refactor(prover): separate outcome evaluation from rendering

crates/openshell-prover/src/lib.rs

@@ -65,11 +65,13 @@ pub fn prove(
         findings = apply_accepted_risks(findings, &accepted);
     }
 
-    let exit_code = if compact {
-        render_compact(&findings, policy_path, credentials_path)
+    if compact {
+        render_compact(&findings);
     } else {
-        render_report(&findings, policy_path, credentials_path)
-    };
+        render_report(&findings, policy_path, credentials_path);
+    }
+
+    let exit_code = i32::from(findings.iter().any(|f| !f.accepted));
 
     Ok(exit_code)
 }
@@ -311,4 +313,65 @@ network_policies:
             "deny-all policy should produce no findings, got: {findings:?}"
         );
     }
+
+    fn outcome(findings: &[finding::Finding]) -> i32 {
+        i32::from(findings.iter().any(|f| !f.accepted))
+    }
+
+    #[test]
+    fn test_outcome_empty_findings() {
+        assert_eq!(outcome(&[]), 0);
+    }
+
+    #[test]
+    fn test_outcome_accepted_only() {
+        let f = finding::Finding {
+            query: finding::category::LINK_LOCAL_REACH.to_owned(),
+            title: String::new(),
+            description: String::new(),
+            paths: vec![],
+            remediation: vec![],
+            accepted: true,
+            accepted_reason: "accepted for test".to_owned(),
+        };
+        assert_eq!(outcome(&[f]), 0);
+    }
+
+    #[test]
+    fn test_outcome_unaccepted_finding() {
+        let f = finding::Finding {
+            query: finding::category::LINK_LOCAL_REACH.to_owned(),
+            title: String::new(),
+            description: String::new(),
+            paths: vec![finding::FindingPath::Exfil(finding::ExfilPath {
+                binary: "/usr/bin/curl".to_owned(),
+                endpoint_host: "169.254.169.254".to_owned(),
+                endpoint_port: 80,
+                mechanism: String::new(),
+                policy_name: "test".to_owned(),
+                category: finding::category::LINK_LOCAL_REACH.to_owned(),
+                method: String::new(),
+            })],
+            remediation: vec![],
+            accepted: false,
+            accepted_reason: String::new(),
+        };
+        assert_eq!(outcome(&[f]), 1);
+    }
+
+    // prove() returns Ok(1) for an unaccepted pathless finding;
+    // renderers show REVIEW, not PASS, when unaccepted findings exist regardless of path count.
+    #[test]
+    fn test_outcome_pathless_unaccepted() {
+        let f = finding::Finding {
+            query: finding::category::LINK_LOCAL_REACH.to_owned(),
+            title: String::new(),
+            description: String::new(),
+            paths: vec![],
+            remediation: vec![],
+            accepted: false,
+            accepted_reason: String::new(),
+        };
+        assert_eq!(outcome(&[f]), 1);
+    }
 }

crates/openshell-prover/src/report.rs

@@ -76,8 +76,7 @@ fn format_path_line(query: &str, p: &crate::finding::ExfilPath) -> String {
 // ---------------------------------------------------------------------------
 
 /// Render compact output (one-line-per-finding-line for demos and CI).
-/// Returns exit code: 0 = pass, 1 = any findings present.
-pub fn render_compact(findings: &[Finding], _policy_path: &str, _credentials_path: &str) -> i32 {
+pub fn render_compact(findings: &[Finding]) {
     let active: Vec<&Finding> = findings.iter().filter(|f| !f.accepted).collect();
     let accepted: Vec<&Finding> = findings.iter().filter(|f| f.accepted).collect();
 
@@ -108,19 +107,17 @@ pub fn render_compact(findings: &[Finding], _policy_path: &str, _credentials_pat
         format!(", {} accepted", accepted.len())
     };
 
-    let path_count: usize = active.iter().map(|f| f.paths.len()).sum();
-    if path_count > 0 {
+    if active.is_empty() {
         println!(
-            "   {}  {path_count} finding path(s) require review{accepted_note}",
-            " REVIEW ".black().bold().on_yellow()
+            "   {}  no findings{accepted_note}",
+            " PASS ".white().bold().on_green()
         );
-        1
     } else {
         println!(
-            "   {}  no findings{accepted_note}",
-            " PASS ".white().bold().on_green()
+            "   {}  {} finding(s) require review{accepted_note}",
+            " REVIEW ".black().bold().on_yellow(),
+            active.len()
         );
-        0
     }
 }
 
@@ -129,8 +126,7 @@ pub fn render_compact(findings: &[Finding], _policy_path: &str, _credentials_pat
 // ---------------------------------------------------------------------------
 
 /// Render a full terminal report with finding panels.
-/// Returns exit code: 0 = pass, 1 = any findings present.
-pub fn render_report(findings: &[Finding], policy_path: &str, credentials_path: &str) -> i32 {
+pub fn render_report(findings: &[Finding], policy_path: &str, credentials_path: &str) {
     let policy_name = Path::new(policy_path)
         .file_name()
         .map_or("policy.yaml", |n| n.to_str().unwrap_or("policy.yaml"));
@@ -160,7 +156,7 @@ pub fn render_report(findings: &[Finding], policy_path: &str, credentials_path:
 
     if active.is_empty() && accepted.is_empty() {
         println!("{}", "No findings. Policy posture is clean.".green().bold());
-        return 0;
+        return;
     }
 
     println!("{}", "Finding Summary".bold().underline());
@@ -207,26 +203,23 @@ pub fn render_report(findings: &[Finding], policy_path: &str, credentials_path:
         }
     }
 
-    let path_count: usize = active.iter().map(|f| f.paths.len()).sum();
     let accepted_note = if accepted.is_empty() {
         String::new()
     } else {
         format!(" ({} accepted)", accepted.len())
     };
-    if path_count > 0 {
+    if active.is_empty() {
         println!(
             "{}{accepted_note}",
-            "REVIEW \u{2014} prover findings require human attention."
-                .bold()
-                .yellow()
+            "PASS \u{2014} All findings accepted.".bold().green()
         );
-        1
     } else {
         println!(
             "{}{accepted_note}",
-            "PASS \u{2014} All findings accepted.".bold().green()
+            "REVIEW \u{2014} prover findings require human attention."
+                .bold()
+                .yellow()
         );
-        0
     }
 }