Harbor Self-Evolving

0.10.2 — stable Workbench styling

Mon, 01 Jan 0001 00:00:00 +0000

Released 2026-09-27. Formal source tag: v0.10.2.

Fixed

Each live Harbor client-plugin lifetime owns its own stylesheet tag, so disposing an older duplicate or hot-reloaded instance cannot remove the active Workbench styles.
Job status text stays at the card’s top-right corner without stretching to the title height.
The status background bubble is removed while completion, running, attention and failure colors and symbols remain visible.
Plugin, Skill and Python Adapter identities align at 0.10.2.

Verification

The 0.10.2 archive records the targeted lifecycle/layout checks and coordinated package publication evidence.

0.10.1 — trustworthy scientific evaluation loop

Mon, 01 Jan 0001 00:00:00 +0000

Released 2026-09-26. Formal source tag: v0.10.1.

Shipped

Formal Candidate Experiments execute only the exact harbor-dsh-evaluator/v2 bundle through a strict private Dataset adapter; Dataset verifiers and v1 fallback cannot become score authority.
Trusted Evaluation Reports, content-addressed Job bundles, cross-artifact Evaluator identity, score suppression and execution-failure handling keep invalid evidence out of quality conclusions.
Repeat-aware Experiments, paired uncertainty, immutable Promotion reports, exact Policy snapshots and stronger Docker/environment invariants make governed comparison auditable.
Historical diagnosis, Candidate-bound business observations, independent Ground Truth meta-evaluation and confirmed badcase drafts preserve their distinct evidence boundaries.
Diagnostic, experiment and governed product profiles reveal only the controls justified by their evidence level.
Plugin, Skill and Python Adapter identities align at 0.10.1, with 34 public schemas in both packages.

Release repair

0.10.0 published to npm, but clean Linux tag/PyPI workflows exposed two release-test portability issues before any Python artifact was built. Public tags and package versions were not moved or overwritten. 0.10.1 contains the same runtime behavior with stable test-helper imports and a bounded shared-runner response budget, and supersedes 0.10.0.

0.10.0 — incomplete publication

Mon, 01 Jan 0001 00:00:00 +0000

Tagged 2026-09-26 at 97a385062ba194d5496ba2d98c45a3701d08c01d.

Warning

Publication was incomplete. npm 0.10.0 published successfully, but clean Linux tag/PyPI workflows failed before any Python artifact was built. The tag and npm package remain immutable; use 0.10.1 instead.

Intended source scope

The source introduced the exact Evaluator v2 execution boundary, sealed trusted reports, repeat-aware scientific Experiments, governed Gate invariants, hardened Historical/business/meta evidence and three product profiles. Runtime behavior is carried forward by 0.10.1.

0.9.8 — Host path translation fix

Mon, 01 Jan 0001 00:00:00 +0000

Released 2026-09-21. Formal source tag: v0.9.8.

Shipped

Host command translation preserves paths already resolved into the Trial host directory.
Historical Session Observation and Candidate commands no longer receive a duplicate host-root prefix.
A HostEnvironment integration test executes the complete SessionObservationAgent upload, digest verification and artifact write path.
Plugin, Skill and Python Adapter identities align at 0.9.8.

Verification

The 0.9.8 archive records focused and complete automated checks. Publication and evidence status are reported separately.

0.9.7 — Context contracts and bilingual site

Mon, 01 Jan 0001 00:00:00 +0000

Released 2026-09-20. Formal source tag: v0.9.7.

Shipped

Candidate Context v3 is valid in Dashboard overview and Job detail; eligible Jobs can use Compare/Gate.
Historical Context v2 is recognized explicitly by protocol, including context-only pending Jobs.
Setup persists the complete installation identity. Settings only copies a reviewable exact update command and never executes registry packages.
Plugin, Skill and Python Adapter identities align at 0.9.7.
The bilingual product/documentation site covers all 19 tools, the Skill, Adapter, evaluation concepts, evidence boundaries and roadmap.

Verification

The 0.9.7 archive records automated Node/Python/package/site checks, public package identities and release assets. Publication and evidence status are reported separately.

0.9.6 — Host-first execution

Mon, 01 Jan 0001 00:00:00 +0000

Released 2026-09-19. Formal source tag: v0.9.6.

