@ran-sh/dsh-crew 0.5.6 → 1.0.0

package/official-web-bridge/lib/client.js

@@ -38,6 +38,7 @@ const SETTINGS_SECTION_IDS = Object.freeze([
 	"adaptive",
 	"runtime",
 	"multimodal",
+	"harnessProviders",
 	"providers",
 	"jobs"
 ]);
@@ -178,7 +179,16 @@ function componentState(status, keys, { aligned = false } = {}) {
 	if (evidence.some((value) => typeof value !== "boolean")) return READINESS_STATES.UNKNOWN;
 	return evidence.every(Boolean) && (!aligned || status.components.target_alignment === true) ? READINESS_STATES.READY : READINESS_STATES.DEGRADED;
 }
-function runtimeState(runtime) {
+function runtimeState(runtime, readinessSnapshot) {
+	if (readinessSnapshot && typeof readinessSnapshot === "object") {
+		const identity = readinessSnapshot.runtime;
+		if (!(identity?.execution_plane === "hub-3210" && identity.profile === "dsh-crew" && Number(identity.listen_port) === 3210 && typeof identity.runtime_id === "string" && identity.runtime_id.trim())) return READINESS_STATES.UNAVAILABLE;
+		const row = Array.isArray(readinessSnapshot.readiness_matrix?.rows) ? readinessSnapshot.readiness_matrix.rows.find((entry) => entry?.id === "hub_compatibility") : void 0;
+		if (row?.status === "PASS") return READINESS_STATES.READY;
+		if (row?.status === "FAIL") return READINESS_STATES.UNAVAILABLE;
+		if (row?.status === "NOT_RUN" || row?.status === "SKIP") return READINESS_STATES.DEGRADED;
+		return READINESS_STATES.UNKNOWN;
+	}
 	if (runtime === void 0) return READINESS_STATES.UNKNOWN;
 	if (runtime === null) return READINESS_STATES.UNAVAILABLE;
 	return runtime?.ok === true && runtime.service === "dsh-crew-hub" ? READINESS_STATES.READY : READINESS_STATES.DEGRADED;
@@ -189,7 +199,7 @@ function bridgeState(surface) {
 	return READINESS_STATES.UNKNOWN;
 }
 /** Project only structured, non-secret installer/runtime evidence. */
-function projectHostReadiness({ installStatus, runtime, surface } = {}) {
+function projectHostReadiness({ installStatus, runtime, surface, readinessSnapshot } = {}) {
 	const codex = installStatus?.codex;
 	const claude = installStatus?.claude;
 	const zcode = installStatus?.zcode;
@@ -229,7 +239,7 @@ function projectHostReadiness({ installStatus, runtime, surface } = {}) {
 		},
 		{
 			id: "crew_harness",
-			state: runtimeState(runtime),
+			state: runtimeState(runtime, readinessSnapshot),
 			detail: runtime?.runtime_version ?? null
 		},
 		{
@@ -375,7 +385,8 @@ const COPY = {
 			adaptive: "自适应路由",
 			runtime: "运行 / 生效边界",
 			multimodal: "视觉与生图",
-			providers: "自定义 Provider",
+			harnessProviders: "Harness Providers",
+			providers: "多模态适配器",
 			jobs: "任务状态"
 		},
 		openHarness: "打开 3210 Crew Harness →",
@@ -432,7 +443,7 @@ const COPY = {
 			"follow-dsh": "跟随 Harness · 使用各档独立的模型优先级",
 			"deepseek-official": "DeepSeek Official · 使用旧版固定模型路由"
 		},
-		workerProviderHint: "仅作用于 Hub 模式；Standalone 始终用 deepseek-official + DEEPSEEK_API_KEY。",
+		workerProviderHint: "仅作用于 Hub 模式；Standalone 仅保留为旧版迁移元数据，不是生产执行路径。",
 		workerModels: "Worker 模型",
 		refreshHarnessModels: "刷新 Harness 模型",
 		refreshingModels: "刷新中…",
@@ -444,6 +455,8 @@ const COPY = {
 		notAdvertised: "当前未列出",
 		noPriority: "未配置优先项",
 		modelPoolSummary: (p, m) => `Providers: ${p} · Models: ${m}`,
+		healthUnprobed: "UNPROBED",
+		checkedAgo: (s) => `${s} 秒前检查`,
 		partialCatalog: "部分 Provider 读取失败",
 		catalogFailed: "无法读取 Harness 模型目录",
 		removePriority: "移除",
@@ -491,6 +504,31 @@ const COPY = {
 		visionProvider: "视觉 provider",
 		visionModel: "视觉模型",
 		imagegenProvider: "生图 provider",
+		harnessProviders: "Harness Providers",
