omp-conductor 0.18.0 → 0.18.2

package/src/gitops.ts

@@ -17,7 +17,8 @@
  * branch cannot disagree.
  */
 
-import { existsSync } from "node:fs";
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
 
 import { parseChainSource, type ChainEntry } from "./chain-check.ts";
@@ -75,6 +76,98 @@ export function credentialedEnv(
   return { ...env, ...extra };
 }
 
+/**
+ * The exact per-run dubious-ownership exemption for a daemon git call against
+ * a worker-owned run repository (#816).
+ *
+ * Every daemon-side invocation whose cwd (or opening) is the run repository
+ * carries the run's own path as a command-line `-c safe.directory=<path>` —
+ * never a wildcard, and never an entry in the daemon's global config, which
+ * would grow one line per run forever. Git 2.35+ refuses to open a repository
+ * owned by another uid ("dubious ownership"); the run repository was handed
+ * to the worker identity at dispatch, so the daemon's own `rev-parse`,
+ * salvage, lane probe and cleanup calls are exactly that shape.
+ */
+export function runRepoSafeDirectoryExemption(runRepoPath: string): [string, string] {
+  return ["-c", `safe.directory=${runRepoPath}`];
+}
+
+/**
+ * A daemon-owned, per-call global git config granting the *source-side*
+ * ownership exemption for a local-path fetch out of one worker-owned run
+ * repository.
+ *
+ * `git fetch <runRepo>` from the mirror is the one daemon git call whose
+ * *source* is worker-owned, and the one shape command-line config cannot
+ * reach: git spawns `upload-pack` against the source — `.git` dubious-ownership
+ * check included — and that subprocess sees none of the destination process's
+ * `-c` options. The only real config file the subprocess reads that this side
+ * controls is the global one, so the run's exemption is materialised there,
+ * for exactly this call: a temp file (0700, daemon's own) naming precisely the
+ * run's repo path and its gitdir, never a wildcard, with the daemon's existing
+ * global config replayed through `include.path` so nothing else about the
+ * caller's git behavior changes. The file is removed when the call is done.
+ */
+export interface ScopedSafeDirectory {
+  /** The env additions for one git call; the caller's own use of it is what
+   *  scopes the exemption to that call. */
+  env: Record<string, string>;
+  /** Remove the daemon-owned temp file. The call must not outlive it. */
+  close: () => void;
+}
+
+/** A config value: git's quoting accepts C escapes in double quotes. */
+function quoteGitConfigValue(value: string): string {
+  return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+
+export function scopedSafeDirectoryEnv(...runRepos: readonly string[]): ScopedSafeDirectory {
+  const dir = mkdtempSync(join(tmpdir(), "omp-conductor-safe-"));
+  try {
+    // The global-config chain the daemon normally reads, replayed: setting
+    // GIT_CONFIG_GLOBAL would otherwise replace those files rather than
+    // augmenting them, dropping e.g. credential helpers and `insteadOf` rules
+    // for the duration of this one call.
+    const globals: string[] = [];
+    const globalOverride = process.env["GIT_CONFIG_GLOBAL"];
+    if (globalOverride !== undefined && globalOverride !== "") {
+      globals.push(globalOverride);
+    } else {
+      const xdgHome = process.env["XDG_CONFIG_HOME"];
+      const xdgConfig = xdgHome === undefined || xdgHome === ""
+        ? join(homedir(), ".config", "git", "config")
+        : join(xdgHome, "git", "config");
+      if (existsSync(xdgConfig)) globals.push(xdgConfig);
+      const home = homedir();
+      if (home !== "") {
+        const gitconfig = join(home, ".gitconfig");
+        if (existsSync(gitconfig)) globals.push(gitconfig);
+      }
+    }
+    const lines = [
+      ...globals.flatMap((file) => ["[include]", `\tpath = ${quoteGitConfigValue(file)}`]),
+      "[safe]",
+      // Both spellings git actually checks (2.43 and later use the gitdir
+      // path for a local-path source; a direct open names the worktree path).
+      // Both are exact, never a wildcard.
+      ...runRepos.flatMap((repo) => [
+        `\tdirectory = ${quoteGitConfigValue(repo)}`,
+        `\tdirectory = ${quoteGitConfigValue(join(repo, ".git"))}`,
+      ]),
+      "",
+    ];
+    const file = join(dir, "gitconfig");
+    writeFileSync(file, lines.join("\n"));
+    return {
+      env: { ...credentialedEnv(), GIT_CONFIG_GLOBAL: file },
+      close: () => rmSync(dir, { recursive: true, force: true }),
+    };
+  } catch (err) {
+    rmSync(dir, { recursive: true, force: true });
+    throw err;
+  }
+}
+
 // ------------------------------------------------- the privileged publish path
 
