Sync GitHub source 230f393a334d767a9d19960ee19ee03ea2e4e770

Canonical source: https://github.com/noqt/Lumi-Eggcracker/commit/230f393a334d767a9d19960ee19ee03ea2e4e770

HUGGINGFACE_MANIFEST.json

@@ -37,8 +37,8 @@
       "size": 10537
     },
     "README.md": {
-      "sha256": "590c33938d8109de2320d46b2aa0d4c981ff53f7b57877f78e666dff49ea8a83",
-      "size": 29143
+      "sha256": "50186f966a36057d967a5d65b05d880452f5dd072de7c02d9d6f641e9df37a6e",
+      "size": 29887
     },
     "RELEASE_NOTES.md": {
       "sha256": "64d330d0f297b15720fc65e6347ececc1b99a917a597d405ebfac04baf3222ea",
@@ -77,8 +77,8 @@
       "size": 14858
     },
     "docs/DETECTION_RECEIPT_EXPORT.md": {
-      "sha256": "a97307fd0648918f84d56c5875e2edaa482689272032cdaad2b377b5335eebe3",
-      "size": 9096
+      "sha256": "19917c226177fb93ddf91d0b0c4a4ff7e6b9af792a70837617d1bf3e69f959da",
+      "size": 9564
     },
     "docs/HUGGINGFACE_DISTRIBUTION.md": {
       "sha256": "b68000aa30407ef1837bc4ca7e6eabe50645911a76250b14570847c507b916e1",
@@ -189,7 +189,7 @@
       "size": 4101
     },
     "index.html": {
-      "sha256": "75d7d87b0f617cf5e50030fc939a7ad0d2b68ee0c9f38f02bf3517b636bd0f87",
+      "sha256": "01c0357580b6da52284b953952bd825b24ba71c388fca1a0bd0ece70808fa431",
       "size": 22790
     },
     "integrations/prometheus/eggcracker.rules.yml": {
@@ -425,8 +425,8 @@
       "size": 549
     },
     "src/lumi_eggcracker/brokered/compare_detection_receipts.py": {
-      "sha256": "f31d84d46d5587776fb2fdef83ed0da6809ef59cb3d7c4441df092970c8e8f0e",
-      "size": 24272
+      "sha256": "c9952a0226354b1aa76b84c5dcc5dac30a7b782869435254c23caf1018fa344d",
+      "size": 24308
     },
     "src/lumi_eggcracker/brokered/linux_ipc.py": {
       "sha256": "6c26fd8b79f013bbbec931aa30f7c0b6c1a7de70368fcaf6121de1db39f6cff2",
@@ -437,8 +437,8 @@
       "size": 55591
     },
     "src/lumi_eggcracker/cli.py": {
-      "sha256": "d350bf345d5e05fd56970b152252e8aaefa6256654c501a9c276e5c55b7ce8ed",
-      "size": 10117
+      "sha256": "ca7675de60a8a58d303f924f4a0f2f3a89346f29cf02cd3dba52bd8112c722d4",
+      "size": 10518
     },
     "src/lumi_eggcracker/client.py": {
       "sha256": "0ac5dd4fdf564b2b7fd9e74de66d9ff083ac153864867b69fc078da9d66bbc66",
@@ -589,8 +589,8 @@
       "size": 7176
     },
     "tests/test_cli.py": {
-      "sha256": "50b1fed650b68c6648cc9934a24b3ea5e203a04dcabce11bb417ada8238932aa",
-      "size": 6908
+      "sha256": "b03872e0b0ebffaeb964eceb85320115b76a6c5ece5b0bce64d79a9a575b7db1",
+      "size": 12128
     },
     "tests/test_collect_supported_path_receipt.py": {
       "sha256": "79ae57bf3d78cac5fbe1b9d7db60462328f70cb17214bc75a5b5e7eff3ea0eef",
@@ -827,6 +827,6 @@
   },
   "schema": "noqt.huggingface_manifest.v1",
   "source_repository": "https://github.com/noqt/Lumi-Eggcracker",
-  "source_revision": "ad43fa130460ba5e2743524a12e4907aa5cc3731",
-  "source_url": "https://github.com/noqt/Lumi-Eggcracker/commit/ad43fa130460ba5e2743524a12e4907aa5cc3731"
+  "source_revision": "230f393a334d767a9d19960ee19ee03ea2e4e770",
+  "source_url": "https://github.com/noqt/Lumi-Eggcracker/commit/230f393a334d767a9d19960ee19ee03ea2e4e770"
 }

