diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4b38723f..6fcf0ab4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -60,9 +60,9 @@ jobs:
     outputs:
       release-kind: ${{ steps.validate-release.outputs.release-kind }}
       release-version: ${{ steps.validate-release.outputs.release-version }}
+      cargo-version: ${{ steps.validate-release.outputs.cargo-version }}
       python-version: ${{ steps.validate-release.outputs.python-version }}
     env:
-      GO_MODULE_TAG: src/bindings-go/go/v${{ inputs.tag }}
       RELEASE_TAG: ${{ inputs.tag }}
       WORKING_DIR: ${{ needs.get-configs.outputs.working-dir }}
     steps:
@@ -102,31 +102,28 @@ jobs:
           {
             echo "release-kind=$release_kind"
             echo "release-version=$VERSION"
+            echo "cargo-version=$RELEASE_TAG"
             echo "python-version=$python_version"
           } >> "$GITHUB_OUTPUT"
-          echo "Tag $RELEASE_TAG is a $release_kind release; Python version is $python_version."
+          echo "Tag $RELEASE_TAG is a $release_kind release; Cargo version is $RELEASE_TAG and Python version is $python_version."
 
-      - name: Check release tags
+      - name: Check release tag
         id: check-tags
         run: |
           set -euo pipefail
           source_commit="$(git rev-parse HEAD^{commit})"
-          missing_tags=false
 
-          for tag in "$RELEASE_TAG" "$GO_MODULE_TAG"; do
-            if git rev-parse -q --verify "refs/tags/$tag" >/dev/null; then
-              tag_commit="$(git rev-parse "refs/tags/$tag^{commit}")"
-              if [ "$tag_commit" != "$source_commit" ]; then
-                echo "::error::Existing tag $tag points to $tag_commit, not source commit $source_commit."
-                exit 1
-              fi
-              echo "Existing tag $tag already points to source commit $source_commit."
-            else
-              missing_tags=true
+          if git rev-parse -q --verify "refs/tags/$RELEASE_TAG" >/dev/null; then
+            tag_commit="$(git rev-parse "refs/tags/$RELEASE_TAG^{commit}")"
+            if [ "$tag_commit" != "$source_commit" ]; then
+              echo "::error::Existing tag $RELEASE_TAG points to $tag_commit, not source commit $source_commit."
+              exit 1
             fi
-          done
-
-          echo "missing=$missing_tags" >> "$GITHUB_OUTPUT"
+            echo 'missing=false' >> "$GITHUB_OUTPUT"
+            echo "Existing tag $RELEASE_TAG already points to source commit $source_commit."
+          else
+            echo 'missing=true' >> "$GITHUB_OUTPUT"
+          fi
 
       - name: Configure Git
         if: steps.check-tags.outputs.missing == 'true'
@@ -134,23 +131,14 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
 
-      - name: Create and push release tags
+      - name: Create and push release tag
         if: steps.check-tags.outputs.missing == 'true'
         run: |
           set -euo pipefail
           source_commit="$(git rev-parse HEAD^{commit})"
-          tag_refs=()
-
-          for tag in "$RELEASE_TAG" "$GO_MODULE_TAG"; do
-            if ! git rev-parse -q --verify "refs/tags/$tag" >/dev/null; then
-              git tag "$tag" "$source_commit"
-              tag_refs+=("refs/tags/$tag")
-              echo "Created tag $tag at commit $source_commit."
-            fi
-          done
-
-          git push --atomic origin "${tag_refs[@]}"
-          printf 'Pushed tag ref=%s\n' "${tag_refs[@]}"
+          git tag "$RELEASE_TAG" "$source_commit"
+          git push origin "refs/tags/$RELEASE_TAG"
+          echo "Created and pushed tag $RELEASE_TAG at source commit $source_commit."
 
   release:
     needs: [ get-configs, version-and-tag ]
@@ -392,8 +380,467 @@ jobs:
           files: release/*
           fail_on_unmatched_files: true
 
