We need to review what changed between two dependency lock snapshots before approving a release. Finish the comparison so additions, removals, upgrades and downgrades are reported consistently.
Build the implementation in Java under /app, with /app/run.sh as its entry point. Read one JSON request from standard input and write one JSON result to standard output. Input has before and after mappings from package name to nonnegative integer release number. Return added and removed sorted name lists plus changed records with name, from, to and direction (upgrade or downgrade), sorted by name. Unchanged releases are omitted. Reject negative, noninteger or boolean release values.
Reject inputs that violate an explicit validation rule with exit status 2, no standard output, and {"error":"invalid_input"} on standard error. For valid input, exit with status 0. Keep the implementation reusable for new inputs; it must work offline and must not depend on the example data being the only data it receives.
Repair or replace the unfinished /app/run.sh and add source files under /app. Malformed JSON must use the same invalid-input response. Do not read /tests or /oracle from the application.