 /** One run's own repository, as the daemon addresses it. */
@@ -163,7 +256,11 @@ export async function probeRunLane(
     for (const line of stdout.split("\n")) add(line.trim(), source);
   };
   if (input.worktree !== "") {
-    const status = await exec(["git", "-C", input.worktree, "status", "--porcelain"], {});
+    // The live run's worktree is owned by the worker identity (#798), so
+    // every daemon-side read of it carries the exact per-run exemption — no
+    // wildcard, no global safe.directory (#816).
+    const exemption = runRepoSafeDirectoryExemption(input.worktree);
+    const status = await exec(["git", ...exemption, "-C", input.worktree, "status", "--porcelain"], {});
     if (status.code === 0) {
       const { untracked, tracked } = parsePorcelain(status.stdout);
       // Untracked files are authored by construction: a merge stages the files
@@ -183,12 +280,12 @@ export async function probeRunLane(
         // resolution. An unreadable divergence read fails open — no tracked
         // occupancy is claimed while the merge makes the read ambiguous.
         const merge = await exec(
-          ["git", "-C", input.worktree, "rev-parse", "-q", "--verify", "MERGE_HEAD"],
+          ["git", ...exemption, "-C", input.worktree, "rev-parse", "-q", "--verify", "MERGE_HEAD"],
           {},
         );
         if (merge.code === 0) {
           const diverged = await exec(
-            ["git", "-C", input.worktree, "diff", "--name-only", input.baseRef],
+            ["git", ...exemption, "-C", input.worktree, "diff", "--name-only", input.baseRef],
             {},
           );
           if (diverged.code === 0) {
@@ -203,7 +300,7 @@ export async function probeRunLane(
       }
     }
     const diff = await exec(
-      ["git", "-C", input.worktree, "diff", "--name-only", `${input.baseRef}...HEAD`],
+      ["git", ...exemption, "-C", input.worktree, "diff", "--name-only", `${input.baseRef}...HEAD`],
       {},
     );
     if (diff.code === 0) addDiff(diff.stdout, "branch");
@@ -311,91 +408,101 @@ export async function pushRunBranch(
   const ref = `refs/heads/${run.branch}`;
   const tracked = `refs/remotes/origin/${run.branch}`;
   const env = credentialedEnv();
+  // The run repository is worker-owned (#798): the direct read below carries
+  // the exact-path exemption on the command line, and the local-path fetch's
+  // source (upload-pack) needs it as a scoped global config for the one call
+  // (#816). Both are exact per-run entries, never a wildcard, and the scoped
+  // file dies with the call.
+  const scoped = scopedSafeDirectoryEnv(run.runRepoPath);
 