Shipped

Host is the default execution environment; Docker remains explicit opt-in.
Candidate Context records execution environment so Host and Docker are not silently comparable.
Plugin, Skill and Python Adapter package identities align at 0.9.6.
The normal registry setup path remains the supported installation.

Verification

The archive records automated Node/Python/package checks and public release identities. Evidence types are kept separate from business acceptance.

19 Harbor Agent tools

Mon, 01 Jan 0001 00:00:00 +0000

The Plugin exposes 19 strict tools: ten workspace/Job mutations enter DSH one-shot approval; nine operations are read-only or in-memory. If the Host lacks the approval seam, mutation tools fail closed.

Tool	Purpose and minimum boundary	Mode / result
`harbor_candidate_snapshot`	Freeze one Cordis composition as an immutable Candidate Manifest.	Writes local artifact · approval. Next: Dataset/Stack doctor or Context preview.
`harbor_model_binding`	Read the current DSH default provider/model/reasoning identity.	Read-only/in-memory. Returns a non-secret binding draft; never credentials.
`harbor_evolution_init`	Compile an accepted Dataset/Generator/Evaluator/Optimizer card into a non-overwriting Stack project.	Writes local artifacts · approval. Does not run evaluation.
`harbor_evolution_doctor`	Validate Candidate, Dataset, Stack, optional Policy and execution architecture before cost.	Read-only. Returns blocking diagnostics.
`harbor_quick_diagnostic_init`	Create one Query, minimal Host-model Candidate, runnable Task and non-promotion Evaluator.	Writes local artifacts · approval. Wiring diagnostic only.
`harbor_session_diagnostic_preview`	Preview 1–10 recent completed top-level Sessions in exact current workspace.	Read-only/in-memory. Safe metadata + 15-minute owner-bound selection token.
`harbor_session_diagnostic_run`	Revalidate a selection token, freeze a private redacted Batch and run one Trial per Session.	Starts evaluation · writes · approval. Historical, Gate N/A.
`harbor_dataset_validate`	Validate manifest, Task uniqueness, instructions, paths, sensitive metadata and source digest.	Read-only. Does not repair or rewrite identity.
`harbor_context_preview`	Refresh Candidate manifest, preview Context v3 and find comparable baselines.	Writes refreshed manifest · approval. No Job.
`harbor_eval_run`	Run strict diagnostic or promotion-eligible Candidate Job with frozen identities.	Starts evaluation · writes · approval. Returns Job identity.
`harbor_eval_result`	Read summary, Job, Dataset, progress, Trial or governance view.	Read-only. Bounded, recursively redacted, explicitly untrusted envelope.
`harbor_resolve_page_context`	Resolve exact-session opaque `@harbor` page context and current revision.	Read-only. Returns narrow metadata, typed refs and navigation action.
`harbor_get_evidence`	Read one Evidence item through an exact typed ancestry ref.	Read-only. Never accepts a guessed path/id.
`harbor_propose_action`	Draft one expiring Workbench action from an explicit user request and fresh context.	In-memory draft. Never writes resources, starts a Job, Gates or deploys.
`harbor_evaluator_inspect`	Inspect active descriptor, implementation kind, ternary Criteria and bounded editable source.	Read-only. Secret/local-path-shaped source is omitted.
`harbor_evaluator_update`	Replace one allowlisted source with optimistic concurrency and new Evaluator/Stack versions.	Writes local artifacts · approval. No automatic evaluation or Gate.
`harbor_ground_truth_init`	Create a non-overwriting independent Ground Truth draft with explicit provenance.	Writes local artifact · approval. Human/programmatic/consensus/model/external.
`harbor_evaluator_meta_evaluate`	Compare repeated observations with independent GT and emit ESF/SCE/RCR.	Writes report · approval. Evaluator governance, not Candidate promotion.
`harbor_candidate_compare`	Apply deterministic Promotion Gate to comparable Baseline and Candidate Jobs under Policy.	Writes Gate artifact · approval · promotion eligible. Never deploys.

Badge meanings

Read-only: does not modify workspace evaluation state.
Writes local artifacts: creates or versions files in the bounded Harbor workspace.
Starts evaluation: can incur runner/Judge/model work after approval.
Promotion eligible: produces evidence or decisions usable by a promotion policy; Historical and quick diagnostic paths do not.

Tool success means the declared operation completed—not that Candidate quality improved or production changed.

