dsh-harbor-evolution 0.4.0 → 0.5.0

package/README.md

@@ -2,7 +2,7 @@
 
 Installable DeepSeek Harness Plugin + Skill for running stable Harbor evaluation and controlled Agent evolution loops, with a native DSH Web dashboard.
 
-The package gives DSH four deterministic Harbor tools, dedicated Tool cards, a Harbor conversation tab, an installation Doctor, and the model- and user-invocable `evolve-agent-with-harbor` Skill. The Skill clarifies the evaluation contract, initializes missing structures, establishes a baseline, diagnoses evidence, limits each iteration to one controlled Candidate change, runs regression evaluation, and produces a Promotion Gate recommendation.
+The package gives DSH eight strict Harbor tools, dedicated Tool cards, a paginated Evaluation Workbench, an installation Doctor, and the model- and user-invocable `evolve-agent-with-harbor` Skill. The Skill clarifies and initializes the Evaluation Stack, validates Dataset identity, runs Architecture Doctor and Context v2 preview, establishes a baseline, diagnoses evidence, limits each iteration to one controlled Candidate change, and applies the Promotion Gate.
 
 ## Install
 
@@ -14,8 +14,8 @@ npx --yes dsh-harbor-evolution@latest setup --project-root "$PWD"
 
 The setup command installs both required runtimes:
 
-- `harbor-dsh-evolution==0.4.0` in a managed Python environment.
-- `dsh-harbor-evolution@0.4.0` in the selected DSH profile.
+- `harbor-dsh-evolution==0.5.0` in a managed Python environment.
+- `dsh-harbor-evolution@0.5.0` in the selected DSH profile.
 
 It then stores the absolute Harbor executable paths and `projectRoot` in the profile's `harbor-evolution` block and verifies the integration. Existing unrelated profile entries are preserved, and rerunning setup updates the same block.
 
@@ -35,19 +35,23 @@ Inspect this workspace and help me clarify and initialize a stable Harbor self-e
 The Plugin registers:
 
 - `harbor_candidate_snapshot`
+- `harbor_evolution_init`
+- `harbor_evolution_doctor`
+- `harbor_dataset_validate`
+- `harbor_context_preview`
 - `harbor_eval_run`
 - `harbor_eval_result`
 - `harbor_candidate_compare`
 
 In the `web` profile, the same package also registers:
 
-- a `Harbor` conversation tab for recent Jobs, metrics, Candidate identity, and evaluation-context digests;
-- four compact result cards for the Harbor Tool calls;
-- a `Harbor Evolution` Settings section that checks the configured project, Jobs directory, and CLI paths.
+- a lightweight Harbor Job overview and on-demand Evaluation Workbench for Contract, Stack, Dataset, Doctor, paginated Trials, evidence, optimization, promotion, and audit artifacts;
+- compact result cards for all Harbor Tool calls;
+- a `Harbor Evolution` Settings section that checks the configured project, Evaluation Stack, Jobs directory, and CLI paths.
 
 The Web UI is intentionally read-only. Starting an evaluation or deciding promotion remains an explicit Agent + Skill workflow, so a page refresh can never launch an expensive Job.
 
-The shortest direct evaluation call needs `candidatePath` and `datasetPath`. Prefer the Skill for a new project because it will not run or compare Jobs until the material evaluation contract is resolved.
+A direct evaluation requires `candidatePath`, `datasetPath`, `stackPath`, and explicit `mode`; `promotion-eligible` additionally requires `policyPath`. Prefer the Skill because it will not run or compare Jobs until the material identities and evaluation contract are resolved.
 
 ## What setup writes
 

package/index.js

@@ -72,14 +72,72 @@ export function apply(ctx, config) {
     },
   }, args => service.snapshot(args)))
 
