YEF-1057: experiment with Harness Profile Marketplace

[Yevanchen]

Caution

PRODUCT EXPERIMENT — DO NOT MERGE. This PR exists to test the Harness Marketplace direction and collect review feedback. Tracks YEF-1057 and is related to #546.

Summary

• Reframe the App console as a Workspace with Home, API Keys, Runs, optional Agents, Environments, Connections, Usage, and Workspace Settings.
• Add one msk_ Workspace API key and a normalized /api/v1/runs lifecycle that can launch an exact, curated Harness Profile Version without creating a user Agent.
• Make the Marketplace unit a locked HarnessProfileVersion, not an individual plugin: every Profile exposes provenance, runtime/Environment requirements, shell-equivalent trust, benchmark state, and an exact id@version selector. Runs freeze the Profile id, version, and source revision.
• Add DeepSeek Harness 0.1.0-rc.8 once as an unavailable locked distribution. Its Cordis plugin graph remains an internal composition mechanism until a Mosoo Driver adapter and measured benchmark exist; there is no broad plugin gallery.
• Keep the Web UI to a minimal catalog/selector and Quick Run. Remove active App Deployment, Channels, Pet Terminal, Agent Type, reset, and long-online status product paths while preserving historical migrations and version snapshots.
• Record the OpenRouter evidence, protocol fragmentation, DeepSeek source/interception map, plugin-abundance correction, trust boundary, curated benchmark plan, and repository impact map in docs/prd/harness-marketplace-experiment.md. Driver-side command/readiness parity is tracked in mosoo-agent-driver#118.

Why

• Test whether developers value reproducible, comparable cloud Harness Runs behind one Workspace key, without requiring Agent setup or Mosoo-managed app deployment first.
• Make the reproducible asset the complete Profile Version and its evidence record, while keeping the Run lifecycle stable across native protocols.
• Prevent installable DSH ingredients, mutable presets, or unreviewed community listings from being presented as equivalent Harness supply.

Verification

• Passed: bun run fmt:check, bun run docs:check, bun run lint, bun run tc, bun run build, bun run public-api:contract:check, and git diff --check.
• Passed suites: API 948/948, Web 209/209, Runtime Catalog 25/25, Contracts 18/18, and Public API client 10/10.
• Contract smoke: one Workspace key admits the exact Codex and OpenCode baseline Profiles with the same gpt-5.5 benchmark identity, freezes distinct Profile snapshots, and creates no user Agent row. Unknown Profile refs and the unavailable DeepSeek distribution fail before Session allocation.
• Not claimed: a live comparable benchmark. This environment has no provider credential, so benchmark results remain null with status contract_smoke; no token, latency, approval, side-effect, or safety values are fabricated.
• A prior repository-wide bun run check reached the unchanged Driver watchdog/process-supervision tests, where 11 tests time out on this macOS host; the isolated unchanged test reproduces the same PID-file timeout.

Impact

• User/API/contract changes: user-facing App becomes Workspace; introduces Workspace keys, curated Harness/Profile catalog, optional exact profile Run selector, frozen Profile source identity, and unified Run creation/read/event/approval/cancel routes; removes retired Deployment and Channel product surfaces. Generated public OpenAPI remains backward compatible with origin/main.
• Generated files / GraphQL / DB / lockfile: updates generated GraphQL and OpenAPI artifacts, bun.lock, and adds 0011_workspace_api_keys without rewriting any production migration.
• Env or config changes: removes active Channel/Deployment sidecars, routes, bindings, queues, and secrets. Historical ChannelConnection migration identity is retained through an unbound 410 tombstone export.
• Risk and rollback: intentionally broad experimental product cut. Do not deploy or merge; rollback is the complete five-commit branch.

Review

• Closest review areas: immutable Profile identity/provenance; Workspace-key authentication and hashing; agentless Harness admission; normalized Run/Driver boundary; DeepSeek trust and isolation model; Cloudflare Durable Object migration compatibility; removal boundaries for Deployment/Channels.
• Known open gate: live provider-backed comparison of at least two complete Profiles on the same model/task, recording outcome, tokens, latency, approvals, side effects, safety findings, Environment revision, and Run IDs. UI polish is intentionally deferred until that evidence exists.