Why don't use harvest_object.package_id? Seems more safe as potentially other harvesters where guid != package_id could extend the base one.