+  verify-release:
+    needs:
+      - get-configs
+      - version-and-tag
+      - release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      PYTHON_VERSION: ${{ needs.version-and-tag.outputs.python-version }}
+      RELEASE_KIND: ${{ needs.version-and-tag.outputs.release-kind }}
+      RELEASE_TAG: ${{ inputs.tag }}
+      RELEASE_VERSION: ${{ needs.version-and-tag.outputs.release-version }}
+      WORKING_DIR: ${{ needs.get-configs.outputs.working-dir }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.tag }}
+
+      - name: Verify published GitHub release artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+
+          release_metadata="$(gh release view "$RELEASE_TAG" \
+            --repo "$GITHUB_REPOSITORY" \
+            --json isDraft,isPrerelease,tagName)"
+          expected_prerelease=false
+          if [ "$RELEASE_KIND" = 'beta' ]; then
+            expected_prerelease=true
+          fi
+          if ! jq -e \
+            --arg tag "$RELEASE_TAG" \
+            --argjson prerelease "$expected_prerelease" \
+            '.tagName == $tag and .isDraft == false and .isPrerelease == $prerelease' \
+            <<< "$release_metadata" >/dev/null; then
+            echo "::error::GitHub release metadata does not match tag $RELEASE_TAG and release kind $RELEASE_KIND."
+            jq . <<< "$release_metadata"
+            exit 1
+          fi
+
+          download_directory="$(mktemp -d)"
+          verification_directory="$(mktemp -d)"
+          trap 'rm -rf "$download_directory" "$verification_directory"' EXIT
+          gh release download "$RELEASE_TAG" \
+            --repo "$GITHUB_REPOSITORY" \
+            --dir "$download_directory"
+
+          expected_artifacts=(
+            "cloudformation-validate-$RELEASE_TAG.jar"
+            "cloudformation-validate-wasm-$RELEASE_TAG.zip"
+            "cloudformation-validate-go-$RELEASE_TAG.zip"
+            'cloudformation-validate-maven-signing-key.asc'
+            'cloudformation-validate-maven-signing-key.asc.fingerprint'
+          )
+
+          committed_wheels=("$WORKING_DIR"/bindings-python/generated/dist/*.whl)
+          if [ ${#committed_wheels[@]} -ne 6 ]; then
+            echo "::error::Expected six committed Python wheels, found ${#committed_wheels[@]}."
+            exit 1
+          fi
+          for wheel in "${committed_wheels[@]}"; do
+            wheel_name="$(basename "$wheel")"
+            case "$wheel_name" in
+              cloudformation_validate-"$RELEASE_VERSION"-*.whl) ;;
+              *)
+                echo "::error::Committed wheel $wheel_name is not version $RELEASE_VERSION."
+                exit 1
+                ;;
+            esac
+            wheel_suffix="${wheel_name#cloudformation_validate-$RELEASE_VERSION-}"
+            expected_artifacts+=("cloudformation_validate-$PYTHON_VERSION-$wheel_suffix")
+          done
+
+          committed_binaries=("$GITHUB_WORKSPACE"/release-bin/cfn-validate-*)
+          if [ ${#committed_binaries[@]} -eq 0 ]; then
+            echo "::error::No committed cfn-validate binaries found."
+            exit 1
+          fi
+          for binary in "${committed_binaries[@]}"; do
+            binary_name="$(basename "$binary")"
+            platform="${binary_name#cfn-validate-}"
+            extension=''
+            case "$platform" in
+              *.exe) platform="${platform%.exe}"; extension='.exe' ;;
+            esac
+            expected_artifacts+=("cfn-validate-$RELEASE_TAG-${platform}${extension}")
+          done
+
+          expected_files=(
+            'signing-key.pem'
+            'signing-key.pem.sha256'
+          )
+          for artifact in "${expected_artifacts[@]}"; do
+            expected_files+=("$artifact" "$artifact.sig")
+          done
+
+          printf '%s\n' "${expected_files[@]}" | LC_ALL=C sort > "$verification_directory/expected-files"
+          downloaded_paths=("$download_directory"/*)
+          if [ ${#downloaded_paths[@]} -eq 0 ]; then
+            echo "::error::GitHub release $RELEASE_TAG has no downloadable artifacts."
+            exit 1
+          fi
+          for path in "${downloaded_paths[@]}"; do
+            basename "$path"
+          done | LC_ALL=C sort > "$verification_directory/downloaded-files"
+          if ! diff -u "$verification_directory/expected-files" "$verification_directory/downloaded-files"; then
+            echo "::error::GitHub release artifact inventory does not match the expected inventory."
+            exit 1
+          fi
+
+          expected_signing_fingerprint="$(tr -d '[:space:]' \
+            < "$download_directory/signing-key.pem.sha256" | tr '[:upper:]' '[:lower:]')"
+          actual_signing_fingerprint="$(openssl pkey \
+            -pubin \
+            -in "$download_directory/signing-key.pem" \
+            -outform DER \
+            | openssl dgst -sha256 \
+            | awk '{print tolower($NF)}')"
+          if [[ ! "$expected_signing_fingerprint" =~ ^[0-9a-f]{64}$ ]] \
+            || [ "$actual_signing_fingerprint" != "$expected_signing_fingerprint" ]; then
+            echo "::error::Published KMS signing key fingerprint is invalid."
+            exit 1
+          fi
+
+          maven_public_key="$download_directory/cloudformation-validate-maven-signing-key.asc"
+          expected_maven_fingerprint="$(tr -d '[:space:]' \
+            < "$maven_public_key.fingerprint" | tr '[:lower:]' '[:upper:]')"
+          actual_maven_fingerprint="$(gpg --batch --show-keys --with-colons "$maven_public_key" \
+            | awk -F: '$1 == "fpr" { print toupper($10); exit }')"
+          if [ -z "$actual_maven_fingerprint" ] \
+            || [ "$actual_maven_fingerprint" != "$expected_maven_fingerprint" ]; then
+            echo "::error::Published Maven signing key fingerprint is invalid."
+            exit 1
+          fi
+
+          for artifact in "${expected_artifacts[@]}"; do
+            echo "Verifying published artifact: $artifact"
+            if ! openssl dgst \
+              -sha256 \
+              -verify "$download_directory/signing-key.pem" \
+              -signature "$download_directory/$artifact.sig" \
+              "$download_directory/$artifact"; then
+              echo "::error::Signature verification failed for published artifact $artifact."
+              exit 1
+            fi
+          done
+          echo "GitHub release metadata, inventory, signing keys, and all artifact signatures are valid."
+
+  publish-crates:
+    needs: [ get-configs, version-and-tag, verify-release ]
+    runs-on: ubuntu-latest
+    environment: release-crates
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      CRATE_PACKAGES: >-
+        cloudformation-validate-template-model
+        cloudformation-validate-data-source
+        cloudformation-validate-rules
+        cloudformation-validate-diagnostics
+        cloudformation-validate-guard-translator
+        cloudformation-validate-schema-validator
+        cloudformation-validate-validation-engine
+        cloudformation-validate-rego-engine
+        cloudformation-validate-cel-engine
+        cloudformation-validate
+      RELEASE_KIND: ${{ needs.version-and-tag.outputs.release-kind }}
+      RELEASE_VERSION: ${{ needs.version-and-tag.outputs.cargo-version }}
+      WORKSPACE_VERSION: ${{ needs.version-and-tag.outputs.release-version }}
+      WORKING_DIR: ${{ needs.get-configs.outputs.working-dir }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.tag }}
+          fetch-depth: 0
+
+      - name: Check existing crates.io releases
+        id: check-crates
+        run: |
+          set -euo pipefail
+          read -r -a packages <<< "$CRATE_PACKAGES"
+          missing_packages=''
+
+          for package in "${packages[@]}"; do
+            if ! status="$(curl --silent --show-error --location \
+              --header 'User-Agent: aws-cloudformation/cloudformation-validate release workflow' \
+              --output /dev/null --write-out '%{http_code}' \
+              "https://crates.io/api/v1/crates/$package/$RELEASE_VERSION")"; then
+              echo "::error::Failed to check crates.io for $package $RELEASE_VERSION."
+              exit 1
+            fi
+            case "$status" in
+              200)
+                echo "$package $RELEASE_VERSION already exists; skipping publication."
+                ;;
+              404)
+                missing_packages="${missing_packages:+$missing_packages }$package"
+                ;;
+              *)
+                echo "::error::crates.io existence check returned HTTP $status for $package $RELEASE_VERSION; refusing to publish."
+                exit 1
+                ;;
+            esac
+          done
+
+          echo "missing-packages=$missing_packages" >> "$GITHUB_OUTPUT"
+          if [ -z "$missing_packages" ]; then
+            echo "All Rust crates already exist at $RELEASE_VERSION."
+          else
+            read -r -a packages <<< "$missing_packages"
+            for package in "${packages[@]}"; do
+              echo "Missing Rust crate: $package $RELEASE_VERSION"
+            done
+          fi
+
+      - name: Setup Rust toolchain
+        if: steps.check-crates.outputs.missing-packages != ''
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c
+        with:
+          toolchain: ${{ needs.get-configs.outputs.rust-toolchain }}
+
+      - name: Stamp beta Cargo workspace
+        if: env.RELEASE_KIND == 'beta' && steps.check-crates.outputs.missing-packages != ''
+        working-directory: ${{ env.WORKING_DIR }}
+        run: |
+          set -euo pipefail
+          workspace_assignment="version = \"$WORKSPACE_VERSION\""
+          dependency_assignment="version = \"=$WORKSPACE_VERSION\""
+          if [ "$(grep -cFx "$workspace_assignment" Cargo.toml)" -ne 1 ]; then
+            echo "::error::Expected one workspace version assignment for $WORKSPACE_VERSION."
+            exit 1
+          fi
+          if [ "$(grep -oF "$dependency_assignment" Cargo.toml | wc -l)" -ne 9 ]; then
