Sync GitHub source c58505a47c36d09bda106addf7a584efff47dabd

Canonical source: https://github.com/noqt/Lumi-Eggcracker/commit/c58505a47c36d09bda106addf7a584efff47dabd

HUGGINGFACE_MANIFEST.json

@@ -37,8 +37,8 @@
       "size": 10537
     },
     "README.md": {
-      "sha256": "1b8d7f3b174f049632caf75bfd5078a38675f62e9435280333b23e0b3228c25a",
-      "size": 47072
+      "sha256": "5865613a0fc9459ceb966df471c6554ea52f850ae1aca28ff4801b64f40136c2",
+      "size": 48062
     },
     "RELEASE_NOTES.md": {
       "sha256": "64d330d0f297b15720fc65e6347ececc1b99a917a597d405ebfac04baf3222ea",
@@ -189,7 +189,7 @@
       "size": 4101
     },
     "index.html": {
-      "sha256": "761e39042d3a7bc2e7c860f6a2713f4a25a2ccbfc2ad7935e8b2e2aba00d6a51",
+      "sha256": "47513ce608bbf202b9375a299f73b7a4d87c5b619aa0548d3e38bcc1ad062c3a",
       "size": 22790
     },
     "integrations/prometheus/eggcracker.rules.yml": {
@@ -257,8 +257,8 @@
       "size": 4746
     },
     "scripts/collect_supported_path_receipt.py": {
-      "sha256": "096ecbc59e57112ecbc4e8a62c3ab1278494d941a883923009dd32f9dd730d26",
-      "size": 38862
+      "sha256": "2b03bf35898df0e4246f502be619debb6ac2c04c9c5857273845436fcdf79c6e",
+      "size": 39406
     },
     "scripts/containment_probe.py": {
       "sha256": "104009c1c3f758633012826f3192d3c1f6433977f96b4c80b4f8f8ddfacc26e4",
@@ -601,8 +601,8 @@
       "size": 6820
     },
     "tests/test_collect_supported_path_receipt.py": {
-      "sha256": "b7835ba053678a83e9470ffa2c59cc80882dc024957a132436962760d3ee7258",
-      "size": 49483
+      "sha256": "039089e8149f556e0ebe2038490ceba27f6570eece5379ce4cbd9c533e0e34f9",
+      "size": 55187
     },
     "tests/test_containment.py": {
       "sha256": "168e840c8928ed5521a1f11080b4bb5679c145f66635c8b3785a2fca60f19f06",
@@ -839,6 +839,6 @@
   },
   "schema": "noqt.huggingface_manifest.v1",
   "source_repository": "https://github.com/noqt/Lumi-Eggcracker",
-  "source_revision": "e2dd36acb4ab45506dc2a82ea8bce0c37e235deb",
-  "source_url": "https://github.com/noqt/Lumi-Eggcracker/commit/e2dd36acb4ab45506dc2a82ea8bce0c37e235deb"
+  "source_revision": "c58505a47c36d09bda106addf7a584efff47dabd",
+  "source_url": "https://github.com/noqt/Lumi-Eggcracker/commit/c58505a47c36d09bda106addf7a584efff47dabd"
 }

HUGGINGFACE_SYNC.json

@@ -1,6 +1,6 @@
 {
   "manifest": "HUGGINGFACE_MANIFEST.json",
-  "manifest_sha256": "b13c931844a56bc153a9e276f0b0ebca8ce16c44f62732bfc0f1161553abe57e",
+  "manifest_sha256": "996cd357f7cf84ddcbf18012bfa634ebbf5bdc517363d119143bac484595de29",
   "mirrored_files": 194,
   "mode": "DERIVED_READ_ONLY_MIRROR",
   "release_reference": {
@@ -65,7 +65,7 @@
   },
   "schema": "noqt.huggingface_sync.v1",
   "source_repository": "https://github.com/noqt/Lumi-Eggcracker",
-  "source_revision": "e2dd36acb4ab45506dc2a82ea8bce0c37e235deb",
-  "source_url": "https://github.com/noqt/Lumi-Eggcracker/commit/e2dd36acb4ab45506dc2a82ea8bce0c37e235deb",
+  "source_revision": "c58505a47c36d09bda106addf7a584efff47dabd",
+  "source_url": "https://github.com/noqt/Lumi-Eggcracker/commit/c58505a47c36d09bda106addf7a584efff47dabd",
   "target": "https://huggingface.co/spaces/noqt/eggcracker"
 }

