dsh-harbor-evolution 0.4.0 → 0.5.0

package/lib/dashboard.js

@@ -1,15 +1,42 @@
-import { access, constants, readdir, readFile, stat } from 'node:fs/promises'
+import { access, constants, lstat, readdir, readFile, stat } from 'node:fs/promises'
 import path from 'node:path'
 
 import { resolveWithin } from './evolution.js'
 
 const SUMMARY_NAME = 'evaluation-summary.json'
-const PROMOTION_NAME = 'promotion-report.json'
 const MAX_JOBS = 50
+const MAX_JSON_BYTES = 2 * 1024 * 1024
+const MAX_TRIAL_LIMIT = 100
+const jsonCache = new Map()
+const SENSITIVE_KEY = /authorization|cookie|token|api[_-]?key|secret|password|request[_-]?headers/i
 
-async function readJson(file) {
+function safeSegment(value, label) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/.test(String(value ?? ''))) throw new Error(`${label} is invalid`)
+  return String(value)
+}
+
+function redact(value, depth = 0) {
+  if (depth > 10) return '[TRUNCATED depth]'
+  if (Array.isArray(value)) return value.slice(0, 10_000).map(item => redact(item, depth + 1))
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, SENSITIVE_KEY.test(key) ? '[REDACTED]' : redact(item, depth + 1)]))
+  }
+  if (typeof value === 'string' && value.length > 8_000) return `${value.slice(0, 8_000)}\n[TRUNCATED ${value.length - 8_000} chars]`
+  return value
+}
+
+async function readJson(file, { maxBytes = MAX_JSON_BYTES } = {}) {
   try {
-    return JSON.parse(await readFile(file, 'utf8'))
+    const details = await lstat(file)
+    if (details.isSymbolicLink()) return { __readError: `${path.basename(file)} may not be a symlink` }
+    if (!details.isFile()) return { __readError: `${path.basename(file)} is not a file` }
+    if (details.size > maxBytes) return { __readError: `${path.basename(file)} exceeds ${maxBytes} bytes` }
+    const cached = jsonCache.get(file)
+    const identity = `${details.mtimeMs}:${details.size}`
+    if (cached?.identity === identity) return cached.value
+    const value = redact(JSON.parse(await readFile(file, 'utf8')))
+    jsonCache.set(file, { identity, value })
+    return value
   } catch (error) {
     if (error.code === 'ENOENT') return undefined
     if (error instanceof SyntaxError) return { __readError: `invalid JSON in ${path.basename(file)}` }
@@ -19,57 +46,76 @@ async function readJson(file) {
 
 async function directoryCheck(directory, { optional = false } = {}) {
   try {
-    const details = await stat(directory)
-    if (!details.isDirectory()) return { status: 'error', detail: 'not a directory' }
+    const details = await lstat(directory)
+    if (details.isSymbolicLink() || !details.isDirectory()) return { status: 'error', detail: 'not a safe directory' }
     await access(directory, constants.R_OK)
     return { status: 'ok', detail: 'readable' }
   } catch (error) {
     if (optional && error.code === 'ENOENT') return { status: 'warning', detail: 'not created yet' }
-    return { status: 'error', detail: error.code === 'ENOENT' ? 'not found' : error.message }
+    return { status: 'error', detail: error.code === 'ENOENT' ? 'not found' : 'not readable' }
+  }
+}
+
+async function fileCheck(file) {
+  try {
+    const details = await lstat(file)
+    return details.isFile() && !details.isSymbolicLink()
+      ? { status: 'ok', detail: path.basename(file) }
+      : { status: 'error', detail: 'not a safe file' }
+  } catch (error) {
+    return { status: 'error', detail: error.code === 'ENOENT' ? 'not found' : 'not readable' }
   }
 }
 
