: a narrow, reversible change in an owned development copy, an explicit verification command or test, and coordinator review of the actual diff before integration. Bootstrap never widens access and never overrides an explicit executor choice, a saved manual profile, or the disabled state.
• Learned stage (adaptive). As comparable outcomes accumulate, the stage moves to learned adaptive selection. The estimator's acceptance-with-uncertainty estimate for that category, not a fixed percentage, drives whether the worker or the coordinator is recommended. An unknown task family cannot transfer evidence or enter trial admission until its classification is known.
• Recovery stage (limited). After quality problems the stage admits a bounded number of ordinary, safe, verifiable tasks so learning cannot collapse permanently. The first eligible case is a canary, later at most one assignment per ceil(1 / recovery_rate) distinct eligible cases, one ticket at a time, with a finite cooldown after a quality failure in the same task family and context. Recovery tasks are regular reviewed tasks, not extra paid benchmarks, and they never override explicit choices, manual profiles, access, safety or the disabled state.
• Stage selection is automatic. The coordinator does not choose a stage by hand, and no configuration switch selects a stage directly.
• Bootstrap continues until quality is supported, including beyond five successes when the confidence bound is still too wide. Bootstrap and recovery share a maximum of three pending/running trial slots; recovery additionally permits at most one active trial. Every tenth eligible bootstrap or cost-learning opportunity in the same category stays with the coordinator for comparison.
• Missing prices permit bounded cost learning on eligible safe tasks; sufficiently supported poor savings veto all trials. Recorded plan bindings are immutable, and queued automatic work rechecks quality cooldown before starting.
• Unknown evidence is distinct from a bad outcome. infrastructure, cancelled and unknown observations stay unlabelled and do not count as quality failures; only rework and rejected are quality failures, and accepted means accepted without rework. Missing or unknown task attributes and missing cost evidence stay unknown rather than being treated as negative.
• Manual delegation profiles are preserved. Existing saved 25/50/75 profiles keep priority, are never silently overwritten, and their real worker outcomes continue to supply local evidence.
• Access and the sandbox are unchanged. Automatic routing cannot widen the configured access level; fresh delegation_level = auto, access = auto settings still resolve to read-only, worker writes require an explicit access grant, and workers keep running in owned development copies inside the required Linux sandbox.
• There is still no Flash/Pro model router; DeepSeek workers remain fixed on deepseek-flash.
• No measured savings are claimed. Actual total cost is recorded per case, and a category with unknown or insufficient cost evidence is not reported as a saving; exact savings and thresholds depend on the project's own recorded outcomes.

Configuration

Stages are selected automatically inside Auto; they are not set directly. The existing controls keep their meaning:

deepseek-team config set --project --delegation-level auto

deepseek-team routing status --path /path/to/repository --json
deepseek-team routing configure --path /path/to/repository --recovery-rate 0.10

Manual profiles and access remain explicit, user-owned choices:

deepseek-team config set --project --delegation-level 50
deepseek-team config set --project --access full-access

Compatibility

• Saved numeric profiles are not overwritten; existing settings, credentials, managed instruction files, hooks, and coordinator model/auth configuration are preserved by a normal upgrade.
• A fresh Auto project has effective read-only access, and routing cannot widen access or take over coordinator-owned work.
• Workers continue to run in owned development copies inside the required Linux sandbox; the primary coordinator runtime is unchanged.

Verification

• The local suite is run with PYTHONPATH=src python3 -m unittest discover -s tests -v.
• Python 3.11, 3.12 and 3.13, runtime/sandbox, and upgrade CI are configured gates; this note does not claim they are already green remotely.
• The existing main-push workflow builds and publishes the GitHub release after its own verification step.

