feat(xce-harness-component): xce-test-resources builds/checks harness explicitly

run-resource-verify.sh's XT default now points at
\$BUILD_DIR/harness/xce_test and fails fast (actionable "run
/xce-build harness" message) if missing -- it drives
inject_resources()'s worker join/resupdate and
internal_controller_check()'s client-context resval, so a hard
failure is correct, matching the precedent from tasks 3.2/3.4.

SKILL.md's build-prerequisite content folded into the existing Usage
section (this skill has no standalone Prerequisites heading, unlike
its siblings) plus a Dependencies section update.

Verified live: sourced the script (main() guarded), called
precondition_checks() present then absent then restored
(checksum-verified intact).

This completes all four downstream-workflow tasks (3.2-3.5) --
xce-test-ha, xce-deploy-ha, xce-test-multihost, and xce-test-resources
all now handle the harness/controller build decoupling correctly.

Task 3.5 of xce-harness-component.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RLSNJhNoULvVcUhXEFafQC

.claude/skills/xce-test-resources/SKILL.md

@@ -109,11 +109,36 @@ script.)
   apiserver binary): `$XCE_RESVERIFY_BUILD_DIR`,
   `$XCE_RESVERIFY_BIN` (controller), `$XCE_RESVERIFY_SCHED_BIN`,
   `$XCE_RESVERIFY_APISERVER_BIN`, `$XCE_RESVERIFY_XT` (the `xce_test`
-  binary), `$XCE_RESVERIFY_PEERS` (defaults to a single-node
+  binary -- default `$XCE_RESVERIFY_BUILD_DIR/harness/xce_test` since
+  xce-harness-component task 3.1 decoupled it from the controller build into
+  its own standalone `harness` component/`/xce-build harness` entry),
+  `$XCE_RESVERIFY_PEERS` (defaults to a single-node
   `localhost:9991` -- this skill verifies value propagation, not raft/HA
   failover, so a single node is deliberate and avoids election-timing
   flakiness; xce-test-ha remains the tool for HA testing).
 
+`run-resource-verify.sh` requires controller, scheduler, apiserver, and
+harness (`xce_test`) binaries in the same build dir before it runs
+(`precondition_checks()`), and fails fast with the exact `/xce-build`
+command to run for whichever one is missing -- `xce_test` is this script's
+own driver client (`inject_resources()`'s worker-context `join`/`resupdate`
+and the nested controller-side check both run through it), so a missing
+harness binary is a hard `FAIL`, not a silently-skipped step or a raw
+spawn/connect error from the first `xtest()` call:
+
+```
+/xce-build controller --incremental
+/xce-build scheduler --incremental
+/xce-build apiserver --incremental
+/xce-build harness --incremental
+```
+
+(`--incremental` matters here specifically because a plain, non-incremental
+`/xce-build <component>` wipes the whole build dir before rebuilding just
+that one component -- see this project's own bug-1719 lesson -- so building
+these one at a time into the same dir needs `--incremental` on every call
+after the first.)
+
 Must be invoked under an environment with `nix` on `PATH` -- the script
 shells out to `nix develop` itself for the steps that need it, so it does
 not need to be pre-wrapped by the caller.
@@ -241,6 +266,10 @@ ever fires. Dispatch it directly via Bash, or via the `Agent` tool
 
 - `xce_test`'s worker-context `resupdate`/`join` and client-context `resval`
   -- resource-name table gap closed (tasks 2.1/2.2).
+- Controller, scheduler, apiserver, and harness (`xce_test`) binaries in the
+  same build dir (see Usage above) -- `xce_test` builds from the standalone
+  `harness` component as of xce-harness-component task 3.1, no longer as a
+  side effect of the controller build.
 - `xce-deploy-ha`'s `deploy-ha.sh` / `start-all.sh` -- apiserver step and
   combined `start-all.sh` (task 3.1).
 - Scheduler and apiserver trace-log lines (tasks 4.1 and 4.2).

.claude/skills/xce-test-resources/run-resource-verify.sh

@@ -202,9 +202,14 @@ BINARY="${XCE_RESVERIFY_BIN:-$BUILD_DIR/controller/xce_controller}"
 SCHED_BIN="${XCE_RESVERIFY_SCHED_BIN:-$BUILD_DIR/scheduler/xce_scheduler}"
 APISERVER_BIN="${XCE_RESVERIFY_APISERVER_BIN:-$BUILD_DIR/frontend/apiserver/xce_apiserver}"
 # xce_test -- drives injection (task 6.1) via its worker-context `join`/
-# `resupdate` commands (same binary xce-test-ha's run-ha-soak.sh uses, same
-# build dir as $BINARY since both come from the controller meson target).
-XT="${XCE_RESVERIFY_XT:-$BUILD_DIR/controller/xce_test}"
+# `resupdate` commands (same binary xce-test-ha's run-ha-soak.sh and
+# xce-test-multihost's run-multihost-verify.sh use). xce-harness-component
+# task 3.1: xce_test now builds from the standalone `src/harness/` component
+# (its own `/xce-build harness` entry), not as a side effect of `/xce-build
+# controller` -- its default path here follows that move, no longer the same
+# build-dir subdir as $BINARY. XCE_RESVERIFY_XT still lets a caller point at
+# any build dir/layout (e.g. a release build) explicitly.
+XT="${XCE_RESVERIFY_XT:-$BUILD_DIR/harness/xce_test}"
 
 # Single-node cluster, deliberately -- this skill verifies resource-value
 # PROPAGATION (controller -> scheduler -> apiserver), not raft/HA failover
@@ -348,7 +353,14 @@ precondition_checks() {
     [ -x "$BINARY" ]       || fail "controller binary missing: $BINARY (run /xce-build controller)"
     [ -x "$SCHED_BIN" ]    || fail "scheduler binary missing: $SCHED_BIN (run /xce-build scheduler) -- required, this skill verifies the scheduler layer"
     [ -x "$APISERVER_BIN" ] || fail "apiserver binary missing: $APISERVER_BIN (run /xce-build apiserver) -- required, this skill verifies the apiserver layer"
-    [ -x "$XT" ]            || fail "xce_test binary missing: $XT (run /xce-build controller) -- required to join a synthetic worker and run resupdate"
+    # xce-harness-component task 3.1 decoupled xce_test from the controller
+    # build -- it is this script's own driver client (inject_resources()'s
+    # worker-context join/resupdate and internal_controller_check()'s
+    # client-context resval all run through it), so a missing binary here is
+    # fatal, not soft-skippable. Fail with the harness-specific build command
+    # instead of a raw spawn/connect error the first time xtest() tries to
+    # exec a nonexistent path.
+    [ -x "$XT" ]            || fail "xce_test binary missing: $XT (run /xce-build harness) -- required to join a synthetic worker and run resupdate"
     command -v nix >/dev/null 2>&1 || fail "nix not found on PATH -- required to resolve the deploy-environment bash and invoke deploy-ha.sh"
 }
 

.kiro/specs/xce-harness-component/tasks.md

@@ -55,7 +55,7 @@
   - _Requirements: 5.3, 5.4_
   - _Boundary: xce-test-multihost skill_
   - _Depends: 3.1_
-- [ ] 3.5 (P) Update the resource-value verification workflow's harness prerequisite
+- [x] 3.5 (P) Update the resource-value verification workflow's harness prerequisite
   - Update `.claude/skills/xce-test-resources/run-resource-verify.sh` and `SKILL.md`
   - Observable: running the workflow from a build dir where only controller was built either builds the harness itself or reports a clear, actionable message
   - _Requirements: 5.3, 5.4_