Merge reviewed Eggcracker guidance and truthful self-service surface

Integrates only the independently accepted attribution, repository guidance, and public-surface changes. No GitHub Release, package publication, deployment, repository-settings change, or expanded product claim.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,16 +1,16 @@
 name: Bug report
-description: Report a reproducible Lumi Nutcracker defect
+description: Report a reproducible Eggcracker defect (sign-in and repository permission required)
 title: "[Bug]: "
 labels: [bug]
 body:
   - type: markdown
     attributes:
-      value: Do not include credentials, private model files or sensitive exploit details. Use private vulnerability reporting for security issues.
+      value: GitHub currently restricts issue creation in this repository, so this tracked form is not an anonymous feedback channel. If you have permission to open an issue, do not include credentials, private model files or sensitive exploit details. Use private vulnerability reporting for security issues.
   - type: input
     id: version
     attributes:
       label: Version
-      placeholder: 0.1.0
+      placeholder: 0.4.0 or exact source commit
     validations:
       required: true
   - type: input

.github/pull_request_template.md

@@ -1,6 +1,6 @@
 ## Summary
 
-Describe the user-visible change and why it belongs in Lumi Eggcracker's narrow kill-switch scope.
+Describe the user-visible change and why it belongs in Eggcracker's narrow kill-switch scope.
 
