feat(prover): add standalone policy boundary checker

.github/workflows/branch-checks.yml

@@ -173,6 +173,25 @@ jobs:
         run: |
           cargo nextest run --profile ci --workspace --features openshell-server/test-support
 
+      - name: Verify standalone policy prover package
+        if: matrix.system == 'x86_64-linux'
+        env:
+          CARGO_NET_OFFLINE: "true"
+        run: |
+          cargo test --locked -p openshell-prover-cli
+          cargo build --locked --release -p openshell-prover-cli --bin openshell-prover
+          cargo tree --locked -p openshell-prover-cli --edges normal --prefix none > /tmp/openshell-prover-dependencies.txt
+          if grep -Eq '^(openshell-(cli|server|sdk|bootstrap|tui|providers|core|policy)) v' /tmp/openshell-prover-dependencies.txt; then
+            echo "ERROR: standalone prover includes an OpenShell control-plane dependency" >&2
+            cat /tmp/openshell-prover-dependencies.txt >&2
+            exit 1
+          fi
+          target/release/openshell-prover check \
+            crates/openshell-prover-cli/tests/fixtures/candidate-contained.yaml \
+            --boundary crates/openshell-prover-cli/tests/fixtures/boundary.yaml \
+            --output json > /tmp/openshell-prover-result.json
+          grep -q '"result"[[:space:]]*:[[:space:]]*"within_boundary"' /tmp/openshell-prover-result.json
+
       - name: Verify telemetry can be compiled out
         run: |
           cargo build -p openshell-gateway --bin openshell-gateway

.github/workflows/build-prover-binaries.yml

@@ -0,0 +1,42 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Build Prover Binaries
+
+on:
+  workflow_call:
+    inputs:
+      cargo-version:
+        required: true
+        type: string
+      checkout-ref:
+        required: false
+        type: string
+        default: ""
+    secrets:
+      CACHIX_AUTH_TOKEN:
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    strategy:
+      matrix:
+        include:
+          - triple: x86_64-unknown-linux-musl
+            runner: linux-amd64-cpu8
+          - triple: aarch64-unknown-linux-musl
+            runner: linux-arm64-cpu8
+          - triple: aarch64-apple-darwin
+            runner: macos-15-xlarge
+    uses: ./.github/workflows/build-binaries.yml
+    with:
+      package: openshell-prover-cli
+      binary: openshell-prover
+      triple: ${{ matrix.triple }}
+      runner: ${{ matrix.runner }}
+      cargo-version: ${{ inputs.cargo-version }}
+      checkout-ref: ${{ inputs.checkout-ref }}
+    secrets: inherit

.github/workflows/build-rpm.yml

@@ -21,6 +21,9 @@ on:
       gateway-target:
         required: true
         type: string
+      prover-target:
+        required: true
+        type: string
       rpm-version:
         required: false
         type: string
@@ -81,10 +84,16 @@ jobs:
           name: openshell-gateway-${{ inputs.gateway-target }}
           path: package-binaries/
 
+      - name: Download prover artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: openshell-prover-${{ inputs.prover-target }}
+          path: package-binaries/
+
       - name: Configure package inputs
         run: |
           set -euo pipefail
-          chmod +x package-binaries/openshell{,-gateway}
+          chmod +x package-binaries/openshell{,-gateway,-prover}
           ls -lah package-binaries
 
       - name: Mark workspace safe for git

.github/workflows/conformance.yml

@@ -97,8 +97,22 @@ jobs:
       checkout-ref: ${{ github.sha }}
     secrets: inherit
 
+  build-prover:
+    needs: version
+    permissions:
+      contents: read
+    uses: ./.github/workflows/build-binaries.yml
+    with:
+      package: openshell-prover-cli
+      binary: openshell-prover
+      triple: x86_64-unknown-linux-musl
+      runner: linux-amd64-cpu8
+      cargo-version: ${{ needs.version.outputs.cargo }}
+      checkout-ref: ${{ github.sha }}
+    secrets: inherit
+
   build-rpm:
-    needs: [version, build-cli, build-gateway]
+    needs: [version, build-cli, build-gateway, build-prover]
     permissions:
       contents: read
     uses: ./.github/workflows/build-rpm.yml
@@ -108,6 +122,7 @@ jobs:
       runner: linux-amd64-cpu8
       cli-target: x86_64-unknown-linux-musl
       gateway-target: x86_64-unknown-linux-gnu
+      prover-target: x86_64-unknown-linux-musl
       cargo-version: ${{ needs.version.outputs.cargo }}
       rpm-version: ${{ needs.version.outputs.rpm_version }}
       rpm-release: ${{ needs.version.outputs.rpm_release }}

.github/workflows/deb-package.yml

@@ -58,6 +58,12 @@ jobs:
           name: openshell-gateway-${{ matrix.gnu_target }}
           path: package-binaries/
 
+      - name: Download prover artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: openshell-prover-${{ matrix.cli_target }}
+          path: package-binaries/
+
       - name: Download VM driver artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -67,14 +73,15 @@ jobs:
       - name: Configure package inputs
         run: |
           set -euo pipefail
-          chmod +x package-binaries/openshell{,-gateway,-driver-vm}
+          chmod +x package-binaries/openshell{,-gateway,-prover,-driver-vm}
           ls -lah package-binaries
 