-  // Copy the run's branch into the mirror, fast-forward only.
-  const fetched = await exec(["git", "-C", mirror, "fetch", "--no-tags", run.runRepoPath, `${ref}:${ref}`], { env });
+  try {
+    // Copy the run's branch into the mirror, fast-forward only.
+    const fetched = await exec(["git", ...runRepoSafeDirectoryExemption(run.runRepoPath), "-C", mirror, "fetch", "--no-tags", run.runRepoPath, `${ref}:${ref}`], { env: scoped.env });
+
+    // The proposed head is read from the run repo itself: when the copy above
+    // was refused, the mirror's copy of the branch is exactly the stale one.
+    const proposedRun = await exec(["git", ...runRepoSafeDirectoryExemption(run.runRepoPath), "-C", run.runRepoPath, "rev-parse", ref], { env: scoped.env });
+    if (proposedRun.code !== 0) {
+      return { ok: false, stderr: scrubUserinfo(proposedRun.stderr.trim() || `git rev-parse ${ref} exited ${String(proposedRun.code)}`) };
+    }
+    const proposed = proposedRun.stdout.trim();
+
+    // Reconcile with the live remote before enforcing anything: the ancestry
+    // that decides a fast-forward is the live remote's, not the mirror's copy's
+    // (see the docstring above). ls-remote answers "is the branch published at
+    // all" and "what does GitHub hold" in one call.
+    const liveListed = await exec(["git", "-C", mirror, "ls-remote", "origin", ref], { env });
+    if (liveListed.code !== 0) {
+      return { ok: false, stderr: scrubUserinfo(liveListed.stderr.trim() || `git ls-remote origin ${ref} exited ${String(liveListed.code)}`) };
+    }
+    const live = liveListed.stdout
+      .split("\n")
+      .map((line) => line.trimEnd())
+      .find((line) => line.endsWith(`\t${ref}`))
+      ?.split(/\s+/, 1)[0];
+
+    if (live !== undefined && live !== proposed) {
+      // The branch is published and the run proposes something different. Pull
+      // the live branch's history into the mirror once (which also keeps the
+      // tracked ref a reattach reads fresh), then prove the fast-forward.
+      const reconciled = await exec(["git", "-C", mirror, "fetch", "--no-tags", "origin", `+${ref}:${tracked}`], { env });
+      if (reconciled.code !== 0) {
+        return { ok: false, stderr: scrubUserinfo(reconciled.stderr.trim() || reconciled.stdout.trim() || `git fetch origin exited ${String(reconciled.code)}`) };
+      }
 
-  // The proposed head is read from the run repo itself: when the copy above
-  // was refused, the mirror's copy of the branch is exactly the stale one.
-  const proposedRun = await exec(["git", "-C", run.runRepoPath, "rev-parse", ref], { env });
-  if (proposedRun.code !== 0) {
-    return { ok: false, stderr: scrubUserinfo(proposedRun.stderr.trim() || `git rev-parse ${ref} exited ${String(proposedRun.code)}`) };
-  }
-  const proposed = proposedRun.stdout.trim();
-
-  // Reconcile with the live remote before enforcing anything: the ancestry
-  // that decides a fast-forward is the live remote's, not the mirror's copy's
-  // (see the docstring above). ls-remote answers "is the branch published at
-  // all" and "what does GitHub hold" in one call.
-  const liveListed = await exec(["git", "-C", mirror, "ls-remote", "origin", ref], { env });
-  if (liveListed.code !== 0) {
-    return { ok: false, stderr: scrubUserinfo(liveListed.stderr.trim() || `git ls-remote origin ${ref} exited ${String(liveListed.code)}`) };
-  }
-  const live = liveListed.stdout
-    .split("\n")
-    .map((line) => line.trimEnd())
-    .find((line) => line.endsWith(`\t${ref}`))
-    ?.split(/\s+/, 1)[0];
-
-  if (live !== undefined && live !== proposed) {
-    // The branch is published and the run proposes something different. Pull
-    // the live branch's history into the mirror once (which also keeps the
-    // tracked ref a reattach reads fresh), then prove the fast-forward.
-    const reconciled = await exec(["git", "-C", mirror, "fetch", "--no-tags", "origin", `+${ref}:${tracked}`], { env });
-    if (reconciled.code !== 0) {
-      return { ok: false, stderr: scrubUserinfo(reconciled.stderr.trim() || reconciled.stdout.trim() || `git fetch origin exited ${String(reconciled.code)}`) };
+      const isAncestor = await exec(["git", "-C", mirror, "merge-base", "--is-ancestor", live, proposed], { env });
+      if (isAncestor.code === 128) {
+        // git could not perform the check at all (an object it was asked to
+        // resolve is missing, not merely unrelated). That is a failed
+        // verification, not a divergence verdict: refuse with git's own words,
+        // still naming both SHAs so the report carries the mismatch.
+        return {
+          ok: false,
+          stderr: scrubUserinfo(
+            isAncestor.stderr.trim() ||
+              isAncestor.stdout.trim() ||
+              `git merge-base --is-ancestor ${live} ${proposed} exited ${String(isAncestor.code)}`,
+          ),
+        };
+      }
+      if (isAncestor.code !== 0) {
+        // A real divergence: no fast-forward exists, and the mirror is left
+        // exactly where it was. Both SHAs are named so the mismatch is
+        // diagnosable instead of a bare "non-fast-forward".
+        return {
+          ok: false,
+          stderr:
+            `refusing non-fast-forward push of ${run.branch}: the live remote tip ${live} is not an ancestor of ` +
+            `the proposed head ${proposed}. Fetch the live branch and rebase or merge it before pushing again.`,
+        };
+      }
     }
 