 ## Verification
 

AGENTS.md

@@ -0,0 +1,151 @@
+# Eggcracker repository instructions
+
+These instructions apply to the whole repository. A deeper `AGENTS.md` may add
+narrower rules for its subtree, but it may not relax the safety, evidence,
+rights, preservation, or publication boundaries below.
+
+## Authority and source truth
+
+1. Exact action-specific founder, legal, risk, and publication authority in the
+   governing company control plane takes precedence.
+2. An accepted bounded work order controls scope, branch, worktree, tests, and
+   stop conditions.
+3. This file controls repository-local execution. Current tracked source,
+   tests, `README.md`, `SECURITY_MODEL.md`, `LIMITATIONS.md`, and
+   `QUALIFICATION.md` are the product-behaviour evidence to reconcile, not
+   permission to broaden an action.
+
+The public source repository is
+`https://github.com/noqt/Lumi-Eggcracker`. Bind work to an exact commit; do not
+treat a local branch name, stale local `main`, tag, build, or worktree as proof
+of current public state. On an instruction, source, documentation, or evidence
+conflict, preserve the state and stop the affected claim or mutation until the
+conflict is reconciled.
+
+## Destructive enforcement boundary
+
+Eggcracker is a privileged native-Linux enforcement daemon, not an alert-only
+tool. An unapproved **complete** match to an active qualified profile is stopped,
+captured into the exact delegated cgroup, and automatically killed with
+`cgroup.kill`; it does not wait for operator confirmation. Root installation,
+native discovery, containment, watchdog, cgroup, or uninstall tests may run only
+under an explicit bounded assignment in a disposable supported Linux
+environment whose loss is acceptable. Record the exact host/VM, kernel,
+systemd/cgroup-v2 capabilities, operator, commit, artifacts, and cleanup result.
+Never run destructive qualification on a workstation, server, shared host, or
+non-disposable environment.
+
+Exactly two profiles are active in version 0.4.0:
+
+- `content.gguf-llama`: a bounded plausible GGUF v2/v3 header plus either the
+  qualified llama.cpp/GGML ELF marker pair or the exact pinned launcher build
+  ID.
+- `content.safetensors-pytorch`: a structurally valid contiguous Safetensors
+  artifact plus the exact pinned CPU PyTorch bridge-and-ATen ELF build-ID pair,
+  observed in one process or the documented bounded related workload using the
+  dedicated workload UID.
+
+Name-only Ollama, vLLM, TGI, LocalAI, llamafile, agent-CLI, and other catalogue
+entries are inactive research until separately qualified. Do not claim
+universal or arbitrary AI/agent/runtime identification, proof of inference,
+malware prevention or detection, IDS/EDR capability, sandboxing, network,
+credential, or filesystem isolation, container/cloud/remote-API protection,
+zero escape, or protection of unobserved or already-escaped processes. A receipt
+proves only that the exact captured quarantine cgroup was empty at the recorded
+point.
+
+## Evidence and claims
+
+Use only these evidence labels:
+
+- `OBSERVED`: directly inspected fact, bound to source, time, and identity.
+- `IMPLEMENTED_INTERNAL`: present in an exact commit or artifact and exercised
+  by named internal checks; not independent use or market evidence.
+- `INTENDED`: planned or designed but not demonstrated as implemented.
+- `UNSUPPORTED`: absent, conflicting, stale, or insufficient evidence; do not
+  present the claim as fact.
+
+Bind every technical result to the exact commit and artifact hash, test command,
+OS/host or VM, Python version, timestamp, and relevant skips or limitations.
+Do not generalise a fixture, internal Windows control run, one Linux host, CI
+run, or receipt into universal capability, native qualification on another
+host, independent installation, adoption, demand, or safety assurance.
+
+Current release snapshot, recorded 12 August 2026 and requiring revalidation
+before any external use:
+
+- public annotated `v0.4.0` and its CI run are bound to
+  `418f877f0d450aeb26d4a1233257746808c490e5`; the recorded CI passed Ruff,
+  69 unit tests, build, and release verification;
+- no matching GitHub Release was observed; and
+- local commit `a3ad746682c89599ce582cd97acf5a99742dc3aa` is an unpushed
+  attribution-only descendant. Its exact candidate has **internal Windows
+  control evidence** accepted by a separate internal control reviewer for Ruff,
+  69 tests with three documented Windows skips, build/release verification,
+  hashes, archive identity, and preservation. This was an internal control
+  review, not an independent external audit or assessment. It is not public,
+  native-Linux qualification, independent use, or market evidence.
+
+## Proportional verification
+
+Run only checks material to the change, and report what actually ran:
+
+- documentation-only: instruction precedence, links and repository paths,
+  evidence/claim vocabulary, prohibited-claim scan, one-file scope where
+  applicable, and `git diff --check`;
+- Python or behavioural change: Ruff and the complete unit-test suite;
+- packaging or release-material change: Ruff, unit tests, release build, and
+  `verify_release.py`, with exact artifact hashes; and
+- detector, profile, approval, root boundary, cgroup, watchdog, containment,
+  install/uninstall, or other security-material change: all applicable checks
+  above plus the complete commit- and host-bound native qualification in
+  `QUALIFICATION.md`, inside the disposable supported Linux environment.
+
+A Windows pass cannot substitute for a native gate. Do not silently weaken a
+test, skip, threshold, negative control, or qualification matrix to obtain PASS.
+
+## Preservation, compatibility, and rights
+
+Treat Git history, tags, untracked files, generated candidates, evidence packs,
+receipts, manifests, checksum files, and release artifacts as protected. Before
+mutation, inventory the original checkout and all worktrees; after mutation,
+prove preservation. Never use destructive reset, clean, history rewrite,
+force-push, tag replacement, bulk overwrite, or deletion without exact
+authority. Write new evidence and artifacts to a fresh task- and commit-bound
+location, hash them, and stage only an explicit intended file list.
+
+Preserve established repository, package, command, socket, policy, receipt,
+manifest, artifact, and schema identifiers unless an authorised compatibility
+plan proves the transition. The project is Apache-2.0: retain `LICENSE` and all
+applicable notices and third-party terms. Do not change legal holders,
+copyright/attribution, licence posture, or add a materially licensed dependency
+without the corresponding reserved review and authority. Do not invent,
+introduce, or infer a current company brand; preserve existing product and
+technical identifiers where compatibility or provenance requires them.
+
+Local branches, permanent worktrees, commits, test artifacts, and release
+preparation are not pushes, tags, GitHub Releases, deployments, publication, or
+public claims. Perform any product-remote push, tag creation/change, release,
+deployment, or publication only with exact action-specific authority for this
+repository, after independent review. Silence, an existing public tag, passing
+CI, or a locally accepted candidate is not publication authority.
+
+## Runtime, privacy, and secrets
+
+In the controlled local execution environment, operate only on F: and G:.
+Before any runtime, test, or tool that may use temporary or cache storage, create
+a task-specific `[TASK_TEMP]` on F: or G: with
+`New-Item -Path [TASK_TEMP] -ItemType Directory -Force -ErrorAction Stop` (do
+not substitute `-LiteralPath` on `New-Item`); resolve it, prove it exists as a
+directory on exactly F: or G:, set `TEMP`, `TMP`, `TMPDIR`, and
+`PYTHONDONTWRITEBYTECODE`, and start a fresh runtime that asserts its selected
+temporary directory resolves exactly to `[TASK_TEMP]`. Abort before substantive
+execution on creation, resolution, drive, or equality failure. Disable caches
+or bind them explicitly to F: or G:.
+`Environment-variable assignment alone is not evidence.`
+
+Do not inspect credential stores, reveal secrets, commit machine-specific paths,
+personal data, raw process arguments or environments, private external data, or
+customer/user material. Use synthetic fixtures and redacted, bounded evidence.
+Raw arguments and environment values do not belong in approvals, detections,
+receipts, logs, or committed guidance.