+            echo "::error::Expected nine internal dependency requirements for $WORKSPACE_VERSION."
+            exit 1
+          fi
+
+          WORKSPACE_VERSION="$WORKSPACE_VERSION" RELEASE_VERSION="$RELEASE_VERSION" perl -0pi -e '
+            my $workspace = $ENV{"WORKSPACE_VERSION"};
+            my $release = $ENV{"RELEASE_VERSION"};
+            my $workspace_updates = s{(\[workspace\.package\]\s*\nversion = )"\Q$workspace\E"}{$1 . qq{"$release"}}e;
+            die "expected one workspace version update\n" unless $workspace_updates == 1;
+            my $dependency_updates = s{version = "=\Q$workspace\E"}{qq{version = "=$release"}}ge;
+            die "expected nine dependency version updates\n" unless $dependency_updates == 9;
+          ' Cargo.toml
+
+          metadata="$(cargo metadata --no-deps --format-version 1)"
+          mapfile -t workspace_packages < <(jq -r '.packages[].name' <<< "$metadata")
+          for package in "${workspace_packages[@]}"; do
+            PACKAGE="$package" WORKSPACE_VERSION="$WORKSPACE_VERSION" RELEASE_VERSION="$RELEASE_VERSION" perl -0pi -e '
+              my $package = $ENV{"PACKAGE"};
+              my $workspace = $ENV{"WORKSPACE_VERSION"};
+              my $release = $ENV{"RELEASE_VERSION"};
+              my $updates = s{(\[\[package\]\]\nname = "\Q$package\E"\nversion = )"\Q$workspace\E"}{$1 . qq{"$release"}}e;
+              die "expected one lock entry for $package\n" unless $updates == 1;
+            ' Cargo.lock
+          done
+
+          metadata="$(cargo metadata --locked --no-deps --format-version 1)"
+          if ! jq -e --arg version "$RELEASE_VERSION" 'all(.packages[]; .version == $version)' <<< "$metadata" >/dev/null; then
+            echo "::error::Not every workspace package was stamped to $RELEASE_VERSION."
+            exit 1
+          fi
+          if [ "$(grep -oF "version = \"=$RELEASE_VERSION\"" Cargo.toml | wc -l)" -ne 9 ]; then
+            echo "::error::Not every internal dependency was stamped to =$RELEASE_VERSION."
+            exit 1
+          fi
+          git diff -- Cargo.toml Cargo.lock
+
+      - name: Authenticate to crates.io with Trusted Publishing
+        if: steps.check-crates.outputs.missing-packages != ''
+        id: crates-auth
+        uses: rust-lang/crates-io-auth-action@v1.0.5
+
+      - name: Publish missing Rust crates
+        if: steps.check-crates.outputs.missing-packages != ''
+        working-directory: ${{ env.WORKING_DIR }}
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.crates-auth.outputs.token }}
+          MISSING_PACKAGES: ${{ steps.check-crates.outputs.missing-packages }}
+        run: |
+          set -euo pipefail
+          read -r -a packages <<< "$MISSING_PACKAGES"
+          for package in "${packages[@]}"; do
+            if [ "$RELEASE_KIND" = 'beta' ]; then
+              cargo publish --locked --allow-dirty -p "$package"
+            else
+              cargo publish --locked -p "$package"
+            fi
+          done
+
+  verify-publish-crates:
+    needs: [ resolve-ref, version-and-tag, publish-crates ]
+    runs-on: ubuntu-latest
+    env:
+      CRATE_PACKAGES: >-
+        cloudformation-validate-template-model
+        cloudformation-validate-data-source
+        cloudformation-validate-rules
+        cloudformation-validate-diagnostics
+        cloudformation-validate-guard-translator
+        cloudformation-validate-schema-validator
+        cloudformation-validate-validation-engine
+        cloudformation-validate-rego-engine
+        cloudformation-validate-cel-engine
+        cloudformation-validate
+      RELEASE_SOURCE_COMMIT: ${{ needs.resolve-ref.outputs.sha }}
+      RELEASE_VERSION: ${{ needs.version-and-tag.outputs.cargo-version }}
+    steps:
+      - name: Verify published crate archives
+        run: |
+          set -euo pipefail
+          read -r -a packages <<< "$CRATE_PACKAGES"
+          max_attempts=60
+
+          for package in "${packages[@]}"; do
+            archive="$(mktemp)"
+            available=false
+            for attempt in $(seq 1 "$max_attempts"); do
+              rm -f "$archive"
+              echo "attempt $attempt/$max_attempts: downloading $package $RELEASE_VERSION from crates.io"
+              if curl --fail --silent --show-error --location \
+                --header 'User-Agent: aws-cloudformation/cloudformation-validate release workflow' \
+                "https://crates.io/api/v1/crates/$package/$RELEASE_VERSION/download" \
+                --output "$archive"; then
+                if ! published_commit="$(
+                  tar -xOf "$archive" "$package-$RELEASE_VERSION/.cargo_vcs_info.json" \
+                    | jq -er '.git.sha1'
+                )"; then
+                  rm -f "$archive"
+                  echo "::error::$package $RELEASE_VERSION has missing or malformed Cargo source provenance."
+                  exit 1
+                fi
+                if [ "$published_commit" != "$RELEASE_SOURCE_COMMIT" ]; then
+                  rm -f "$archive"
+                  echo "::error::$package $RELEASE_VERSION records source commit $published_commit, expected $RELEASE_SOURCE_COMMIT."
+                  exit 1
+                fi
+                available=true
+                echo "$package $RELEASE_VERSION records source commit $RELEASE_SOURCE_COMMIT."
+                break
+              fi
+              sleep 10
+            done
+            rm -f "$archive"
+            if [ "$available" != true ]; then
+              echo "::error::Timed out waiting for $package $RELEASE_VERSION on crates.io."
+              exit 1
+            fi
+          done
+
+  publish-go:
+    needs: [ resolve-ref, version-and-tag, verify-release ]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    env:
+      GO_MODULE_TAG: src/bindings-go/go/v${{ inputs.tag }}
+      RELEASE_SOURCE_COMMIT: ${{ needs.resolve-ref.outputs.sha }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.resolve-ref.outputs.sha }}
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Check existing Go module release
+        id: check-go-release
+        run: |
+          set -euo pipefail
+          if git rev-parse -q --verify "refs/tags/$GO_MODULE_TAG" >/dev/null; then
+            tag_commit="$(git rev-parse "refs/tags/$GO_MODULE_TAG^{commit}")"
+            if [ "$tag_commit" != "$RELEASE_SOURCE_COMMIT" ]; then
+              echo "::error::Existing tag $GO_MODULE_TAG points to $tag_commit, not source commit $RELEASE_SOURCE_COMMIT."
+              exit 1
+            fi
+            echo 'exists=true' >> "$GITHUB_OUTPUT"
+            echo "Go module $GO_MODULE_TAG already exists at source commit $RELEASE_SOURCE_COMMIT; skipping publication."
+          else
+            echo 'exists=false' >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Configure Git
+        if: steps.check-go-release.outputs.exists != 'true'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Publish Go module tag
+        if: steps.check-go-release.outputs.exists != 'true'
+        run: |
+          set -euo pipefail
+          git tag "$GO_MODULE_TAG" "$RELEASE_SOURCE_COMMIT"
+          git push origin "refs/tags/$GO_MODULE_TAG"
+          echo "Published Go module tag $GO_MODULE_TAG at source commit $RELEASE_SOURCE_COMMIT."
+
+  verify-publish-go:
+    needs: [ publish-go ]
+    runs-on: ubuntu-latest
+    env:
+      GO_MODULE_PATH: github.com/aws-cloudformation/cloudformation-validate/src/bindings-go/go
+      GO_MODULE_VERSION: v${{ inputs.tag }}
+    steps:
+      - name: Verify Go module artifacts resolve from the public proxy
+        run: |
+          set -euo pipefail
+          download_directory="$(mktemp -d)"
+          trap 'rm -rf "$download_directory"' EXIT
+          base="https://proxy.golang.org/$GO_MODULE_PATH/@v/$GO_MODULE_VERSION"
+          expected_prefix="$GO_MODULE_PATH@$GO_MODULE_VERSION/"
+
+          verify() {
+            rm -f "$download_directory"/*
+            curl --fail --silent --show-error --location \
+              --output "$download_directory/module.info" \
+              "$base.info" || return 1
+            curl --fail --silent --show-error --location \
+              --output "$download_directory/go.mod" \
+              "$base.mod" || return 1
+            curl --fail --silent --show-error --location \
+              --output "$download_directory/module.zip" \
+              "$base.zip" || return 1
+
+            jq -e --arg version "$GO_MODULE_VERSION" '.Version == $version' \
+              "$download_directory/module.info" >/dev/null || return 1
+            grep -Fx "module $GO_MODULE_PATH" "$download_directory/go.mod" >/dev/null || return 1
+            unzip -Z1 "$download_directory/module.zip" > "$download_directory/contents"
+
+            expected_files=(
+              go.mod
+              cfnvalidate.go
+              version.go
+              internal/bindings_go/bindings_go.go
+              libs/darwin-aarch64/libbindings_go.a
+              libs/linux-x86-64/libbindings_go.a
+              libs/win32-x86-64/libbindings_go.a
+            )
+            for file in "${expected_files[@]}"; do
+              grep -Fx "$expected_prefix$file" "$download_directory/contents" >/dev/null || return 1
+            done
+          }
+
+          max_attempts=60
+          for attempt in $(seq 1 "$max_attempts"); do
+            echo "attempt $attempt/$max_attempts: downloading $GO_MODULE_PATH@$GO_MODULE_VERSION from proxy.golang.org"
+            if verify; then
+              echo "The public Go proxy serves the expected module metadata, source, generated bindings, and platform libraries."
+              exit 0
+            fi
+            sleep 10
+          done
+
+          echo "::error::Timed out waiting for $GO_MODULE_PATH@$GO_MODULE_VERSION on proxy.golang.org."
+          exit 1
+
   publish-maven:
-    needs: [ get-configs, version-and-tag, release ]
+    needs: [ get-configs, version-and-tag, verify-release ]
     runs-on: ubuntu-latest
     environment: release-maven
     permissions:
@@ -634,7 +1081,7 @@ jobs:
 
