refactor(prover): separate outcome evaluation from rendering

[eviehoward]

Summary

Moves exit-code logic out of the renderers and into prove(), so outcome evaluation happens once in a single place rather than independently in each renderer.

Related Issue

Closes #2411

Changes

• render_compact and render_report return () instead of i32; all exit-code logic removed from both
• prove() computes exit code after rendering: i32::from(findings.iter().any(|f| !f.accepted))
• Call site in prove() drops unused policy_path/credentials_path args from render_compact
• Both renderer banners gate on active.is_empty() rather than path_count > 0, so terminal output and exit code agree for pathless unaccepted findings
• Four unit tests added covering: empty findings, all-accepted, unaccepted with paths, pathless unaccepted (the case the old renderers got wrong)

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated - not applicable, no infrastructure, sandbox, or policy changes

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated - not applicable, internal refactor, no behavioral or API change

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

This pull request has had no activity for 14 days and is now marked stale. It may be closed in 7 days if there is no further activity.

[eviehoward]

I'm still keeping an eye on this, AFAIK it's still mergeable- please let me know if anything needs changing or if a rebase is needed 🙂

[2000krysztof]

Thanks for addressing my concerns @eviehoward LGTM

[github-actions]

This pull request has had no activity for 14 days and is now marked stale. It may be closed in 7 days if there is no further activity.

[eviehoward]

Commenting to remove stale label- still keeping an eye on this, please lmk if anything needs changing or if a rebase is needed 🙂

[zredlined]

Thanks for the clear write-up. Looks good to me, with the renderers being presentation-only and pass/fail living in one place, which is what #2411 asked for.

Two non-blocking suggestions:

1. Consider making outcome public and moving it next to Finding (in finding.rs). The gateway path builds findings through run_all_queries and never goes through prove(), so a shared, public pass/fail helper is more useful than a private one in lib.rs, and it gives the logic a home independent of the CLI entry point.
2. apply_accepted_risks treats a pathless finding as accepted, while the new outcome treats an unaccepted pathless finding as a failure. They never meet today because the queries only emit findings with at least one path, but it's worth stating that invariant in one place, probably as a doc comment on Finding::paths, so the two don't drift.

One small thing on the compact renderer: the summary now counts findings instead of paths. That reads fine to me and nothing depends on the old string, just flagging it since it is a visible output change.

Once CI runs on the runners, this looks good to merge.

[zredlined]

/ok to test

[copy-pr-bot]

/ok to test

@zredlined, there was an error processing your request: E1

See the following link for more information: https://docs.gha-runners.nvidia.com/cpr/e/1/

[johntmyers]

/ok to test b1dbd85

[github-actions]

Label test:e2e applied, but pull-request/2632 does not exist yet. A maintainer needs to comment /ok to test b1dbd85de4f71f6b3e44becd9ef07216f4c1d338 to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

[johntmyers]

gator-agent

PR Review Status

No blocking findings remain. This focused refactor implements #2411: prove() evaluates the outcome after accepted risks, both renderers only present findings, and the four outcome tests exercise the production helper.

@eviehoward, I checked the helper you added and its call from prove(). @zredlined, I checked your suggestions about helper visibility and pathless findings; those remain optional and do not prevent testing. The compact summary now counts findings, and both banners correctly show REVIEW for an unaccepted pathless finding.

Blocking findings: None.

Carried findings: None.

Gator metadata

• Validation: Localized prover refactor implementing #2411; no conflicting duplicate found.
• Docs: No material published-contract change; the minor summary wording correction does not require a docs gate under pragmatic review calibration.
• Checks: DCO passes. Current-head Branch Checks (including Trivy), Helm Lint, and Branch E2E Checks are queued. Maintainer approval remains outstanding.
• E2E: test:e2e applied; authorized /ok to test created the matching current-head mirror and queued the E2E workflow with the label present.
• Head SHA: b1dbd85de4f71f6b3e44becd9ef07216f4c1d338
• Base SHA: 6e6e6493b3df093540cfcc43b4a1df501470e561
• Merge base SHA: 6e6e6493b3df093540cfcc43b4a1df501470e561
• Patch ID: 52ddc8300294de80d95f2a90a07f86ecc4f19757
• Gator payload: 12
• Review mode: initial
• Previous reviewed SHA: none
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:watch-pipeline