HUGGINGFACE_SYNC.json

@@ -1,6 +1,6 @@
 {
   "manifest": "HUGGINGFACE_MANIFEST.json",
-  "manifest_sha256": "a36c3105950b5fadc687451666db75490b12e1dad2fdf5fb9ab5e3a1be796ffd",
+  "manifest_sha256": "c3daf4ec06f808bc036393a7f1ce77892da6d8d05ed1bf542314761e31b181c3",
   "mirrored_files": 191,
   "mode": "DERIVED_READ_ONLY_MIRROR",
   "release_reference": {
@@ -65,7 +65,7 @@
   },
   "schema": "noqt.huggingface_sync.v1",
   "source_repository": "https://github.com/noqt/Lumi-Eggcracker",
-  "source_revision": "ad43fa130460ba5e2743524a12e4907aa5cc3731",
-  "source_url": "https://github.com/noqt/Lumi-Eggcracker/commit/ad43fa130460ba5e2743524a12e4907aa5cc3731",
+  "source_revision": "230f393a334d767a9d19960ee19ee03ea2e4e770",
+  "source_url": "https://github.com/noqt/Lumi-Eggcracker/commit/230f393a334d767a9d19960ee19ee03ea2e4e770",
   "target": "https://huggingface.co/spaces/noqt/eggcracker"
 }

README.md

@@ -11,7 +11,7 @@ short_description: Native Linux kill switch for supported local-AI workloads
 ---
 
 > Official noqt Hugging Face distribution, generated from GitHub commit
-> [`ad43fa130460`](https://github.com/noqt/Lumi-Eggcracker/commit/ad43fa130460ba5e2743524a12e4907aa5cc3731). This Space distributes the source for
+> [`230f393a334d`](https://github.com/noqt/Lumi-Eggcracker/commit/230f393a334d767a9d19960ee19ee03ea2e4e770). This Space distributes the source for
 > discovery and cloning; Eggcracker itself runs on a supported native Linux
 > host, not on Hugging Face. A snapshot is called current only after the
 > release-linked sync job verifies its returned Hub commit and full manifest.
@@ -499,6 +499,25 @@ check is structural validation only, not authentication, privacy assurance,
 completeness, containment or incident truth. It does not certify that a bundle
 is safe to share; review the file yourself before attaching it.
 
+## Compare detection receipt exports
+
+The published v1.0.10 package does not include this installed subcommand. After
+building and installing a package or wheel from source that contains this
+change, compare two redacted detection receipt exports with the offline CLI
+command:
+
+```sh
+eggcracker compare-detection-receipts \
+  --before ./before-export.json \
+  --after ./after-export.json
+```
+
+Use `--output ./comparison.json` to write the bounded JSON report to a new
+file. The command refuses to replace an existing output. It compares recorded
+exports only; it does not authenticate them or verify a live workload. See
+[the export and comparison guide](docs/DETECTION_RECEIPT_EXPORT.md) for input,
+output, redaction and filesystem behavior.
+
 ## Install and remove
 
 The first-kill command is the recommended campaign path. A release is complete

docs/DETECTION_RECEIPT_EXPORT.md

@@ -124,25 +124,38 @@ and filesystem operations.
 
 ## Comparing two redacted exports
 
-The offline comparator validates two existing exports and reports only the
-same bounded recorded-context comparison to stdout:
+A package or wheel built from source that contains this change exposes the
+comparator through the installed `eggcracker` command as an additive, offline
+subcommand. The published v1.0.10 package does not include this subcommand. It
+validates exactly two existing exports and reports only the bounded
+recorded-context comparison to stdout:
 
 ```sh
-python src/lumi_eggcracker/brokered/compare_detection_receipts.py \
+eggcracker compare-detection-receipts \
   --before ./before-export.json \
   --after ./after-export.json
 ```
 
-The optional `--output FILE` writes those exact UTF-8 JSON bytes, including the
-final newline, to a new comparison file instead of writing JSON to stdout:
+Run `eggcracker compare-detection-receipts --help` to see the installed
+command's options. The optional `--output FILE` writes those exact UTF-8 JSON
+bytes, including the final newline, to a new comparison file instead of writing
+JSON to stdout:
 
 ```sh
-python src/lumi_eggcracker/brokered/compare_detection_receipts.py \
+eggcracker compare-detection-receipts \
   --before ./before-export.json \
   --after ./after-export.json \
   --output ./comparison.json
 ```
 
