Sync GitHub source 8ab9513367be0d2c0dcee1f38cfd7178aa71c7dd

Canonical source: https://github.com/noqt/Lumi-Eggcracker/commit/8ab9513367be0d2c0dcee1f38cfd7178aa71c7dd

HUGGINGFACE_MANIFEST.json

@@ -37,8 +37,8 @@
       "size": 10537
     },
     "README.md": {
-      "sha256": "f4a7951d86f828e92d371af6895b2ad7ff7fc9343f95e5830633e37586cc051c",
-      "size": 31089
+      "sha256": "8d42000b36c3560d5e78054c94b9c547fe19214ad42bd1791837bb286a3370d4",
+      "size": 31503
     },
     "RELEASE_NOTES.md": {
       "sha256": "64d330d0f297b15720fc65e6347ececc1b99a917a597d405ebfac04baf3222ea",
@@ -189,7 +189,7 @@
       "size": 4101
     },
     "index.html": {
-      "sha256": "60aec61bda5ecd0df3bf9498d80af1ed50d34beca7670d3183b64affb43cd0e9",
+      "sha256": "7e4f35f1f1b8e600fc69bf7da573dac5c23a6d74b20d55623fb0b5779e53bb18",
       "size": 22790
     },
     "integrations/prometheus/eggcracker.rules.yml": {
@@ -437,8 +437,8 @@
       "size": 55591
     },
     "src/lumi_eggcracker/cli.py": {
-      "sha256": "ca7675de60a8a58d303f924f4a0f2f3a89346f29cf02cd3dba52bd8112c722d4",
-      "size": 10518
+      "sha256": "3be4ce117402ec750f9d86acdfe050e8dca16696f7450d19de7b51250e80e8ed",
+      "size": 15504
     },
     "src/lumi_eggcracker/client.py": {
       "sha256": "0ac5dd4fdf564b2b7fd9e74de66d9ff083ac153864867b69fc078da9d66bbc66",
@@ -589,8 +589,8 @@
       "size": 7176
     },
     "tests/test_cli.py": {
-      "sha256": "b03872e0b0ebffaeb964eceb85320115b76a6c5ece5b0bce64d79a9a575b7db1",
-      "size": 12128
+      "sha256": "727d8d5f855c877320488c4064edbb0dc03e6f68b73ce472eb1803fe58089d2e",
+      "size": 18895
     },
     "tests/test_collect_supported_path_receipt.py": {
       "sha256": "79ae57bf3d78cac5fbe1b9d7db60462328f70cb17214bc75a5b5e7eff3ea0eef",
@@ -827,6 +827,6 @@
   },
   "schema": "noqt.huggingface_manifest.v1",
   "source_repository": "https://github.com/noqt/Lumi-Eggcracker",
-  "source_revision": "a82d86680dc86d442a0f45ca3e8ddec915b125cb",
-  "source_url": "https://github.com/noqt/Lumi-Eggcracker/commit/a82d86680dc86d442a0f45ca3e8ddec915b125cb"
+  "source_revision": "8ab9513367be0d2c0dcee1f38cfd7178aa71c7dd",
+  "source_url": "https://github.com/noqt/Lumi-Eggcracker/commit/8ab9513367be0d2c0dcee1f38cfd7178aa71c7dd"
 }

HUGGINGFACE_SYNC.json

@@ -1,6 +1,6 @@
 {
   "manifest": "HUGGINGFACE_MANIFEST.json",
-  "manifest_sha256": "3999dc00867639421942326d6ddadb8c3cfbf8032024897234e369556ed5b584",
+  "manifest_sha256": "73af8a2e51b02f3016f7aff8ab7a04af7d918d474ef8a7a109389d8f9700af4a",
   "mirrored_files": 191,
   "mode": "DERIVED_READ_ONLY_MIRROR",
   "release_reference": {
@@ -65,7 +65,7 @@
   },
   "schema": "noqt.huggingface_sync.v1",
   "source_repository": "https://github.com/noqt/Lumi-Eggcracker",
-  "source_revision": "a82d86680dc86d442a0f45ca3e8ddec915b125cb",
-  "source_url": "https://github.com/noqt/Lumi-Eggcracker/commit/a82d86680dc86d442a0f45ca3e8ddec915b125cb",
+  "source_revision": "8ab9513367be0d2c0dcee1f38cfd7178aa71c7dd",
+  "source_url": "https://github.com/noqt/Lumi-Eggcracker/commit/8ab9513367be0d2c0dcee1f38cfd7178aa71c7dd",
   "target": "https://huggingface.co/spaces/noqt/eggcracker"
 }

