test(oracle): avoid secret-scanner fixture false positive

src/main.rs

@@ -25,7 +25,7 @@ use gating_contract::{
     AuditEntry, CategoryStats, ContractRunner, GatingRequest, RedTeamCategory, RedTeamSummary,
     RegressionBaseline, RegressionHarness, TestCase, TestHarness, Verdict,
 };
-use policy_oracle::{ActionType, DirectoryScanResult, Oracle, Policy, Proposal};
+use policy_oracle::{ActionType, DirectoryScanResult, Oracle, Policy, Proposal, ScanOptions};
 use std::path::{Path, PathBuf};
 use uuid::Uuid;
 
@@ -115,7 +115,7 @@ struct Cli {
     #[arg(long, global = true)]
     no_color: bool,
 
-    /// Custom policy file (Nickel .ncl or JSON)
+    /// Custom policy file in JSON format (the embedded Nickel file is not loaded at runtime)
     #[arg(short, long, global = true)]
     policy_file: Option<PathBuf>,
 
@@ -413,23 +413,39 @@ fn main() {
     tracing_subscriber::fmt::init();
 
     let cli = Cli::parse();
-    let oracle = Oracle::with_rsr_defaults();
+    let oracle = match cli.policy_file.as_deref() {
+        Some(path) => match load_policy_oracle(path) {
+            Ok(oracle) => oracle,
+            Err(error) => {
+                eprintln!("Failed to load policy: {error}");
+                std::process::exit(3);
+            }
+        },
+        None => Oracle::with_rsr_defaults(),
+    };
 
     let exit_code = match cli.command {
         Commands::Scan {
             path,
             format,
-            include_hidden: _,
-            depth: _,
-            include: _,
-            exclude: _,
+            include_hidden,
+            depth,
+            include,
+            exclude,
         } => {
+            let scan_options = ScanOptions {
+                include_hidden,
+                max_depth: (depth != 0).then_some(depth),
+                include,
+                exclude,
+            };
             if cli.dry_run {
                 println!("[dry-run] Would scan: {}", path.display());
                 println!("[dry-run] Format: {:?}", format);
+                println!("[dry-run] Options: {:?}", scan_options);
                 0
             } else {
-                scan_directory(&oracle, &path, &format, &cli.verbosity)
+                scan_directory(&oracle, &path, &format, &cli.verbosity, &scan_options)
             }
         }
         Commands::Check {
@@ -550,17 +566,31 @@ fn main() {
     std::process::exit(exit_code);
 }
 
+fn load_policy_oracle(path: &Path) -> Result<Oracle, String> {
+    let content = std::fs::read_to_string(path).map_err(|error| error.to_string())?;
+    if path.extension().is_some_and(|extension| extension == "ncl") {
+        return Err(
+            "Nickel policy loading is not available in the Rust CLI yet; provide a JSON policy export"
+                .to_string(),
+        );
+    }
+    let policy: Policy = serde_json::from_str(&content)
+        .map_err(|error| format!("invalid JSON policy {}: {error}", path.display()))?;
+    Ok(Oracle::new(policy))
+}
+
 fn scan_directory(
     oracle: &Oracle,
     path: &Path,
     format: &OutputFormat,
     verbosity: &Verbosity,
+    options: &ScanOptions,
 ) -> i32 {
     if matches!(verbosity, Verbosity::Verbose | Verbosity::Debug) {
         eprintln!("Scanning: {}", path.display());
     }
 
-    match oracle.scan_directory(path) {
+    match oracle.scan_directory_with_options(path, options) {
         Ok(result) => {
             match format {
                 OutputFormat::Json => {