feat: DeepCode executor + Jev verification judge (with cargo-audit dep bumps)

crates/agent-runtime/src/backend.rs

@@ -250,6 +250,11 @@ impl GenericCliBackend {
             timeout,
         )
     }
+    pub fn deepcode(timeout: Duration) -> Self {
+        // Headless one-shot; --json keeps the output machine-readable. The prompt
+        // is appended as the final argv by GenericCliBackend::execute.
+        Self::from_env("deepcode", "DEEPCODE_CMD", "deepcode exec --json", timeout)
+    }
 }
 
 #[async_trait]

crates/agent-runtime/src/main.rs

@@ -117,6 +117,7 @@ fn backend_for(executor: &str, task_timeout: Duration) -> Arc<dyn CliAgentBacken
         "CODEX" => Arc::new(GenericCliBackend::codex(task_timeout)),
         "OPENCODE" => Arc::new(GenericCliBackend::opencode(task_timeout)),
         "CODEBUDDY" => Arc::new(GenericCliBackend::codebuddy(task_timeout)),
+        "DEEPCODE" => Arc::new(GenericCliBackend::deepcode(task_timeout)),
         _ => Arc::new(ClaudeBackend::new(task_timeout)),
     }
 }

crates/delivery/src/adapters/local.rs

@@ -36,9 +36,12 @@ impl LocalCommandAgentExecutor {
         match kind {
             ExecutorKind::ClaudeCode => &self.claude_code,
             ExecutorKind::Codex => &self.codex,
-            // The local path only configures two argvs; OpenCode/CodeBuddy deliberately
-            // fall back to the claude argv (real routing lives in crates/agent-runtime).
-            ExecutorKind::OpenCode | ExecutorKind::CodeBuddy => &self.claude_code,
+            // The local path only configures two argvs; OpenCode/CodeBuddy/DeepCode
+            // deliberately fall back to the claude argv (real routing lives in
+            // crates/agent-runtime).
+            ExecutorKind::OpenCode | ExecutorKind::CodeBuddy | ExecutorKind::DeepCode => {
+                &self.claude_code
+            }
         }
     }
 }

crates/delivery/src/adapters/queue.rs

@@ -22,7 +22,7 @@ use crate::ports::{
     RuntimeInfo, WorkQueue, WorkSpec,
 };
 
-const KNOWN_CAPS: [ExecutorKind; 4] = ExecutorKind::ALL;
+const KNOWN_CAPS: [ExecutorKind; 5] = ExecutorKind::ALL;
 
 #[derive(Default)]
 pub struct InMemoryWorkQueue {

crates/delivery/src/adapters/redis_queue.rs

@@ -25,7 +25,7 @@ const ACKMAP: &str = "fleet:ackmap";
 const RT_INDEX: &str = "fleet:rt:index";
 const SEP: char = '\u{1f}';
 
-fn known_caps() -> [ExecutorKind; 4] {
+fn known_caps() -> [ExecutorKind; 5] {
     ExecutorKind::ALL
 }
 

crates/delivery/src/domain/delivery.rs

@@ -12,20 +12,22 @@ pub enum ExecutorKind {
     Codex,
     OpenCode,
     CodeBuddy,
+    DeepCode,
 }
 
 impl ExecutorKind {
     /// Single authoritative list of executor kinds; queue adapters and tests consume
     /// it, so a new variant only touches this file.
-    pub const ALL: [ExecutorKind; 4] =
-        [Self::ClaudeCode, Self::Codex, Self::OpenCode, Self::CodeBuddy];
+    pub const ALL: [ExecutorKind; 5] =
+        [Self::ClaudeCode, Self::Codex, Self::OpenCode, Self::CodeBuddy, Self::DeepCode];
 
     pub fn as_str(&self) -> &'static str {
         match self {
             Self::ClaudeCode => "CLAUDE_CODE",
             Self::Codex => "CODEX",
             Self::OpenCode => "OPENCODE",
             Self::CodeBuddy => "CODEBUDDY",
+            Self::DeepCode => "DEEPCODE",
         }
     }
 
@@ -35,6 +37,7 @@ impl ExecutorKind {
             "CODEX" => Some(Self::Codex),
             "OPENCODE" => Some(Self::OpenCode),
             "CODEBUDDY" => Some(Self::CodeBuddy),
+            "DEEPCODE" => Some(Self::DeepCode),
             _ => None,
         }
     }