Module harness_command 

The controlled tier’s substrate: one harness command, ready to run and ready to narrate.

Every controlled-tier noun (ORCH-18 scheduled jobs, ORCH-21 profiles, …) mutates through the HARNESS’S OWN verb, executed as a subprocess. The three mechanics that are identical for every one of them live here so each noun implements only its own harness semantics:

1. Narration. [HarnessCommand::narrate] renders the exact argv that ran, with every credential as <redacted> — tokens are never printed, logged, or stored.
2. Execution. [HarnessCommand::run] returns the harness’s stdout on success and the harness’s OWN stderr as the failure message, never a supercode-invented sentence.
3. Location. [harness_program] finds the harness’s executable from the compiled registry, with a SUPERCODE_<HARNESS>_BIN override so a fake CLI can stand in under test without touching PATH.

Constants

HERMES_BIN_ENV

Environment variable overriding the hermes executable (tests).

OPENCLAW_BIN_ENV

Environment variable overriding the openclaw executable (tests).