Function report 

pub fn report(index: &Index, ledger: &Ledger) -> EvidenceReport

Join the claims of the index with the executions of the ledger and decide, per claim, what the repository can honestly say.

The git comparison is done once per distinct recorded commit and shared by every claim that recorded against it.

Claims come from the index and nothing else; executions come from the ledger and nothing else. A claim the ledger has never heard of is ProofState::NotRun, and if it declares a guarantee, that is a finding — the file existing was never the proof.

use majordomus_cli::evidence::{self, Ledger, ProofState};
use majordomus_cli::git::GitState;
use majordomus_cli::index::{Index, RepositoryInfo, State};
use majordomus_cli::{Object, Provenance};

let repo = tempfile::tempdir().unwrap();
let claim = Object {
    kind: "claim".into(),
    identity: "scope-integrity".into(),
    uri: "majordomus://claim/scope-integrity".into(),
    title: None,
    description: None,
    metadata: serde_json::json!({
        "claim": "a commit outside the task's scope is refused",
        "status": "guaranteed",
        "source": "docs/SCOPE.md",
        "test": "test/cases/07_scope.sh",
    }),
    body: String::new(),
    content: String::new(),
    media_type: "application/yaml",
    provenance: Provenance {
        path: "docs/CLAIMS.yaml".into(),
        directory: "docs".into(),
        source_class: "claim".into(),
        section: None,
        bytes: 0,
        member: Some("claims.0".into()),
    },
};
let index = Index {
    repository: RepositoryInfo {
        root: repo.path().display().to_string(),
        layer_schema: "ai-repository/v1".into(),
        sections: Default::default(),
        git: GitState::Unavailable { reason: "doc".into() },
        discovery: "filesystem".into(),
        source_classes: vec![],
        kind_sources: vec![],
        scope_origin: majordomus_cli::scope::Origin::Distribution,
        scope_path: String::new(),
        observed: Default::default(),
    },
    objects: vec![claim],
    diagnostics: vec![],
    state: State::Ok,
    fingerprint: String::new(),
    scoped: Default::default(),
    distribution: None,
    providers: Default::default(),
    share: None,
};

let report = evidence::report(&index, &Ledger::empty());
let proof = &report.claims[0];
assert_eq!(proof.test.as_deref(), Some("suite:07_scope"), "the id came from the path");
assert_eq!(proof.state, ProofState::NotRun);
assert_eq!(report.totals.get("not run"), Some(&1));

// a guarantee with nothing recorded behind it is a finding, and the reader is told
// exactly what would settle it
assert!(!report.satisfied());
assert_eq!(report.findings[0].claim, "scope-integrity");
assert_eq!(
    report.findings[0].reproduce.as_deref(),
    Some("bash test/run.sh 07_scope")
);