   publish-python-beta:
     if: needs.version-and-tag.outputs.release-kind == 'beta'
-    needs: [ version-and-tag, release ]
+    needs: [ version-and-tag, verify-release ]
     runs-on: ubuntu-latest
     environment: release-python-beta
     permissions:
@@ -771,7 +1218,7 @@ jobs:
 
   publish-python-prod:
     if: needs.version-and-tag.outputs.release-kind == 'production'
-    needs: [ version-and-tag, release ]
+    needs: [ version-and-tag, verify-release ]
     runs-on: ubuntu-latest
     environment: release-python-prod
     permissions:
@@ -906,7 +1353,7 @@ jobs:
           exit 1
 
   publish-npm:
-    needs: [ get-configs, version-and-tag, release ]
+    needs: [ get-configs, version-and-tag, verify-release ]
     runs-on: ubuntu-latest
     environment: release-npm
     permissions:
diff --git a/.kiro/skills/cloudformation-validate-development/SKILL.md b/.kiro/skills/cloudformation-validate-development/SKILL.md
index e1d85cb0..2c3f22df 100644
--- a/.kiro/skills/cloudformation-validate-development/SKILL.md
+++ b/.kiro/skills/cloudformation-validate-development/SKILL.md
@@ -37,7 +37,7 @@ cargo build                                   # whole workspace (debug)
 cargo build -p cfn-validate                   # CLI -> target/debug/cfn-validate (add --release for optimized)
 
 # Core Rust tests - only when they cover the changed behavior
-cargo test -p cel-engine <name>               # single crate / filtered test - preferred while iterating
+cargo test -p cloudformation-validate-cel-engine <name>               # single crate / filtered test - preferred while iterating
 cargo test --workspace 2>&1 | tee ../tmp/test-output.txt   # broad core changes only; at most once at completion
 # CI runs coverage, not plain test: cargo llvm-cov --locked --release --workspace --no-fail-fast
 
@@ -74,7 +74,7 @@ Apply these rules when choosing validation:
 
 ```bash
 # Dump the full SemanticModel - ALWAYS start here. If the model is wrong, fix template-model.
-cargo run -p template-model --example inspect -- <template>
+cargo run -p cloudformation-validate-template-model --example inspect -- <template>
 
 # Accuracy vs cfn-lint. Requires a local cfn-lint checkout - first check whether cfn-lint is available on the
 # machine (`cfn-lint --version`), then ask the user for the checkout path; never assume or hardcode a location.
diff --git a/.kiro/steering/structure.md b/.kiro/steering/structure.md
index aa774e45..27aeb2db 100644
--- a/.kiro/steering/structure.md
+++ b/.kiro/steering/structure.md
@@ -6,7 +6,8 @@
 src/
 ├── Cargo.toml                  # Workspace root
 ├── rust-toolchain.toml         # Pinned toolchain + wasm32 target
-├── cfn-validate/               # CLI binary (`cfn-validate`) and library facade
+├── bindings-rust/              # Public Rust library facade published as `cloudformation-validate`
+├── cfn-validate/               # CLI binary (`cfn-validate`) and CLI-only helpers
 ├── validation-engine/          # ValidationEngine trait, orchestration pipeline, Step Functions validation
 ├── template-model/             # LEAF crate — parser (JSON/YAML), SemanticModel, intrinsic resolver,
 │                               # condition SAT solver, reference graph, SAM transform, nesting, template
@@ -18,15 +19,14 @@ src/
 │                               # severity, category, descriptions), filter, category/severity enums
 │                               # (depends on template-model)
 ├── schema-validator/           # Compiled JSON Schema validation against provider schemas
-├── rego-engine/                # Rego evaluation via Regorus + custom builtins + Guard→Rego translation
-│   └── handwritten/rego/       # Hand-written Rego policies (structure, intrinsics, references,
-│                               # resources, best_practices)
+├── rego-engine/                # Rego evaluation via Regorus + custom builtins + Guard→Rego translation;
+│   └── handwritten/rego/       # hand-written policies embedded by rego-engine/build.rs
 ├── cel-engine/                 # Native Rust rules + CEL interpreter + Guard→CEL translation
 │   └── src/rules/              # Native rules: structure, intrinsics, references, conditions,
 │                               # resources, resources_extra, best_practices, patterns
 ├── data-source/                # BUILD-TIME — downloads schemas, syncs cfn-lint data, generates
-│   ├── src/                    # schema-validator artifacts and CEL rules; build.rs embeds them and
-│   │                           # the hand-written Rego policies into the binary (zstd)
+│   ├── src/                    # schema-validator artifacts and CEL rules; build.rs embeds generated
+│   │                           # and hand-maintained shared data into the binary (zstd)
 │   ├── generated/              # Generated artifacts (committed, NEVER edit manually)
 │   ├── handwritten/            # Hand-maintained JSON reference tables (deprecated resource types,
 │   │                           # sensitive ports, GetAtt return-type overrides, schema-dependent
@@ -102,7 +102,7 @@ src/
   go in `rego-engine/handwritten/rego/` or `cel-engine/src/rules/`.
 - **Hand-written Rego policies live in `rego-engine/handwritten/rego/`.** These are hand-authored Rego rules organized
   by category (structure, intrinsics, references, resources, best_practices). They are embedded into the binary by
-  `data-source/build.rs`.
+  `rego-engine/build.rs`.
 - **All rules must be registered in the `rules` crate registry (`rules/src/registry.rs`).** A rule that evaluates but
   is not registered is a bug — the registry is the single source of truth for IDs, severity, category, and description.
 - **Native Rust rules live under `cel-engine/src/rules/`.** Choose the appropriate module (structure, intrinsics,
diff --git a/.kiro/steering/tech.md b/.kiro/steering/tech.md
index 436d8f0f..768ce8a4 100644
--- a/.kiro/steering/tech.md
+++ b/.kiro/steering/tech.md
@@ -11,11 +11,10 @@
 ## Build-time code generation
 
 The `data-source` crate downloads CloudFormation provider schemas, syncs cfn-lint data, applies patches/extensions, and
-generates schema-validator artifacts and (data-driven) CEL rules. Rego policies are hand-written in
-`rego-engine/handwritten/rego/`. `data-source/build.rs` compresses every generated and hand-written artifact (zstd) and
-exposes them as lazy byte constants via the `data-source::embedded` API. `rego-engine`, `cel-engine`, `schema-validator`,
-and `guard-translator` consume those constants at runtime — none of them have their own `build.rs`. Everything compiles
-into the binary — no runtime fetching.
+generates schema-validator artifacts and (data-driven) CEL rules. `data-source/build.rs` compresses generated and
+hand-maintained JSON artifacts (zstd) and exposes them as lazy byte constants via the `data-source::embedded` API.
+Rego policies remain hand-written in `rego-engine/handwritten/rego/`; `rego-engine/build.rs` discovers and embeds those
+package-local policies. Everything compiles into the binary — no runtime fetching.
 
 `data-source/generated/` is committed generated code — **never hand-edit it, and never run the regeneration
 pipeline yourself**. Regeneration is a maintainer-run operation; if a change requires regenerating these artifacts,
@@ -41,7 +40,7 @@ cargo build                                   # whole workspace (debug)
 cargo build -p cfn-validate                   # CLI -> target/debug/cfn-validate (add --release for optimized)
 
 # Core Rust tests — only when these tests exercise the changed behavior
-cargo test -p cel-engine <name>               # single crate / filtered test — preferred while iterating
+cargo test -p cloudformation-validate-cel-engine <name>               # single crate / filtered test — preferred while iterating
 cargo test --workspace 2>&1 | tee ../tmp/test-output.txt   # broad core changes only; at most once at completion
 # CI runs coverage, not plain test: cargo llvm-cov --locked --release --workspace --no-fail-fast
 
@@ -98,7 +97,7 @@ Use these, not `println!` or ad-hoc logging.
 
 ### inspect — use this first
 
-`cargo run -p template-model --example inspect -- <template>` — dumps the full SemanticModel. Always start here when
+`cargo run -p cloudformation-validate-template-model --example inspect -- <template>` — dumps the full SemanticModel. Always start here when
 debugging. If the model is wrong, fix `template-model`.
 
 ### cfn-validate
diff --git a/CLAUDE.md b/CLAUDE.md
index cba42de2..7dd08bf3 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -37,7 +37,7 @@ cargo build                                   # whole workspace (debug)
 cargo build -p cfn-validate                   # CLI -> target/debug/cfn-validate (add --release for optimized)
 
 # Core Rust tests - only when they cover the changed behavior
-cargo test -p cel-engine <name>               # single crate / filtered test - preferred while iterating
+cargo test -p cloudformation-validate-cel-engine <name>               # single crate / filtered test - preferred while iterating
 cargo test --workspace 2>&1 | tee ../tmp/test-output.txt   # broad core changes only; at most once at completion
 # CI runs coverage, not plain test: cargo llvm-cov --locked --release --workspace --no-fail-fast
 
@@ -68,7 +68,7 @@ Validation depends on the changed surface:
 
