feat(core): add durable context federation and multi-agent collaborat…

.github/workflows/deepagent-code.yml

@@ -26,7 +26,7 @@ jobs:
       - uses: ./.github/actions/setup-bun
 
       - name: Run deepagent-code
-        uses: lessweb/deepagent-code/github@2c14fc5586fe0b88e5c04732d2e846769cc35671 # latest
+        uses: deepagent-ltd/deepagent-code/github@github-v1.4.4
         env:
           DEEPAGENT_CODE_API_KEY: ${{ secrets.DEEPAGENT_CODE_API_KEY }}
           DEEPAGENT_CODE_PERMISSION: '{"bash": "deny"}'

.github/workflows/docs-update.yml

@@ -43,7 +43,7 @@ jobs:
 
       - name: Run deepagent-code
         if: steps.commits.outputs.has_commits == 'true'
-        uses: lessweb/deepagent-code/github@2c14fc5586fe0b88e5c04732d2e846769cc35671 # latest
+        uses: deepagent-ltd/deepagent-code/github@github-v1.4.4
         env:
           DEEPAGENT_CODE_API_KEY: ${{ secrets.DEEPAGENT_CODE_API_KEY }}
         with:

.gitignore

@@ -36,6 +36,8 @@ UPCOMING_CHANGELOG.md
 logs/
 *.bun-build
 tsconfig.tsbuildinfo
+/packages/*/.artifacts/
+/script/live-llm.config.local.json
 
 # Internal design docs — kept local-only, not tracked in git (see S2-v3.4.1 DOC-2).
 # Erased from history via git-filter-repo; the public distilled version lives in design/.

CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## Desktop 1.4.4 / DeepAgent Core V4.0.5 - Durable context and collaboration
+
+- Persist AgentExecution claims, leases, generations, resource locks, token debits, terminal metadata, and handoffs for event-driven multi-Agent work.
+- Complete the production `task` and `pr_finalize` path with canonical worktrees, SHA-bound reviews, serialized `--no-ff` merges, Senior Reviewer closure, resume, takeover, and cleanup fencing.
+- Connect federated context, Location-owned code/document indexes, Context Epoch selection, and durable Session continuation without bridging through an in-memory orchestration loop.
+- Unify private filesystem storage for Core, CLI, Desktop, WSL, databases, logs, caches, and temporary files under `~/.deepagent/code/` while keeping native secret values in the OS credential store.
+- Expand the DeepSeek real-LLM matrix to cover prompt-cache retention, sandboxed Python verifiers, parallel workers, complete Git/PR collaboration, V4 event runtime, strength inheritance, resume/takeover, and autonomous EVAL scoring.
+- Release Desktop 1.4.4 with application version displays, updater metadata, Desktop release tags, and GitHub Action references aligned to the published versions.
+
 ## Desktop 1.4.3 / DeepAgent Core V4.0.4_r8 - Production reliability release
 
 - Persist the complete TaskRun lifecycle, including exact-retry admission, generation, owner/lease fencing, phase changes, terminal compare-and-set, result references, and a leased notification outbox.

README.md

@@ -14,7 +14,7 @@
   <a href="https://github.com/deepagent-ltd/deepagent-code-enterprise">Enterprise</a>
 </p>
 
-<p align="center"><sub>Desktop 1.4.3 · DeepAgent Core V4.0.4_r8</sub></p>
+<p align="center"><sub>Desktop 1.4.4 · DeepAgent Core V4.0.5</sub></p>
 
 ---
 
@@ -83,26 +83,28 @@ Composable domain packs add language, framework, platform, hardware, business, a
 
 ### Specialist agents and Expert Panel
 
-DeepAgent can partition independent work across bounded, isolated workers. Write-capable subagents receive dedicated worktrees, return compact summaries and artifact references, and leave their full transcripts available for inspection.
+DeepAgent can partition independent work across bounded, isolated workers. Delegated runs persist their identity, generation, owner, lease, phase, terminal state, result, and parent delivery, so an exact retry resumes the same work instead of silently starting another worker. Write-capable subagents receive dedicated worktrees, return compact summaries and artifact references, and leave their full transcripts available for inspection.
+
+Automatic write collaboration follows a durable Git/PR path. Workers commit only their scoped changes; one Reviewer session checks each exact worker SHA, the coordinator performs serial `--no-ff` merges on the Session branch, and one Senior Reviewer examines the merged batch. Resume, timeout, cancellation, takeover, review feedback, and cleanup are generation-fenced so a stale worker cannot settle or overwrite newer work.
 