+  ctx.tools.register(jsonTool({
+    name: 'harbor_evolution_init',
+    description: 'Initialize a strict, non-overwriting Evaluation Stack project after the Skill has clarified identities, primary metric, judge, and promotion threshold.',
+    parameters: {
+      datasetPath: { type: 'string', required: true },
+      stackId: { type: 'string', required: true },
+      stackVersion: { type: 'string', required: true },
+      datasetId: { type: 'string', required: true },
+      datasetVersion: { type: 'string', required: true },
+      contractId: { type: 'string', required: true },
+      contractVersion: { type: 'string', required: true },
+      primaryMetric: { type: 'string', required: true },
+      primaryDirection: { type: 'string', required: true },
+      judgeProvider: { type: 'string', required: true },
+      judgeModel: { type: 'string', required: true },
+      judgeVersion: { type: 'string', required: true },
+      policyId: { type: 'string', required: true },
+      policyVersion: { type: 'string', required: true },
+      minImprovement: { type: 'number', required: true },
+    },
+  }, args => service.initialize(args)))
+
+  ctx.tools.register(jsonTool({
+    name: 'harbor_evolution_doctor',
+    description: 'Validate the Evaluation Stack architecture, Dataset manifest, Candidate, and optional Promotion Policy before an expensive Harbor Job.',
+    parameters: {
+      candidatePath: { type: 'string', required: true },
+      datasetPath: { type: 'string', required: true },
+      stackPath: { type: 'string', required: true },
+      policyPath: { type: 'string' },
+      mode: { type: 'string', required: true },
+    },
+  }, args => service.doctor(args)))
+
+  ctx.tools.register(jsonTool({
+    name: 'harbor_dataset_validate',
+    description: 'Validate dataset-manifest.json, task uniqueness, instructions, paths, sensitive metadata, and the immutable source digest.',
+    parameters: {
+      datasetPath: { type: 'string', required: true },
+    },
+  }, args => service.validateDataset(args)))
+
+  ctx.tools.register(jsonTool({
+    name: 'harbor_context_preview',
+    description: 'Preview Evaluation Context v2 and find comparable baselines before launching a Job.',
+    parameters: {
+      candidatePath: { type: 'string', required: true },
+      candidateId: { type: 'string' },
+      version: { type: 'string' },
+      datasetPath: { type: 'string', required: true },
+      stackPath: { type: 'string', required: true },
+      mode: { type: 'string', required: true },
+    },
+  }, args => service.previewContext(args)))
+
   ctx.tools.register(jsonTool({
     name: 'harbor_eval_run',
-    description: 'Snapshot and run one DeepSeek Harness Candidate against a Harbor dataset, then return the completed evaluation summary.',
+    description: 'Run a strict diagnostic or promotion-eligible Harbor Job bound to Candidate, Dataset Manifest, Evaluation Stack, and Context v2 identities.',
     parameters: {
       candidatePath: { type: 'string', required: true },
       candidateId: { type: 'string' },
       version: { type: 'string' },
       datasetPath: { type: 'string', required: true },
+      stackPath: { type: 'string', required: true },
+      mode: { type: 'string', required: true },
+      policyPath: { type: 'string' },
       jobName: { type: 'string' },
     },
   }, args => service.run(args)))

package/lib/candidate.js

@@ -6,6 +6,16 @@ export const MANIFEST_NAME = 'candidate-manifest.json'
 const DIGEST_PREFIX = Buffer.from('harbor-dsh-candidate-v1\0')
 const EXCLUDED_DIRS = new Set(['.git', 'node_modules', '__pycache__'])
 const EXCLUDED_FILES = new Set([MANIFEST_NAME, '.DS_Store'])
+const LOCKFILES = ['package-lock.json', 'pnpm-lock.yaml', 'yarn.lock', 'bun.lock', 'bun.lockb']
+const CREDENTIAL_FILES = new Set([
+  'credentials.json',
+  'service-account.json',
+  'secrets.json',
+  'secrets.yaml',
+  'secrets.yml',
+  'id_rsa',
+  'id_ed25519',
+])
 
 async function walk(root, current = root) {
   const entries = await readdir(current, { withFileTypes: true })
@@ -46,8 +56,7 @@ export async function computeCandidate(candidateDir) {
   return { digest: `sha256:${digest.digest('hex')}`, files }
 }
 
-export async function snapshotCandidate(candidateDir, options = {}) {
-  const root = path.resolve(candidateDir)
+async function validateCandidateContract(root) {
   for (const required of ['cordis.yml', 'package.json']) {
     try {
       if (!(await stat(path.join(root, required))).isFile()) throw new Error()
@@ -55,6 +64,24 @@ export async function snapshotCandidate(candidateDir, options = {}) {
       throw new Error(`Candidate is missing required file: ${required}`)
     }
   }
+  const files = await walk(root)
+  if (!files.some(item => LOCKFILES.includes(item.relative))) {
+    throw new Error(`Candidate requires a JavaScript lockfile: ${LOCKFILES.join(', ')}`)
+  }
+  const credentialPaths = files
+    .map(item => item.relative)
+    .filter((relative) => {
+      const name = path.basename(relative).toLowerCase()
+      return name.startsWith('.env') || CREDENTIAL_FILES.has(name)
+    })
+  if (credentialPaths.length > 0) {
+    throw new Error(`Candidate contains credential-bearing files: ${credentialPaths.join(', ')}; inject credentials at runtime instead`)
+  }
+}
+
+export async function snapshotCandidate(candidateDir, options = {}) {
+  const root = path.resolve(candidateDir)
+  await validateCandidateContract(root)
   let packageJson
   try {
     packageJson = JSON.parse(await readFile(path.join(root, 'package.json'), 'utf8'))