-    const isAncestor = await exec(["git", "-C", mirror, "merge-base", "--is-ancestor", live, proposed], { env });
-    if (isAncestor.code === 128) {
-      // git could not perform the check at all (an object it was asked to
-      // resolve is missing, not merely unrelated). That is a failed
-      // verification, not a divergence verdict: refuse with git's own words,
-      // still naming both SHAs so the report carries the mismatch.
-      return {
-        ok: false,
-        stderr: scrubUserinfo(
-          isAncestor.stderr.trim() ||
-            isAncestor.stdout.trim() ||
-            `git merge-base --is-ancestor ${live} ${proposed} exited ${String(isAncestor.code)}`,
-        ),
-      };
+    if (fetched.code !== 0 && live === undefined) {
+      // The mirror refused the plain copy and there is no published branch to
+      // validate the run's head against: a rewritten branch that was never
+      // published must not rewrite the mirror either. Refuse with git's words.
+      return { ok: false, stderr: scrubUserinfo(fetched.stderr.trim() || fetched.stdout.trim() || `git fetch exited ${String(fetched.code)}`) };
     }
-    if (isAncestor.code !== 0) {
-      // A real divergence: no fast-forward exists, and the mirror is left
-      // exactly where it was. Both SHAs are named so the mismatch is
-      // diagnosable instead of a bare "non-fast-forward".
-      return {
-        ok: false,
-        stderr:
-          `refusing non-fast-forward push of ${run.branch}: the live remote tip ${live} is not an ancestor of ` +
-          `the proposed head ${proposed}. Fetch the live branch and rebase or merge it before pushing again.`,
-      };
+    if (fetched.code !== 0) {
+      // The proposed head is a legitimate fast-forward over the live remote (it
+      // equals the live head or the ancestor test above passed), so the only
+      // thing the plain copy refused on was the mirror's own stale copy.
+      // Refresh it; the push below still re-checks against the live remote.
+      const refreshed = await exec(["git", ...runRepoSafeDirectoryExemption(run.runRepoPath), "-C", mirror, "fetch", "--no-tags", run.runRepoPath, `+${ref}:${ref}`], { env: scoped.env });
+      if (refreshed.code !== 0) {
+        return { ok: false, stderr: scrubUserinfo(refreshed.stderr.trim() || refreshed.stdout.trim() || `git fetch exited ${String(refreshed.code)}`) };
+      }
     }
-  }
 