LIMITATIONS.md

@@ -1,6 +1,13 @@
 # Limitations
 
-Lumi Eggcracker 0.4.0 autonomously acts only on a complete match from its two active, publicly qualified content profiles. Its content path supports a regular GGUF v2/v3 artifact combined with a qualified llama.cpp/GGML ELF runtime, or a regular Safetensors artifact combined with the exact pinned CPU PyTorch bridge-plus-ATen ELF build-ID pair. The two evidence groups may be observed in one process or across a bounded related workload using the installed dedicated workload UID: a live direct parent/child or sibling relation, or one exact Eggcracker-owned workload cgroup. Unrelated same-UID or common-init processes are not joined. There is no guarantee for evidence that escaped before observation, unobserved processes, or containerised or remote workloads. It does not recognise arbitrary, custom, fully stripped, encrypted or otherwise unlisted AI/agent workloads.
+Eggcracker 0.4.0 autonomously acts only on a complete match from its two active, contract-qualified content profiles. Its content path supports a regular GGUF v2/v3 artifact combined with a qualified llama.cpp/GGML ELF runtime, or a regular Safetensors artifact combined with the exact pinned CPU PyTorch bridge-plus-ATen ELF build-ID pair. The two evidence groups may be observed in one process or across a bounded related workload using the installed dedicated workload UID: a live direct parent/child or sibling relation, or one exact Eggcracker-owned workload cgroup. Unrelated same-UID or common-init processes are not joined. There is no guarantee for evidence that escaped before observation, unobserved processes, or containerised or remote workloads. It does not recognise arbitrary, custom, fully stripped, encrypted or otherwise unlisted AI/agent workloads.
+
+The qualification contract is published in `QUALIFICATION.md`. Project records
+report a complete native result for exact commit
+`418f877f0d450aeb26d4a1233257746808c490e5` on one WSL2 Ubuntu host, but the
+checksum-bound evidence pack is not retained in this repository or a public
+GitHub Release. That project-recorded result is not independently re-verifiable
+from the durable public surface and does not qualify another commit or host.
 
 Name-only profiles for Ollama, vLLM, TGI, LocalAI, llamafile and agent CLIs are intentionally not active in this release. They require exact invocation fixtures and launcher-identity qualification before they can become destructive profiles.
 

QUALIFICATION.md

@@ -1,5 +1,15 @@
 # Qualification
 
+This file defines the native qualification contract for an exact candidate and
+host. Project records report a complete result for commit
+`418f877f0d450aeb26d4a1233257746808c490e5` on one WSL2 Ubuntu host. The
+corresponding checksum-bound native evidence pack is not retained in this
+repository, a public GitHub Release, or current authorised durable evidence.
+Treat that result as project-recorded and commit-bound, not as independently
+re-verifiable native evidence or a qualification of another host. Re-run every
+gate below on the exact source and target host before making a current native
+qualification claim.
+
 The 0.4.0 candidate is releasable only when its exact commit passes the complete 0.3.1 regression, strict Safetensors and PyTorch/ATen direct tests, the existing selected-workload matrix, the native autonomous-discovery matrix, the GGUF and Safetensors content-recognition matrices, the combined detector self-protection matrix, and the host-overhead benchmark on one Ubuntu VM.
 
 Mandatory autonomous gates are: 100/100 unapproved fixture discoveries and complete tree kills, 100/100 unrelated-canary survivals, zero surviving bounded replacement attempts, zero reused-PID signals, 50/50 exact approved survivals, zero kills in the benign and partial-match matrices, zero workload policy/socket accesses, restart recovery, p95 qualifying-snapshot-to-stop below 100 ms, and p95 trigger-to-empty below 500 ms. Full process-start-to-stop time is retained as diagnostic evidence because real model startup can occur before the runtime identity becomes observable; it is not a containment-latency gate.

README.md

@@ -1,8 +1,8 @@
-# Lumi Eggcracker
+# Eggcracker
 
 **Deterministic containment for unapproved local AI workloads on Linux.**
 
-Lumi Eggcracker is a privileged Linux enforcement daemon for a narrow,
+Eggcracker is a privileged Linux enforcement daemon for a narrow,
 published catalogue of locally observed AI workloads.
 