Evaluate recent Sessions

Mon, 01 Jan 0001 00:00:00 +0000

Historical evaluation is the cold start when you have real Agent interactions but no curated Dataset. It is diagnostic, not promotion evidence.

Web path

Open Historical Sessions in the DSH Harbor page.
Preview up to three recently completed top-level Sessions visible to the current DSH workspace.
Review the frozen Judge identity, projected evidence fields, redaction policy and cost/data disclosure.
Select Sessions and confirm.
The Plugin writes a private redacted Batch, materializes one Harbor Trial per Session and starts a non-promotion Historical Job.

The Agent-tool path can preview up to ten Sessions, but only from the exact current working directory. Preview returns safe metadata and a short-lived owner-bound selection token—not raw Session ids or transcripts.

Install and start

Mon, 01 Jan 0001 00:00:00 +0000

Requirements

A working DeepSeek Harness installation and the business Agent workspace you want to evaluate.
Node.js/npm for the DSH Plugin setup command.
Python environment support used by the installed Adapter.
Harbor >=0.21,<0.22.
Docker only if you explicitly choose container execution; 0.10.3 defaults to Host.

Install

Run from the business Agent workspace, not from this source repository:

npx --yes dsh-harbor-evolution@latest setup --project-root "$PWD"

For a version-pinned installation, replace latest with 0.10.3. Setup writes the selected DSH profile dependency, configures the Harbor project integration, installs the compatible Python Adapter and exposes the bundled evolve-agent-with-harbor Skill. Follow the exact restart command printed by setup.

Native DSH evaluation workbench

Mon, 01 Jan 0001 00:00:00 +0000

The npm package dsh-harbor-evolution is more than a tool registry. It owns five layers:

Setup lifecycle — configure the selected DSH profile, install the Python Adapter, expose the bundled Skill and request a restart.
Agent orchestration — register 19 strict tools with typed boundaries and approval semantics.
Native Web experience — Workbench, Historical launcher, Context, Evidence, Artifacts, operations and Settings.
Host services — bounded project/job reads, Session selection, model brokerage and background operation coordination.
Trust boundary — redaction, same-origin browser checks, explicit confirmation and untrusted evidence envelopes.

Tool surface

The Plugin registers 19 tools. Ten mutation-capable tools require one-shot DSH approval; nine are read-only or in-memory. The complete per-tool contract is in Tool reference.

Why self-editing is not progress

Mon, 01 Jan 0001 00:00:00 +0000

An Agent can rewrite its prompt, tools or Evaluator and still become worse. “It changed” is not “it improved.”

A trustworthy loop fixes the business cases, execution identity and scoring contract before the change. It separates the Optimizer that proposes a change from the Gate that judges promotion.

You do

Name the business failure and the owner of the final deployment decision.

Harbor records

The identities and evidence chain needed to revisit the claim.

Candidate evaluation and promotion

Mon, 01 Jan 0001 00:00:00 +0000

Candidate evaluation answers a narrower question than Historical diagnosis: did one controlled change improve a fixed business task under comparable evaluation conditions?

Strict sequence

Snapshot Candidate into an immutable manifest.
Validate Dataset identity, task uniqueness, paths, sensitive metadata and source digest.
Doctor Candidate, Dataset, Evaluation Stack and optional Promotion Policy.
Preview Context v3 and discover comparable baselines before spending on a Job.
Run diagnostic first when the stack or provider path is new.
Change one controlled surface—Agent or Evaluator, not both silently.
Run promotion-eligible regression with fixed identities.
Inspect progress, Trial output, criterion evidence and governance impact.
Compare and Gate against a comparable baseline.

Comparability

A baseline is not comparable merely because it used the same repository. Candidate manifest, Dataset manifest, Evaluation Stack, Context, execution environment and relevant model/Judge identities must satisfy the contract. A changed Dataset digest, stack version, provider identity or runtime boundary can require a fresh baseline.

Define the four concepts

Mon, 01 Jan 0001 00:00:00 +0000

Self-evolution is not “letting the model edit itself.” It is an inspectable learning chain: Dataset defines the problem, Generator produces results, Evaluator judges evidence, and Optimizer proposes one controlled change. The Evaluator is itself tested through Meta-Evaluation.

