Expose retained runs through service API

docs/LOCAL-SERVICE-API.md

@@ -98,7 +98,41 @@ errors.
 ### `GET /runs/{job_id}/reports`
 
 Returns the Markdown report content, assessment package JSON, retention summary,
-and their filesystem paths after a job has succeeded.
+submission package JSON when present, and their filesystem paths after a job has
+succeeded.
+
+### `GET /retained-runs`
+
+Lists durable retained run summaries by scanning a runs directory. Without a
+query parameter, the service scans `<root>/runs`.
+
+```text
+GET /retained-runs?runs_dir=/runs
+```
+
+### `GET /retained-runs/latest`
+
+Selects the latest retained run, optionally filtered by target and assessment
+profile refs.
+
+```text
+GET /retained-runs/latest?runs_dir=/runs&target=sample-repository&assessment=sample-noop-assessment
+```
+
+### `GET /retained-runs/{run_id}/reports`
+
+Returns the retained summary plus safe report paths for a durable run. This
+works after a service restart because it reads `retention-summary.json` from
+disk instead of in-memory job records.
+
+### `GET /retained-runs/{run_id}/artifact-manifest`
+
+Returns the assessment package `artifact_manifest` for a retained run. If the
+run predates assessment packages, the response is compatible and returns an
+empty manifest with `compatibility: "assessment-package-missing"`.
+
+Retained-run endpoints validate report and artifact paths before returning
+them. A path that escapes the selected run directory is rejected.
 
 ## Container Mode
 
@@ -112,5 +146,6 @@ podman run --rm -p 8080:8080 \
 ```
 
 The service keeps job state in memory. Durable run evidence remains in the
-mounted output directory. See `docs/SERVICE-JOB-DURABILITY.md` for the explicit
-restart and recovery contract.
+mounted output directory and can be discovered through `GET /retained-runs`
+after restart. See `docs/SERVICE-JOB-DURABILITY.md` for the explicit recovery
+contract.