 ```bash
 # Dump the full SemanticModel - ALWAYS start here. If the model is wrong, fix template-model.
-cargo run -p template-model --example inspect -- <template>
+cargo run -p cloudformation-validate-template-model --example inspect -- <template>
 
 # Accuracy vs cfn-lint. Requires a local cfn-lint checkout - first check whether cfn-lint is available on the
 # machine (`cfn-lint --version`), then ask the user for the checkout path; never assume or hardcode a location.
diff --git a/INSTALLATION.md b/INSTALLATION.md
index f895d6d0..8a26974b 100644
--- a/INSTALLATION.md
+++ b/INSTALLATION.md
@@ -1,8 +1,8 @@
 # Installation
 
-`cloudformation-validate` is distributed as a prebuilt command-line tool and as packages for Node.js, Python, Go, and
-the JVM. All distributions contain the validation rules and CloudFormation resource schemas they need, so validation
-runs offline after installation without AWS credentials or runtime downloads.
+`cloudformation-validate` is distributed as a prebuilt command-line tool and as packages for Rust, Node.js, Python,
+Go, and the JVM. All distributions contain the validation rules and CloudFormation resource schemas they need, so
+validation runs offline after installation without AWS credentials or runtime downloads.
 
 ## Command-line interface
 
@@ -34,6 +34,21 @@ codes.
 Package-manager installation is recommended: it selects the compatible native artifact and resolves any runtime
 dependencies. Use an explicit version in applications that require reproducible builds.
 
+### Rust
+
+The Rust library is published to [crates.io as `cloudformation-validate`](https://crates.io/crates/cloudformation-validate)
+and requires Rust 1.96 or later.
+
+```bash
+# Latest release
+cargo add cloudformation-validate
+
+# Specific release (replace <version>)
+cargo add 'cloudformation-validate@=<version>'
+```
+
+See the [Rust API and examples](src/bindings-rust/README.md).
+
 ### Node.js
 
 The Node.js/WASM package is published to
diff --git a/README.md b/README.md
index baf1eee7..52174453 100644
--- a/README.md
+++ b/README.md
@@ -7,6 +7,7 @@
 [![Offline](https://img.shields.io/badge/runtime-fully%20offline-success)](#features)
 
 [![Latest release](https://img.shields.io/github/v/release/aws-cloudformation/cloudformation-validate?include_prereleases)](https://github.com/aws-cloudformation/cloudformation-validate/releases)
+[![crates.io version](https://img.shields.io/crates/v/cloudformation-validate?logo=rust)](https://crates.io/crates/cloudformation-validate)
 [![npm version](https://img.shields.io/npm/v/%40aws%2Fcloudformation-validate?logo=npm)](https://www.npmjs.com/package/@aws/cloudformation-validate)
 [![Maven Central](https://img.shields.io/maven-central/v/software.amazon.cloudformation/cloudformation-validate?logo=apachemaven)](https://central.sonatype.com/artifact/software.amazon.cloudformation/cloudformation-validate)
 [![PyPI version](https://img.shields.io/pypi/v/cloudformation-validate?logo=pypi)](https://pypi.org/project/cloudformation-validate/)
@@ -61,11 +62,13 @@ When a template is submitted, `cloudformation-validate` runs a fixed pipeline:
 
 ## Installation
 
-Use a prebuilt CLI or install a published language binding; Rust and this source repository are not required.
+Use the prebuilt CLI, embed the Rust library, or install a published language binding; this source repository is not
+required.
 
 | Interface | Published artifact | Install |
 |-----------|--------------------|---------|
-| CLI | [GitHub Releases](https://github.com/aws-cloudformation/cloudformation-validate/releases) | [Download the newest binary for Linux, macOS, or Windows](INSTALLATION.md#command-line-interface) |
+| CLI binary | [GitHub Releases](https://github.com/aws-cloudformation/cloudformation-validate/releases) | [Download the newest binary for Linux, macOS, or Windows](INSTALLATION.md#command-line-interface) |
+| Rust library | [crates.io: `cloudformation-validate`](https://crates.io/crates/cloudformation-validate) | `cargo add cloudformation-validate` |
 | Node.js | [npm: `@aws/cloudformation-validate`](https://www.npmjs.com/package/@aws/cloudformation-validate) | `npm install @aws/cloudformation-validate` |
 | Python | [PyPI](https://pypi.org/project/cloudformation-validate/) / [TestPyPI beta](https://test.pypi.org/project/cloudformation-validate/) | `python3 -m pip install cloudformation-validate` |
 | Go | [Go module](https://pkg.go.dev/github.com/aws-cloudformation/cloudformation-validate/src/bindings-go/go) | `go get github.com/aws-cloudformation/cloudformation-validate/src/bindings-go/go@latest` |
@@ -101,28 +104,35 @@ cargo run -p cfn-validate -- template.yaml --guard-rule-source ./my-rules/
 
