fix(prover): distinguish sibling endpoints and fail closed on solver errors

[alangou]

Summary

Keep sibling endpoints distinct in the prover and read each endpoint's own allowed methods. Propagate inconsistent or inconclusive solver results as validation errors so policy approval requires successful analysis of both the current and proposed policies.

Changes

• Index endpoint facts by rule, endpoint position, and effective port, using unambiguous keys.
• Propagate analysis errors through the CLI and gateway; advance evaluation tokens to v3 so stored verdicts are reevaluated.
• Add prover and gateway regression tests and update the prover README, advisor documentation, and CLI skill.

Compatibility

• Protobuf messages and RPC signatures are unchanged.
• The Rust openshell-prover API changes: run_all_queries and check_credential_safety now return Result<Vec<Finding>>, and EndpointId adds endpoint_index. Repository callers are updated.
• Pending proposals with older evaluation tokens require reevaluation. Unavailable analysis blocks approval, including when analysis of the current policy fails.

Testing

• Prover suite: 110 tests passed.
• Gateway policy suite: 254 tests passed.
• Regression tests fail when the previous endpoint encoding or lookup is restored, then pass with the final implementation.
• Prover and server Clippy with all targets and -D warnings, Rust formatting, and git diff --check passed.
• mise run docs: navigation passed; Fern reported 0 errors and 3 warnings.
• Policy-advisor E2E passed with the official workload fixture and a temporary copy of the scenario whose only assertion change expects allow_index_crates_io_443, the rule name produced by the base implementation. This exercised approval, the active REST/read-only policy, and a successful request after hot-reload. The unmodified scenario still fails on its stale cargo_registry name assertion; the tracked E2E script is unchanged.
• Standard E2E CI requested through test:e2e.

Checklist

• Follows Conventional Commits.
• Commit is signed off for DCO.
• Relevant implementation documentation, user documentation, and agent guidance updated.

[github-actions]

Label test:e2e applied for 2a29ab2. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4326.docs.buildwithfern.com/openshell

[alangou]

gator-agent

PR Review Status

The independent code review found no blocking issues in the endpoint identity changes or fail-closed solver handling. The required Branch Checks, Helm Lint, Trivy Changes, and standard E2E gates are green on this head.

Action required: A human maintainer must review and approve this PR.

Blocking findings: None.
Carried findings: None.
Non-blocking suggestions: None.

Gator metadata

• Validation: Focused prover correctness fix and gateway error propagation; the author has verified repository admin authority.
• Docs: Prover README, published policy-advisor documentation, and CLI skill updated; existing navigation is sufficient.
• Checks: All required current-head gates are green; DCO and vouch checks passed; no merge conflict.
• E2E: test:e2e is present and the standard E2E workflow completed successfully on this exact head. No additional GPU, Windows, or Kubernetes-specific labels are needed for this patch.
• Head SHA: 2a29ab2052164a56b424ac1c9747fdeb5a8e2b0c
• Base SHA: 67adcf1a3cf054be54dfdbf6a44c65b4d426b1ec
• Merge base SHA: e406c2befbe65501409026d49259602669f7246a
• Patch ID: 160c66399ac671eda6cf56da74960b54cb00f337
• Gator payload: 12
• Review mode: initial
• Previous reviewed SHA: none
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:approval-needed

[alangou]

gator-agent

Monitoring Complete

Monitoring is complete because this PR has merged.

Final status: Gator review found no blocking findings, required checks passed, and human maintainer approval was recorded before merge.

I removed the active gator:* label because there is nothing left for gator to monitor on this PR.

Gator metadata

• Head SHA: 2a29ab2052164a56b424ac1c9747fdeb5a8e2b0c
• Gator payload: 12