 For high-risk decisions, convene an **Expert Panel**. Correctness, security, performance, architecture, and reproducibility lenses review the same frozen question, debate anonymously for up to three rounds, and feed a deterministic arbiter that preserves minority opinions and fails closed to human review.
 
 ### Team and agent messaging
 
 Project IM brings people and agents into the same thread. Mention an agent to start a scoped run with project context, stream its progress, inspect its artifacts, and keep the answer attached to the conversation that requested it.
 
-## DeepAgent Core V4.0.4_r8
+## DeepAgent Core V4.0.5
 
-Desktop 1.4.3 ships the eighth reliability revision of the V4.0.4 contract. This release hardens the boundaries where long-running and delegated work previously risked duplicate execution, ambiguous completion, or renderer-wide failure:
+Desktop 1.4.4 ships the durable context and collaboration release. It connects Session V2, federated context, delegated execution, Git/PR review, and human supervision without moving durable authority back into process-local agent loops:
 
-- **Durable subagent execution:** TaskRun admission, generation, ownership, leases, settlement, and parent delivery are persisted. Exact retries reconcile to the original run, terminal state uses transactional compare-and-set, and a leased outbox makes completion delivery recoverable without re-running provider work.
-- **Two-stage structured finalization:** research and structured output are separate phases. The finalizer is a bounded single turn with thinking disabled when supported, only the `StructuredOutput` tool visible, no historical task or compaction payload, and no empty-success path.
-- **Fail-closed model and tool boundaries:** provider capability decisions no longer silently relax required tool choice, invalid tool input is rejected before execution, and provider, schema, permission, interruption, timeout, and doom-loop failures keep distinct recoverable terminal reasons.
-- **Semantic no-progress protection:** shell activity uses semantic fingerprints, while the no-progress budget compares bounded results, workspace state, and plan progress so cosmetic command changes cannot evade loop detection.
-- **Contained supervision UI:** subagent controls use valid sibling interactions, display real terminal state, and run behind a local ErrorBoundary with retry, close, persisted-mode validation, same-build quarantine, and recovery after build changes.
-- **Release-grade verification:** the affected Core, runtime, app, and desktop paths are covered by exact-retry, failure-injection, production Chromium, Electron cold-start, and source-map smoke tests.
+- **Durable context and execution:** prompt admission, Context Epoch selection, AgentExecution claims, leases, generations, resource locks, token debits, terminal metadata, and handoffs are persisted before scheduling provider work.
+- **Complete multi-agent Git/PR collaboration:** write workers use canonical isolated worktrees, commit only scoped changes, and enqueue SHA-bound PRs. A normal Reviewer handles each item, merges are serialized with `--no-ff`, and a Senior Reviewer closes the batch.
+- **Generation-fenced supervision:** resume, cancellation, timeout, takeover, review feedback, and cleanup reuse durable Session identity while preventing stale workers from settling newer work.
+- **One private filesystem root:** Core, CLI, Desktop, WSL, databases, logs, caches, and temporary files stay under `~/.deepagent/code/`; production writes cannot be redirected by ordinary environment variables.
+- **Cache-safe real-model verification:** stable prompt prefixes are separated from volatile tails, finalizer and compaction baselines are isolated, and the DeepSeek matrix covers sandboxed tools, cache retention, parallel workers, PR closure, recovery, strength inheritance, and EVAL scoring.
+- **Release-grade verification:** deterministic state-machine tests, cross-process ownership tests, real-model suites, packaged sidecar checks, Desktop UI coverage, and source-map smoke tests exercise the production entry points.
 
-V4.0.4_r8 retains the durable documents, event delivery, governed learning, isolated worktrees, and secure credential boundaries introduced across the earlier V4.0.4 revisions.
+V4.0.5 retains the durable documents, event delivery, governed learning, secure credential boundaries, and fail-closed provider/tool contracts established in the V4.0 line.
 