 async function executableCheck(command) {
   if (!command) return { status: 'error', detail: 'not configured' }
-  if (!path.isAbsolute(command)) return { status: 'ok', detail: `${command} (resolved from PATH)` }
+  if (!path.isAbsolute(command)) return { status: 'ok', detail: `${command} (PATH)` }
   try {
     await access(command, constants.X_OK)
-    return { status: 'ok', detail: command }
+    return { status: 'ok', detail: path.basename(command) }
   } catch (error) {
-    return { status: 'error', detail: error.code === 'ENOENT' ? `${command} not found` : error.message }
+    return { status: 'error', detail: error.code === 'ENOENT' ? 'not found' : 'not executable' }
   }
 }
 
 function jobStatus(summary) {
   if (!summary) return 'pending'
   if (summary.__readError) return 'failed'
-  const trials = Number(summary.n_trials ?? 0)
-  const exceptions = Number(summary.n_exceptions ?? 0)
-  if (trials > 0 && exceptions >= trials) return 'failed'
-  if (exceptions > 0) return 'partial'
+  if (Number(summary.n_trials ?? 0) > 0 && Number(summary.n_exceptions ?? 0) >= Number(summary.n_trials ?? 0)) return 'failed'
+  if (Number(summary.n_exceptions ?? 0) > 0) return 'partial'
   return 'completed'
 }
 
+function primaryMetric(summary, contract) {
+  const name = contract?.primary_metric
+  if (name && typeof summary?.metrics?.[name] === 'number') return { name, value: summary.metrics[name] }
+  const entry = Object.entries(summary?.metrics ?? {}).find(([, value]) => typeof value === 'number')
+  return entry ? { name: entry[0], value: entry[1] } : undefined
+}
+
 async function readJob(jobsDir, entry, details) {
   const directory = path.join(jobsDir, entry.name)
-  const summary = await readJson(path.join(directory, SUMMARY_NAME))
-  const promotion = await readJson(path.join(directory, PROMOTION_NAME))
+  const [summary, context, promotion, contract] = await Promise.all([
+    readJson(path.join(directory, SUMMARY_NAME)),
+    readJson(path.join(directory, 'evaluation-context.json')),
+    readJson(path.join(directory, 'promotion-report.json')),
+    readJson(path.join(directory, 'evaluation-contract.json')),
+  ])
+  const evaluationContext = summary?.evaluation_context ?? context
+  if (evaluationContext?.schema_version !== 2) return undefined
   return {
     name: entry.name,
-    path: directory,
     updatedAt: details.mtime.toISOString(),
     status: jobStatus(summary),
+    mode: summary?.mode,
     nTrials: Number(summary?.n_trials ?? 0),
     nExceptions: Number(summary?.n_exceptions ?? 0),
+    primaryMetric: primaryMetric(summary, contract),
     metrics: summary?.metrics ?? {},
-    candidate: summary?.candidate ?? undefined,
-    evaluationContext: summary?.evaluation_context ?? undefined,
-    promotion: promotion ? {
-      decision: promotion.decision,
-      reasons: Array.isArray(promotion.reasons) ? promotion.reasons : [],
-      baselineJob: promotion.baseline_job,
-      candidateJob: promotion.candidate_job,
-    } : undefined,
+    candidate: summary?.candidate,
+    evaluationContext,
+    artifactValidation: summary?.artifact_validation,
+    promotion: promotion ? { decision: promotion.decision, reasons: promotion.reasons ?? [], baselineJob: promotion.baseline_job } : undefined,
     readError: summary?.__readError,
   }
 }
@@ -82,62 +128,139 @@ async function listJobs(jobsDir) {
     if (error.code === 'ENOENT') return []
     throw error
   }
-  const recent = await Promise.all(entries
-    .filter(entry => entry.isDirectory())
-    .map(async entry => ({ entry, details: await stat(path.join(jobsDir, entry.name)) })))
+  const directories = entries.filter(entry => entry.isDirectory() && !entry.isSymbolicLink())
+  const recent = await Promise.all(directories.map(async entry => ({ entry, details: await stat(path.join(jobsDir, entry.name)) })))
   recent.sort((left, right) => right.details.mtimeMs - left.details.mtimeMs)
-  return Promise.all(recent
-    .slice(0, MAX_JOBS)
-    .map(({ entry, details }) => readJob(jobsDir, entry, details)))
+  const jobs = await Promise.all(recent.map(({ entry, details }) => readJob(jobsDir, entry, details)))
+  return jobs.filter(Boolean).slice(0, MAX_JOBS)
 }
 
