TalentDeltaDM-Code-Agent — Auditable Code-Maintenance Agent
A local-first code-maintenance agent whose core is one ReAct loop — inspect, plan, patch, verify against tests — so every step stays in a record you can read.
A local-first code-maintenance agent whose entire core is one ReAct loop: inspect a repository, plan a change, patch it, then verify with tests, keeping an auditable record of every step. Provider-switchable over any OpenAI-compatible endpoint (DeepSeek, OpenAI, Claude or Gemini), with built-in and user-defined skill packs, MCP config examples and a 550-test suite.
Created by TalentDelta Team Member · via TalentDelta
Licence:
Scouted from github.com/hwfengcs/DM-Code-Agent at commit e4530be37e6f972d9735381e524cab4b5f732ddd (2026-08-27). Licence MIT. Upstream credit: hwfengcs. bench_reports excluded as regenerable; every other file byte-identical to the pin. Upstream code and licence stay upstream's.
Brought into the catalogue by TalentDelta Team Member (Scout).
contributed by TalentDelta Team Member (Scout)
No reviewer summary was written for this build.
First TalentDelta packaging at pinned commit e4530be37e6f (2026-08-27). Upstream paths deliberately NOT shipped: bench_reports — raw SWE-bench run logs (about 2.1 MB), regenerable and not needed to run the agent; the swebench_verified benchmark data ships as-is. Every other file is byte-identical to the pinned commit, a provenance record is appended to README.md, and the packaging secret scan found only redaction-test fixtures (fake sk-live values in tests/), no live credential.
Review: Decision: APPROVED — dm-code-maintenance-agent v1.0.0 ([internal reference removed]), decided 2026-09-30 19:41:54Z Uploader / notice recipient: [internal reference removed] — the file's only credit (position 0, role 'scouted') and the version's uploader, so the two agree; the address is internal (@talentdelta.ai), which the notice path skips by design, so no external party is mailed. WHAT WAS CHECKED, AND HOW - Bytes: fetched from our own store (scripts/review-lane/blob-fetch.cjs) by the stored object hash, not through the customer download door. sha256 32de35a416e152ae36cb269ebf2f4d6119599ef235450b02b049eba7324fd249 · 3,764,896 B — matches FileVersion.blobId→Blob.contentHash and the uploaded size exactly. - Provenance, verified by fetching the commit rather than trusting the pack: the tree was compared path-by-path and byte-by-byte (git blob sha1, mode + content) against a clean clone of hwfengcs/DM-Code-Agent sitting at the disclosed pin e4530be37e6f. Result: 276 files identical, 1 differing (README.md), 0 added, 28 not shipped. The pinned clone's HEAD is e4530be37e6f, matching the pin named in the change note and the README append; zero symlinks ship. - The one differing file is README.md, and the difference is purely additive: upstream's README text is a byte-prefix of the shipped file, whose extra bytes are the appended provenance record (upstream URL, licence, pin, runtime note, and the list of what was not shipped). - Removals are exactly the disclosed set: `bench_reports/` — benchmark evidence and figures (28 files, about 2.1 MB). Every not-shipped path falls inside those categories; zero undisclosed removal. - Licence: MIT — hwfengcs (2026). Licence text ships; the terms match the claim. - Taxonomy: 4 skill slugs, all storable leaves: software_engineering/code_quality/{code_review,code_refactoring}, software_engineering/code_debugging/root_cause_debugging, software_engineering/software_testing/unit_integration_testing; domain technology/software_engineering — each verified against the pinned snapshot apps/web/src/lib/taxonomy/oasf-1.1.0.json (tag v1.1.0, commit f510be0d4b58, 513 skills / 201 domains): node exists, category=false, no children. - Secrets: the lane's own packaging reader plus an independent secret-shaped scan over every text member. No live credential. Findings and adjudication: * Reader verdict BLOCKED: 3 blocking, all three adjudicated non-blocking. Two are `sk-` values in `tests/` — the redaction-test fixtures the change note discloses ('fake sk-live values in tests/'). The third, `dm_agent/cli/__init__.py:168`, is not a value at all: the line is `args.api_key = get_api_key_for_provider(args.provider)`, and the reader's key-assignment regex matched a function call. No live credential is present anywhere in the tree. * Test-suite count: the summary's '550-test suite' is supported by the pack's own badge at the pin (554 passed, 1 skipped); 521 test functions ship, which parametrisation explains. * 28 reader WARNs are the README naming `bench_reports/*` outputs that were deliberately not shipped — disclosed in the change note and the append as regenerable evidence. * No SKILL.md: the reader classifies this as a profile blueprint/template pack (identity/config files plus skill folders), which matches its shape. WHAT I COULD NOT CHECK - The live install-test (an unattended run through the download door on a test identity) was not run for this pack; the byte read proves packaging, not that the pack does its job on a stock host. - Delivery: the decision notice goes to an internal address, which the platform skips by design (skipped=internal_recipient) — there is no external recipient to confirm receipt. VERDICT: approved. The bytes are upstream's at the pin, the removals are the disclosed ones, the licence and taxonomy check out, and nothing private, client-owned or live is in it. (2026-09-30)