+		harnessProviderHint: "3210 Crew Harness 的真实 Provider 注册与生命周期；不是视觉 / 生图适配器。",
+		providerState: (state) => `状态：${state}`,
+		providerModels: (count) => `${count} 个模型`,
+		providerJobs: (count) => `${count} 个运行任务`,
+		providerDeletePlan: "生成删除计划",
+		providerDelete: "确认删除",
+		providerPlanReady: "计划已生成；再次确认后才会修改 3210 配置。",
+		providerRollback: "回滚",
+		providerRollbackConfirm: "按已保存事务恢复这个 Harness Provider 及原有路由？",
+		providerRollbackUnavailable: "没有可验证的回滚事务",
+		providerReplacement: "替换 Harness 默认 Provider（输入 Provider id）",
+		providerDeleteConfirm: "确认按计划删除这个 Harness Provider？会清理路由引用并重启 3210。",
+		providerDeleteBlocked: "当前 Provider 不能删除（内置、在用、已删除或缺少可用替换）。",
+		providerLifecycleError: "Provider 生命周期操作失败",
+		providerNoInventory: "暂时无法读取 3210 Provider inventory。",
+		credentialReferences: "Credential 引用",
+		credentialReferenceHint: "仅显示引用名、归属和孤儿状态；不会读取或删除密钥。",
+		credentialOrphan: "孤儿 · 可单独申请清理",
+		credentialInUse: (count) => `使用中 · ${count} 个 Provider`,
+		credentialPurgePlan: "申请清理",
+		credentialPurgeConfirm: "这是不可恢复的 Crew-owned 凭据清理，确认继续？",
+		credentialPurging: "清理中…",
+		credentialPurgeUnavailable: "凭据清理不可用",
+		credentialPurgeUnverified: "已执行清理，但验证失败；引用仍保留用于恢复检查",
 		customProviders: "自定义 Provider",
 		addProvider: "＋ 添加 Provider",
 		noCustomProviders: "暂无。添加后会出现在上方的视觉 / 生图 provider 选择里。",
@@ -544,6 +582,23 @@ const COPY = {
 		roleStateHint: "auto：orchestrator 可自动派发；manual：仅显式点名；disabled：禁用。未显式设置时由协作模式推导。",
 		autoReview: "自动复审",
 		autoReviewHint: "worker 成功后自动运行一次 reviewer（独立模型策略，只读）",
+		modelOrdering: "候选排序",
+		orderingDesc: {
+			manual: "手动顺序",
+			"health-aware": "健康感知"
+		},
+		orderingHint: "手动 priority 始终保持顺序；健康感知仅重排未显式锁定的自动候选。",
+		healthGate: "健康门",
+		healthGateDesc: {
+			"hard-failures": "跳过明确不可调用",
+			off: "关闭健康门"
+		},
+		reviewGate: "Reviewer 验收门",
+		reviewGateDesc: {
+			required: "required · 未批准则失败",
+			optional: "optional · 记录但不阻断",
+			off: "off · 不自动复审"
+		},
 		isolation: "工作区隔离",
 		isolationHint: "worktree 为默认；非 Git 仓库时需显式 shared，否则任务以 NOT_GIT_REPOSITORY 失败。",
 		isolationDesc: {
@@ -570,9 +625,8 @@ const COPY = {
 			d: "接入自己的 API 或本地命令；保存后会出现在上面的视觉 / 生图 provider 选择里。"
 		},
 		modeDesc: {
-			auto: "auto · 优先 hub",
-			hub: "hub · 必须 hub",
-			standalone: "standalone · 独立进程"
+			auto: "auto · 优先 3210",
+			hub: "hub · 必须 3210"
 		},
 		save: "保存",
 		saved: "已保存",
@@ -654,7 +708,8 @@ const COPY = {
 			adaptive: "Adaptive routing",
 			runtime: "Runtime / activation boundaries",
 			multimodal: "Vision & image generation",
-			providers: "Custom providers",
+			harnessProviders: "Harness Providers",
+			providers: "Multimodal adapters",
 			jobs: "Task status"
 		},
 		openHarness: "Open 3210 Crew Harness →",
@@ -711,7 +766,7 @@ const COPY = {
 			"follow-dsh": "Follow Harness · use each tier's ordered model priority",
 			"deepseek-official": "DeepSeek Official · use legacy fixed model routing"
 		},
-		workerProviderHint: "Applies to Hub workers only; Standalone always uses deepseek-official + DEEPSEEK_API_KEY.",
+		workerProviderHint: "Applies to Hub workers only; Standalone is legacy migration metadata only and is not a production execution path.",
 		workerModels: "Worker Models",
 		refreshHarnessModels: "Refresh Harness Models",
 		refreshingModels: "Refreshing…",
@@ -723,6 +778,8 @@ const COPY = {
 		notAdvertised: "Currently not advertised",
 		noPriority: "No priority models configured",
 		modelPoolSummary: (p, m) => `Providers: ${p} · Models: ${m}`,
+		healthUnprobed: "UNPROBED",
+		checkedAgo: (s) => `checked ${s}s ago`,