       - name: Build Debian package
         run: |
           set -euo pipefail
           OPENSHELL_CLI_BINARY="${PWD}/package-binaries/openshell" \
           OPENSHELL_GATEWAY_BINARY="${PWD}/package-binaries/openshell-gateway" \
+          OPENSHELL_PROVER_BINARY="${PWD}/package-binaries/openshell-prover" \
           OPENSHELL_DRIVER_VM_BINARY="${PWD}/package-binaries/openshell-driver-vm" \
           OPENSHELL_DEB_VERSION="${INPUTS_DEB_VERSION}" \
           OPENSHELL_DEB_ARCH="${{ matrix.deb_arch }}" \

.github/workflows/package-release-binaries.yml

@@ -5,6 +5,11 @@ name: Package Release Binaries
 
 on:
   workflow_call:
+    inputs:
+      checkout-ref:
+        required: false
+        type: string
+        default: ""
 
 permissions:
   actions: read
@@ -58,6 +63,15 @@ jobs:
           - artifact: openshell-driver-vm-aarch64-apple-darwin
             binary: openshell-driver-vm
             package: driver-vm-macos
+          - artifact: openshell-prover-x86_64-unknown-linux-musl
+            binary: openshell-prover
+            package: prover-binary-linux-amd64
+          - artifact: openshell-prover-aarch64-unknown-linux-musl
+            binary: openshell-prover
+            package: prover-binary-linux-arm64
+          - artifact: openshell-prover-aarch64-apple-darwin
+            binary: openshell-prover
+            package: prover-binary-macos
     steps:
       - name: Download ${{ matrix.artifact }}
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -81,3 +95,109 @@ jobs:
           path: ${{ matrix.artifact }}.tar.gz
           retention-days: 5
           if-no-files-found: error
+
+  smoke-prover:
+    name: Smoke packaged prover (${{ matrix.triple }})
+    needs: package
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - triple: x86_64-unknown-linux-musl
+            runner: linux-amd64-cpu8
+            package: prover-binary-linux-amd64
+          - triple: aarch64-unknown-linux-musl
+            runner: linux-arm64-cpu8
+            package: prover-binary-linux-arm64
+          - triple: aarch64-apple-darwin
+            runner: macos-15-xlarge
+            package: prover-binary-macos
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs['checkout-ref'] || github.sha }}
+
+      - name: Download packaged prover
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: ${{ matrix.package }}
+          path: package
+
+      - name: Extract and run containment check
+        env:
+          TRIPLE: ${{ matrix.triple }}
+        run: |
+          set -euo pipefail
+          mkdir extracted
+          tar -xzf "package/openshell-prover-${TRIPLE}.tar.gz" -C extracted
+          test "$(find extracted -type f | wc -l | tr -d ' ')" = 1
+          test -x extracted/openshell-prover
+          if [ "${RUNNER_OS}" = "Linux" ]; then
+            tasks/scripts/verify-static-binary.sh extracted/openshell-prover
+          else
+            otool -L extracted/openshell-prover | tee linkage.txt
+            if grep -Eiq 'libz3|/nix/store' linkage.txt; then
+              echo "ERROR: packaged prover has a non-portable native dependency" >&2
+              exit 1
+            fi
+          fi
+          extracted/openshell-prover check \
+            crates/openshell-prover-cli/tests/fixtures/candidate-contained.yaml \
+            --boundary crates/openshell-prover-cli/tests/fixtures/boundary.yaml \
+            --output json > result.json
+          grep -q '"result"[[:space:]]*:[[:space:]]*"within_boundary"' result.json
+
+          if extracted/openshell-prover check \
+            crates/openshell-prover-cli/tests/fixtures/candidate-underscore-host.yaml \
+            --boundary crates/openshell-prover-cli/tests/fixtures/boundary-empty.yaml \
+            --output json > underscore.json; then
+            echo "ERROR: underscore host unexpectedly stayed within an empty boundary" >&2
+            exit 1
+          else
+            test "$?" = 1
+          fi
+          grep -q '"result"[[:space:]]*:[[:space:]]*"exceeds_boundary"' underscore.json
+          grep -q '"host"[[:space:]]*:[[:space:]]*"api_internal.example.com"' underscore.json
+
+          if extracted/openshell-prover check \
+            crates/openshell-prover-cli/tests/fixtures/candidate-unicode-network-selector.yaml \
+            --boundary crates/openshell-prover-cli/tests/fixtures/boundary-empty.yaml \
+            --output json > unicode.json; then
+            echo "ERROR: non-ASCII network selector unexpectedly produced a definitive result" >&2
+            exit 1
+          else
+            test "$?" = 3
+          fi
+          grep -q '"result"[[:space:]]*:[[:space:]]*"unsupported"' unicode.json
+          grep -q '"reason_code"[[:space:]]*:[[:space:]]*"unsupported_policy_shape"' unicode.json
+
+  prover-checksums:
+    name: Package prover checksums
+    needs: smoke-prover
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Download packaged prover archives
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: prover-binary-*
+          path: release
+          merge-multiple: true
+
+      - name: Generate prover checksums
+        run: |
+          set -euo pipefail
+          cd release
+          sha256sum openshell-prover-*.tar.gz > openshell-prover-checksums-sha256.txt
+          test "$(awk 'END { print NR }' openshell-prover-checksums-sha256.txt)" = 3
+          sha256sum --check openshell-prover-checksums-sha256.txt
+
+      - name: Upload prover checksums
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: prover-checksums
+          path: release/openshell-prover-checksums-sha256.txt
+          retention-days: 5
+          if-no-files-found: error