-function latestMetric(jobs) {
-  const completed = jobs.find(job => job.status === 'completed' || job.status === 'partial')
-  if (!completed) return undefined
-  const entry = Object.entries(completed.metrics).find(([, value]) => typeof value === 'number')
-  return entry ? { name: entry[0], value: entry[1] } : undefined
+function jobsDirectory(config) {
+  return resolveWithin(path.resolve(config.projectRoot), config.jobsDir, 'jobsDir')
+}
+
+function jobDirectory(config, job) {
+  return path.join(jobsDirectory(config), safeSegment(job, 'job'))
 }
 
 export async function readDashboardSnapshot(config, metadata = {}) {
   const projectRoot = path.resolve(config.projectRoot)
-  const jobsDir = resolveWithin(projectRoot, config.jobsDir, 'jobsDir')
-  const [jobs, projectRootCheck, jobsDirCheck, harborCheck, harborDshCheck] = await Promise.all([
+  const jobsDir = jobsDirectory(config)
+  const [jobs, projectRootCheck, jobsDirCheck, harborCheck, harborDshCheck, stackCheck] = await Promise.all([
     listJobs(jobsDir),
     directoryCheck(projectRoot),
     directoryCheck(jobsDir, { optional: true }),
     executableCheck(config.harborBin),
     executableCheck(config.harborDshBin),
+    fileCheck(path.join(projectRoot, '.harbor', 'evaluation-stack.yml')),
   ])
-
-  const counts = jobs.reduce((result, job) => {
-    result[job.status] = (result[job.status] ?? 0) + 1
-    return result
-  }, {})
-
+  const counts = jobs.reduce((result, job) => ({ ...result, [job.status]: (result[job.status] ?? 0) + 1 }), {})
+  const latestMetric = jobs.find(job => job.primaryMetric)?.primaryMetric
   return {
-    schemaVersion: 1,
+    schemaVersion: 2,
     generatedAt: new Date().toISOString(),
     pluginVersion: metadata.pluginVersion ?? 'development',
-    config: {
-      projectRoot,
-      jobsDir,
-      dshVersion: config.dshVersion,
-      agentImportPath: config.agentImportPath,
-      pluginImportPath: config.pluginImportPath,
-    },
-    checks: {
-      projectRoot: projectRootCheck,
-      jobsDir: jobsDirCheck,
-      harbor: harborCheck,
-      harborDsh: harborDshCheck,
-    },
+    config: { jobsDir: config.jobsDir, dshVersion: config.dshVersion, agentImportPath: config.agentImportPath, pluginImportPath: config.pluginImportPath },
+    checks: { projectRoot: projectRootCheck, jobsDir: jobsDirCheck, harbor: harborCheck, harborDsh: harborDshCheck, evaluationStack: stackCheck },
     overview: {
       totalJobs: jobs.length,
       completedJobs: (counts.completed ?? 0) + (counts.partial ?? 0),
       activeJobs: counts.pending ?? 0,
       failedJobs: counts.failed ?? 0,
-      latestMetric: latestMetric(jobs),
+      latestMetric,
     },
     jobs,
   }
 }
+
+const DETAIL_ARTIFACTS = {
+  summary: 'evaluation-summary.json',
+  candidate: 'candidate-manifest.json',
+  dataset: 'dataset-manifest.json',
+  stack: 'evaluation-stack-manifest.json',
+  context: 'evaluation-context.json',
+  contract: 'evaluation-contract.json',
+  doctor: 'architecture-doctor.json',
+  population: 'population-report.json',
+  optimization: 'optimization-report.json',
+  promotion: 'promotion-report.json',
+}
+
+function schemaIssue(key, value) {
+  if (value === undefined) return undefined
+  if (value?.__readError) return value.__readError
+  if (!isObject(value)) return 'artifact must be an object'
+  const version = { summary: 2, candidate: 1, dataset: 1, stack: 1, context: 2, contract: 1, doctor: 1, population: 1, optimization: 1, promotion: 2 }[key]
+  if (value.schema_version !== version) return `schema_version must be ${version}`
+  const required = {
+    summary: ['job', 'candidate', 'evaluation_context', 'metrics'],
+    candidate: ['candidate_id', 'version', 'digest'],
+    dataset: ['dataset_id', 'version', 'source_digest', 'tasks'],
