Native DSH evaluation workbench

The npm package dsh-harbor-evolution is more than a tool registry. It owns five layers:

1. Setup lifecycle — configure the selected DSH profile, install the Python Adapter, expose the bundled Skill and request a restart.
2. Agent orchestration — register 19 strict tools with typed boundaries and approval semantics.
3. Native Web experience — Workbench, Historical launcher, Context, Evidence, Artifacts, operations and Settings.
4. Host services — bounded project/job reads, Session selection, model brokerage and background operation coordination.
5. Trust boundary — redaction, same-origin browser checks, explicit confirmation and untrusted evidence envelopes.

Tool surface

The Plugin registers 19 tools. Ten mutation-capable tools require one-shot DSH approval; nine are read-only or in-memory. The complete per-tool contract is in Tool reference.

Workbench

The Web experience brings the strict pipeline into DSH:

• Dashboard and Job/Trial status;
• Pipeline stages and preflight;
• Context, comparable baselines and Gate readiness;
• Trial output, criterion evidence and artifacts;
• Historical Session selection and disclosure;
• reviewed action drafts, deterministic preflight and explicit confirmation;
• background operations and recovery states;
• Settings, execution environment and version UI.

Context and reviewed actions

Ordinary chat remains ordinary chat. @harbor page context resolves a short-lived, owner-bound reference; typed Evidence refs then enforce Workspace → Job → Trial → Criterion → Evidence ancestry. Artifact text is always treated as untrusted data.

Ask AI can prepare a proposal draft, but it cannot write files, start Jobs, change Evaluators, run Gate or deploy. The user separately reviews deterministic preflight and confirms the exact action.

Current limits

Version 0.9.7 accepts Candidate Context v3 and explicitly recognizes Historical Context v2 by protocol. Candidate Compare/Gate still depends on a comparable baseline, valid artifacts, promotion-eligible mode and policy; support does not imply a PROMOTE result.

The earlier untagged one-click updater preview was withdrawn before release. Version 0.9.7 performs a version check and offers an exact copyable setup command only when the complete installation identity is available; the browser never executes a registry package.