+The source checkout also retains direct invocation of the comparator module:
+
+```sh
+python src/lumi_eggcracker/brokered/compare_detection_receipts.py \
+  --before ./before-export.json \
+  --after ./after-export.json
+```
+
 On successful file output, stdout remains empty and the comparator prints only
 `comparison written` to stderr. With no `--output`, stdout behavior remains the
 original comparison JSON. Both exports are fully validated and the existing

index.html

@@ -4,7 +4,7 @@
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <meta name="description" content="Lumi Eggcracker is noqt's native Linux kill switch for unapproved supported local-AI workloads. Clone the complete source from Hugging Face.">
-  <meta name="noqt-source-revision" content="ad43fa130460ba5e2743524a12e4907aa5cc3731">
+  <meta name="noqt-source-revision" content="230f393a334d767a9d19960ee19ee03ea2e4e770">
   <meta name="theme-color" content="#090a0c">
   <title>Lumi Eggcracker — Native Linux AI kill switch</title>
   <style>
@@ -649,7 +649,7 @@ sudo /usr/bin/python3 -I -S scripts/first_kill.py \
     <section>
       <div class="shell source-bar">
         <div>
-          <div class="source-id">SOURCE COMMIT · ad43fa130460</div>
+          <div class="source-id">SOURCE COMMIT · 230f393a334d</div>
           <h2>Inspect every line.</h2>
           <p>Complete source, tests, qualification documents and reproducible proof tooling are distributed in this repository.</p>
         </div>

src/lumi_eggcracker/brokered/compare_detection_receipts.py

@@ -686,9 +686,13 @@ class _QuietArgumentParser(argparse.ArgumentParser):
         self.exit(2, f"{self.prog}: invalid command line\n")
 
 
-def main(argv: list[str] | None = None) -> int:
+def main(
+    argv: list[str] | None = None,
+    *,
+    prog: str = "compare_detection_receipts.py",
+) -> int:
     parser = _QuietArgumentParser(
-        prog="compare_detection_receipts.py",
+        prog=prog,
         description="Compare two explicit redacted detection receipt exports.",
     )
     parser.add_argument("--before", required=True, metavar="FILE", help="first export file")

src/lumi_eggcracker/cli.py

@@ -9,6 +9,7 @@ import sys
 from pathlib import Path
 
 from . import __version__
+from .brokered.compare_detection_receipts import main as compare_detection_receipts_main
 from .client import request
 from .gate import main as gate_main
 from .jsonio import JsonInputError, write_new_json
@@ -111,6 +112,10 @@ def _parser() -> argparse.ArgumentParser:
         help="offline structural review of a support bundle",
     )
     validate_support.add_argument("FILE", type=Path)
+    commands.add_parser(
+        "compare-detection-receipts",
+        help="compare two redacted detection receipt exports",
+    )
     commands.add_parser("version", help="print the public version")
     return parser
 
@@ -121,6 +126,10 @@ def _command(argv: list[str]) -> list[str]:
 
 def main(argv: list[str] | None = None) -> int:
     values = sys.argv[1:] if argv is None else argv
+    if values[:1] == ["compare-detection-receipts"]:
+        return compare_detection_receipts_main(
+            values[1:], prog="eggcracker compare-detection-receipts"
+        )
     if values[:1] == ["validate-support-bundle"]:
         if values[1:] == ["--help"]:
             _parser().parse_args(values)

tests/test_cli.py

@@ -1,8 +1,11 @@
 from __future__ import annotations
 
 import io
+import json
+import tempfile
 import unittest
 from contextlib import redirect_stderr, redirect_stdout
+from pathlib import Path
 from unittest.mock import patch
 
 from lumi_eggcracker.cli import main
@@ -30,6 +33,7 @@ class CliTests(unittest.TestCase):
             "doctor",
             "support-bundle",
             "validate-support-bundle",
+            "compare-detection-receipts",
             "version",
         ):
             self.assertIn(command, help_text)
@@ -37,6 +41,125 @@ class CliTests(unittest.TestCase):
         self.assertNotIn("_supervisor", help_text)
         self.assertNotIn("network" + "-deny", help_text)
 
