fix(providers): reconcile readiness with mutation replay

Merge current main and preserve original provider operation receipts and
mutation identities across admitted request replay. Reject replay when its
operation evidence is unavailable without repeating the saved mutation.

Regenerate protocol bindings, refresh the measured public schema fingerprint,
and align request and boundary test fixtures with the combined interfaces.

Signed-off-by: Shiju <shiju@nvidia.com>

Author: shiju-nv

.github/actions/build-docker-image/action.yml

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 name: Build Docker Image
-description: Build and push one architecture of an OpenShell image
+description: Build, push, and export a multi-platform OpenShell image
 
 inputs:
   component:
@@ -11,14 +11,8 @@ inputs:
   binary:
     description: Binary staged in the Docker build context
     required: true
-  triple:
-    description: Binary artifact target triple
-    required: true
-  arch:
-    description: Docker architecture name
-    required: true
-  platform:
-    description: Docker platform
+  target-suffix:
+    description: Binary artifact target suffix
     required: true
   image-tag:
     description: Docker image tag
@@ -35,41 +29,64 @@ runs:
         buildkitd-config: /etc/buildkit/buildkitd.toml
 
     - name: Log in to GHCR
-      shell: bash
-      run: echo "${INPUTS_GITHUB_TOKEN}" | docker login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin
-      env:
-        INPUTS_GITHUB_TOKEN: ${{ inputs.github-token }}
+      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ inputs.github-token }}
+
+    - name: Download amd64 ${{ inputs.binary }}
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: ${{ inputs.binary }}-x86_64-${{ inputs.target-suffix }}
+        path: artifact/amd64
 
-    - name: Download ${{ inputs.binary }}
+    - name: Download arm64 ${{ inputs.binary }}
       uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
-        name: ${{ inputs.binary }}-${{ inputs.triple }}
-        path: artifact
+        name: ${{ inputs.binary }}-aarch64-${{ inputs.target-suffix }}
+        path: artifact/arm64
 
     - name: Stage ${{ inputs.binary }}
       shell: bash
-      run: install -Dm0755 artifact/${INPUTS_BINARY} deploy/docker/.build/prebuilt-binaries/${INPUTS_ARCH}/${INPUTS_BINARY}
       env:
-        INPUTS_BINARY: ${{ inputs.binary }}
-        INPUTS_ARCH: ${{ inputs.arch }}
+        BINARY: ${{ inputs.binary }}
+      run: |
+        install -Dm0755 artifact/amd64/${BINARY} deploy/docker/.build/prebuilt-binaries/amd64/${BINARY}
+        install -Dm0755 artifact/arm64/${BINARY} deploy/docker/.build/prebuilt-binaries/arm64/${BINARY}
 
     - name: Build ${{ inputs.component }} image
       shell: bash
       env:
+        COMPONENT: ${{ inputs.component }}
         IMAGE_TAG: ${{ inputs.image-tag }}
-        INPUTS_PLATFORM: ${{ inputs.platform }}
-        INPUTS_COMPONENT: ${{ inputs.component }}
-        INPUTS_ARCH: ${{ inputs.arch }}
       run: |
+        install -d artifacts/images
         docker buildx build \
           --builder openshell \
-          --platform ${INPUTS_PLATFORM} \
-          --file deploy/docker/Dockerfile.${INPUTS_COMPONENT} \
-          --target ${INPUTS_COMPONENT} \
-          --tag ghcr.io/nvidia/openshell/${INPUTS_COMPONENT}:${IMAGE_TAG}-${INPUTS_ARCH} \
-          --cache-from type=gha,scope=${INPUTS_COMPONENT}-${INPUTS_ARCH} \
-          --cache-to type=gha,mode=max,scope=${INPUTS_COMPONENT}-${INPUTS_ARCH} \
+          --platform linux/amd64,linux/arm64 \
+          --file deploy/docker/Dockerfile.${COMPONENT} \
+          --target ${COMPONENT} \
+          --tag ghcr.io/nvidia/openshell/${COMPONENT}:${IMAGE_TAG} \
+          --cache-from type=gha,scope=${COMPONENT} \
+          --cache-to type=gha,mode=max,scope=${COMPONENT} \
           --provenance=mode=min \
           --attest type=sbom \
           --output type=image,push=true,oci-mediatypes=true,oci-artifact=true \
+          --output type=oci,dest=artifacts/images/${COMPONENT}.tar \
           .
+
+    - name: Verify SBOM attestation
+      shell: bash
+      env:
+        IMAGE_REF: ghcr.io/nvidia/openshell/${{ inputs.component }}:${{ inputs.image-tag }}
+      run: tasks/scripts/verify-image-sbom.sh "${IMAGE_REF}" --require-cargo
+
+    - name: Upload ${{ inputs.component }} image
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      with:
+        name: image-${{ inputs.component }}
+        path: artifacts
+        compression-level: 0
+        retention-days: 5
+        if-no-files-found: error

