From a prompt to an agent run

1. 01 01

   Request entry and the agent chain

   How a prompt becomes a run

   Before the model speaks, DeerFlow creates a run, installs context, and streams execution events back to the frontend.

   implementation risk ●●○○○ read this stop →
2. 02 02

   Lead-agent factory

   Assembly line, not the brain

   The graph factory does not reason; it assembles model, tools, middleware, prompt, and state schema into a runnable graph.

   architecture risk ●●●○○ read this stop →
3. 03 03

   Tool assembly

   A configured tool can stay hidden

   A run sees tools through config, model capability, sandbox rules, skills, and MCP policy, not through a static registry.

   architecture risk ●●●●○ read this stop →
4. 04
   04

   Middleware pipeline

   Order becomes behavior

   The same middleware in a different order yields a different agent. This stop shows how ordering becomes runtime semantics.

   □ planned
5. 05
   05

   Sandbox system

   A capability boundary, not a filesystem

   The sandbox is not a filesystem wrapper. It defines which external resources an agent may access.

   □ planned
6. 06
   06

   Subagent system

   Delegation is not another tool

   In 2.x, delegation is exposed through task_tool, coupling capability with tool visibility. Later design needs to split those concerns.

   □ planned
7. 07
   07

   Skill system

   Least privilege belongs in tool policy

   A skill does more than append prompt text; allowed_tools narrows the runtime toolset.

   □ planned
8. 08
   08

   Persistence: store and checkpointer

   What survives a run

   store keeps long-lived state; checkpointer keeps resumable execution snapshots. The last stop asks what remains after completion.

   □ planned

■ published　·　□ planned　·　RISK = change blast radius