@@ -0,0 +1,112 @@
+name: __tmp verify native-dep guard (DROP BEFORE MERGE)
+
+# TEMPORARY instrumentation to capture real CI fail/pass evidence for the
+# agent-SDK native-optional-dep guard. Dropped before the PR is opened; the
+# captured run URLs remain valid in the Actions history. Mirrors the approach
+# used in #324064.
+
+on:
+  push:
+    branches:
+      - guard-agent-sdk-native-deps
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: tmp-native-dep-guard-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  # Flip to "1" to force the missing-native-dep condition (FAIL run); "0" for a
+  # healthy build (PASS run).
+  INSTRUMENT_FAIL: "1"
+
+jobs:
+  cli-check:
+    name: CLI check (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+
+      - name: Run refactored checkNativeOptionalDeps.ts against a synthetic node_modules
+        shell: bash
+        run: |
+          set -e
+          suffix=$(node -p "process.platform + '-' + process.arch")
+          echo "Host native package suffix: $suffix (INSTRUMENT_FAIL=$INSTRUMENT_FAIL)"
+          # Base packages present …
+          mkdir -p "node_modules/@openai/codex" "node_modules/@anthropic-ai/claude-agent-sdk"
+          # … per-platform native packages present only in the PASS case.
+          if [ "$INSTRUMENT_FAIL" != "1" ]; then
+            mkdir -p "node_modules/@openai/codex-$suffix" "node_modules/@anthropic-ai/claude-agent-sdk-$suffix"
+          fi
+          node build/azure-pipelines/common/checkNativeOptionalDeps.ts
+
+  release-guard:
+    name: Release guard via produce.ts (${{ matrix.vscodePlatform }}-${{ matrix.arch }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            vscodePlatform: linux
+            arch: x64
+          - os: macos-latest
+            vscodePlatform: darwin
+            arch: arm64
+          - os: windows-latest
+            vscodePlatform: win32
+            arch: x64
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+
+      - name: Provide produce.ts runtime deps (tar, @azure/*) without a full root install
+        shell: bash
+        run: |
+          set -e
+          # produce.ts statically imports package.ts (-> `tar`) and upload.ts
+          # (-> `@azure/identity`, `@azure/storage-blob`). In the real pipeline
+          # these resolve from the root node_modules created by a full `npm ci`.
+          # For this cheap check we install only those three into an isolated
+          # project and stage them into a root node_modules so ESM resolution
+          # succeeds and execution reaches the guard in buildOne. buildOne's own
+          # scratch `npm ci` is unaffected (separate dir).
+          tmp="$(mktemp -d)"
+          ( cd "$tmp" && npm init -y >/dev/null 2>&1 && npm install --no-audit --no-fund --loglevel=error tar@^7.5.16 @azure/identity @azure/storage-blob )
+          mkdir -p node_modules
+          cp -R "$tmp/node_modules/." node_modules/
+          test -d node_modules/tar && test -d node_modules/@azure/identity && test -d node_modules/@azure/storage-blob && echo "produce.ts runtime deps staged into root node_modules"
+
+      - name: Run produce.ts (buildOne) for ${{ matrix.vscodePlatform }}-${{ matrix.arch }}
+        shell: bash
+        run: |
+          set -e
+          if [ "$INSTRUMENT_FAIL" = "1" ]; then
+            # Reproduce the real bug: npm silently skips the optional native
+            # package. The guard in buildOne must throw and produce.ts must exit
+            # non-zero instead of building a binary-less tarball.
+            echo "Instrumenting failure: npm_config_omit=optional"
+            export npm_config_omit=optional
+          fi
+          node build/agent-sdk/produce.ts --vscode-platform=${{ matrix.vscodePlatform }} --arch=${{ matrix.arch }}