.github/actions/build-rust-binary/action.yml

@@ -17,7 +17,7 @@ inputs:
   cargo-version:
     description: Cargo package version embedded in the binary
     required: true
-  image-tag:
+  supervisor-image-tag:
     description: Default supervisor image tag embedded in the binary
     required: false
     default: ""
@@ -29,11 +29,6 @@ inputs:
     description: Additional flags passed to cargo build
     required: false
     default: ""
-  interpreter:
-    description: Expected ELF program interpreter, "none" for static, or "skip"
-    required: false
-    default: skip
-
 runs:
   using: composite
   steps:
@@ -63,7 +58,7 @@ runs:
       shell: nix develop -c bash -euo pipefail {0}
       env:
         GIT_DIR: /nonexistent
-        OPENSHELL_IMAGE_TAG: ${{ inputs.image-tag }}
+        OPENSHELL_IMAGE_TAG: ${{ inputs.supervisor-image-tag }}
         INPUTS_PACKAGE: ${{ inputs.package }}
         INPUTS_BINARY: ${{ inputs.binary }}
         INPUTS_TRIPLE: ${{ inputs.triple }}
@@ -75,24 +70,12 @@ runs:
       env:
         INPUTS_BINARY: ${{ inputs.binary }}
         INPUTS_TRIPLE: ${{ inputs.triple }}
-        INPUTS_INTERPRETER: ${{ inputs.interpreter }}
       run: |
         binary="target/${INPUTS_TRIPLE}/release/${INPUTS_BINARY}"
         # Confirm the binary runs and reports the expected name.
         "$binary" --version | grep -q "^${INPUTS_BINARY} "
         # Confirm Syft can decode the embedded cargo-auditable metadata.
         SYFT_CHECK_FOR_APP_UPDATE=false syft "file:${binary}" -o cyclonedx-json | grep 'pkg:cargo/' > /dev/null
-        if [ "$INPUTS_INTERPRETER" != skip ]; then
-          actual_interpreter="$(readelf -l "$binary" | sed -n 's/.*Requesting program interpreter: \(.*\)]/\1/p')"
-          expected_interpreter="$INPUTS_INTERPRETER"
-          if [ "$expected_interpreter" = none ]; then
-            expected_interpreter=""
-          fi
-          if [ "$actual_interpreter" != "$expected_interpreter" ]; then
-            echo "error: expected interpreter '${expected_interpreter:-<none>}', got '${actual_interpreter:-<none>}'" >&2
-            exit 1
-          fi
-        fi
 
     - name: Upload ${{ inputs.binary }}
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7

.github/actions/release-helm-oci/action.yml

@@ -26,7 +26,7 @@ inputs:
       as 0.0.0-dev.<sha> with appVersion set to the same SHA, enabling exact
       version pinning alongside the floating 0.0.0-dev tag. Both chart version
       and appVersion use the full SHA so the chart tag matches the image tag
-      pushed by docker-build.yml.
+      pushed by build-images.yml.
     required: false
     default: ""
 

.github/workflows/branch-checks.yml

@@ -173,6 +173,25 @@ jobs:
         run: |
           cargo nextest run --profile ci --workspace --features openshell-server/test-support
 
+      - name: Verify standalone policy prover package
+        if: matrix.system == 'x86_64-linux'
+        env:
+          CARGO_NET_OFFLINE: "true"
+        run: |
+          cargo test --locked -p openshell-prover-cli
+          cargo build --locked --release -p openshell-prover-cli --bin openshell-prover
+          cargo tree --locked -p openshell-prover-cli --edges normal --prefix none > /tmp/openshell-prover-dependencies.txt
+          if grep -Eq '^(openshell-(cli|server|sdk|bootstrap|tui|providers|core|policy)) v' /tmp/openshell-prover-dependencies.txt; then
+            echo "ERROR: standalone prover includes an OpenShell control-plane dependency" >&2
+            cat /tmp/openshell-prover-dependencies.txt >&2
+            exit 1
+          fi
+          target/release/openshell-prover check \
+            crates/openshell-prover-cli/tests/fixtures/candidate-contained.yaml \
+            --boundary crates/openshell-prover-cli/tests/fixtures/boundary.yaml \
+            --output json > /tmp/openshell-prover-result.json
+          grep -q '"result"[[:space:]]*:[[:space:]]*"within_boundary"' /tmp/openshell-prover-result.json
+
       - name: Verify telemetry can be compiled out
         run: |
           cargo build -p openshell-gateway --bin openshell-gateway