-  if (fetched.code !== 0 && live === undefined) {
-    // The mirror refused the plain copy and there is no published branch to
-    // validate the run's head against: a rewritten branch that was never
-    // published must not rewrite the mirror either. Refuse with git's words.
-    return { ok: false, stderr: scrubUserinfo(fetched.stderr.trim() || fetched.stdout.trim() || `git fetch exited ${String(fetched.code)}`) };
-  }
-  if (fetched.code !== 0) {
-    // The proposed head is a legitimate fast-forward over the live remote (it
-    // equals the live head or the ancestor test above passed), so the only
-    // thing the plain copy refused on was the mirror's own stale copy.
-    // Refresh it; the push below still re-checks against the live remote.
-    const refreshed = await exec(["git", "-C", mirror, "fetch", "--no-tags", run.runRepoPath, `+${ref}:${ref}`], { env });
-    if (refreshed.code !== 0) {
-      return { ok: false, stderr: scrubUserinfo(refreshed.stderr.trim() || refreshed.stdout.trim() || `git fetch exited ${String(refreshed.code)}`) };
+    const pushed = await exec(["git", "-C", mirror, "push", "origin", `${ref}:${ref}`], { env });
+    if (pushed.code !== 0) {
+      return { ok: false, stderr: scrubUserinfo(pushed.stderr.trim() || pushed.stdout.trim() || `git push exited ${String(pushed.code)}`) };
     }
+    return { ok: true, sha: proposed };
+  } finally {
+    scoped.close();
   }
-
-  const pushed = await exec(["git", "-C", mirror, "push", "origin", `${ref}:${ref}`], { env });
-  if (pushed.code !== 0) {
-    return { ok: false, stderr: scrubUserinfo(pushed.stderr.trim() || pushed.stdout.trim() || `git push exited ${String(pushed.code)}`) };
-  }
-  return { ok: true, sha: proposed };
 }
 
 /**

package/src/graph-health.ts

@@ -33,6 +33,19 @@ export type CodeGraphHealth =
         indexer: CheckState;
         mcpMount: McpMountState;
       };
+      /**
+       * Session-recorded graph-tools observations over this project's runs
+       * (#726): what dispatched sessions' registries actually held at start.
+       * `recorded: 0` means no run has ever recorded the fact — "observed" is
+       * never claimed without one, which is the whole honesty contract of the
+       * state. This is the runtime counterpart to `prerequisites.mcpMount`,
+       * which is deliberately a *config* finding.
+       */
+      session: {
+        recorded: number;
+        present: number;
+        absent: number;
+      };
       repos: CodeGraphRepoHealth[];
       timer: {
         enabled: "enabled" | "disabled" | "unknown";
@@ -61,6 +74,7 @@ export function pendingCodeGraph(project: ProjectConfig, now = Date.now()): Code
     status: "unknown",
     checkedAt: new Date(now).toISOString(),
     prerequisites: { indexer: "unknown", mcpMount: "unknown" },
+    session: { recorded: 0, present: 0, absent: 0 },
     repos: repos.map((repo) => ({
       name: repo.name,
       path: repo.graphProject,
@@ -78,6 +92,12 @@ export interface CodeGraphProbeDeps {
   exists(path: string): boolean;
   run(command: string, args: readonly string[]): Promise<ReadOnlyCommandResult>;
   now(): number;
+  /**
+   * Session-recorded graph-tools observations for the probed project (#726).
+   * Absent, the probe reports no observation — which is exactly what a caller
+   * that has no store must report, and never a claim that tools were absent.
+   */
+  graphToolsObservations?(): { recorded: number; present: number; absent: number };
 }
 
 async function runReadOnly(command: string, args: readonly string[]): Promise<ReadOnlyCommandResult> {
@@ -104,7 +124,7 @@ async function runReadOnly(command: string, args: readonly string[]): Promise<Re
   }
 }
 