 ## Installation
 
@@ -183,6 +185,8 @@ Official-provider keys added via the app/CLI are stored separately in
 [providers guide](https://deepagent-code.ai/docs/providers/) for the full
 reference (base URL overrides, headers, per-model config, gateways).
 
+All DeepAgent Code private filesystem data lives under `~/.deepagent/code/`, including configuration, credential references, databases, Desktop state, logs, caches, and temporary files. Native secret values remain in the operating system's credential store. Tests use explicit isolated roots and cannot redirect production storage through ordinary environment variables.
+
 ## Quick Example
 
 Start the agent and give it a task:
@@ -284,6 +288,7 @@ bun run --cwd packages/deepagent-code dev import-history --from codex --dry-run
 
 - [Providers & Models](https://deepagent-code.ai/docs/providers/)
 - [Architecture & Design](design/README.md)
+- [Real-LLM Testing Guide](design/real-llm-testing.md)
 - [Security Policy](SECURITY.md)
 - [Privacy Policy](PRIVACY.md)
 - [Contributing](CONTRIBUTING.md)

README.zh.md

@@ -14,7 +14,7 @@
   <a href="https://github.com/deepagent-ltd/deepagent-code-enterprise">Enterprise 版本</a>
 </p>
 
-<p align="center"><sub>桌面版 1.4.3 · DeepAgent Core V4.0.4_r8</sub></p>
+<p align="center"><sub>桌面版 1.4.4 · DeepAgent Core V4.0.5</sub></p>
 
 ---
 
@@ -83,26 +83,28 @@ Session V2 运行器在持久 Context Epoch 下从明确的 Context Source 装
 
 ### 专业子智能体与 Expert Panel
 
-DeepAgent 可以把独立工作拆分给数量有界、相互隔离的 Worker。具备写权限的子智能体获得独立 worktree，只向父会话返回紧凑摘要和工件引用，完整执行记录仍可随时查看。
+DeepAgent 可以把独立工作拆分给数量有界、相互隔离的 Worker。委派运行会持久化自己的身份、generation、owner、lease、阶段、终态、结果和父会话投递，因此 exact retry 会恢复同一项工作，而不是静默启动另一个 Worker。具备写权限的子智能体获得独立 worktree，只向父会话返回紧凑摘要和工件引用，完整执行记录仍可随时查看。
+
+自动写协作走一条持久 Git/PR 路径。Worker 只提交其作用域内的改动；同一个普通 Reviewer Session 按精确 Worker SHA 逐项审阅，协调器在 Session 分支上串行执行 `--no-ff` merge，再由同一个 Senior Reviewer Session 审阅合并后的完整批次。恢复、超时、取消、接管、审阅反馈和清理都受 generation fence 保护，过期 Worker 无法结算或覆盖较新的工作。
 
 高风险决策可以召集 **Expert Panel**。正确性、安全、性能、架构与可复现性等专家视角审阅同一个冻结问题，进行最多三轮匿名辩论，再由确定性仲裁器生成裁定。少数派意见会被保留，无法安全达成一致时会失败关闭并交给人类。
 
 ### 团队与智能体消息
 
 项目 IM 把团队成员和智能体放进同一条讨论。@ 某个智能体即可启动有明确作用域的运行，使用项目上下文、流式展示进度、关联执行工件，并把答案留在发起任务的对话里。
 
-## DeepAgent Core V4.0.4_r8
+## DeepAgent Core V4.0.5
 
-桌面版 1.4.3 搭载 V4.0.4 合同的第八次可靠性修订。本次发布重点加固长任务和委派任务的关键边界，避免重复执行、模糊终态或局部界面故障演变为整页崩溃：
+桌面版 1.4.4 搭载持久上下文与协作版本。它把 Session V2、联邦上下文、委派执行、Git/PR 审阅和人类监督连接起来，同时不把持久权威退回到进程内 Agent loop：
 