+    stack: ['stack_id', 'version', 'digest', 'comparison_digest', 'components', 'judge'],
+    context: ['digest', 'full_digest', 'candidate', 'dataset', 'evaluation_stack', 'runtime'],
+    contract: ['contract_id', 'version', 'primary_metric', 'metrics'],
+    doctor: ['promotion_ready', 'findings'],
+    population: ['population_size', 'groups', 'metrics'],
+    optimization: ['hypotheses'],
+    promotion: ['decision', 'reasons', 'policy_digest'],
+  }[key] ?? []
+  const missing = required.filter(field => value[field] === undefined)
+  return missing.length ? `missing fields: ${missing.join(', ')}` : undefined
+}
+
+function isObject(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
+export async function readJobDetail(config, args) {
+  const job = safeSegment(args.job, 'job')
+  const directory = jobDirectory(config, job)
+  const check = await directoryCheck(directory)
+  if (check.status !== 'ok') throw new Error('Job not found')
+  const values = await Promise.all(Object.values(DETAIL_ARTIFACTS).map(name => readJson(path.join(directory, name))))
+  const artifacts = Object.fromEntries(Object.keys(DETAIL_ARTIFACTS).map((key, index) => [key, values[index]]))
+  if (artifacts.summary && !artifacts.summary.__readError) {
+    const { trials: _trials, ...lightSummary } = artifacts.summary
+    artifacts.summary = lightSummary
+  }
+  const validation = Object.fromEntries(Object.entries(artifacts).map(([key, value]) => {
+    const issue = schemaIssue(key, value)
+    return [key, value === undefined ? { status: 'missing' } : issue ? { status: 'invalid', error: issue } : { status: 'valid' }]
+  }))
+  if (validation.context.status !== 'valid') throw new Error('Job is not a Context v2 evaluation')
+  return { schemaVersion: 1, job, artifacts, validation }
+}
+
+export async function readTrialsPage(config, args) {
+  const job = safeSegment(args.job, 'job')
+  const offset = Math.max(0, Number.parseInt(args.offset ?? 0, 10) || 0)
+  const limit = Math.min(MAX_TRIAL_LIMIT, Math.max(1, Number.parseInt(args.limit ?? 50, 10) || 50))
+  const query = String(args.query ?? '').trim().toLowerCase()
+  const status = String(args.status ?? '')
+  const summary = await readJson(path.join(jobDirectory(config, job), SUMMARY_NAME))
+  if (!summary || summary.__readError) throw new Error('Job summary is unavailable')
+  let trials = Array.isArray(summary.trials) ? summary.trials : []
+  if (query) trials = trials.filter(trial => `${trial.id ?? ''} ${trial.name ?? ''}`.toLowerCase().includes(query))
+  if (status) trials = trials.filter(trial => (trial.exception ? 'infrastructure-error' : 'assessed') === status)
+  const items = trials.slice(offset, offset + limit).map(trial => ({
+    id: trial.id ?? trial.name,
+    name: trial.name,
+    status: trial.exception ? 'infrastructure-error' : 'assessed',
+    rewards: trial.rewards ?? {},
+    exception: trial.exception ? { type: trial.exception.type, classification: trial.exception.classification } : undefined,
+  }))
+  return { schemaVersion: 1, job, offset, limit, total: trials.length, items, hasMore: offset + items.length < trials.length }
+}
+
+function assessmentName(id) {
+  return `${String(id).replace(/[^A-Za-z0-9._-]+/g, '-').replace(/^[.-]+|[.-]+$/g, '') || 'trial'}.json`
+}
+
+export async function readTrialDetail(config, args) {
+  const job = safeSegment(args.job, 'job')
+  const trial = safeSegment(args.trial, 'trial')
+  const directory = jobDirectory(config, job)
+  const assessment = await readJson(path.join(directory, 'trial-assessments', assessmentName(trial)))
+  if (!assessment || assessment.__readError) throw new Error('Trial assessment not found')
+  return { schemaVersion: 1, job, trial, assessment }
+}