-const DEFAULT_DEPS: CodeGraphProbeDeps = {
+export const DEFAULT_DEPS: CodeGraphProbeDeps = {
   prereqs: resolvePrereqs,
   exists: existsSync,
   run: runReadOnly,
@@ -241,6 +261,19 @@ export async function probeCodeGraph(
   if (indexer === "missing") reasons.push("indexer is not present on PATH");
   if (mcpMount === "unconfigured") reasons.push("worker MCP configuration does not mount the indexer");
 
+  // The runtime half (#726): what dispatched sessions actually had in their
+  // registries. `recorded: 0` (no run ever recorded an observation, or no
+  // store-backed reader) contributes nothing — "observed" is only ever claimed
+  // from a run that recorded it. An observed absence is the signal this
+  // feature exists to surface: config says "mounted" while sessions ran
+  // without the tools, which is exactly the blind spot `mcp.json` alone had.
+  const session = deps.graphToolsObservations?.() ?? { recorded: 0, present: 0, absent: 0 };
+  if (session.recorded > 0 && session.absent > 0) {
+    reasons.push(
+      `graph tools observed absent from the session registry in ${session.absent} of ${session.recorded} runs`,
+    );
+  }
+
   // The units are per project (`cbm-reindex-<project>.*`): probing the shared
   // stem would report project B's health against project A's timer, and with
   // both installed the answer would be whichever the probe guessed (#720).
@@ -301,6 +334,7 @@ export async function probeCodeGraph(
     status: uncertain ? "unknown" : reasons.length === 0 ? "healthy" : "degraded",
     checkedAt,
     prerequisites: { indexer, mcpMount },
+    session,
     repos,
     timer: { enabled, active },
     refresh: refresh.health,

package/src/graph.ts

@@ -29,7 +29,7 @@ import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "n
 import { homedir, userInfo } from "node:os";
 import { dirname, join } from "node:path";
 import { expandHome, stateDir } from "./config.ts";
-import type { ProjectConfig, RepoTarget } from "./types.ts";
+import type { GraphToolsObservation, ProjectConfig, RepoTarget } from "./types.ts";
 
 /**
  * The indexer's own CLI, invoked by name rather than by path so the generated
@@ -38,6 +38,71 @@ import type { ProjectConfig, RepoTarget } from "./types.ts";
  */
 const INDEXER = "codebase-memory-mcp";
 