 ## Embedding as a library
 
-### Rust
+### Rust [(bindings-rust)](src/bindings-rust/README.md)
+
+Add the library facade:
+
+```toml
+[dependencies]
+cloudformation-validate = "1.10.0"
+```
 
 Construct an engine and a schema validator once, then validate many templates:
 
 ```rust
-use rego_engine::RegoEngine;
-use schema_validator::SchemaValidator;
-use validation_engine::{validate_bytes_with_path, EngineConfig, ValidateConfig};
+use cloudformation_validate::{
+    EngineConfig, RegoEngine, SchemaValidator, ValidateConfig, validate_bytes_with_path,
+};
 
 let schema_validator = SchemaValidator::default();
 let engine = RegoEngine::new(EngineConfig::default())?;
 
-let bytes = std::fs::read("template.yaml") ?;
+let bytes = std::fs::read("template.yaml")?;
 let report = validate_bytes_with_path(
-    & engine,
-    & schema_validator,
-    & bytes,
-    ValidateConfig::default (),
+    &engine,
+    &schema_validator,
+    &bytes,
+    ValidateConfig::default(),
     "template.yaml".to_string(),
-) ?;
+)?;
 
-for d in & report.diagnostics {
+for d in &report.diagnostics {
     println!("[{}] {} - {}", d.severity, d.rule_id, d.message);
 }
 ```
diff --git a/scripts/generate_licenses.py b/scripts/generate_licenses.py
index 1b71ed86..141861cb 100644
--- a/scripts/generate_licenses.py
+++ b/scripts/generate_licenses.py
@@ -32,17 +32,18 @@
     "bindings-jvm",
     "bindings-python",
     "bindings-wasm",
-    "cel-engine",
     "cfn-validate",
-    "data-source",
-    "diagnostics",
-    "guard-translator",
-    "rego-engine",
+    "cloudformation-validate",
+    "cloudformation-validate-cel-engine",
+    "cloudformation-validate-data-source",
+    "cloudformation-validate-diagnostics",
+    "cloudformation-validate-guard-translator",
+    "cloudformation-validate-rego-engine",
+    "cloudformation-validate-rules",
+    "cloudformation-validate-schema-validator",
+    "cloudformation-validate-template-model",
+    "cloudformation-validate-validation-engine",
     "resources",
-    "rules",
-    "schema-validator",
-    "template-model",
-    "validation-engine",
 }
 
 APACHE_LICENSE_REFERENCE = (
diff --git a/src/Cargo.lock b/src/Cargo.lock
index e1b1763d..bd7528a3 100644
--- a/src/Cargo.lock
+++ b/src/Cargo.lock
@@ -240,68 +240,68 @@ checksum = "4372b9543397a4b86050cc5e7ee36953edf4bac9518e8a774c2da694977fb6e4"
 name = "bindings-go"
 version = "1.9.0"
 dependencies = [
- "cel-engine",
- "data-source",
- "diagnostics",
- "rego-engine",
- "rules",
- "schema-validator",
+ "cloudformation-validate-cel-engine",
+ "cloudformation-validate-data-source",
+ "cloudformation-validate-diagnostics",
+ "cloudformation-validate-rego-engine",
+ "cloudformation-validate-rules",
+ "cloudformation-validate-schema-validator",
+ "cloudformation-validate-template-model",
+ "cloudformation-validate-validation-engine",
  "serde",
  "serde_json",
- "template-model",
  "thiserror 2.0.19",
  "uniffi 0.31.2",
- "validation-engine",
 ]
 
 [[package]]
 name = "bindings-jvm"
 version = "1.9.0"
 dependencies = [
- "cel-engine",
- "data-source",
- "diagnostics",
- "rego-engine",
- "rules",
- "schema-validator",
- "template-model",
+ "cloudformation-validate-cel-engine",
+ "cloudformation-validate-data-source",
+ "cloudformation-validate-diagnostics",
+ "cloudformation-validate-rego-engine",
+ "cloudformation-validate-rules",
+ "cloudformation-validate-schema-validator",
+ "cloudformation-validate-template-model",
+ "cloudformation-validate-validation-engine",
  "thiserror 2.0.19",
  "uniffi 0.32.0",
- "validation-engine",
 ]
 
 [[package]]
 name = "bindings-python"
 version = "1.9.0"
 dependencies = [
- "cel-engine",
- "data-source",
- "diagnostics",
- "rego-engine",
- "rules",
- "schema-validator",
- "template-model",
+ "cloudformation-validate-cel-engine",
+ "cloudformation-validate-data-source",
+ "cloudformation-validate-diagnostics",
+ "cloudformation-validate-rego-engine",
+ "cloudformation-validate-rules",
+ "cloudformation-validate-schema-validator",
+ "cloudformation-validate-template-model",
+ "cloudformation-validate-validation-engine",
  "thiserror 2.0.19",
  "uniffi 0.32.0",
- "validation-engine",
 ]
 
 [[package]]
 name = "bindings-wasm"
 version = "1.9.0"
 dependencies = [
- "cel-engine",
+ "cloudformation-validate-cel-engine",
+ "cloudformation-validate-diagnostics",
+ "cloudformation-validate-rego-engine",
+ "cloudformation-validate-rules",
+ "cloudformation-validate-schema-validator",
+ "cloudformation-validate-template-model",
+ "cloudformation-validate-validation-engine",
  "console_error_panic_hook",
- "diagnostics",
  "getrandom 0.3.4",
- "rego-engine",
- "rules",
- "schema-validator",
  "serde",
  "serde-wasm-bindgen",
- "template-model",
  "tsify",
- "validation-engine",
  "wasm-bindgen",
 ]
 
@@ -448,27 +448,6 @@ dependencies = [
  "shlex",
 ]
 
-[[package]]
-name = "cel-engine"
-version = "1.9.0"
-dependencies = [
- "anyhow",
- "cel-interpreter",
- "data-source",
- "diagnostics",
- "guard-translator",
- "ipnetwork",
- "log",
- "regex",
- "rules",
- "schema-validator",
- "serde",
- "serde_json",
- "template-model",
- "validation-engine",
- "web-time",
-]
-
 [[package]]
 name = "cel-interpreter"
 version = "0.10.0"
@@ -506,21 +485,21 @@ checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 name = "cfn-validate"
 version = "1.9.0"
 dependencies = [
- "cel-engine",
  "chrono",
- "data-source",
- "diagnostics",
+ "cloudformation-validate-cel-engine",
+ "cloudformation-validate-data-source",
+ "cloudformation-validate-diagnostics",
+ "cloudformation-validate-rego-engine",
+ "cloudformation-validate-rules",
+ "cloudformation-validate-schema-validator",
+ "cloudformation-validate-template-model",
+ "cloudformation-validate-validation-engine",
  "env_logger",
  "log",
- "rego-engine",
  "resources",
- "rules",
- "schema-validator",
  "serde_json",
  "sha2",
  "tempfile",
- "template-model",
- "validation-engine",
 ]
 