package/lib/evolution.js

@@ -23,47 +23,135 @@ export async function snapshot(config, args) {
 }
 
 function slug(value) {
-  return String(value)
-    .toLowerCase()
-    .replace(/[^a-z0-9._-]+/g, '-')
-    .replace(/^[._-]+|[._-]+$/g, '') || 'candidate'
+  return String(value).toLowerCase().replace(/[^a-z0-9._-]+/g, '-').replace(/^[._-]+|[._-]+$/g, '') || 'candidate'
 }
 
 export function makeJobName(manifest, now = new Date()) {
   const timestamp = now.toISOString().replace(/\.\d{3}Z$/, 'Z').replace(/[-:]/g, '')
   const suffix = `${timestamp}-${manifest.digest.slice(7, 15)}`
-  const available = 100 - suffix.length - 1
-  const identity = `${slug(manifest.candidate_id)}-${slug(manifest.version)}`.slice(0, available)
+  const identity = `${slug(manifest.candidate_id)}-${slug(manifest.version)}`.slice(0, 99 - suffix.length)
   return `${identity}-${suffix}`
 }
 
+async function cliJson(config, args, { allowedExitCodes = [0] } = {}) {
+  const result = await runProcess(config.harborDshBin, args, {
+    cwd: config.projectRoot,
+    timeoutMs: config.timeoutMs,
+    allowedExitCodes,
+    env: { ...process.env, ...(config.pythonPath ? { PYTHONPATH: config.pythonPath } : {}) },
+  })
+  try {
+    return JSON.parse(result.stdout)
+  } catch {
+    throw new Error(`harbor-dsh returned invalid JSON for ${args.slice(0, 2).join(' ')}`)
+  }
+}
+
+function strictInputs(config, args) {
+  const projectRoot = path.resolve(config.projectRoot)
+  const candidate = resolveWithin(projectRoot, args.candidatePath, 'candidatePath')
+  const dataset = resolveWithin(projectRoot, args.datasetPath, 'datasetPath')
+  const stack = resolveWithin(projectRoot, args.stackPath, 'stackPath')
+  const jobs = resolveWithin(projectRoot, config.jobsDir, 'jobsDir')
+  const mode = args.mode
+  if (!['diagnostic', 'promotion-eligible'].includes(mode)) throw new Error('mode must be diagnostic or promotion-eligible')
+  const policy = args.policyPath ? resolveWithin(projectRoot, args.policyPath, 'policyPath') : undefined
+  if (mode === 'promotion-eligible' && !policy) throw new Error('promotion-eligible mode requires policyPath')
+  return { projectRoot, candidate, dataset, stack, jobs, mode, policy }
+}
+
+export async function validateDataset(config, args) {
+  const dataset = resolveWithin(config.projectRoot, args.datasetPath, 'datasetPath')
+  return cliJson(config, ['dataset', 'validate', dataset, '--project-root', config.projectRoot], { allowedExitCodes: [0, 2] })
+}
+
+export async function initializeProject(config, args) {
+  const dataset = resolveWithin(config.projectRoot, args.datasetPath, 'datasetPath')
+  return cliJson(config, [
+    'init', '--project-root', config.projectRoot, '--dataset', dataset,
+    '--stack-id', args.stackId, '--stack-version', args.stackVersion,