README.md

@@ -11,7 +11,7 @@ short_description: Native Linux kill switch for supported local-AI workloads
 ---
 
 > Official noqt Hugging Face distribution, generated from GitHub commit
-> [`e2dd36acb4ab`](https://github.com/noqt/Lumi-Eggcracker/commit/e2dd36acb4ab45506dc2a82ea8bce0c37e235deb). This Space distributes the source for
+> [`c58505a47c36`](https://github.com/noqt/Lumi-Eggcracker/commit/c58505a47c36d09bda106addf7a584efff47dabd). This Space distributes the source for
 > discovery and cloning; Eggcracker itself runs on a supported native Linux
 > host, not on Hugging Face. A snapshot is called current only after the
 > release-linked sync job verifies its returned Hub commit and full manifest.
@@ -486,6 +486,22 @@ python3 scripts/collect_supported_path_receipt.py \
   --manifest receipt-set.json
 ```
 
+For a shell or CI decision, add `--require-all-supported` to that exact
+summary-only command. This flag is accepted only when both the summary mode
+and its explicit summary opt-in are present; it is rejected for write, verify,
+compare, or any other mode before input is read or output is written. The JSON
+bytes are identical with or without the flag, and a valid summary keeps stderr
+empty: exit `0` means every entry is `supported-success`, exit `1` means at
+least one entry is a declared `reproducible-blocker`, and exit `2` means the
+manifest or a receipt is invalid with no stdout or writes. Without the flag,
+summary exit statuses and bytes remain unchanged.
+
+This optional gate is available only from a source checkout or source build
+containing this change; it is not a claim that the signed v1.0.10 package
+provides the flag. It remains a bounded structural/source-identity decision,
+not receipt trust or authenticity, proof of execution or containment, or an
+enforcement action.
+
 Every manifest entry is checked through the same bounded final-receipt reader
 used by single-file verification. Each receipt is limited to 8 KiB and must be
 a regular, non-link file with valid UTF-8 JSON and the expected source IDs.

index.html

@@ -4,7 +4,7 @@
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <meta name="description" content="Lumi Eggcracker is noqt's native Linux kill switch for unapproved supported local-AI workloads. Clone the complete source from Hugging Face.">
-  <meta name="noqt-source-revision" content="e2dd36acb4ab45506dc2a82ea8bce0c37e235deb">
+  <meta name="noqt-source-revision" content="c58505a47c36d09bda106addf7a584efff47dabd">
   <meta name="theme-color" content="#090a0c">
   <title>Lumi Eggcracker — Native Linux AI kill switch</title>
   <style>
@@ -649,7 +649,7 @@ sudo /usr/bin/python3 -I -S scripts/first_kill.py \
     <section>
       <div class="shell source-bar">
         <div>
-          <div class="source-id">SOURCE COMMIT · e2dd36acb4ab</div>
+          <div class="source-id">SOURCE COMMIT · c58505a47c36</div>
           <h2>Inspect every line.</h2>
           <p>Complete source, tests, qualification documents and reproducible proof tooling are distributed in this repository.</p>
         </div>

scripts/collect_supported_path_receipt.py

@@ -701,6 +701,7 @@ def main(argv: Sequence[str] | None = None) -> int:
             "--i-opt-in-to-summarize-receipts",
             "--i-opt-in-to-summarize-receipt-set",
             "--i-opt-in-to-summary",
+            "--require-all-supported",
         }
         for argument in raw_arguments
     )
@@ -742,6 +743,11 @@ def main(argv: Sequence[str] | None = None) -> int:
         dest="i_opt_in_to_summarize_receipts",
         help="explicitly allow a bounded local receipt-set summary",
     )
+    parser.add_argument(
+        "--require-all-supported",
+        action="store_true",
+        help="exit 1 when a valid receipt-set summary contains a reproducible blocker",
+    )
     parser.add_argument(
         "--expect-source-commit",