 		partialCatalog: "Some providers failed to load",
 		catalogFailed: "Unable to read Harness model catalog",
 		removePriority: "Remove",
@@ -770,6 +827,31 @@ const COPY = {
 		visionProvider: "Vision provider",
 		visionModel: "Vision model",
 		imagegenProvider: "Image-gen provider",
+		harnessProviders: "Harness Providers",
+		harnessProviderHint: "Live Provider registration and lifecycle in the 3210 Crew Harness; separate from vision / image-gen adapters.",
+		providerState: (state) => `State: ${state}`,
+		providerModels: (count) => `${count} models`,
+		providerJobs: (count) => `${count} running jobs`,
+		providerDeletePlan: "Plan deletion",
+		providerDelete: "Confirm delete",
+		providerPlanReady: "Plan ready; a second confirmation is required before changing 3210 config.",
+		providerRollback: "Rollback",
+		providerRollbackConfirm: "Restore this Harness Provider and its previous routing from the saved transaction?",
+		providerRollbackUnavailable: "No verified rollback transaction is available",
+		providerReplacement: "Replacement Harness Default provider id",
+		providerDeleteConfirm: "Delete this Harness Provider per the plan? Routing refs will be scrubbed and 3210 restarted.",
+		providerDeleteBlocked: "This Provider cannot be deleted (built-in, in use, already absent, or missing a valid replacement).",
+		providerLifecycleError: "Provider lifecycle operation failed",
+		providerNoInventory: "3210 Provider inventory is temporarily unavailable.",
+		credentialReferences: "Credential references",
+		credentialReferenceHint: "Names, ownership, and orphan status only; values are never read or deleted.",
+		credentialOrphan: "orphan · separate purge approval required",
+		credentialInUse: (count) => `in use · ${count} provider(s)`,
+		credentialPurgePlan: "Purge…",
+		credentialPurgeConfirm: "This irreversibly removes a Crew-owned credential. Continue?",
+		credentialPurging: "Purging…",
+		credentialPurgeUnavailable: "Credential purge unavailable",
+		credentialPurgeUnverified: "Purge ran but verification failed; the reference remains visible for recovery",
 		customProviders: "Custom providers",
 		addProvider: "＋ Add provider",
 		noCustomProviders: "None yet. Added providers appear in the vision / image-gen selects above.",
@@ -823,6 +905,23 @@ const COPY = {
 		roleStateHint: "auto = the orchestrator may dispatch automatically; manual = only when explicitly named; disabled = off. When unset, derived from the collaboration mode.",
 		autoReview: "Automatic review",
 		autoReviewHint: "Run one reviewer pass (independent model policy, read-only) after a successful worker run",
+		modelOrdering: "Candidate ordering",
+		orderingDesc: {
+			manual: "Manual order",
+			"health-aware": "Health-aware"
+		},
+		orderingHint: "Explicit priority always keeps its order; health-aware mode only reorders automatic, unlocked candidates.",
+		healthGate: "Health gate",
+		healthGateDesc: {
+			"hard-failures": "Skip known hard failures",
+			off: "Health gate off"
+		},
+		reviewGate: "Reviewer acceptance gate",
+		reviewGateDesc: {
+			required: "required · fail unless approved",
+			optional: "optional · record without blocking",
+			off: "off · no automatic review"
+		},
 		isolation: "Workspace isolation",
 		isolationHint: "worktree is the default; non-git workspaces require explicit shared, otherwise jobs fail with NOT_GIT_REPOSITORY.",
 		isolationDesc: {
@@ -849,9 +948,8 @@ const COPY = {
 			d: "Bring your own API or local command; saved providers appear in the vision / image-gen selects above."