 [[package]]
@@ -576,6 +555,199 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
 
+[[package]]
+name = "cloudformation-guard-lang"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b772510f23124bee8df542527318eb9ff8a04d3d88812291c85e6e87f5bb62f3"
+dependencies = [
+ "chrono",
+ "colored",
+ "cruet",
+ "fancy-regex 0.13.0",
+ "indexmap 1.9.3",
+ "lazy_static",
+ "nom",
+ "nom_locate",
+ "serde",
+ "serde_json",
+ "serde_yaml",
+ "thiserror 1.0.69",
+ "unsafe-libyaml",
+ "urlencoding",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "cloudformation-validate"
+version = "1.9.0"
+dependencies = [
+ "cloudformation-validate-cel-engine",
+ "cloudformation-validate-data-source",
+ "cloudformation-validate-diagnostics",
+ "cloudformation-validate-rego-engine",
+ "cloudformation-validate-rules",
+ "cloudformation-validate-schema-validator",
+ "cloudformation-validate-template-model",
+ "cloudformation-validate-validation-engine",
+]
+
+[[package]]
+name = "cloudformation-validate-cel-engine"
+version = "1.9.0"
+dependencies = [
+ "anyhow",
+ "cel-interpreter",
+ "cloudformation-validate-data-source",
+ "cloudformation-validate-diagnostics",
+ "cloudformation-validate-guard-translator",
+ "cloudformation-validate-rules",
+ "cloudformation-validate-schema-validator",
+ "cloudformation-validate-template-model",
+ "cloudformation-validate-validation-engine",
+ "ipnetwork",
+ "log",
+ "regex",
+ "serde",
+ "serde_json",
+ "web-time",
+]
+
+[[package]]
+name = "cloudformation-validate-data-source"
+version = "1.9.0"
+dependencies = [
+ "anyhow",
+ "chrono",
+ "env_logger",
+ "log",
+ "lz4_flex",
+ "postcard",
+ "ruzstd",
+ "serde",
+ "serde_json",
+ "tsify",
+ "uniffi 0.32.0",
+ "ureq",
+ "wasm-bindgen",
+ "zip",
+ "zstd",
+]
+
+[[package]]
+name = "cloudformation-validate-diagnostics"
+version = "1.9.0"
+dependencies = [
+ "cloudformation-validate-rules",
+ "cloudformation-validate-template-model",
+ "log",
+ "serde",
+ "serde_json",
+ "tsify",
+ "uniffi 0.32.0",
+ "wasm-bindgen",
+ "web-time",
+]
+
+[[package]]
+name = "cloudformation-validate-guard-translator"
+version = "1.9.0"
+dependencies = [
+ "cloudformation-guard-lang",
+ "cloudformation-validate-rules",
+ "indexmap 2.14.0",
+ "serde",
+]
+
+[[package]]
+name = "cloudformation-validate-rego-engine"
+version = "1.9.0"
+dependencies = [
+ "anyhow",
+ "cloudformation-validate-data-source",
+ "cloudformation-validate-diagnostics",
+ "cloudformation-validate-guard-translator",
+ "cloudformation-validate-rules",
+ "cloudformation-validate-schema-validator",
+ "cloudformation-validate-template-model",
+ "cloudformation-validate-validation-engine",
+ "ipnetwork",
+ "log",
+ "regorus",
+ "serde",
+ "serde_json",
+ "web-time",
+]
+
+[[package]]
+name = "cloudformation-validate-rules"
+version = "1.9.0"
+dependencies = [
+ "cloudformation-validate-template-model",
+ "log",
+ "regex",
+ "serde",
+ "serde_json",
+ "tsify",
+ "uniffi 0.32.0",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "cloudformation-validate-schema-validator"
+version = "1.9.0"
+dependencies = [
+ "cloudformation-validate-data-source",
+ "cloudformation-validate-diagnostics",
+ "cloudformation-validate-rules",
+ "cloudformation-validate-template-model",
+ "log",
+ "regex",
+ "serde",
+ "serde_json",
+ "tsify",
+ "uniffi 0.32.0",
+ "wasm-bindgen",
+ "web-time",
+]
+
+[[package]]
+name = "cloudformation-validate-template-model"
+version = "1.9.0"
+dependencies = [
+ "base64",
+ "env_logger",
+ "fancy-regex 0.18.0",
+ "log",
+ "regex",
+ "serde",
+ "serde_json",
+ "tsify",
+ "uniffi 0.32.0",
+ "wasm-bindgen",
+ "web-time",
+ "yaml-rust2",
+]
+
+[[package]]
+name = "cloudformation-validate-validation-engine"
+version = "1.9.0"
+dependencies = [
+ "cloudformation-validate-data-source",
+ "cloudformation-validate-diagnostics",
+ "cloudformation-validate-guard-translator",
+ "cloudformation-validate-rules",
+ "cloudformation-validate-schema-validator",
+ "cloudformation-validate-template-model",
+ "log",
+ "serde",
+ "serde_json",
+ "tsify",
+ "uniffi 0.32.0",
+ "wasm-bindgen",
+ "web-time",
+]
+
 [[package]]
 name = "cobs"
 version = "0.3.0"
@@ -666,27 +838,6 @@ dependencies = [
  "hybrid-array",
 ]
 
-[[package]]
-name = "data-source"
-version = "1.9.0"
-dependencies = [
- "anyhow",
- "chrono",
- "env_logger",
- "log",
- "lz4_flex",
- "postcard",
- "ruzstd",
- "serde",
- "serde_json",
- "tsify",
- "uniffi 0.32.0",
- "ureq",
- "wasm-bindgen",
- "zip",
- "zstd",
-]
-
 [[package]]
 name = "defmt"
 version = "1.1.1"
@@ -718,21 +869,6 @@ dependencies = [
  "thiserror 2.0.19",
 ]
 
-[[package]]
-name = "diagnostics"
-version = "1.9.0"
-dependencies = [
- "log",
- "rules",
- "serde",
- "serde_json",
- "template-model",
- "tsify",
- "uniffi 0.32.0",
- "wasm-bindgen",
- "web-time",
-]
-
 [[package]]
 name = "digest"
 version = "0.11.3"
@@ -963,38 +1099,6 @@ dependencies = [
  "scroll",
 ]
 