-- **持久化子智能体执行：** TaskRun 的准入、generation、owner、lease、结算与父会话投递均持久化。exact retry 会归并到原始运行，终态通过事务 CAS 结算，租约式 outbox 可在不重复执行 provider work 的前提下恢复完成通知。
-- **两阶段结构化终结：** 研究和结构化输出分为独立阶段。finalizer 是次数有界的单轮执行；在 provider 支持时关闭 thinking，只暴露 `StructuredOutput`，不混入历史 task 或 compaction 内容，也不存在空结果成功路径。
-- **失败关闭的模型与工具边界：** provider capability 决策不再静默放宽 required tool choice；无效工具输入在执行前被拒绝；provider、schema、permission、interruption、timeout 与 doom-loop 保留不同且可恢复的终态原因。
-- **语义级无进展保护：** shell 使用语义 fingerprint；无进展预算同时比较有界结果、工作区状态与计划进度，不能再靠改写命令描述绕过循环检测。
-- **故障隔离的监督面板：** 子智能体控件使用合法的 sibling interaction，展示真实终态，并由局部 ErrorBoundary、重试/关闭、持久 mode 校验、同 build quarantine 与 build 变化后的恢复机制保护。
-- **发布级验证：** 受影响的 Core、运行时、App 与 Desktop 路径已覆盖 exact retry、故障注入、production Chromium、Electron 冷启动和 source-map smoke。
+- **持久上下文与执行：** prompt 准入、Context Epoch 选择、AgentExecution claim、lease、generation、资源锁、token debit、终态 metadata 和 handoff 都在调度 provider work 前持久化。
+- **完整多 Agent Git/PR 协作：** 写 Worker 使用 canonical 隔离 worktree，只提交作用域内改动，并进入绑定精确 SHA 的 PR queue。普通 Reviewer 逐项审阅，协调器串行执行 `--no-ff` merge，再由 Senior Reviewer 完成批次复审。
+- **受 generation fence 保护的监督：** 恢复、取消、超时、接管、审阅反馈和清理复用持久 Session 身份，同时阻止过期 Worker 结算较新的工作。
+- **唯一私有文件数据根：** Core、CLI、Desktop、WSL、数据库、日志、缓存和临时文件统一位于 `~/.deepagent/code/`；普通环境变量不能重定向生产写入。
+- **缓存安全的真实模型验证：** 稳定 prompt prefix 与易变 tail 分离，finalizer 和 compaction 使用隔离基线；DeepSeek 矩阵覆盖 sandbox 工具、缓存保持、并行 Worker、PR 闭环、恢复、强度继承与 EVAL 评分。
+- **发布级验证：** 确定性状态机测试、跨进程 ownership 测试、真实模型 suite、packaged sidecar 检查、Desktop UI 覆盖和 source-map smoke 共同验证生产入口。
 
-V4.0.4_r8 同时保留此前 V4.0.4 各修订建立的持久文档、可靠事件投递、知识治理、worktree 隔离与安全凭据边界。
+V4.0.5 保留 V4.0 系列建立的持久文档、可靠事件投递、知识治理、安全凭据边界以及失败关闭的 provider/tool 合同。
 
 ## 安装
 
@@ -178,6 +180,8 @@ deepagent auth list
 完整参考（Base URL 覆盖、请求头、逐模型配置、网关）见
 [供应商文档](https://deepagent-code.ai/docs/providers/)。
 
+DeepAgent Code 的所有私有文件数据都位于 `~/.deepagent/code/`，包括配置、凭据引用、数据库、桌面状态、日志、缓存和临时文件；原生 secret 值仍由操作系统凭据存储保管。测试使用显式隔离的数据根，普通环境变量不能重定向生产存储。
+
 ## 快速示例
 
 启动智能体并交给它一个任务：
@@ -279,6 +283,7 @@ bun run --cwd packages/deepagent-code dev import-history --from codex --dry-run
 
 - [供应商与模型](https://deepagent-code.ai/docs/providers/)
 - [架构与设计](design/README.md)
+- [真实 LLM 测试指南](design/real-llm-testing.md)
 - [安全策略](SECURITY.md)
 - [隐私策略](PRIVACY.md)
 - [贡献指南](CONTRIBUTING.md)