 		},
 		modeDesc: {
-			auto: "auto · prefer hub",
-			hub: "hub · require hub",
-			standalone: "standalone"
+			auto: "auto · prefer 3210",
+			hub: "hub · require 3210"
 		},
 		save: "Save",
 		saved: "Saved",
@@ -1339,12 +1437,20 @@ function WorkersPanel({ ctx }) {
 	const [modelCatalog, setModelCatalog] = (0, react.useState)(null);
 	const [modelCatalogError, setModelCatalogError] = (0, react.useState)("");
 	const [modelCatalogBusy, setModelCatalogBusy] = (0, react.useState)(false);
+	const [providerInventory, setProviderInventory] = (0, react.useState)(null);
+	const [providerHealth, setProviderHealth] = (0, react.useState)([]);
+	const [credentialRefs, setCredentialRefs] = (0, react.useState)([]);
+	const [credentialUnverified, setCredentialUnverified] = (0, react.useState)([]);
+	const [credentialLifecycleBusy, setCredentialLifecycleBusy] = (0, react.useState)(null);
+	const [providerInventoryError, setProviderInventoryError] = (0, react.useState)("");
+	const [providerLifecycleBusy, setProviderLifecycleBusy] = (0, react.useState)(null);
 	const [modelPickerTier, setModelPickerTier] = (0, react.useState)(null);
 	const [modelQuery, setModelQuery] = (0, react.useState)("");
 	const [testResult, setTestResult] = (0, react.useState)(null);
 	const [expandedSections, setExpandedSections] = (0, react.useState)(() => readSectionState(sectionStorage()));
 	const [surface, setSurface] = (0, react.useState)("detecting");
 	const [runtimeInfo, setRuntimeInfo] = (0, react.useState)(void 0);
+	const [readinessSnapshot, setReadinessSnapshot] = (0, react.useState)(void 0);
 	const toggleSection = (sectionId) => {
 		setExpandedSections((current) => ({
 			...current,
@@ -1362,6 +1468,9 @@ function WorkersPanel({ ctx }) {
 			"pro"
 		]));
 	}, [modelCatalogError]);
+	(0, react.useEffect)(() => {
+		if (providerInventoryError) setExpandedSections((current) => openSections(current, ["harnessProviders"]));
+	}, [providerInventoryError]);
 	(0, react.useEffect)(() => {
 		if (testResult && !testResult.busy && testResult.ok === false) setExpandedSections((current) => openSections(current, ["providers"]));
 	}, [testResult]);
@@ -1422,11 +1531,15 @@ function WorkersPanel({ ctx }) {
 	}, [detectSurface]);
 	const refreshAll = (0, react.useCallback)(async () => {
 		try {
-			const [j, s, c, pr] = await Promise.all([
+			const [j, s, c, pr, pi, ph, cr, ext] = await Promise.all([
 				get("/jobs"),
 				get("/install/status"),
 				get("/config"),
-				get("/presets")
+				get("/presets"),
+				get("/providers").catch(() => null),
+				get("/provider-health").catch(() => null),
+				get("/credential-references").catch(() => null),
+				get("/extension").catch(() => null)
 			]);
 			if (j.ok) setJobs(j.jobs ?? []);
 			if (s.ok) setStatus(s.status);
@@ -1438,14 +1551,22 @@ function WorkersPanel({ ctx }) {
 				value: x.id,
 				label: x.name ?? x.id
 			}))]);
+			if (pi?.ok) setProviderInventory(pi);
+			if (ph?.ok) setProviderHealth(ph.health ?? []);
+			if (cr?.ok) {
+				setCredentialRefs(cr.records ?? []);
+				setCredentialUnverified(cr.unverified_purges ?? []);
+			}
+			if (ext?.ok) setReadinessSnapshot(ext.extension?.readiness_snapshot ?? void 0);
 		} catch {}
 	}, [get]);
 	(0, react.useEffect)(() => {
 		if (surface !== CREW_UI_SURFACES.OFFICIAL) return void 0;
 		refreshAll();
 		const timer = setInterval(() => {
-			get("/jobs").then((j) => {
+			Promise.all([get("/jobs"), get("/provider-health").catch(() => null)]).then(([j, health]) => {
 				if (j.ok) setJobs(j.jobs ?? []);
+				if (health?.ok) setProviderHealth(health.health ?? []);
 			}).catch(() => {});
 		}, 3e3);
 		return () => clearInterval(timer);
@@ -1467,9 +1588,68 @@ function WorkersPanel({ ctx }) {
 			setModelCatalogBusy(false);
 		}
 	}, [get, copy]);
+	const refreshProviderInventory = (0, react.useCallback)(async () => {
+		setProviderInventoryError("");
+		try {
+			const [result, health, refs] = await Promise.all([
+				get("/providers"),
+				get("/provider-health").catch(() => null),
+				get("/credential-references").catch(() => null)
+			]);
+			if (!result.ok) throw new Error(result.error ?? copy.providerNoInventory);
+			setProviderInventory(result);
+			if (health?.ok) setProviderHealth(health.health ?? []);
+			if (refs?.ok) {
+				setCredentialRefs(refs.records ?? []);
+				setCredentialUnverified(refs.unverified_purges ?? []);
+			}
+		} catch (error) {
+			setProviderInventoryError(error?.message ?? copy.providerNoInventory);
+		}
+	}, [get, copy]);
+	const purgeCredentialRef = (0, react.useCallback)(async (ref) => {
+		if (ref?.ownership !== "crew-owned" || ref?.orphan !== true || ref?.purge_capability !== "eligible") return;
+		const referenceId = String(ref.reference_id ?? "");
+		if (!referenceId || !window.confirm(copy.credentialPurgeConfirm)) return;
+		setCredentialLifecycleBusy(referenceId);
+		setNotice(copy.working);
+		try {
+			const encoded = encodeURIComponent(referenceId);
+			const planned = await post(`/credential-references/${encoded}/purge-plan`, {});