Meet the four roles

Dataset — business tasks and failure cases that answer what to evaluate.
Generator — runs the Candidate and produces answers or Artifacts: who answers and how.
Evaluator — applies criteria and Evidence requirements: what counts as good and whether evidence is sufficient.
Optimizer — proposes one new-version change from failure evidence: what to change next.

In an Agent system, each role is broader than a model. Generator includes prompts, Skills, tools and runtime; Evaluator includes rubric, Judge, parsing and validity rules; Optimizer may be a Coding Agent constrained by the project Skill.

Diagnose recent Sessions

Mon, 01 Jan 0001 00:00:00 +0000

Historical evaluation lowers the cold-start cost. Preview bounded Session metadata, inspect what may reach the Judge, then confirm a non-promotion Job.

You do

Select recent completed Sessions that reflect the failure, review exclusions and consent to the disclosed Judge/data boundary.

Harbor records

A private redacted Batch, frozen Judge identity, one Trial per Session, criterion applicability, coverage and reason codes.

This does not prove

Historical scores are not comparable Candidate regression evidence and never go through Promotion Gate.

Evaluator governance and meta-evaluation

Mon, 01 Jan 0001 00:00:00 +0000

Candidate quality and Evaluator quality are separate governance problems.

Interface and inspection

Formal Candidate Evaluators implement harbor-dsh-evaluator/v2. A descriptor identifies implementation kind (script or llm-as-judge), ternary Criteria and a bounded allowlist of editable source files. Inspection omits secret-shaped and local-path-shaped values.

Controlled update

An Evaluator update replaces one descriptor-authorized source file under optimistic concurrency. The caller supplies the expected digest and new Evaluator and Stack versions. The update never runs evaluation or Gate automatically.

Workbench, context, and reviewed actions

Mon, 01 Jan 0001 00:00:00 +0000

The Harbor page is injected into the existing DSH Web GUI. It reuses DSH locale, Session, conversation, composer, Settings and Tool View surfaces; it is not a second chat product or login system.

Object-first Workbench

A Job opens into eight connected sections: Summary, Trials, Pipeline, Optimization, Compare/Gate, Evaluator/Rubric, Artifacts and Audit. The Pipeline tracks Candidate, Dataset, Integration, Renderer, Judge, Meta, Reporter, Optimizer and Gate separately so a wiring failure is not mislabeled as a low score.

Concepts and trustworthy scores

Mon, 01 Jan 0001 00:00:00 +0000

Translate the four concepts into business language

Concept	Practical meaning	Question answered in Harbor
Dataset	Business cases with task instructions, inputs and expected evidence. It defines what to evaluate; it is not a raw dump of conversations.	Which capabilities must work, and which failures must be detected?
Generator	The execution process that receives a Task and produces an answer or Artifact under a fixed Candidate, model and runtime. It may be an LLM Agent, script, workflow or other program.	Who answers, how is it run, and what does it produce?
Evaluator	The criteria and evidence logic used to judge output quality. It may be a deterministic script or `llm-as-judge`.	What counts as good, and is the evidence sufficient to decide?
Optimizer	The role that reads Dataset-level results and Trial evidence, then proposes one constrained, reviewable change. It cannot declare success by itself.	What should change, and how do we avoid changing too much at once?

Harbor compiles these user-facing concepts into a stricter Evaluation Stack with Integration, Renderer, Judge, Contract, Reporter, Policy, Context and Gate roles. Users describe the business problem first instead of filling in an internal architecture questionnaire.

Turn badcases into a Dataset

Mon, 01 Jan 0001 00:00:00 +0000

A Dataset is curated business intent, not a dump of private transcripts. Abstract the failure, preserve the relevant constraint and create an independently reviewable expected behavior.

You do

Deduplicate failure patterns, remove private identifiers, separate tuning from holdout and review every instruction file.

Harbor records

Task ids, paths, instructions, sensitive-metadata checks and immutable source digest.

This does not prove

A clean Dataset does not prove the population is complete or that one metric captures all business risk.

Architecture and trust boundaries

Mon, 01 Jan 0001 00:00:00 +0000

Three product roles

Plugin: the user-facing DSH integration and permission boundary.
Skill: the workflow policy that chooses the smallest safe evaluation path.
Adapter: the Harbor runtime bridge that materializes Jobs, Trials, Evidence and Context.

The Gate remains a separate deterministic policy function; it is not part of the Optimizer and has no deployment capability.

