Enum Command 

pub enum Command {
    Run {
        rules_dir: PathBuf,
        payload: Option<String>,
        payload_file: Option<PathBuf>,
        output: Option<PathBuf>,
        max_steps: usize,
    },
    Replay {
        fact_log: PathBuf,
    },
    Diff {
        a: PathBuf,
        b: PathBuf,
    },
    Validate {
        rules_dir: PathBuf,
    },
    VerifyChain {
        fact_log: PathBuf,
    },
    ScanWalDir {
        wal_dir: PathBuf,
        baseline: Option<PathBuf>,
        sentinel_log: Option<PathBuf>,
        json: Option<PathBuf>,
    },
    TruncatePartialLine {
        wal_file: PathBuf,
        confirm: bool,
    },
    CompileEvopack {
        rules_file: PathBuf,
        output: PathBuf,
    },
    AnchorKeygen {
        output: Option<PathBuf>,
    },
    AnchorPubkey {
        seed: String,
    },
    VerifyAnchors {
        audit: PathBuf,
        pubkey: Option<String>,
    },
}

Variants

Run

Load and execute JSON rules (output a fact log)

Fields

rules_dir: PathBuf

Rules directory (contains *.json files)

payload: Option<String>

Initial payload (JSON string, optional, default {})

payload_file: Option<PathBuf>

Read initial payload from a file (JSON format)

output: Option<PathBuf>

Output file (default stdout)

max_steps: usize

Maximum execution step limit (default 10000; emit Fact::Error and exit when exceeded)

Replay

Replay a fact log (pretty-print each Fact)

Fields

fact_log: PathBuf

Fact log file (JSON Lines format, interoperable with the tier1 reactor WAL)

Diff

Compare two fact logs (aligned by FactId, not HashSet)

Fields

a: PathBuf

First fact log

b: PathBuf

Second fact log

Validate

Validate JSON rule files (tier1 RuleValidator, syntactic + semantic validation)

Fields

rules_dir: PathBuf

Rules directory

VerifyChain

Verify fact log hash chain integrity (blake3, interoperable with evorule-governance)

Fields

fact_log: PathBuf

Fact log file

ScanWalDir

Audit chain sentinel: scan a WAL directory, verify every chain end-to-end, and compare against the previous scan baseline (prefix-anchored: pure appends vs. history-rewritten recalculation are distinguished precisely). Exit codes: 0 ok / 2 self-test failed / 3 chain broken / 4 file gone / 5 partial line.

Fields

wal_dir: PathBuf

WAL directory (session_.wal, shared_facts.wal, governance_single_reactor.wal)

baseline: Option<PathBuf>

Baseline file for cross-scan comparison (first run creates it)

sentinel_log: Option<PathBuf>

Append-only sentinel log (one line per file per scan; keep in a separate dir)

json: Option<PathBuf>

Machine-readable JSON report output file

TruncatePartialLine

Controlled recovery: truncate a WAL file to its last complete line, with prefix chain verification report and .partial.bak backup (dry-run unless –confirm)

Fields

wal_file: PathBuf

WAL file (with a partial trailing line)

confirm: bool

Confirm on-disk truncation (default: dry-run)

CompileEvopack

Compile JSON rules into a compact .evopack binary package (host compiler for the embedded no_std kernel)

Deterministic: the same input rules always produce the same bytes (postcard canonical encoding, BTreeMap key order), the artifact can be burned into MCU firmware or used for QEMU cross-validation against the no_std kernel. Rule count exceeding the TCB upper limit (MAX_TRANSFORM_RULES) is rejected at compile time (fail-fast).

Fields

rules_file: PathBuf

Rules file (JSON: {“transform”: […]}, {“transforms”: […]}, top-level array, or single object)

output: PathBuf

Output .evopack binary file

AnchorKeygen

Generate a G-A1 audit anchor signing keypair (one-time ops)

Produces a private seed (32 bytes, 64 hex chars) and a public key (32 bytes, 64 hex chars). Keep the private key secret; it is used to configure the auditor signing anchor. The public key can be distributed to third parties for offline verification with verify-anchors.

Fields

output: Option<PathBuf>

File to write the private seed to (default: print to stdout)

AnchorPubkey

Derive the verification public key from a private seed (deployment companion)

The deployment (evorule-server EVORULE_ANCHOR_SEED) holds only the seed; verifiers need only the public key. Prints the derived public key for secure distribution. Use --seed - to read the seed from stdin.

Fields

seed: String

Private seed (64 hex chars), or - to read one line from stdin

VerifyAnchors

Verify G-A1 audit anchors offline (anti-repudiation)

Takes an audit export JSON produced by evorule-governance Auditor::export(). Verifies each anchor’s chain link and recomputes the payload signature with the public key, proving the audit chain was actually produced by the private key holder.

Fields

audit: PathBuf

Audit export JSON file

pubkey: Option<String>

Public key hex (default: use the export’s embedded verifying_key)

Trait Implementations

impl Debug for Command

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl FromArgMatches for Command

fn from_arg_matches(__clap_arg_matches: &ArgMatches) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn from_arg_matches_mut( __clap_arg_matches: &mut ArgMatches, ) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn update_from_arg_matches( &mut self, __clap_arg_matches: &ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

fn update_from_arg_matches_mut<'b>( &mut self, __clap_arg_matches: &mut ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

impl Subcommand for Command

fn augment_subcommands<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate Self via FromArgMatches::from_arg_matches_mut

fn augment_subcommands_for_update<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate self via FromArgMatches::update_from_arg_matches_mut

fn has_subcommand(__clap_name: &str) -> bool

Test whether Self can parse a specific subcommand