+    def test_compare_detection_receipts_help_uses_installed_command(self) -> None:
+        output = io.StringIO()
+        with redirect_stdout(output), self.assertRaises(SystemExit) as raised:
+            main(["compare-detection-receipts", "--help"])
+        self.assertEqual(0, raised.exception.code)
+        self.assertIn("usage: eggcracker compare-detection-receipts", output.getvalue())
+        self.assertIn("--before FILE", output.getvalue())
+        self.assertIn("--after FILE", output.getvalue())
+
+    def test_compare_detection_receipts_forwards_arguments_before_connected_commands(
+        self,
+    ) -> None:
+        forwarded = [
+            "--before",
+            "before-export.json",
+            "--after",
+            "after-export.json",
+            "--output",
+            "comparison.json",
+        ]
+        with (
+            patch(
+                "lumi_eggcracker.cli.compare_detection_receipts_main", return_value=0
+            ) as compare,
+            patch("lumi_eggcracker.cli.request") as request,
+            patch("lumi_eggcracker.cli.supervisor_main") as supervisor,
+            patch("lumi_eggcracker.cli.gate_main") as gate,
+            patch("lumi_eggcracker.cli.watchdog_main") as watchdog,
+        ):
+            self.assertEqual(0, main(["compare-detection-receipts", *forwarded]))
+        compare.assert_called_once_with(
+            forwarded, prog="eggcracker compare-detection-receipts"
+        )
+        request.assert_not_called()
+        supervisor.assert_not_called()
+        gate.assert_not_called()
+        watchdog.assert_not_called()
+
+    def test_compare_detection_receipts_success_and_existing_output_refusal(self) -> None:
+        def synthetic_export(event_id: str) -> dict[str, object]:
+            return {
+                "export_schema": "lumi-eggcracker.redacted-detection-receipt-export.v1",
+                "source_sha256": "f" * 64,
+                "authentication": "NOT_AUTHENTICATED",
+                "live_verification": "NOT_PERFORMED",
+                "receipt": {
+                    "schema_version": "lumi-eggcracker.detection-receipt.v2",
+                    "event_id": event_id,
+                    "source_commit": "a" * 40,
+                    "version": "1.0.10",
+                    "catalogue_sha256": "b" * 64,
+                    "receipt_written_utc": "2026-10-02T00:00:00Z",
+                    "detector": {
+                        "profile": "content.gguf-llama",
+                        "detection_path": "CONTENT",
+                        "catalogue_schema": "lumi-eggcracker.detectors.v3",
+                    },
+                    "trigger": {"kind": "UNAPPROVED_AI_MATCH"},
+                    "recorded_result": "CONTAINMENT_FAILED",
+                },
+            }
+
+        with tempfile.TemporaryDirectory(prefix="cli-receipt-comparison-") as directory:
+            root = Path(directory)
+            before = root / "before.json"
+            after = root / "after.json"
+            before.write_text(json.dumps(synthetic_export("0" * 24)), encoding="utf-8")
+            after.write_text(json.dumps(synthetic_export("1" * 24)), encoding="utf-8")
+            output = root / "existing-comparison.json"
+            original_output = b"preserve this synthetic report\n"
+            output.write_bytes(original_output)
+
+            stdout = io.StringIO()
+            stderr = io.StringIO()
+            with (
+                patch("lumi_eggcracker.cli.request") as request,
+                patch("lumi_eggcracker.cli.supervisor_main") as supervisor,
+                redirect_stdout(stdout),
+                redirect_stderr(stderr),
+            ):
+                self.assertEqual(
+                    0,
+                    main(
+                        [
+                            "compare-detection-receipts",
+                            "--before",
+                            str(before),
+                            "--after",
+                            str(after),
+                        ]
+                    ),
+                )
+                comparison = json.loads(stdout.getvalue())
+                self.assertEqual("RECORDED", comparison["comparison_status"])
+                self.assertEqual("", stderr.getvalue())
+                stdout.seek(0)
+                stdout.truncate(0)
+                stderr.seek(0)
+                stderr.truncate(0)
+                self.assertEqual(
+                    1,
+                    main(
+                        [
+                            "compare-detection-receipts",
+                            "--before",
+                            str(before),
+                            "--after",
+                            str(after),
+                            "--output",
+                            str(output),
+                        ]
+                    ),
+                )
+                self.assertEqual("", stdout.getvalue())
+                self.assertIn("OUTPUT_ALREADY_EXISTS", stderr.getvalue())
+                request.assert_not_called()
+                supervisor.assert_not_called()
+            self.assertEqual(original_output, output.read_bytes())
+
     def test_validate_support_bundle_dispatches_before_connected_commands(self) -> None:
         with (
             patch("lumi_eggcracker.cli.validate_support_bundle_main", return_value=0) as validate,