+    '--dataset-id', args.datasetId, '--dataset-version', args.datasetVersion,
+    '--contract-id', args.contractId, '--contract-version', args.contractVersion,
+    '--primary-metric', args.primaryMetric, '--primary-direction', args.primaryDirection,
+    '--judge-provider', args.judgeProvider, '--judge-model', args.judgeModel, '--judge-version', args.judgeVersion,
+    '--policy-id', args.policyId, '--policy-version', args.policyVersion,
+    '--min-improvement', String(args.minImprovement),
+  ])
+}
+
+export async function runDoctor(config, args) {
+  const inputs = strictInputs(config, { ...args, mode: args.mode ?? 'diagnostic' })
+  const command = ['doctor', '--architecture', '--project-root', inputs.projectRoot, '--stack', inputs.stack, '--dataset', inputs.dataset]
+  if (args.candidatePath) command.push('--candidate', inputs.candidate)
+  if (inputs.policy) command.push('--policy', inputs.policy)
+  return cliJson(config, command, { allowedExitCodes: [0, 2] })
+}
+
+export async function previewContext(config, args) {
+  const manifest = await snapshot(config, args)
+  const inputs = strictInputs(config, args)
+  const preview = await cliJson(config, [
+    'context', 'preview',
+    '--project-root', inputs.projectRoot,
+    '--candidate', inputs.candidate,
+    '--dataset', inputs.dataset,
+    '--stack', inputs.stack,
+    '--jobs-dir', inputs.jobs,
+    '--mode', inputs.mode,
+  ])
+  return { manifest, ...preview }
+}
+
 export async function runEvaluation(config, args) {
   const manifest = await snapshot(config, args)
-  const candidateDir = resolveWithin(config.projectRoot, args.candidatePath, 'candidatePath')
-  const dataset = resolveWithin(config.projectRoot, args.datasetPath, 'datasetPath')
-  const jobsDir = resolveWithin(config.projectRoot, config.jobsDir, 'jobsDir')
+  const inputs = strictInputs(config, args)
+  const datasetValidation = await validateDataset(config, args)
+  if (!datasetValidation.valid) {
+    throw new Error(`Dataset validation failed: ${datasetValidation.findings.map(item => item.code).join(', ')}`)
+  }
+  const doctor = await runDoctor(config, args)
+  if (inputs.mode === 'promotion-eligible' && !doctor.promotion_ready) {
+    throw new Error(`Architecture Doctor blocked promotion-eligible Job: ${doctor.findings.filter(item => item.level === 'error').map(item => item.code).join(', ')}`)
+  }
+  const preview = await cliJson(config, [
+    'context', 'preview', '--project-root', inputs.projectRoot,
+    '--candidate', inputs.candidate, '--dataset', inputs.dataset,
+    '--stack', inputs.stack, '--jobs-dir', inputs.jobs, '--mode', inputs.mode,
+  ])
   const jobName = args.jobName ?? makeJobName(manifest)
   if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/.test(jobName)) throw new Error('jobName contains unsupported characters')
 