README.md

@@ -11,7 +11,7 @@ short_description: Native Linux kill switch for supported local-AI workloads
 ---
 
 > Official noqt Hugging Face distribution, generated from GitHub commit
-> [`a82d86680dc8`](https://github.com/noqt/Lumi-Eggcracker/commit/a82d86680dc86d442a0f45ca3e8ddec915b125cb). This Space distributes the source for
+> [`8ab9513367be`](https://github.com/noqt/Lumi-Eggcracker/commit/8ab9513367be0d2c0dcee1f38cfd7178aa71c7dd). This Space distributes the source for
 > discovery and cloning; Eggcracker itself runs on a supported native Linux
 > host, not on Hugging Face. A snapshot is called current only after the
 > release-linked sync job verifies its returned Hub commit and full manifest.
@@ -547,6 +547,20 @@ exports only; it does not authenticate them or verify a live workload. See
 [the export and comparison guide](docs/DETECTION_RECEIPT_EXPORT.md) for input,
 output, redaction and filesystem behavior.
 
+## Check installed health
+
+For an installed source/build containing this change, record its version and
+then request the bounded health snapshot:
+
+```sh
+eggcracker version
+eggcracker doctor --summary
+```
+
+The snapshot is not containment proof. `doctor --summary` is available only in
+the source/build that contains this change; its presence is not a claim that
+the published v1.0.10 release includes this option.
+
 ## Install and remove
 
 The first-kill command is the recommended campaign path. A release is complete

index.html

@@ -4,7 +4,7 @@
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <meta name="description" content="Lumi Eggcracker is noqt's native Linux kill switch for unapproved supported local-AI workloads. Clone the complete source from Hugging Face.">
-  <meta name="noqt-source-revision" content="a82d86680dc86d442a0f45ca3e8ddec915b125cb">
+  <meta name="noqt-source-revision" content="8ab9513367be0d2c0dcee1f38cfd7178aa71c7dd">
   <meta name="theme-color" content="#090a0c">
   <title>Lumi Eggcracker — Native Linux AI kill switch</title>
   <style>
@@ -649,7 +649,7 @@ sudo /usr/bin/python3 -I -S scripts/first_kill.py \
     <section>
       <div class="shell source-bar">
         <div>
-          <div class="source-id">SOURCE COMMIT · a82d86680dc8</div>
+          <div class="source-id">SOURCE COMMIT · 8ab9513367be</div>
           <h2>Inspect every line.</h2>
           <p>Complete source, tests, qualification documents and reproducible proof tooling are distributed in this repository.</p>
         </div>

src/lumi_eggcracker/cli.py

@@ -18,6 +18,122 @@ from .support_bundle import main as support_bundle_main
 from .support_bundle import validate_main as validate_support_bundle_main
 from .watchdog import main as watchdog_main
 
