evorule_cli/
cli.rs

1// SPDX-License-Identifier: AGPL-3.0-or-later
2// Copyright (C) 2026 EvoRule Project
3// This file is part of EvoRule, licensed under GNU Affero General Public License v3 or later.
4//! CLI 参数定义（clap derive）
5//!
6//! 子命令：
7//! - `run`：加载并执行 JSON 规则，输出 fact log
8//! - `replay`：重放 fact log（pretty-print）
9//! - `diff`：对比两个 fact log（按 FactId 对齐）
10//! - `validate`：校验 JSON 规则文件（用 tier1 RuleValidator）
11//! - `verify-chain`：验证 fact log 哈希链完整性
12//! - `anchor-keygen`：生成 G-A1 审计锚点签名密钥对（一次性运维）
13//! - `verify-anchors`：离线校验 G-A1 审计锚点真实性（防抵赖）
14
15use std::path::PathBuf;
16
17use clap::{Parser, Subcommand};
18
19/// evorule: 没有智能,只有执行的最佳实践
20#[derive(Parser, Debug)]
21#[command(
22    name = "evorule",
23    version,
24    about = "evorule: no intelligence, only best practices of execution",
25    long_about = "evorule CLI - load and execute user-written JSON rules.\n\
26                  Zero network, zero telemetry, zero system dependencies, suited for compliance-sensitive local use.\n\
27                  The fact log uses the evorule-reactor WAL format, interoperable with the evorule-governance audit chain."
28)]
29pub struct Cli {
30    #[command(subcommand)]
31    pub command: Command,
32}
33
34#[derive(Subcommand, Debug)]
35pub enum Command {
36    /// Load and execute JSON rules (output a fact log)
37    Run {
38        /// Rules directory (contains *.json files)
39        rules_dir: PathBuf,
40
41        /// Initial payload (JSON string, optional, default {})
42        #[arg(long, conflicts_with = "payload_file")]
43        payload: Option<String>,
44
45        /// Read initial payload from a file (JSON format)
46        #[arg(long)]
47        payload_file: Option<PathBuf>,
48
49        /// Output file (default stdout)
50        #[arg(long, short = 'o')]
51        output: Option<PathBuf>,
52
53        /// Maximum execution step limit (default 10000; emit Fact::Error and exit when exceeded)
54        #[arg(long, default_value_t = crate::executor::DEFAULT_MAX_STEPS)]
55        max_steps: usize,
56    },
57
58    /// Replay a fact log (pretty-print each Fact)
59    Replay {
60        /// Fact log file (JSON Lines format, interoperable with the tier1 reactor WAL)
61        fact_log: PathBuf,
62    },
63
64    /// Compare two fact logs (aligned by FactId, not HashSet)
65    Diff {
66        /// First fact log
67        a: PathBuf,
68        /// Second fact log
69        b: PathBuf,
70    },
71
72    /// Validate JSON rule files (tier1 RuleValidator, syntactic + semantic validation)
73    Validate {
74        /// Rules directory
75        rules_dir: PathBuf,
76    },
77
78    /// Verify fact log hash chain integrity (blake3, interoperable with evorule-governance)
79    VerifyChain {
80        /// Fact log file
81        fact_log: PathBuf,
82    },
83
84    /// Generate a G-A1 audit anchor signing keypair (one-time ops)
85    ///
86    /// Produces a private seed (32 bytes, 64 hex chars) and a public key (32 bytes, 64 hex chars).
87    /// Keep the private key secret; it is used to configure the auditor signing anchor. The public key
88    /// can be distributed to third parties for offline verification with `verify-anchors`.
89    AnchorKeygen {
90        /// File to write the private seed to (default: print to stdout)
91        #[arg(long)]
92        output: Option<PathBuf>,
93    },
94
95    /// Verify G-A1 audit anchors offline (anti-repudiation)
96    ///
97    /// Takes an audit export JSON produced by `evorule-governance` `Auditor::export()`.
98    /// Verifies each anchor's chain link and recomputes the payload signature with the public key,
99    /// proving the audit chain was actually produced by the private key holder.
100    VerifyAnchors {
101        /// Audit export JSON file
102        audit: PathBuf,
103        /// Public key hex (default: use the export's embedded verifying_key)
104        #[arg(long)]
105        pubkey: Option<String>,
106    },
107}
evorule_cli/cli.rs

evorule_cli/
cli.rs