   const harborArgs = [
-    'run', '-p', dataset,
+    'run', '-p', inputs.dataset,
     '-a', config.agentImportPath,
-    '--ak', `candidate_path=${candidateDir}`,
+    '--ak', `candidate_path=${inputs.candidate}`,
     '--ak', `candidate_version=${manifest.version}`,
     '--ak', `candidate_digest=${manifest.digest}`,
     '--job-name', jobName,
-    '--jobs-dir', jobsDir,
+    '--jobs-dir', inputs.jobs,
     '--plugin', config.pluginImportPath,
-    '--plugin-kwarg', `candidate_manifest=${path.join(candidateDir, MANIFEST_NAME)}`,
+    '--plugin-kwarg', `candidate_manifest=${path.join(inputs.candidate, MANIFEST_NAME)}`,
+    '--plugin-kwarg', `dataset_path=${inputs.dataset}`,
+    '--plugin-kwarg', `stack_path=${inputs.stack}`,
+    '--plugin-kwarg', `project_root=${inputs.projectRoot}`,
+    '--plugin-kwarg', `mode=${inputs.mode}`,
   ]
-  const result = await runProcess(config.harborBin, harborArgs, {
+  if (inputs.policy) harborArgs.push('--plugin-kwarg', `policy_path=${inputs.policy}`)
+  const processResult = await runProcess(config.harborBin, harborArgs, {
     cwd: config.projectRoot,
     timeoutMs: config.timeoutMs,
     env: { ...process.env, ...(config.pythonPath ? { PYTHONPATH: config.pythonPath } : {}) },
   })
-  const jobDir = path.join(jobsDir, jobName)
+  const jobDir = path.join(inputs.jobs, jobName)
   const summary = JSON.parse(await readFile(path.join(jobDir, 'evaluation-summary.json'), 'utf8'))
-  return { manifest, jobDir, summary, process: { code: result.code } }
+  return {
+    manifest,
+    job: path.relative(inputs.projectRoot, jobDir),
+    summary,
+    doctor,
+    contextPreview: preview,
+    process: { code: processResult.code },
+  }
 }
 
 export async function readEvaluation(config, args) {
@@ -75,14 +163,5 @@ export async function compareCandidates(config, args) {
   const baseline = resolveWithin(config.projectRoot, args.baselineJob, 'baselineJob')
   const candidate = resolveWithin(config.projectRoot, args.candidateJob, 'candidateJob')
   const policy = resolveWithin(config.projectRoot, args.policyPath, 'policyPath')
-  const result = await runProcess(config.harborDshBin, [
-    'promote', baseline, candidate, '--policy', policy,
-  ], {
-    cwd: config.projectRoot,
-    timeoutMs: config.timeoutMs,
-    // harbor-dsh uses exit 1 for a valid REJECT decision. The report remains
-    // model-readable; infrastructure failures still reject the subprocess.
-    allowedExitCodes: [0, 1],
-  })
-  return JSON.parse(result.stdout)
+  return cliJson(config, ['promote', baseline, candidate, '--policy', policy], { allowedExitCodes: [0, 1] })
 }

package/lib/service.js

@@ -1,5 +1,14 @@
-import { readDashboardSnapshot } from './dashboard.js'
-import { compareCandidates, readEvaluation, runEvaluation, snapshot } from './evolution.js'
+import { readDashboardSnapshot, readJobDetail, readTrialDetail, readTrialsPage } from './dashboard.js'
+import {
+  compareCandidates,
+  initializeProject,
+  previewContext,
+  readEvaluation,
+  runDoctor,
+  runEvaluation,
+  snapshot,
+  validateDataset,
+} from './evolution.js'
 
 /** One Host-side boundary shared by Agent tools and the Web dashboard. */
 export class EvolutionService {
@@ -12,6 +21,10 @@ export class EvolutionService {
     return snapshot(this.config, args)
   }
 
+  initialize(args) {
+    return initializeProject(this.config, args)
+  }
+
   run(args) {
     return runEvaluation(this.config, args)
   }
@@ -24,7 +37,31 @@ export class EvolutionService {
     return compareCandidates(this.config, args)
   }
 
+  doctor(args) {
+    return runDoctor(this.config, args)
+  }
+
+  validateDataset(args) {
+    return validateDataset(this.config, args)
+  }
+
+  previewContext(args) {
+    return previewContext(this.config, args)
+  }
+
   dashboard() {
     return readDashboardSnapshot(this.config, this.metadata)
   }
+
+  job(args) {
+    return readJobDetail(this.config, args)
+  }
+
+  trials(args) {
+    return readTrialsPage(this.config, args)
+  }
+
+  trial(args) {
+    return readTrialDetail(this.config, args)
+  }
 }