+/**
+ * The MCP server name the graph tools arrive under in a session's registry,
+ * in the spellings the harness prefixes tools with (#726). `graphToolsPresent`
+ * matches against these, so the runtime observation and `resolvePrereqs`'s
+ * config check share one identity and cannot drift apart. The underscore form
+ * is the harness's normalised spelling for a server name; the verbatim form
+ * covers servers that keep their hyphens.
+ */
+export const GRAPH_MCP_SERVER_NAMES: readonly string[] = [INDEXER, INDEXER.replace(/-/g, "_")];
+
+/**
+ * Whether the code-graph tools are in a live session's registry (#726).
+ *
+ * Takes the session's own enabled tool names and matches the harness's MCP
+ * mounting convention (`mcp__<server>_<tool>`). This is the runtime
+ * observation: unlike {@link resolvePrereqs}'s `mounted` (which reads
+ * `mcp.json` and can only say what a session should mount), it answers what
+ * the session actually had, so "the model ignored a tool it had" and "the
+ * tool was missing" stop looking identical from outside the session.
+ */
+export function graphToolsPresent(toolNames: readonly string[]): boolean {
+  return toolNames.some(
+    (name) =>
+      name.startsWith("mcp__") &&
+      GRAPH_MCP_SERVER_NAMES.some((server) => name.startsWith(`mcp__${server}_`)),
+  );
+}
+
+/**
+ * Poll a session's registry for the code-graph observation (#726).
+ *
+ * Measured against the real harness rather than assumed: MCP wiring finalises
+ * after `createAgentSession` resolves (a deferred discovery pass), so the
+ * registry read can throw in the window right after session creation, and the
+ * graph tools surface under the *enabled* names — the active names stop at
+ * the core tools. This therefore polls the enabled surface until the read
+ * stops throwing, bounded by `deadlineMs`; a surface that never becomes
+ * readable (or a build that does not expose one — `getEnabledToolNames` is
+ * `undefined`) records *no* observation — never "graph tools absent", which
+ * is the `present: false` truth value of a surface that was read.
+ *
+ * @param getEnabledToolNames the session's `getEnabledToolNames` read, already
+ *   bound to its session (the SDK method dereferences private state), or
+ *   `undefined` when the harness surface is absent
+ */
+export async function observeGraphTools(
+  getEnabledToolNames: (() => string[]) | undefined,
+  options: { intervalMs?: number; deadlineMs?: number } = {},
+): Promise<GraphToolsObservation | undefined> {
+  if (getEnabledToolNames === undefined) return undefined;
+  const intervalMs = options.intervalMs ?? 250;
+  const deadlineMs = options.deadlineMs ?? 15_000;
+  const start = Date.now();
+  for (;;) {
+    try {
+      return { present: graphToolsPresent(getEnabledToolNames()), at: Date.now() };
+    } catch {
+      if (Date.now() - start >= deadlineMs) return undefined;
+      const { promise, resolve } = Promise.withResolvers<void>();
+      setTimeout(resolve, intervalMs);
+      await promise;
+    }
+  }
+}
+
 /** The shared prefix of every reindex artefact; `cbm` is the indexer's own prefix. */
 export const REINDEX_UNIT = "cbm-reindex";
 

package/src/harness-loader.ts

@@ -0,0 +1,59 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+import {
+  OMP_HARNESS_PACKAGE,
+  OMP_NATIVES_PACKAGE,
+  packageNodeModulesRoot,
+} from "./host.ts";
+
+export interface HarnessAttestation {
+  path: string;
+  version: string;
+  nativePath: string;
+}
+
+/** Resolve the installed peer from this package's directory, never Bun's ambient cache. */
+export function resolveHarnessEntry(moduleDir: string = import.meta.dir): string {
+  return Bun.resolveSync(OMP_HARNESS_PACKAGE, moduleDir);
+}
+
+/** The installed peer version belonging to a resolved harness entry. */
+export function harnessVersion(entry: string): string | undefined {
+  const root = packageNodeModulesRoot(entry);
+  if (root === undefined) return undefined;
+  try {
+    const parsed: unknown = JSON.parse(
+      readFileSync(join(root, OMP_HARNESS_PACKAGE, "package.json"), "utf8"),
+    );
+    if (parsed === null || typeof parsed !== "object") return undefined;
+    const version = Reflect.get(parsed, "version");
+    return typeof version === "string" && version !== "" ? version : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Exercise the worker's real import contract: explicitly anchored peer and
+ * native-addon resolution, with the caller responsible for passing
+ * `--no-install` so neither import can fall through to Bun's package cache.
+ */
+export async function probeHarness(moduleDir: string = import.meta.dir): Promise<HarnessAttestation> {
+  const path = resolveHarnessEntry(moduleDir);
+  await import(path);
+  const version = harnessVersion(path);
+  if (version === undefined) throw new Error(`cannot read the harness version for ${path}`);
+  const nativePath = Bun.resolveSync(OMP_NATIVES_PACKAGE, dirname(path));
+  await import(nativePath);
+  return { path, version, nativePath };
+}
+
+if (import.meta.main) {
+  try {
+    process.stdout.write(`${JSON.stringify(await probeHarness())}\n`);
+  } catch (cause) {
+    process.stderr.write(`${cause instanceof Error ? cause.stack ?? cause.message : String(cause)}\n`);
+    process.exitCode = 1;
+  }
+}