+_DOCTOR_SUMMARY_SCHEMA = "lumi-eggcracker.doctor-summary.v1"
+_DOCTOR_SUMMARY_ERROR = "eggcracker: doctor summary unavailable"
+_DOCTOR_SUMMARY_INSTALLATION_STATES = frozenset(
+    {"HEALTHY", "DRIFT", "RECOVERY_REQUIRED", "NOT_INSTALLED"}
+)
+_DOCTOR_SUMMARY_NETWORK_MODES = frozenset({"offline", "unsupported"})
+
+
+class _DoctorSummaryInvalid(ValueError):
+    """The supervisor response cannot be safely reduced to a doctor summary."""
+
+
+def _doctor_summary(value: object) -> dict[str, object]:
+    """Reduce a doctor response to a fixed, nonidentifying health object."""
+
+    if type(value) is not dict:
+        raise _DoctorSummaryInvalid
+
+    result = value.get("result")
+    if type(result) is not str or result not in {"PASS", "UNSUPPORTED"}:
+        raise _DoctorSummaryInvalid
+
+    def required_bool(container: object, key: str) -> bool:
+        if type(container) is not dict or key not in container:
+            raise _DoctorSummaryInvalid
+        item = container[key]
+        if type(item) is not bool:
+            raise _DoctorSummaryInvalid
+        return item
+
+    autonomous_discovery = required_bool(value, "autonomous_discovery")
+    cgroup_v2 = required_bool(value, "cgroup_v2")
+    pidfd = required_bool(value, "pidfd")
+
+    network = value.get("network")
+    if type(network) is not dict:
+        raise _DoctorSummaryInvalid
+    network_mode = network.get("mode")
+    if type(network_mode) is not str or network_mode not in _DOCTOR_SUMMARY_NETWORK_MODES:
+        raise _DoctorSummaryInvalid
+    network_primitives = network.get("primitives")
+    primitives_supported = required_bool(network_primitives, "supported")
+    network_cleanup = required_bool(network, "cleanup_healthy")
+
+    execution_boundary = value.get("execution_boundary")
+    execution_supported = required_bool(execution_boundary, "supported")
+
+    discovery = value.get("discovery")
+    discovery_healthy = required_bool(discovery, "healthy")
+    receipt_persistence = required_bool(discovery, "receipt_persistence_healthy")
+
+    incidents = value.get("incidents")
+    incidents_healthy = required_bool(incidents, "healthy")
+    incidents_lockdown = required_bool(incidents, "lockdown")
+    if not incidents_healthy and not incidents_lockdown:
+        raise _DoctorSummaryInvalid
+
+    installation = value.get("installation")
+    if type(installation) is not dict or "state" not in installation:
+        raise _DoctorSummaryInvalid
+    installation_state = installation["state"]
+    if (
+        type(installation_state) is not str
+        or installation_state not in _DOCTOR_SUMMARY_INSTALLATION_STATES
+    ):
+        raise _DoctorSummaryInvalid
+
+    workload_identity = value.get("workload_identity")
+    workload_identity_healthy = required_bool(workload_identity, "healthy")
+
+    failed_checks: set[str] = set()
+    if not cgroup_v2:
+        failed_checks.add("cgroup_v2")
+    if not pidfd:
+        failed_checks.add("pidfd")
+    if network_mode != "offline":
+        failed_checks.add("network_mode")
+    if not primitives_supported:
+        failed_checks.add("network_primitives")
+    if not network_cleanup:
+        failed_checks.add("network_cleanup")
+    if not execution_supported:
+        failed_checks.add("execution_boundary")
+    if not discovery_healthy:
+        failed_checks.add("discovery")
+    if not receipt_persistence:
+        failed_checks.add("receipt_persistence")
+    if not incidents_healthy:
+        failed_checks.add("incidents")
+    if installation_state != "HEALTHY":
+        failed_checks.add("installation")
+    if not workload_identity_healthy:
+        failed_checks.add("workload_identity")
+
+    if result == "PASS":
+        if not autonomous_discovery or failed_checks:
+            raise _DoctorSummaryInvalid
+        summary_result = "READY"
+    else:
+        if autonomous_discovery:
+            raise _DoctorSummaryInvalid
+        if not failed_checks:
+            # The supervisor also gates readiness on quarantine_root, which is
+            # deliberately not exposed by its public doctor response.
+            failed_checks.add("supervisor_readiness")
+        summary_result = "NOT_READY"
+
+    return {
+        "failed_checks": sorted(failed_checks),
+        "next_action": (
+            "NONE" if summary_result == "READY" else "REVIEW_SUPERVISOR_READINESS"
+        ),
+        "result": summary_result,
+        "schema": _DOCTOR_SUMMARY_SCHEMA,
+    }
+
 