 > Engineering preview: when a complete qualified match has no exact root approval,
@@ -15,7 +15,7 @@ There is no alert-only phase for an unapproved catalogue match. Containment begi
 ## What it does
 
 - continuously scans host processes and performs a startup scan before accepting control commands;
-- detects only the two publicly qualified content/runtime profiles below; unqualified name-only catalogue entries are not active in this release;
+- detects only the two contract-qualified content/runtime profiles below; unqualified name-only catalogue entries are not active in this release;
 - recognises the qualified `content.gguf-llama` profile without depending on executable or model filename: a bounded plausible GGUF v2/v3 header and either two llama.cpp/GGML ELF runtime markers or the exact pinned llama.cpp launcher build ID are both required;
 - recognises `content.safetensors-pytorch` when a structurally valid Safetensors artifact and the exact pinned CPU PyTorch bridge-plus-ATen ELF build-ID pair appear in one process or across a bounded related workload using the installed dedicated workload UID (a live direct parent/child or sibling relation, or one exact Eggcracker-owned workload cgroup); unrelated same-UID or common-init processes are not joined;
 - lets the configured operator approve one exact executable, UID and invocation before it is run;
@@ -29,7 +29,16 @@ Eggcracker does not identify every possible AI implementation. Content recogniti
 
 A successful receipt proves the captured quarantine cgroup is empty. It does not prove that a process which escaped before detection never existed.
 
-## Publicly qualified profiles
+## Active contract-qualified profiles
+
+The table states the exact profile contract implemented by this source. Project
+records report that these profiles passed the native qualification gates for
+commit `418f877f0d450aeb26d4a1233257746808c490e5` on one WSL2 Ubuntu host.
+The corresponding checksum-bound native evidence pack is not retained in this
+repository or a public GitHub Release, so that result is not independently
+re-verifiable from the durable public surface. Run the qualification in
+[QUALIFICATION.md](QUALIFICATION.md) on the exact commit and target host before
+relying on it.
 
 | Profile | Exact qualification | Active in 0.4.0 |
 | --- | --- | --- |
@@ -46,7 +55,28 @@ A successful receipt proves the captured quarantine cgroup is empty. It does not
 
 ## Quick start
 
-Download and extract `lumi-eggcracker-0.4.0-linux.zip`, then run as root:
+There is currently no v0.4.0 GitHub Release or durable anonymous download for
+the Linux bundle. To evaluate the tagged source, build it locally in a disposable
+Ubuntu VM:
+
+```sh
+git clone --branch v0.4.0 --depth 1 https://github.com/noqt/Lumi-Eggcracker.git
+cd Lumi-Eggcracker
+test "$(git rev-parse HEAD)" = "418f877f0d450aeb26d4a1233257746808c490e5"
+python3 scripts/build_release.py --output dist/local
+python3 scripts/verify_release.py \
+  --artifact dist/local/lumi-eggcracker-0.4.0.pyz \
+  --source-archive dist/local/lumi-eggcracker-0.4.0-source.zip \
+  --release-bundle dist/local/lumi-eggcracker-0.4.0-linux.zip
+```
+
+Alternatively, a signed-in GitHub user may download the authenticated
+`lumi-eggcracker-v0.4.0` artifact from the
+[successful `v0.4.0` tag workflow](https://github.com/noqt/Lumi-Eggcracker/actions/runs/31472099403)
+while GitHub retains it, then perform the same source-commit and
+`verify_release.py` checks. A CI artifact is not a durable anonymous Release
+channel. After validation, extract `lumi-eggcracker-0.4.0-linux.zip` and run as
+root:
 
 ```sh
 cd lumi-eggcracker-0.4.0

SECURITY.md

@@ -1,6 +1,6 @@
 # Security policy
 
-Lumi Eggcracker is a privileged local process-containment preview. Test only workloads and machines you own or administer.
+Eggcracker is a privileged local process-containment preview. Test only workloads and machines you own or administer.
 
 Report vulnerabilities privately through the repository security-advisory channel. Do not include exploit code, machine-specific paths, credentials, or live workload details in public issues.
 

pyproject.toml

@@ -10,7 +10,6 @@ readme = "README.md"
 requires-python = ">=3.11"
 license = "Apache-2.0"
 license-files = ["LICENSE"]
-authors = [{name = "Skylark.AI"}]
 dependencies = []
 keywords = ["ai", "agents", "cgroups", "kill-switch", "linux"]
 classifiers = [