Eight-role Evaluation Stack

Generator, Integration, Renderer, Evaluator/Judge, Contract, Reporter, Optimizer and Policy/Gate separate execution, observation, interpretation, reporting, change proposal and promotion. This avoids a single opaque prompt both changing the system and grading itself.

Run one controlled regression

Mon, 01 Jan 0001 00:00:00 +0000

Snapshot the Candidate, validate the Dataset, doctor the Stack, preview Context and run diagnostic mode before promotion-eligible work when the path is new.

You do

State one hypothesis and one allowed change. Keep Dataset, criteria, provider and runtime fixed unless the change deliberately creates a new baseline.

Harbor records

Manifest digests, Context v3, model/Judge identities, Trial output, criterion Evidence, validity, coverage and governance impact.

Read the Gate and hand off

Mon, 01 Jan 0001 00:00:00 +0000

Compare the Candidate Job with a comparable baseline under an explicit Promotion Policy. Read the overall decision together with regressions, coverage and invalid criteria.

You do

Review representative evidence, confirm the policy matches business risk and decide whether external CI/CD should consume the recommendation.

Harbor records

Baseline/Candidate Job identities, Policy identity, comparison details and deterministic Gate artifact.

This does not prove

PROMOTE is not a production deployment, Champion mutation or universal quality guarantee. It is a recommendation for the frozen evidence and policy.

Security, privacy, and execution boundaries

Mon, 01 Jan 0001 00:00:00 +0000

Harbor Self-Evolving narrows high-impact operations, but it is not a general sandbox or multi-user authorization system.

Session and project scope

Agent tools derive project root from the calling Session’s absolute cwd. Web tokens bind Session and project. Candidate/private context and journal paths apply symlink and no-follow defenses where implemented. General lexical path containment is not a universal physical-filesystem guarantee; stronger realpath/openat containment remains roadmap work.

Troubleshooting

Mon, 01 Jan 0001 00:00:00 +0000

Harbor page is missing

Confirm setup changed the profile DSH actually runs, restart using the printed command, and verify the dependency is an exact registry version rather than link:. Check that both Harbor plugins and the bundled Skill are present.

Plugin loads but evaluation commands fail

Check the managed Python environment and harbor plugins list. Normal installation must include both dsh-evolution and dsh-historical-evaluation; adding the npm source directory alone is incomplete.

Evidence before optimization

Sat, 19 Sep 2026 00:00:00 +0000

The fastest way to make self-evolution untrustworthy is to let the same opaque loop choose cases, rewrite itself and declare victory.

Harbor reverses that order. First freeze what is being tested and how. Then inspect whether evidence is valid and how much of the population it covers. Only then propose one change and compare it against a baseline whose identities still match.

This is why the Optimizer and Gate are separate, why Historical Sessions are diagnosis rather than promotion, and why a raw reward never silently becomes a valid score.

Host first, with honest boundaries

Sat, 19 Sep 2026 00:00:00 +0000

Requiring Docker before a user can diagnose an Agent creates friction. Pretending direct execution is isolated creates risk. Version 0.9.6 chooses Host as the default and names the boundary precisely.

Host mode runs with the current user’s permissions and environment. It supplies no container isolation, user switching, network policy or CPU/memory limits. Docker remains explicit opt-in when that boundary is required.

Execution environment becomes part of Context identity. A result produced on Host is not silently compared with Docker. Lower friction does not require weaker evidence—as long as the runtime difference remains visible.

0.10.3 — actionable project-directory recovery

Mon, 01 Jan 0001 00:00:00 +0000

Released on 2026-09-27. Formal source tag: v0.10.3.

What changed

Directory-read denials now use the stable HARBOR_PROJECT_ROOT_ACCESS_DENIED code without exposing a local path.
The Workbench explains that the failure is not a network issue, provides macOS recovery and alternative project-location steps, keeps technical details collapsed, and can copy the recovery instructions.
Classification is limited to directory reads so ordinary EACCES file operations are not mislabeled.
Source-development setup explicitly includes locked dev dependencies even when the Host runs with NODE_ENV=production.
Plugin, Skill and Python Adapter identities align at 0.10.3.

Evidence boundary

The 0.10.3 archive records targeted service/client/setup checks, the generated client bundle, source setup and matched public npm/PyPI artifacts. It does not claim complete cross-platform TCC/ACL coverage or fix desktop Host signing and permission declarations.