package/lib/web.js

@@ -1,4 +1,7 @@
 export const DASHBOARD_ROUTE = '/_dsh/harbor-evolution/dashboard'
+export const JOB_ROUTE = '/_dsh/harbor-evolution/job'
+export const TRIALS_ROUTE = '/_dsh/harbor-evolution/trials'
+export const TRIAL_ROUTE = '/_dsh/harbor-evolution/trial'
 
 function sendJson(response, status, body) {
   response.writeHead(status, {
@@ -16,20 +19,24 @@ export function isSameOriginRequest(request) {
   if (!origin) {
     if (fetchSite === 'same-origin' || fetchSite === 'none') return true
     const address = request.socket?.remoteAddress ?? ''
-    return address === '::1' || address === '127.0.0.1' || address.startsWith('127.')
-      || address.startsWith('::ffff:127.')
+    return address === '::1' || address === '127.0.0.1' || address.startsWith('127.') || address.startsWith('::ffff:127.')
   }
   const host = request.headers.host
   if (!host) return false
   try {
     const parsed = new URL(origin)
-    return (parsed.protocol === 'http:' || parsed.protocol === 'https:') && parsed.host === host
+    return ['http:', 'https:'].includes(parsed.protocol) && parsed.host === host
   } catch {
     return false
   }
 }
 
-export function createDashboardHandler(service) {
+function safeError(error) {
+  const message = error instanceof Error ? error.message : String(error)
+  return message.replace(/(?:\/[A-Za-z0-9._ -]+){2,}/g, '[local path]').replace(/[A-Za-z]:\\[^\s]+/g, '[local path]')
+}
+
+export function createApiHandler(load, code = 'request-failed') {
   return (request, response) => {
     if (request.method !== 'GET') {
       response.writeHead(405, { allow: 'GET' })
@@ -40,24 +47,30 @@ export function createDashboardHandler(service) {
       sendJson(response, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin request required' } })
       return
     }
-    Promise.resolve(service.dashboard()).then(
+    const url = new URL(request.url ?? '/', 'http://localhost')
+    const args = Object.fromEntries(url.searchParams)
+    Promise.resolve(load(args)).then(
       value => sendJson(response, 200, { ok: true, value }),
-      error => sendJson(response, 500, {
-        ok: false,
-        error: { code: 'dashboard-unavailable', message: error instanceof Error ? error.message : String(error) },
-      }),
+      error => sendJson(response, 500, { ok: false, error: { code, message: safeError(error) } }),
     )
   }
 }
 
-/** Add the dashboard route only in profiles that provide the optional Web service. */
+export function createDashboardHandler(service) {
+  return createApiHandler(() => service.dashboard(), 'dashboard-unavailable')
+}
+
 export function installDashboardWeb(ctx, service) {
   if (typeof ctx.inject !== 'function') return
   ctx.inject(['webServer'], (webCtx) => {
-    webCtx.effect(() => webCtx.webServer.register({
-      kind: 'exact',
-      path: DASHBOARD_ROUTE,
-      handler: createDashboardHandler(service),
-    }), 'harbor-evolution: dashboard route')
+    const routes = [
+      [DASHBOARD_ROUTE, createDashboardHandler(service)],
+      [JOB_ROUTE, createApiHandler(args => service.job(args), 'job-unavailable')],
+      [TRIALS_ROUTE, createApiHandler(args => service.trials(args), 'trials-unavailable')],
+      [TRIAL_ROUTE, createApiHandler(args => service.trial(args), 'trial-unavailable')],
+    ]
+    for (const [route, handler] of routes) {
+      webCtx.effect(() => webCtx.webServer.register({ kind: 'exact', path: route, handler }), `harbor-evolution: ${route}`)
+    }
   })
 }

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "dsh-harbor-evolution",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "DeepSeek Harness plugin and bundled Skill for safely evolving Cordis Candidates with Harbor.",
   "type": "module",
   "main": "index.js",
   "exports": {
     ".": "./index.js",
     "./client": "./lib/client.js",
+    "./cordis.patch.yml": "./cordis.patch.yml",
     "./package.json": "./package.json"
   },
   "bin": {