Expose retained runs through service API

tests/test_core.py

@@ -7,6 +7,7 @@ import time
 import unittest
 from tempfile import TemporaryDirectory
 from pathlib import Path
+from urllib.parse import quote
 
 from guide_board.discovery import discover_extensions
 from guide_board.errors import ValidationError
@@ -458,6 +459,64 @@ class CoreArchitectureTests(unittest.TestCase):
                     reports["assessment_package"]["json"]["run_id"],
                     status["result"]["run_id"],
                 )
+                self.assertEqual(
+                    reports["submission_package"]["json"]["run_id"],
+                    status["result"]["run_id"],
+                )
+            finally:
+                service.stop()
+
+    def test_service_exposes_retained_runs_after_restart(self) -> None:
+        with TemporaryDirectory() as temporary_directory:
+            runs_dir = Path(temporary_directory) / "runs"
+            result = run_assessment(
+                ROOT,
+                ROOT / "profiles" / "targets" / "sample-repository.json",
+                ROOT / "profiles" / "assessments" / "sample-noop.json",
+                runs_dir / "sample",
+            )
+            _write_unsafe_artifact_run(runs_dir / "unsafe-run")
+
+            service = start_service(ROOT, host="127.0.0.1", port=0)
+            try:
+                query = f"runs_dir={quote(str(runs_dir), safe='')}"
+                listing = _request_json(service, "GET", f"/retained-runs?{query}")
+                self.assertEqual(listing["runs_dir"], str(runs_dir))
+                self.assertIn(result["run_id"], [run["run_id"] for run in listing["runs"]])
+
+                latest = _request_json(
+                    service,
+                    "GET",
+                    f"/retained-runs/latest?{query}&target=sample-repository&assessment=sample-noop-assessment",
+                )
+                self.assertEqual(latest["run"]["run_id"], result["run_id"])
+                self.assertIn("submission_package", latest["run"]["paths"])
+
+                reports = _request_json(
+                    service,
+                    "GET",
+                    f"/retained-runs/{result['run_id']}/reports?{query}",
+                )
+                self.assertEqual(
+                    reports["run"]["paths"]["assessment_package"],
+                    str(runs_dir / "sample" / "reports" / "assessment-package.json"),
+                )
+
+                artifacts = _request_json(
+                    service,
+                    "GET",
+                    f"/retained-runs/{result['run_id']}/artifact-manifest?{query}",
+                )
+                self.assertEqual(artifacts["artifact_manifest"], [])
+                self.assertEqual(artifacts["compatibility"], "current")
+
+                unsafe = _request_json(
+                    service,
+                    "GET",
+                    f"/retained-runs/unsafe-run/artifact-manifest?{query}",
+                    expected_status=400,
+                )
+                self.assertIn("escapes run directory", unsafe["error"]["message"])
             finally:
                 service.stop()
 
@@ -603,6 +662,34 @@ def _write_retention_summary(
     )
 
 
+def _write_unsafe_artifact_run(run_dir: Path) -> None:
+    _write_retention_summary(
+        run_dir,
+        "unsafe-run",
+        "2026-05-07T12:00:00+00:00",
+        "completed",
+        {"pass": 1},
+        0,
+        1,
+    )
+    reports_dir = run_dir / "reports"
+    reports_dir.mkdir(parents=True, exist_ok=True)
+    (reports_dir / "assessment-package.json").write_text(
+        json.dumps(
+            {
+                "artifact_manifest": [
+                    {
+                        "id": "artifact:unsafe",
+                        "path": "../outside.txt",
+                        "checksum": "sha256:unsafe",
+                    }
+                ]
+            }
+        ),
+        encoding="utf-8",
+    )
+
+
 def _request_json(
     service: ServiceHandle,
     method: str,