         help="expected exact lowercase source commit identity for verification",
@@ -822,11 +828,13 @@ def main(argv: Sequence[str] | None = None) -> int:
             arguments.summary_receipts
             or arguments.summary_manifest is not None
             or arguments.i_opt_in_to_summarize_receipts
+            or arguments.require_all_supported
         )
         if arguments.verify_receipt is not None:
             if (
                 arguments.i_opt_in_to_write_local_receipt
                 or arguments.i_opt_in_to_summarize_receipts
+                or arguments.require_all_supported
                 or arguments.input is not None
                 or arguments.output is not None
                 or arguments.summary_manifest is not None
@@ -887,7 +895,11 @@ def main(argv: Sequence[str] | None = None) -> int:
             if arguments.summary_manifest is None:
                 raise ReceiptInputError("summary mode requires --manifest")
             summary = summarize_receipts(arguments.summary_manifest)
-            sys.stdout.write(_encode_summary(summary).decode("utf-8"))
+            encoded = _encode_summary(summary)
+            sys.stdout.write(encoded.decode("utf-8"))
+            if arguments.require_all_supported:
+                outcome_counts = summary["aggregate"]["outcome_counts"]
+                return 1 if outcome_counts["reproducible-blocker"] else 0
             return 0
         if comparison_requested:
             if (

tests/test_collect_supported_path_receipt.py

@@ -561,6 +561,125 @@ class SupportedPathReceiptTests(unittest.TestCase):
         self.assertEqual(8, summary["aggregate"]["outcome_counts"]["supported-success"])
         self.assertLessEqual(len(result.stdout.encode("utf-8")), collector.MAX_SUMMARY_OUTPUT_BYTES)
 
+    def test_require_all_supported_keeps_all_success_summary_bytes_and_exits_zero(self) -> None:
+        with TemporaryDirectory() as directory:
+            entries: list[dict[str, object]] = []
+            for index in range(8):
+                commit = f"{index + 1:040x}"
+                tree = f"{index + 1:064x}"
+                receipt, _encoded = self.write_final_receipt(
+                    directory,
+                    observed=success_observed(
+                        source_commit=commit,
+                        source_tree_sha256=tree,
+                    ),
+                    name=f"success-{index}.json",
+                )
+                entries.append(self.summary_entry(receipt, commit=commit, tree=tree))
+            manifest = self.write_summary_manifest(directory, entries)
+            unflagged = self.run_summary_cli(manifest)
+            flagged = self.run_summary_cli(manifest, extra=["--require-all-supported"])
+        self.assertEqual(0, unflagged.returncode)
+        self.assertEqual(0, flagged.returncode)
+        self.assertEqual(unflagged.stdout, flagged.stdout)
+        self.assertEqual("", flagged.stderr)
+
+    def test_require_all_supported_returns_one_for_blocker_with_identical_summary_bytes(self) -> None:
+        with TemporaryDirectory() as directory:
+            first, _first_encoded = self.write_final_receipt(
+                directory, observed=success_observed(), name="success.json"
+            )
+            blocker_commit = "c" * 40
+            blocker_tree = "d" * 64
+            second, _second_encoded = self.write_final_receipt(
+                directory,
+                observed=blocker_observed(
+                    source_commit=blocker_commit,
+                    source_tree_sha256=blocker_tree,
+                ),
+                name="blocker.json",
+            )
+            manifest = self.write_summary_manifest(
+                directory,
+                [
+                    self.summary_entry(first),
+                    self.summary_entry(second, commit=blocker_commit, tree=blocker_tree),