 class _RejectDuplicateIdentifier(argparse.Action):
     """Accept one identifier option and fail closed on a repeated spelling."""
@@ -102,7 +218,12 @@ def _parser() -> argparse.ArgumentParser:
     ):
         command = incident_commands.add_parser(action, help=help_text)
         command.add_argument("incident_id")
-    commands.add_parser("doctor", help="check the installed protected supervisor")
+    doctor = commands.add_parser("doctor", help="check the installed protected supervisor")
+    doctor.add_argument(
+        "--summary",
+        action="store_true",
+        help="emit a bounded readiness summary instead of the full doctor response",
+    )
     support = commands.add_parser(
         "support-bundle", help="write a local redacted health and receipt bundle"
     )
@@ -149,6 +270,14 @@ def main(argv: list[str] | None = None) -> int:
         return support_bundle_main(args.output)
     try:
         if args.command == "doctor":
+            if args.summary:
+                try:
+                    summary = _doctor_summary(request("doctor"))
+                except Exception:  # noqa: BLE001 - summary failures are intentionally constant
+                    print(_DOCTOR_SUMMARY_ERROR, file=sys.stderr)
+                    return 6
+                print(json.dumps(summary, sort_keys=True))
+                return 0 if summary["result"] == "READY" else 6
             value = request("doctor")
             print(json.dumps(value, sort_keys=True))
             return 0 if value.get("result") == "PASS" else 6

tests/test_cli.py

@@ -11,6 +11,35 @@ from unittest.mock import patch
 from lumi_eggcracker.cli import main
 
 
+def doctor_response(**overrides: object) -> dict[str, object]:
+    value: dict[str, object] = {
+        "autonomous_discovery": True,
+        "backend": "root-supervisor",
+        "cgroup_v2": True,
+        "catalogue": {"secret": "catalogue-canary"},
+        "discovery": {
+            "healthy": True,
+            "receipt_persistence_healthy": True,
+            "path": "/private/discovery-canary",
+        },
+        "execution_boundary": {"supported": True, "argv": ["argv-canary"]},
+        "incidents": {"healthy": True, "lockdown": False, "secret": "incident-canary"},
+        "installation": {"state": "HEALTHY", "path": "/private/install-canary"},
+        "network": {
+            "cleanup_healthy": True,
+            "mode": "offline",
+            "primitives": {"supported": True, "uid": "uid-canary"},
+        },
+        "pidfd": True,
+        "result": "PASS",
+        "version": "1.0.10",
+        "workload_identity": {"healthy": True, "uid": 4242},
+        "workload_uid": 4242,
+    }
+    value.update(overrides)
+    return value
+
+
 class CliTests(unittest.TestCase):
     def test_version(self) -> None:
         output = io.StringIO()
@@ -41,6 +70,128 @@ class CliTests(unittest.TestCase):
         self.assertNotIn("_supervisor", help_text)
         self.assertNotIn("network" + "-deny", help_text)
 