+			if (!planned.ok || !planned.plan) throw new Error(planned.code ?? copy.credentialPurgeUnavailable);
+			if (!window.confirm(`${copy.credentialPurgeConfirm}\n\n${referenceId}`)) return;
+			const result = await readJson(await fetch(withLang(`/credential-references/${encoded}`), {
+				method: "DELETE",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({
+					plan_id: planned.plan.plan_id,
+					expected_revision: planned.plan.expected_revision,
+					confirm: true,
+					lang: locale === "zh" ? "zh" : "en"
+				})
+			}), `/credential-references/${encoded}`);
+			if (!result.ok || result.state !== "VERIFIED") throw new Error(result.code ?? copy.credentialPurgeUnavailable);
+			setNotice(copy.saved);
+			await refreshProviderInventory();
+		} catch (error) {
+			setNotice(String(error?.message ?? error));
+		} finally {
+			setCredentialLifecycleBusy(null);
+		}
+	}, [
+		copy,
+		locale,
+		post,
+		readJson,
+		refreshProviderInventory,
+		withLang
+	]);
 	(0, react.useEffect)(() => {
 		if (surface === CREW_UI_SURFACES.OFFICIAL) refreshHarnessModels();
 	}, [surface, refreshHarnessModels]);
+	(0, react.useEffect)(() => {
+		if (surface === CREW_UI_SURFACES.OFFICIAL) refreshProviderInventory();
+	}, [surface, refreshProviderInventory]);
 	const act = (0, react.useCallback)(async (target, confirmName) => {
 		if (confirmName && !window.confirm(copy.confirmRestore(confirmName))) return;
 		setBusy(true);
@@ -1524,6 +1704,36 @@ function WorkersPanel({ ctx }) {
 		...c,
 		[key]: value
 	}));
+	const rolePolicyField = (role, patch) => {
+		const effectivePatch = role === "worker" && (patch.ordering === "manual" || patch.ordering === "health-aware") ? {
+			...patch,
+			adaptive: {
+				...normalizeAdaptive(config?.worker?.model_policy?.adaptive),
+				enabled: patch.ordering === "health-aware"
+			}
+		} : patch;
+		setConfig((current) => ({
+			...current,
+			[role]: {
+				...current?.[role],
+				model_policy: {
+					...current?.[role]?.model_policy,
+					...effectivePatch
+				}
+			}
+		}));
+		applyPatch({ [role]: { model_policy: effectivePatch } });
+	};
+	const reviewField = (patch) => {
+		setConfig((current) => ({
+			...current,
+			review: {
+				...current?.review,
+				...patch
+			}
+		}));
+		applyPatch({ review: patch });
+	};
 	const customProviders = config?.custom_providers ?? [];
 	const extraModels = config?.extra_models ?? {};
 	const RESERVED_IDS = [
@@ -1748,6 +1958,96 @@ function WorkersPanel({ ctx }) {
 		}));
 		applyPatch(patch);
 	};
+	const deleteHarnessProvider = async (record) => {
+		if (!record || record.ownership === "harness" || record.desired_state === "absent" || Number(record.references?.active_jobs ?? 0) > 0) {
+			setNotice(copy.providerDeleteBlocked);
+			return;
+		}
+		let replacementDefault;
+		if (record.references?.harness_default === true) {
+			const candidate = (providerInventory?.records ?? []).find((item) => item.id !== record.id && item.desired_state !== "absent" && item.ownership !== "harness" && (item.models?.length ?? 0) > 0)?.id ?? "";
+			const entered = window.prompt(copy.providerReplacement, candidate);
+			if (!entered?.trim()) return;
+			replacementDefault = entered.trim();
+		}
+		setProviderLifecycleBusy(record.id);
+		setNotice(copy.working);
+		try {
+			const encoded = encodeURIComponent(record.id);
+			const planned = await post(`/providers/${encoded}/delete-plan`, replacementDefault ? { replacement_default: replacementDefault } : {});
+			if (!planned.ok || !planned.plan) throw new Error(planned.code ?? copy.providerLifecycleError);
+			if (!window.confirm(`${copy.providerPlanReady}\n\n${copy.providerDeleteConfirm}\n${(planned.plan.will_remove ?? []).join("\n")}`)) return;
+			const path = `/providers/${encoded}`;
+			const result = await readJson(await fetch(withLang(path), {
+				method: "DELETE",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({
+					plan_id: planned.plan.plan_id,
+					expected_revision: planned.plan.expected_revision,
+					confirm: true,
+					lang: locale === "zh" ? "zh" : "en"
+				})
+			}), path);
+			if (!result.ok) throw new Error(result.code ?? result.error ?? copy.providerLifecycleError);
+			if (result.restart_required === true && result.result?.state === "RESTART_PENDING") {
+				const restartPath = "http://127.0.0.1:3080/_dsh/dsh-crew/supervisor/restart";
+				const restarted = await readJson(await fetch(restartPath, {
+					method: "POST",
+					headers: { "content-type": "application/json" },
+					body: JSON.stringify({ confirm: true })
+				}), restartPath);
+				if (!restarted.ok) throw new Error(restarted.code ?? restarted.error ?? copy.providerLifecycleError);
+				const verified = await post(`/providers/${encoded}/verify-delete`, {
+					transaction_id: planned.plan.plan_id,
+					confirm: true
+				});
+				if (!verified.ok || verified.state !== "VERIFIED") throw new Error(verified.code ?? verified.error ?? copy.providerLifecycleError);
+			}
+			setNotice(copy.saved);
+			await refreshProviderInventory();
+		} catch (error) {