+                ],
+            )
+            unflagged = self.run_summary_cli(manifest)
+            flagged = self.run_summary_cli(manifest, extra=["--require-all-supported"])
+        self.assertEqual(0, unflagged.returncode)
+        self.assertEqual(1, flagged.returncode)
+        self.assertEqual(unflagged.stdout, flagged.stdout)
+        self.assertEqual("", flagged.stderr)
+
+    def test_require_all_supported_rejects_non_summary_modes_without_partial_output(self) -> None:
+        private_marker = "private-require-all-input"
+        with TemporaryDirectory() as directory:
+            source = Path(directory) / "input.json"
+            source_bytes = json.dumps({"private": private_marker}).encode("utf-8")
+            source.write_bytes(source_bytes)
+            output = Path(directory) / "receipt.json"
+            result = subprocess.run(
+                [
+                    sys.executable,
+                    str(SCRIPT),
+                    "--require-all-supported",
+                    "--i-opt-in-to-write-local-receipt",
+                    "--input",
+                    str(source),
+                    "--output",
+                    str(output),
+                ],
+                cwd=ROOT,
+                capture_output=True,
+                check=False,
+                text=True,
+            )
+            self.assertEqual(source_bytes, source.read_bytes())
+            self.assertFalse(output.exists())
+        self.assertEqual(2, result.returncode)
+        self.assertEqual("", result.stdout)
+        self.assertTrue(result.stderr.startswith("NOT SUMMARIZED:"))
+        self.assertNotIn(private_marker, result.stderr)
+
+    def test_require_all_supported_requires_summary_opt_in_without_stdout_or_writes(self) -> None:
+        with TemporaryDirectory() as directory:
+            receipt, receipt_bytes = self.write_final_receipt(directory, name="valid.json")
+            manifest = self.write_summary_manifest(
+                directory,
+                [self.summary_entry(receipt), self.summary_entry(receipt.with_name("missing.json"))],
+            )
+            manifest_bytes = manifest.read_bytes()
+            result = self.run_summary_cli(
+                manifest,
+                opt_in=False,
+                extra=["--require-all-supported"],
+            )
+            self.assertEqual(receipt_bytes, receipt.read_bytes())
+            self.assertEqual(manifest_bytes, manifest.read_bytes())
+            self.assertFalse((Path(directory) / "summary.json").exists())
+        self.assertEqual(2, result.returncode)
+        self.assertEqual("", result.stdout)
+        self.assertTrue(result.stderr.startswith("NOT SUMMARIZED:"))
+
+    def test_require_all_supported_invalid_set_has_no_partial_output_or_input_changes(self) -> None:
+        with TemporaryDirectory() as directory:
+            receipt, receipt_bytes = self.write_final_receipt(directory, name="valid.json")
+            missing = Path(directory) / "missing.json"
+            manifest = self.write_summary_manifest(
+                directory,
+                [self.summary_entry(receipt), self.summary_entry(missing)],
+            )
+            manifest_bytes = manifest.read_bytes()
+            result = self.run_summary_cli(manifest, extra=["--require-all-supported"])
+            self.assertEqual(receipt_bytes, receipt.read_bytes())
+            self.assertEqual(manifest_bytes, manifest.read_bytes())
+            self.assertFalse((Path(directory) / "summary.json").exists())
+        self.assertEqual(2, result.returncode)
+        self.assertEqual("", result.stdout)
+        self.assertTrue(result.stderr.startswith("NOT SUMMARIZED:"))
+
     def test_summary_cli_requires_distinct_opt_in(self) -> None:
         with TemporaryDirectory() as directory:
             receipt, _encoded = self.write_final_receipt(directory)