DeepSeek Team 0.7.0

DeepSeek Team 0.7.0

Highlights

• Fresh settings default to Auto delegation (delegation_level = "auto") with routing mode auto. A cold start stays conservative: without enough comparable local evidence the ordinary recommendation keeps the coordinator.
• Existing saved manual 25/50/75 profiles are preserved, never silently overwritten, and their real worker outcomes continue to supply local evidence.
• Access stays independent of delegation: fresh delegation_level = auto, access = auto settings resolve to read-only. Automatic routing cannot widen the configured access level.
• DeepSeek workers remain fixed on deepseek-flash; there is still no Flash/Pro model router.
• The coordinator records a feature card before execution, and a statistical estimator returns recommendations with explicit posterior uncertainty.
• Public evidence is imported explicitly and byte-pinned, and its influence is capped by reliability, similarity, freshness, source-family and total external bounds. There is no fine-tuning, no background fetch, and no invented or bundled benchmark scores.
• executor: auto is resolved by conservative quality and cost rules. Existing explicit worker/coordinator choices are kept; abstention retains the coordinator and records the reason.
• Learning is passive: local outcomes from normal coordinated work plus manual-profile outcomes. Routing never launches paid activity on its own.
• Safe controlled recovery admits a bounded number of eligible, low-risk uncertain tasks. With the default recovery_rate = 0.10, the first eligible case is a canary and later at most one assignment is allowed per ten distinct eligible uncertain cases. Only one recovery ticket may be pending or running at a time; an unused pending ticket expires after one hour, and a quality failure starts a one-hour family cooldown.
• The pending-plan expiry is not a worker runtime timeout. A running assignment is inspected and dispositioned through the normal coordination flow instead.
• Routing decisions are persisted per project with decisions, outbox, idempotence, schema versioning and private project state.
• Extra experiments require an explicit reservation. The default experiment budget is 0, the ledger is an internal accounting control and not a provider hard cap, and no paid benchmark runs automatically.
• Evaluation is chronological: each prediction is scored before that case's outcome is learned. Export streams privately and replaces files atomically, and abandoned work is reconciled through cancellation.
• The sandbox boundary, independent access and credentials, and the current runtime/coordinator hooks are unchanged.

See the routing guide for the full policy and command reference.

Configuration

Switch an existing project to Auto delegation (an existing numeric profile is only changed when you set it deliberately):

deepseek-team config set --project --delegation-level auto

Inspect routing state and effective configuration:

deepseek-team routing status --path /path/to/repository --json
deepseek-team routing config --path /path/to/repository --json

Keeping full-access is a user-owned choice, set explicitly and never granted automatically:

deepseek-team config set --project --access full-access

Compatibility

• Saved numeric profiles are not overwritten; existing settings, credentials, and coordinator model/auth configuration are preserved by a normal upgrade.
• Workers continue to run in owned development copies inside the required Linux sandbox; the primary coordinator runtime is unchanged.
• A fresh Auto project has effective read-only access, and routing cannot widen access or take over coordinator-owned work.

Verification

• The local suite ran 472 tests: OK, with 3 skips because Claude CLI was unavailable.
• Python 3.11, 3.12 and 3.13, runtime/sandbox, and upgrade CI are configured gates; this note does not claim they are already green remotely.
• The existing main-push workflow builds and publishes the GitHub release after its own verification step.

DeepSeek Team 0.6.0

DeepSeek Team 0.6.0

Highlights

• DeepSeek Team workers remain fixed on deepseek-flash; there is still no Flash/Pro model router.
• Added a persisted effort policy: auto | low | medium | high.
• effort=auto is now the default. In this mode, the frontier Codex/Claude coordinator chooses low, medium, or high for each DeepSeek assignment.
• Added project/global forced effort settings with the same precedence model as other policy fields: one-job CLI override > project > global > default.
• A direct worker that reaches the runner without a concrete frontier selection uses medium only as an execution fallback.
• Restored coordinator-native Codex/Claude subagents as a supported capability when a substantial planned deliverable includes a concrete delegation_reason.
• Native subagents complement rather than replace DeepSeek worker assignments required by the 50/75 delegation profiles.
• Protected coordinator responsibilities remain coordinator-owned.
• DeepSeek workers remain leaf workers: nested agent/delegation surfaces stay disabled.
• Selected DeepSeek effort and native-subagent rationale are retained in coordination state for continuity after compaction.

Configuration

Automatic effort selection is the default:

deepseek-team config set --project --effort auto

Force a project-level effort:

deepseek-team config set --project --effort high

Or a user-wide default:

deepseek-team config set --global --effort high

A one-job override remains available through deepseek-team worker --effort low|medium|high.

