enumeray compatibility check

Compare the selected software/evidence and write a new private installation receipt without repairs, credential renewal or execution.

Use when: Establish which selected identities agree, or preserve explicit mismatch/missing-evidence results before reopening retained state.

Role and prerequisites: Any holder of the selected installation evidence. With --connector, current connector owner/co-admin with connectors:read. Acquire the complete signed evidence directory using the installation recipe, including both signature bundles and all four native reports. Signed verification needs separately trusted Cosign v3; acquisition also needs curl and jq. Confirm that the selected version has published release assets; example filenames do not establish availability. Live checks require --api or a configured origin; public API identity is read without credentials. With --connector, provide a static ENUMERAY_TOKEN or an existing saved access token for that same origin; the command never refreshes or rewrites credentials. With --local-only, no configured profile, login or running API is required.

Example

enumeray --api https://enumeray.example.org --json compatibility check \
  --manifest release-evidence-v0.1.0-alpha.1/release-manifest.json \
  --service-receipt release-evidence-v0.1.0-alpha.1/service-publish.json \
  --receipt release-evidence-v0.1.0-alpha.1/installation-receipt.json

Choose exactly one evidence mode: signed manifest plus service publication receipt, explicit unsigned development selection, or authenticated transferred receipt. Trust is signed_release, unsigned_development, authenticated_transfer or unverified; trust and match status are separate fields. A match concerns only the selected checks and declared scope. Recent connector contact proves neither journal ownership nor predecessor shutdown; saved context/peer observations prove neither runtime/dataset suitability nor site qualification. Observation files older than 60 seconds cannot satisfy a live check. No repair, credential refresh, registration, launch, cancellation or cleanup is performed. Existing state, alpha migration limits and preservation obligations remain unchanged.

Inputs and options

Input	Meaning and use
--manifest <MANIFEST>	Existing release-manifest.json acquired for the selected release. Its adjacent release-manifest.json.sigstore.json and all four manifest-bound native qualification reports are required. Pair with --service-receipt; mutually exclusive with development and transferred selection modes.
--service-receipt <SERVICE_RECEIPT>	Existing service-publish.json authorizing that exact manifest and service/public pair, with adjacent service-publish.sigstore.json. Required with --manifest; a downloaded receipt is not trusted until the service workflow signature and manifest binding pass.
--development-selection <DEVELOPMENT_SELECTION>	Explicit unsigned selected-pair JSON supplied by the responsible owner: exact service/public repositories and revisions, version and baseline. Dirty builds require the independently selected content fingerprints. Replaces the manifest/service-receipt pair and cannot be combined with transferred evidence; it never establishes release qualification.
--transferred-receipt <TRANSFERRED_RECEIPT>	Prior successful signed_release compatibility receipt received through an authenticated channel. Pair with --transferred-sha256; unsigned or incomplete receipts cannot become release-qualified. The new trust is authenticated_transfer, not freshly repeated online signature verification.
--transferred-sha256 <TRANSFERRED_SHA256>	Full SHA-256 of --transferred-receipt conveyed independently by the trusted verifier. A checksum downloaded beside an untrusted receipt does not authenticate the handoff.
--receipt <RECEIPT>	New private installation-comparison JSON output file, not an analysis acceptance receipt or an input selection. Existing paths are refused and historical evidence is never overwritten; choose a new path for every attempt.
--local-only	Limit comparison to the installed executable/host and explicitly supplied saved snapshots. Excludes live API/connector/remote-availability conclusions and conflicts with --connector. A local match is not whole-installation proof.
--peer <PEER>	Repeatable saved compatibility inspect JSON with observed_at and complete build identity. Each supplied peer becomes required evidence. Live comparisons require a recent observation; local-only accepts an explicitly historical snapshot without asserting current availability.
--docs <DOCS>	Selected documentation docs-build.json. Compares the root/service and public source identities, including required content fingerprints for modified sources; this metadata comparison does not verify every rendered page byte.
--examples <EXAMPLES>	Selected examples-manifest.json or model-examples-manifest.json. Compares its source identity metadata; it does not independently verify every archive/member byte or establish scientific validity.
--connector <CONNECTOR>	Connector ID whose authorized diagnostics should supply its executing build observation. Requires static credentials for the selected API origin, connectors:read and current connector administration; never launches work, renews a login or proves journal ownership. Incompatible with --local-only.
--context <CONTEXT>	Repeatable saved runner-observation JSON file, not a bare execution-context ID: schema_version 1, exact context_id, RFC3339 observed_at and complete build_identity. The site owner authenticates the host/context association; comparison does not launch a probe or scientific job.

Every command also accepts the profile, API, JSON and timeout options.

Result and next step

Writes schema_version 1, status, trust, observed_at, selected evidence, expected/observed checks and limits to the new private receipt and prints the same result. Status is match, mismatch or missing_evidence. Exit 0 requires all selected comparisons to match; exit 1 indicates mismatch, missing evidence or verification/operational failure, and invalid arguments exit 2. Failures before comparison, including malformed selection or an existing receipt, may produce an error without creating a receipt.

Read every check and limit. Stop before unsafe reuse on mismatch or missing evidence; obtain the missing evidence from its owner and repeat to a new receipt path. Follow the change-safety runbook before replacing binaries or reopening durable work.

Exact syntax, defaults and accepted values

Compare selected identities without repairs, credential renewal or execution

Usage: enumeray compatibility check [OPTIONS] --receipt <RECEIPT>

Options:
      --api <API>
          User API origin override; credentials never cross origins. Host/runner commands use explicit configuration
      --manifest <MANIFEST>
          Existing signed release-manifest.json; adjacent signature and native reports are required
      --profile <PROFILE>
          Named local user API/login profile; host/runner commands use explicit configuration [default: default]
      --service-receipt <SERVICE_RECEIPT>
          Existing service-publish.json; adjacent Sigstore bundle is required
      --config <CONFIG>
          Private user profiles file; defaults to $XDG_CONFIG_HOME/enumeray/profiles.json or ~/.config/enumeray/profiles.json
      --development-selection <DEVELOPMENT_SELECTION>
          Explicit unsigned selected-pair JSON, including content fingerprints for dirty builds
      --json
          Emit user API results as JSON (NDJSON for following logs) and runtime errors on stderr; host/runner output follows its own protocol
      --transferred-receipt <TRANSFERRED_RECEIPT>
          Previously verified signed-release match receipt transferred through an authenticated channel
      --timeout <TIMEOUT>
          User API HTTP timeout in seconds; live logs use it for read inactivity. Does not limit execution time [default: 60]
      --transferred-sha256 <TRANSFERRED_SHA256>
          Independently conveyed SHA-256 of the transferred receipt (not a hash downloaded beside it)
      --receipt <RECEIPT>
          New private output file. Existing receipts are never overwritten
      --local-only
          Check only installed/local and explicitly supplied snapshot identities; exclude live service/daemon conclusions
      --peer <PEER>
          Saved compatibility inspect JSON; every supplied peer becomes a required comparison
      --docs <DOCS>
          Documentation docs-build.json selected for this installation
      --examples <EXAMPLES>
          Selected examples-manifest.json or model-examples-manifest.json
      --connector <CONNECTOR>
          Read this connector's authorized diagnostics with static credentials; never renew a session
      --context <CONTEXT>
          Saved runner identity observation with schema_version, context_id, observed_at and build_identity
  -h, --help
          Print help