+			setNotice(String(error?.message ?? error));
+		} finally {
+			setProviderLifecycleBusy(null);
+		}
+	};
+	const rollbackHarnessProvider = async (record, transactionId) => {
+		if (!record || !transactionId || record.desired_state !== "absent") {
+			setNotice(copy.providerRollbackUnavailable);
+			return;
+		}
+		if (!window.confirm(copy.providerRollbackConfirm)) return;
+		setProviderLifecycleBusy(`rollback:${record.id}`);
+		setNotice(copy.working);
+		try {
+			const encoded = encodeURIComponent(record.id);
+			const result = await post(`/providers/${encoded}/rollback`, {
+				transaction_id: transactionId,
+				confirm: true
+			});
+			if (!result.ok) throw new Error(result.code ?? result.error ?? copy.providerLifecycleError);
+			if (result.restart_required === true && result.state === "ROLLBACK_PENDING") {
+				const restartPath = "http://127.0.0.1:3080/_dsh/dsh-crew/supervisor/restart";
+				const restarted = await readJson(await fetch(restartPath, {
+					method: "POST",
+					headers: { "content-type": "application/json" },
+					body: JSON.stringify({ confirm: true })
+				}), restartPath);
+				if (!restarted.ok) throw new Error(restarted.code ?? restarted.error ?? copy.providerLifecycleError);
+				const verified = await post(`/providers/${encoded}/verify-rollback`, {
+					transaction_id: transactionId,
+					confirm: true
+				});
+				if (!verified.ok || verified.state !== "ROLLED_BACK") throw new Error(verified.code ?? verified.error ?? copy.providerLifecycleError);
+			} else if (result.state !== "ROLLED_BACK") throw new Error(result.code ?? copy.providerLifecycleError);
+			setNotice(copy.saved);
+			await refreshProviderInventory();
+		} catch (error) {
+			setNotice(String(error?.message ?? error));
+		} finally {
+			setProviderLifecycleBusy(null);
+		}
+	};
 	/** Card: title + one-line description header, then its fields. */
 	const block = (text, fields, gridded = true) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 		style: S.block,
@@ -1818,28 +2118,37 @@ function WorkersPanel({ ctx }) {
 	const adaptive = normalizeAdaptive(config?.worker?.model_policy?.adaptive);
 	const setAdaptiveLocal = (candidate) => {
 		const next = normalizeAdaptive(candidate);
+		const ordering = next.enabled ? "health-aware" : "manual";
 		setConfig((current) => ({
 			...current,
 			worker: {
 				...current.worker,
 				model_policy: {
 					...current.worker?.model_policy,
-					adaptive: next
+					adaptive: next,
+					ordering
 				}
 			}
 		}));
-		return next;
+		return {
+			next,
+			ordering
+		};
 	};
 	const saveAdaptive = (candidate) => {
-		const next = setAdaptiveLocal(candidate);
-		applyPatch({ worker: { model_policy: { adaptive: next } } });
+		const { next, ordering } = setAdaptiveLocal(candidate);
+		applyPatch({ worker: { model_policy: {
+			adaptive: next,
+			ordering
+		} } });
 	};
 	const modelActivity = aggregateModelInvocations(jobs);
 	const currentSurfaceResponsibilities = surfaceResponsibilities(surface);
 	const hostReadiness = projectHostReadiness({
 		installStatus: status,
 		runtime: runtimeInfo,
-		surface
+		surface,
+		readinessSnapshot
 	});
 	if (!currentSurfaceResponsibilities.fullControlPlane) return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(MinimalCrewPanel, {
 		locale,
@@ -2131,6 +2440,9 @@ function WorkersPanel({ ctx }) {
 							model: provider?.models?.find((item) => item.id === ref.model)
 						};
 					};
+					const modelHealth = (ref) => providerHealth.find((entry) => entry.provider === ref.provider && entry.model === ref.model && entry.fresh === true) ?? null;
+					const healthLabel = (health) => health?.state ? String(health.state).toUpperCase().replace(/-/g, " ") : copy.healthUnprobed;
+					const healthAge = (health) => Number.isFinite(health?.observed_at) ? copy.checkedAgo(Math.max(0, Math.round((Date.now() - health.observed_at) / 1e3))) : "";
 					const filteredProviders = catalogProviders.map((provider) => ({
 						...provider,
 						models: (provider.models ?? []).filter((model) => {
@@ -2187,6 +2499,7 @@ function WorkersPanel({ ctx }) {
 									},
 									children: priority.map((ref, index) => {
 										const meta = modelMeta(ref);
+										const health = modelHealth(ref);
 										const warning = !meta.provider ? copy.providerUnavailable : !meta.model ? copy.notAdvertised : "";
 										return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 											style: {
@@ -2231,6 +2544,15 @@ function WorkersPanel({ ctx }) {
 																ref.model
 															]
 														}),
+														/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+															style: {
+																display: "block",
+																fontSize: 10.5,
+																color: health?.state === "callable" ? "#3fb950" : health ? "#c98735" : "inherit",
+																opacity: health ? .9 : .5
+															},
+															children: [healthLabel(health), healthAge(health) ? ` · ${healthAge(health)}` : ""]
+														}),
