Module harnpack 

harn run <bundle.harnpack> — verify the embedded OpenTrustGraph signature, replay the archive into the content-addressed pack cache, and execute the bundled entrypoint.

See issue #1784 (epic #1779). The verify path reuses the helpers shipped with E6.1/E6.3 (workflow_bundle.rs) so signing and verification share the same canonical-hash code path.

Structs

HarnpackError

HarnpackRunOptions

Options for prepare_harnpack.

PreparedHarnpack

Outcome of prepare_harnpack. The CLI surface uses this to (a) emit the pack_run event before the run starts, (b) decide whether to short-circuit on --dry-run-verify, and (c) hand off the unpacked entrypoint path to the existing source-execution code path.

Functions

looks_like_harnpack

Detect whether path references a .harnpack bundle by extension or zstd magic header. The magic-header path keeps detection robust for renamed bundles (./bundle without extension) which is the failure mode that bit us when users curl bundles without -o.

prepare_harnpack

Verify the bundle at path, replay it into the content-addressed pack cache, and return the unpacked entrypoint to execute.