Function prove

crates/openshell-prover/src/lib.rs:37–75

Run the prover end-to-end and return an exit code. - `0` — pass (no critical/high findings, or all accepted) - `1` — fail (critical or high findings present) - `2` — input error Binary and API capability registries are embedded at compile time. Pass `registry_dir` to override with a custom filesystem registry.

(
    policy_path: &str,
    credentials_path: &str,
    registry_dir: Option<&str>,
    accepted_risks_path: Option<&str>,
    compact: bool,
)

/// Binary and API capability registries are embedded at compile time.
/// Pass `registry_dir` to override with a custom filesystem registry.
pub fn prove(
    policy_path: &str,
    credentials_path: &str,
    registry_dir: Option<&str>,
    accepted_risks_path: Option<&str>,
    compact: bool,
) -> Result<i32> {
    let policy = parse_policy(Path::new(policy_path))?;

    let (credential_set, binary_registry) = match registry_dir {
        Some(dir) => {
            let dir = Path::new(dir);
            (
                credentials::load_credential_set_from_dir(Path::new(credentials_path), dir)?,
                registry::load_binary_registry_from_dir(dir)?,
            )
        }
        None => (
            credentials::load_credential_set_embedded(Path::new(credentials_path))?,
            registry::load_embedded_binary_registry()?,
        ),
    };

    let z3_model = build_model(policy, credential_set, binary_registry);
    let mut findings = run_all_queries(&z3_model);

    if let Some(ar_path) = accepted_risks_path {
        let accepted = load_accepted_risks(Path::new(ar_path))?;
        findings = apply_accepted_risks(findings, &accepted);
    }

    let exit_code = if compact {
        render_compact(&findings, policy_path, credentials_path)
    } else {
        render_report(&findings, policy_path, credentials_path)
    };

    Ok(exit_code)
}

// ===========================================================================
// Tests