 														warning && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 															style: {
 																display: "block",
@@ -2536,7 +2858,7 @@ function WorkersPanel({ ctx }) {
 								block({
 									t: copy.autoReview,
 									d: copy.autoReviewHint
-								}, /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+								}, /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
 									style: {
 										...S.field,
 										flexDirection: "row",
@@ -2551,7 +2873,65 @@ function WorkersPanel({ ctx }) {
 										style: { fontSize: 12.5 },
 										children: copy.autoReview
 									})]
-								}), false),
+								}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+									style: S.field,
+									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										style: S.fieldLabel,
+										children: copy.reviewGate
+									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CustomSelect, {
+										value: config.review?.gate ?? "required",
+										onChange: (v) => reviewField({ gate: v }),
+										options: [
+											"required",
+											"optional",
+											"off"
+										].map((value) => ({
+											value,
+											label: copy.reviewGateDesc[value]
+										}))
+									})]
+								})] })),
+								block({
+									t: copy.modelOrdering,
+									d: copy.orderingHint
+								}, /* @__PURE__ */ (0, react_jsx_runtime.jsx)(react_jsx_runtime.Fragment, { children: ["worker", "review"].map((role) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+									style: { display: "contents" },
+									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+										style: S.field,
+										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+											style: S.fieldLabel,
+											children: [
+												role === "worker" ? copy.roleWorker : copy.roleReviewer,
+												" · ",
+												copy.modelOrdering
+											]
+										}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CustomSelect, {
+											value: config?.[role]?.model_policy?.ordering ?? "manual",
+											onChange: (v) => rolePolicyField(role, { ordering: v }),
+											options: ["manual", "health-aware"].map((value) => ({
+												value,
+												label: copy.orderingDesc[value]
+											}))
+										})]
+									}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+										style: S.field,
+										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+											style: S.fieldLabel,
+											children: [
+												role === "worker" ? copy.roleWorker : copy.roleReviewer,
+												" · ",
+												copy.healthGate
+											]
+										}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CustomSelect, {
+											value: config?.[role]?.model_policy?.health_gate ?? "hard-failures",
+											onChange: (v) => rolePolicyField(role, { health_gate: v }),
+											options: ["hard-failures", "off"].map((value) => ({
+												value,
+												label: copy.healthGateDesc[value]
+											}))
+										})]
+									})]
+								}, role)) })),
 								block({
 									t: copy.isolation,
 									d: copy.isolationHint
@@ -2948,11 +3328,7 @@ function WorkersPanel({ ctx }) {
 							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CustomSelect, {
 								value: config.mode,
 								onChange: (v) => field("mode", v),
-								options: [
-									"auto",
-									"hub",
-									"standalone"
-								].map((m) => ({
+								options: ["auto", "hub"].map((m) => ({
 									value: m,
 									label: copy.modeDesc[m]
 								}))
@@ -3190,6 +3566,167 @@ function WorkersPanel({ ctx }) {
 						})
 					] }))
 				}),
+				/* @__PURE__ */ (0, react_jsx_runtime.jsxs)(CollapsibleSection, {
+					sectionId: "harnessProviders",
+					title: copy.sectionNames.harnessProviders,
+					summary: sectionSummary(copy.providerCount(providerInventory?.records?.length ?? 0), providerInventoryError ? copy.providerLifecycleError : ""),
+					expanded: !!expandedSections.harnessProviders,
+					onToggle: () => toggleSection("harnessProviders"),
+					children: [
+						providerInventoryError && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							style: {
+								fontSize: 12,
+								color: "#c55"
+							},
+							children: providerInventoryError
+						}),
+						!providerInventoryError && (providerInventory?.records?.length ?? 0) === 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							style: {
+								fontSize: 12,
+								opacity: .55
+							},
+							children: copy.providerNoInventory
+						}),
+						(providerInventory?.records ?? []).map((record) => {
+							const blocked = record.ownership === "harness" || record.desired_state === "absent" || Number(record.references?.active_jobs ?? 0) > 0;
+							const lifecycle = record.desired_state === "absent" ? "absent" : record.lifecycle?.enabled === false ? "disabled" : record.lifecycle?.catalogued ? "catalogued" : "configured";