Compatibility

• Existing 0.5.0 projects without an effort field resolve to effort=auto.
• Existing project settings, credentials, coordinator auth/model configuration, managed instruction files, hooks, and sandbox boundaries are preserved by a standard upgrade.
• Delegation levels remain 25/50/75 and access remains independently configurable as auto|read-only|full-access.
• The legacy exact-file writer remains available.

Verification

The 0.6.0 line is gated by:

• Python 3.11, 3.12, and 3.13 unit/build/install checks;
• Ubuntu Bubblewrap/AppArmor smoke verification;
• real Codex/Claude permission and runtime verification using offline provider fixtures;
• an explicit 0.5.0 → 0.6.0 installer-upgrade check that verifies old project settings resolve to effort=auto without rewriting the existing settings file.

DeepSeek Team 0.5.0

DeepSeek Team 0.5.0

Highlights

• Added a persistent coordination ledger for sessions, tasks, deliverables, assignments, workspaces, results, checks, constraints and result dispositions.
• Added supported Codex lifecycle-hook integration for new sessions and post-compaction restoration.
• At 75/full-access, coordinator source mutation is now gated until a compliant distribution is registered; one token worker plus unreasoned local implementation/tests/fixtures/docs is detected as insufficient application of the profile.
• Added scope revision gates so newly discovered substantial work must be added to the distribution before coordinator mutation.
• Pending worker-owned scope cannot be duplicated by the coordinator before the worker result is reviewed.
• Worker runs automatically record assignment start/completion, workspace id, worker-only file delta, declared checks and result summary.
• Added explicit result dispositions so useful reviews survive continuation/compaction and cannot silently disappear from the final accounting.
• Added sandbox-local dependency/readiness probes before provider credential access and post-worker verification commands inside the same sparse Bubblewrap boundary.
• Added explicit selective import of required uncommitted source into an owned workspace; imported files remain coordinator-prepared and are not attributed to the worker.
• Added structured/evidenced retention constraints. Free-form reasons such as "quality ownership" or "release work" are not accepted as technical blockers.
• Added stable user-level Codex hook installation during normal install/update, active only in projects explicitly attached with deepseek-team init.
• Updated verification to current Codex CLI 0.155.1 and Claude Code 2.1.278, including a real new-session Codex coordinator test that observes a PreToolUse denial before duplicate source mutation reaches disk.

Compatibility

• Delegation levels remain 25/50/75 and access remains independently configurable as auto|read-only|full-access.
• Defaults remain 25 + auto → read-only.
• Explicit read-only never expands automatically.
• The legacy --write --allow-write exact-file mode remains available.
• Worker sandboxing remains mandatory for managed access.
• Existing credentials, primary coordinator model/auth, project settings and user text outside managed blocks are preserved.
• Existing 0.4 projects do not need to be re-initialized after a normal package upgrade; the stable user-level Codex hook discovers the existing managed project binding.

Coordinator integration boundaries

Codex has a technical process gate through supported lifecycle hooks after the user accepts/trusts the stable hook definition in Codex. DeepSeek Team does not bypass or infer that native trust decision.

Claude Code receives the same persistent ledger, managed worker accounting and generated instructions, but coordinator distribution enforcement remains instruction-driven in this release. No Claude PreToolUse technical block is claimed.

Hooks are a coordinator-process guardrail. They are not the worker security boundary; Bubblewrap/AppArmor and the managed workspace boundary remain responsible for worker isolation.

Metrics

0.5.0 does not report an "actual useful-work percentage". The 25/50/75 value is a target policy. Recorded facts include assignments, executors, workspace ids, file deltas, checks, results, dispositions and constraints; these are not converted into a fabricated productivity percentage.

Upgrade

From a normal source checkout:

git pull --ff-only
python3 install.py --with-sandbox   # Ubuntu recommended
# or: python3 install.py            # if the sandbox is already working

deepseek-team hooks status
deepseek-team doctor --runtime codex --offline

For Codex, review/trust the stable DeepSeek Team hook definition once using Codex /hooks. Subsequent package updates keep the same command definition and do not require re-running deepseek-team init for already attached projects.

See docs/VERIFICATION.md and docs/HARDENING.md for exact verification evidence and security limits.