+    def test_doctor_summary_ready_is_fixed_and_nonidentifying(self) -> None:
+        response = doctor_response()
+        output = io.StringIO()
+        error = io.StringIO()
+        with patch("lumi_eggcracker.cli.request", return_value=response) as request, redirect_stdout(output), redirect_stderr(error):
+            self.assertEqual(0, main(["doctor", "--summary"]))
+        self.assertEqual(
+            {
+                "failed_checks": [],
+                "next_action": "NONE",
+                "result": "READY",
+                "schema": "lumi-eggcracker.doctor-summary.v1",
+            },
+            json.loads(output.getvalue()),
+        )
+        self.assertEqual("", error.getvalue())
+        self.assertNotIn("canary", output.getvalue())
+        request.assert_called_once_with("doctor")
+
+    def test_doctor_summary_mixed_failures_are_sorted_and_deduplicated(self) -> None:
+        response = doctor_response(
+            autonomous_discovery=False,
+            cgroup_v2=False,
+            execution_boundary={"supported": False},
+            discovery={"healthy": False, "receipt_persistence_healthy": False},
+            incidents={"healthy": False, "lockdown": True},
+            installation={"state": "DRIFT"},
+            network={
+                "cleanup_healthy": False,
+                "mode": "unsupported",
+                "primitives": {"supported": False},
+            },
+            pidfd=False,
+            result="UNSUPPORTED",
+            workload_identity={"healthy": False},
+        )
+        output = io.StringIO()
+        with patch("lumi_eggcracker.cli.request", return_value=response), redirect_stdout(output):
+            self.assertEqual(6, main(["doctor", "--summary"]))
+        summary = json.loads(output.getvalue())
+        self.assertEqual(
+            [
+                "cgroup_v2",
+                "discovery",
+                "execution_boundary",
+                "incidents",
+                "installation",
+                "network_cleanup",
+                "network_mode",
+                "network_primitives",
+                "pidfd",
+                "receipt_persistence",
+                "workload_identity",
+            ],
+            summary["failed_checks"],
+        )
+        self.assertEqual(len(summary["failed_checks"]), len(set(summary["failed_checks"])))
+        self.assertEqual("NOT_READY", summary["result"])
+        self.assertEqual("REVIEW_SUPERVISOR_READINESS", summary["next_action"])
+        self.assertEqual(
+            {"failed_checks", "next_action", "result", "schema"},
+            set(summary),
+        )
+        self.assertNotIn("canary", output.getvalue())
+
+    def test_doctor_summary_unsupported_without_visible_failure_is_honest(self) -> None:
+        response = doctor_response(autonomous_discovery=False, result="UNSUPPORTED")
+        output = io.StringIO()
+        with patch("lumi_eggcracker.cli.request", return_value=response), redirect_stdout(output):
+            self.assertEqual(6, main(["doctor", "--summary"]))
+        self.assertEqual(
+            {
+                "failed_checks": ["supervisor_readiness"],
+                "next_action": "REVIEW_SUPERVISOR_READINESS",
+                "result": "NOT_READY",
+                "schema": "lumi-eggcracker.doctor-summary.v1",
+            },
+            json.loads(output.getvalue()),
+        )
+
+    def test_doctor_summary_malformed_or_contradictory_response_is_constant_error(self) -> None:
+        malformed = [
+            {},
+            doctor_response(result=True),
+            doctor_response(cgroup_v2="true"),
+            doctor_response(network={"mode": "secret-path-canary"}),
+            doctor_response(autonomous_discovery=False),
+            doctor_response(autonomous_discovery=True, result="UNSUPPORTED"),
+            doctor_response(incidents={"healthy": False, "lockdown": False}),
+            doctor_response(installation={"state": "PRIVATE-CANARY"}),
+        ]
+        for response in malformed:
+            with self.subTest(response=response):
+                output = io.StringIO()
+                error = io.StringIO()
+                with patch("lumi_eggcracker.cli.request", return_value=response), redirect_stdout(output), redirect_stderr(error):
+                    self.assertEqual(6, main(["doctor", "--summary"]))
+                self.assertEqual("", output.getvalue())
+                self.assertEqual("eggcracker: doctor summary unavailable\n", error.getvalue())
+                self.assertNotIn("canary", error.getvalue())
+
+        output = io.StringIO()
+        error = io.StringIO()
+        with patch("lumi_eggcracker.cli.request", side_effect=OSError("/private/CANARY")), redirect_stdout(output), redirect_stderr(error):
+            self.assertEqual(6, main(["doctor", "--summary"]))
+        self.assertEqual("", output.getvalue())
+        self.assertEqual("eggcracker: doctor summary unavailable\n", error.getvalue())
+        self.assertNotIn("CANARY", error.getvalue())
+
+    def test_default_doctor_output_and_exit_remain_unchanged(self) -> None:
+        for result, expected_exit in (("PASS", 0), ("UNSUPPORTED", 6)):
+            with self.subTest(result=result):
+                response = doctor_response(
+                    autonomous_discovery=result == "PASS", result=result
+                )
+                output = io.StringIO()
+                error = io.StringIO()
+                with patch("lumi_eggcracker.cli.request", return_value=response), redirect_stdout(output), redirect_stderr(error):
+                    self.assertEqual(expected_exit, main(["doctor"]))
+                self.assertEqual(json.dumps(response, sort_keys=True) + "\n", output.getvalue())
+                self.assertEqual("", error.getvalue())
+
     def test_compare_detection_receipts_help_uses_installed_command(self) -> None:
         output = io.StringIO()
         with redirect_stdout(output), self.assertRaises(SystemExit) as raised: