Nanobot Legion: public running deployment, authenticated collaboration
Reviewed September 6, 2026 UTC

Discovery
https://github.com/HKUDS/nanobot/discussions/3925
A Chinese owner-side show-and-tell post datedMay20 describes several cooperating agents in one HF Space. It links code and production/staging deployments. The post is by DreamShepherd2006; appearing in HKUDS's forum does not make the deployment an HKU research project. No affiliation or Chinese-lab attribution established.

Public code
https://github.com/DreamShepherd2006/nanobot-legion
Pinned1cc0d93b75b5bee1d7ccc95d9092801d6836316e,33 current tree files, filtered bare clone. Public README describes a deployment layer atop nanobot/cloud-agent-gateway, plus HF and ModelScope destinations. Source implementation and hosting are more concrete than an unlinked architectural claim.

Deployment observation
https://huggingface.co/api/spaces/DreamShepherd2006/nanobot-multi-agent-nightly
Public metadata returned200: private=false, disabled=false, sdk=docker, runtime.stage=RUNNING, Space SHA c64454d885e1e426c210ab1ed40e2228829abbb1.
https://dreamshepherd2006-nanobot-multi-agent-nightly.hf.space/
Root GET returned200 and a Hugging Face sign-in page. RUNNING identifies a hosted container state, not how many agents are alive or whether they are cooperating. No sign-in, websocket connection, relay request, task submission or protected workspace access attempted. Space source SHA differs from the deployment-overlay GitHub SHA; no byte-level deployment/source join performed.

Static checks
Read deploy/huggingface/squad_bridge.py, push_tasks.py and scripts/resurrect_neo.sh. No code executed.
Bridge resolves a peer from a roster, connects to a local websocket and attaches correlation_id to messages. It writes failed-delivery entries to /data/squad_dlq.jsonl. No such runtime log is published in this inspected tree.
The _attempt_delivery function can return success=True with accumulated text when total or idle timeout is reached. Therefore its delivery-success signal does not necessarily mean a task completed or a full response finished. This is a source-level semantic limit, not a failure observed on the deployed service.
push_tasks.py accepts a tasks-list payload and posts it to a token-protected route. It is a progress-reporting mechanism, not itself an independent result verifier. Actual route-side validation was not audited. A posted Done status would need an output/event join before being treated as completed work.
The resurrection script uses local process/log files. Presence of recovery code does not prove unattended recovery occurred.

Evidence level and next steps
A separately operated, Chinese-described multi-agent deployment is publicly identifiable, and the container is currently reported running. Public artifacts still do not establish a specific multi-agent run, model provenance, or escaped activity. Owner-published correlation-ID logs with final outputs would be the useful next evidence. Follow public upstream PR3869 (DeepSeek message handling) and PR3908 (peer-discovery events) for concrete runtime bug reports. Do not interpret use of a DeepSeek label as lab ownership.

Preservation
279-private contains pinned overlay repository, head/tree inventory, three selected source copies, public HF metadata, sign-in HTML and SHA256SUMS. Metadata whitelist mirrored under pastebins/data/dreamshepherd2006-nanobot-multi-agent-nightly.hf.space/. This host is reachable here; more infrastructure would not supply account authorization.