feat(policy): lint authored policy files offline - #5358

diff --git a/crates/openshell-policy/src/ambiguity.rs b/crates/openshell-policy/src/ambiguity.rs
index efb846a..0eb9739 100644
--- a/crates/openshell-policy/src/ambiguity.rs
+++ b/crates/openshell-policy/src/ambiguity.rs
@@ -58,9 +58,12 @@ struct EndpointRef<'a> {
 /// request-specific metadata) path selectors can match the same request.
 #[must_use]
 pub fn find_endpoint_ambiguities(policy: &SandboxPolicy) -> Vec<EndpointAmbiguity> {
-    let endpoints = policy
-        .network_policies
-        .iter()
+    // Protobuf maps do not preserve iteration order. Sort rule keys so callers
+    // receive the same ambiguity pairs, in the same order, for equivalent input.
+    let mut network_policies: Vec<_> = policy.network_policies.iter().collect();
+    network_policies.sort_by_key(|(key, _)| *key);
+    let endpoints = network_policies
+        .into_iter()
         .flat_map(|(key, rule)| {
             let policy_name = if rule.name.is_empty() {
                 key.as_str()
@@ -775,6 +778,43 @@ mod tests {
         assert!(find_endpoint_ambiguities(&policy_with(left, right)).is_empty());
     }
 
+    #[test]
+    fn ambiguities_are_reported_in_rule_key_order() {
+        let pairs = |policy: &SandboxPolicy| {
+            find_endpoint_ambiguities(policy)
+                .into_iter()
+                .map(|ambiguity| (ambiguity.left_policy, ambiguity.right_policy))
+                .collect::<Vec<_>>()
+        };
+        let build = || {
+            let mut policy = SandboxPolicy::default();
+            for (key, tls) in [
+                ("zeta", NetworkTlsMode::Skip),
+                ("alpha", NetworkTlsMode::Unspecified),
+                ("mid", NetworkTlsMode::Skip),
+            ] {
+                let mut endpoint = endpoint("api.example.com", 443);
+                endpoint.tls = tls as i32;
+                policy.network_policies.insert(
+                    key.to_string(),
+                    NetworkPolicyRule {
+                        endpoints: vec![endpoint],
+                        ..Default::default()
+                    },
+                );
+            }
+            policy
+        };
+        let expected = vec![
+            ("alpha".to_string(), "mid".to_string()),
+            ("alpha".to_string(), "zeta".to_string()),
+        ];
+        // Each map gets its own hash seed, so repeat to catch unordered iteration.
+        for _ in 0..32 {
+            assert_eq!(pairs(&build()), expected);
+        }
+    }
+
     #[test]
     fn compatible_request_rules_may_overlap() {
         let mut left = endpoint("api.example.com", 443);

diff --git a/crates/openshell-cli/tests/policy_only_process_identity_integration.rs b/crates/openshell-cli/tests/policy_only_process_identity_integration.rs
index 559534e..90b77ca 100644
--- a/crates/openshell-cli/tests/policy_only_process_identity_integration.rs
+++ b/crates/openshell-cli/tests/policy_only_process_identity_integration.rs
@@ -183,3 +183,35 @@ async fn authored_policy_lint_matches_gateway_file_validation() {
         }
     }
 }
+
+#[tokio::test]
+async fn authored_policy_lint_matches_gateway_endpoint_ambiguity() {
+    let server = run_server().await;
+    let policy = openshell_policy::parse_sandbox_policy(
+        "version: 1\nnetwork_policies:\n  conflict:\n    endpoints:\n      - {host: example.com, port: 443}\n      - {host: example.com, port: 443, tls: skip}\n",
+    )
+    .unwrap();
+    let ambiguities = openshell_policy::find_endpoint_ambiguities(&policy);
+    assert_eq!(ambiguities.len(), 1, "{ambiguities:?}");
+    let mut client = grpc_client(&server.endpoint, &server.tls).await.unwrap();
+    let error = client
+        .create_sandbox(CreateSandboxRequest {
+            name: "ambiguity".to_string(),
+            spec: Some(SandboxSpec {
+                policy: Some(policy),
+                ..Default::default()
+            }),
+            workspace_scope: Some(openshell_core::proto::workspace_selector(
+                "default".to_string(),
+            )),
+            ..Default::default()
+        })
+        .await
+        .expect_err("an ambiguous authored file must be rejected by the gateway too");
+    assert_eq!(error.code(), tonic::Code::FailedPrecondition);
+    assert!(
+        error.message().contains(&ambiguities[0].to_string()),
+        "{error} did not report {}",
+        ambiguities[0]
+    );
+}