+							const rollbackTransaction = (providerInventory?.lifecycle_transactions ?? []).find((entry) => entry.provider_id === record.id && ["VERIFIED", "RESTART_PENDING"].includes(entry.state));
+							return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								style: {
+									display: "flex",
+									alignItems: "center",
+									gap: 8,
+									fontSize: 12.5,
+									flexWrap: "wrap"
+								},
+								children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										style: { fontWeight: 600 },
+										children: record.display_name || record.id
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										style: {
+											...S.chip(record.lifecycle?.enabled === true),
+											...S.mono
+										},
+										children: record.id
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										style: { opacity: .65 },
+										children: copy.providerState(lifecycle)
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										style: { opacity: .65 },
+										children: copy.providerModels(record.models?.length ?? 0)
+									}),
+									Number(record.references?.active_jobs ?? 0) > 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										style: { color: "#c98735" },
+										children: copy.providerJobs(record.references.active_jobs)
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { style: { flex: 1 } }),
+									record.ownership !== "harness" && record.desired_state !== "absent" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										style: {
+											...S.btn,
+											padding: "2px 8px"
+										},
+										disabled: blocked || providerLifecycleBusy !== null,
+										onClick: () => {
+											deleteHarnessProvider(record);
+										},
+										children: providerLifecycleBusy === record.id ? copy.working : copy.providerDeletePlan
+									}),
+									record.desired_state === "absent" && rollbackTransaction && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										style: {
+											...S.btn,
+											padding: "2px 8px"
+										},
+										disabled: providerLifecycleBusy !== null,
+										onClick: () => {
+											rollbackHarnessProvider(record, rollbackTransaction.transaction_id);
+										},
+										children: providerLifecycleBusy === `rollback:${record.id}` ? copy.working : copy.providerRollback
+									})
+								]
+							}, record.id);
+						}),
+						(credentialRefs.length > 0 || credentialUnverified.length > 0) && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							style: {
+								marginTop: 10,
+								borderTop: "1px solid rgba(128,128,128,0.16)",
+								paddingTop: 8
+							},
+							children: [
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+									style: {
+										fontWeight: 600,
+										fontSize: 12.5
+									},
+									children: copy.credentialReferences
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+									style: {
+										fontSize: 11,
+										opacity: .6,
+										margin: "3px 0 7px"
+									},
+									children: copy.credentialReferenceHint
+								}),
+								credentialUnverified.map((entry) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+									style: {
+										color: "#c55",
+										fontSize: 11.5
+									},
+									children: [
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											style: S.mono,
+											children: entry.reference_id
+										}),
+										" · ",
+										copy.credentialPurgeUnverified
+									]
+								}, `unverified:${entry.reference_id}`)),
+								credentialRefs.map((ref) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+									style: {
+										display: "flex",
+										alignItems: "center",
+										gap: 8,
+										fontSize: 11.5,
+										flexWrap: "wrap"
+									},
+									children: [
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											style: S.mono,
+											children: ref.reference_id
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											style: { opacity: .65 },
+											children: ref.ownership
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											style: { color: ref.orphan ? "#c98735" : void 0 },
+											children: ref.orphan ? copy.credentialOrphan : copy.credentialInUse(ref.consumer_count ?? 0)
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { style: { flex: 1 } }),
+										ref.ownership === "crew-owned" && ref.orphan === true && ref.purge_capability === "eligible" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+											type: "button",
+											style: {
+												...S.btn,
+												padding: "2px 8px"
+											},
+											disabled: credentialLifecycleBusy !== null,
+											onClick: () => {
+												purgeCredentialRef(ref);
+											},
+											children: credentialLifecycleBusy === ref.reference_id ? copy.credentialPurging : copy.credentialPurgePlan
+										})
+									]
+								}, ref.reference_id))
+							]
+						})
+					]
+				}),
 				/* @__PURE__ */ (0, react_jsx_runtime.jsx)(CollapsibleSection, {
 					sectionId: "providers",
 					title: copy.sectionNames.providers,