-[[package]]
-name = "guard-lang"
-version = "1.0.0"
-source = "git+https://github.com/aws-cloudformation/cloudformation-guard.git?branch=guard-lib#58da2e0c861276d5dad45df6e14c719f8313361c"
-dependencies = [
- "chrono",
- "colored",
- "cruet",
- "fancy-regex 0.13.0",
- "indexmap 1.9.3",
- "lazy_static",
- "nom",
- "nom_locate",
- "serde",
- "serde_json",
- "serde_yaml",
- "thiserror 1.0.69",
- "unsafe-libyaml",
- "urlencoding",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "guard-translator"
-version = "1.9.0"
-dependencies = [
- "guard-lang",
- "indexmap 2.14.0",
- "rules",
- "serde",
-]
-
 [[package]]
 name = "hash32"
 version = "0.2.1"
@@ -1528,26 +1632,6 @@ version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
-[[package]]
-name = "rego-engine"
-version = "1.9.0"
-dependencies = [
- "anyhow",
- "data-source",
- "diagnostics",
- "guard-translator",
- "ipnetwork",
- "log",
- "regorus",
- "rules",
- "schema-validator",
- "serde",
- "serde_json",
- "template-model",
- "validation-engine",
- "web-time",
-]
-
 [[package]]
 name = "regorus"
 version = "0.9.1"
@@ -1589,20 +1673,6 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
-[[package]]
-name = "rules"
-version = "1.9.0"
-dependencies = [
- "log",
- "regex",
- "serde",
- "serde_json",
- "template-model",
- "tsify",
- "uniffi 0.32.0",
- "wasm-bindgen",
-]
-
 [[package]]
 name = "rustc-hash"
 version = "2.1.3"
@@ -1684,24 +1754,6 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
-[[package]]
-name = "schema-validator"
-version = "1.9.0"
-dependencies = [
- "data-source",
- "diagnostics",
- "log",
- "regex",
- "rules",
- "serde",
- "serde_json",
- "template-model",
- "tsify",
- "uniffi 0.32.0",
- "wasm-bindgen",
- "web-time",
-]
-
 [[package]]
 name = "scopeguard"
 version = "1.2.0"
@@ -1941,24 +1993,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "template-model"
-version = "1.9.0"
-dependencies = [
- "base64",
- "env_logger",
- "fancy-regex 0.18.0",
- "log",
- "regex",
- "serde",
- "serde_json",
- "tsify",
- "uniffi 0.32.0",
- "wasm-bindgen",
- "web-time",
- "yaml-rust2",
-]
-
 [[package]]
 name = "textwrap"
 version = "0.16.2"
@@ -2430,25 +2464,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "validation-engine"
-version = "1.9.0"
-dependencies = [
- "data-source",
- "diagnostics",
- "guard-translator",
- "log",
- "rules",
- "schema-validator",
- "serde",
- "serde_json",
- "template-model",
- "tsify",
- "uniffi 0.32.0",
- "wasm-bindgen",
- "web-time",
-]
-
 [[package]]
 name = "wasi"
 version = "0.11.1+wasi-snapshot-preview1"
diff --git a/src/Cargo.toml b/src/Cargo.toml
index 1f23e88d..4255a0f8 100644
--- a/src/Cargo.toml
+++ b/src/Cargo.toml
@@ -3,6 +3,7 @@ members = [
     "bindings-go",
     "bindings-jvm",
     "bindings-python",
+    "bindings-rust",
     "bindings-wasm",
     "cel-engine",
     "cfn-validate",
@@ -24,6 +25,7 @@ name = "cloudformation-validate"
 [workspace.package]
 version = "1.9.0"
 edition = "2024"
+rust-version = "1.96"
 license = "Apache-2.0"
 description = "AWS CloudFormation Validate"
 repository = "https://github.com/aws-cloudformation/cloudformation-validate"
@@ -36,12 +38,21 @@ keywords = [
 ]
 categories = [
     "development-tools",
-    "command-line-utilities",
+    "development-tools::testing",
     "parser-implementations",
     "config"
 ]
 
 [workspace.dependencies]
+cel-engine = { package = "cloudformation-validate-cel-engine", path = "cel-engine", version = "=1.9.0" }
+data-source = { package = "cloudformation-validate-data-source", path = "data-source", version = "=1.9.0", default-features = false }
+diagnostics = { package = "cloudformation-validate-diagnostics", path = "diagnostics", version = "=1.9.0" }
+guard-translator = { package = "cloudformation-validate-guard-translator", path = "guard-translator", version = "=1.9.0" }
+rego-engine = { package = "cloudformation-validate-rego-engine", path = "rego-engine", version = "=1.9.0" }
+rules = { package = "cloudformation-validate-rules", path = "rules", version = "=1.9.0" }
+schema-validator = { package = "cloudformation-validate-schema-validator", path = "schema-validator", version = "=1.9.0" }
+template-model = { package = "cloudformation-validate-template-model", path = "template-model", version = "=1.9.0" }
+validation-engine = { package = "cloudformation-validate-validation-engine", path = "validation-engine", version = "=1.9.0" }
 uniffi = "=0.32.0"
 
 [profile.dev]
diff --git a/src/bindings-go/Cargo.toml b/src/bindings-go/Cargo.toml
index 275bc76b..a12b544d 100644
--- a/src/bindings-go/Cargo.toml
+++ b/src/bindings-go/Cargo.toml
@@ -1,5 +1,6 @@
 [package]
 name = "bindings-go"
+publish = false
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -13,14 +14,14 @@ crate-type = ["cdylib", "staticlib"]
 name = "bindings_go"
 
 [dependencies]
-data-source = { path = "../data-source", default-features = false }
-validation-engine = { path = "../validation-engine" }
-diagnostics = { path = "../diagnostics" }
-rules = { path = "../rules" }
-template-model = { path = "../template-model" }
-rego-engine = { path = "../rego-engine" }
-cel-engine = { path = "../cel-engine" }
-schema-validator = { path = "../schema-validator" }
+data-source = { workspace = true }
+validation-engine = { workspace = true }
+diagnostics = { workspace = true }
+rules = { workspace = true }
+template-model = { workspace = true }
+rego-engine = { workspace = true }
+cel-engine = { workspace = true }
+schema-validator = { workspace = true }
 uniffi = "=0.31.2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
diff --git a/src/bindings-jvm/Cargo.toml b/src/bindings-jvm/Cargo.toml
index f644b3d3..353f43c4 100644
--- a/src/bindings-jvm/Cargo.toml
+++ b/src/bindings-jvm/Cargo.toml
@@ -1,5 +1,6 @@
 [package]
 name = "bindings-jvm"
+publish = false
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -17,14 +18,14 @@ name = "uniffi-bindgen"
 path = "src/bin/uniffi-bindgen.rs"
 
 [dependencies]
-data-source = { path = "../data-source", default-features = false, features = ["uniffi-bindings"] }
-validation-engine = { path = "../validation-engine", features = ["uniffi-bindings"] }
-diagnostics = { path = "../diagnostics", features = ["uniffi-bindings"] }
-rules = { path = "../rules", features = ["uniffi-bindings"] }
-template-model = { path = "../template-model", features = ["uniffi-bindings"] }
-rego-engine = { path = "../rego-engine" }
-cel-engine = { path = "../cel-engine" }
-schema-validator = { path = "../schema-validator", features = ["uniffi-bindings"] }
+data-source = { workspace = true, features = ["uniffi-bindings"] }
+validation-engine = { workspace = true, features = ["uniffi-bindings"] }
+diagnostics = { workspace = true, features = ["uniffi-bindings"] }
+rules = { workspace = true, features = ["uniffi-bindings"] }
+template-model = { workspace = true, features = ["uniffi-bindings"] }
+rego-engine = { workspace = true }
+cel-engine = { workspace = true }
+schema-validator = { workspace = true, features = ["uniffi-bindings"] }
 uniffi = { workspace = true, features = ["cli"] }
 thiserror = "2"
 
diff --git a/src/bindings-python/Cargo.toml b/src/bindings-python/Cargo.toml
index bb371daf..3f5c2ea7 100644
--- a/src/bindings-python/Cargo.toml
+++ b/src/bindings-python/Cargo.toml
@@ -1,5 +1,6 @@
 [package]
 name = "bindings-python"
+publish = false
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -13,14 +14,14 @@ crate-type = ["cdylib", "lib"]
 name = "bindings_python"
 
 [dependencies]
-data-source = { path = "../data-source", default-features = false, features = ["uniffi-bindings"] }
-validation-engine = { path = "../validation-engine", features = ["uniffi-bindings"] }
-diagnostics = { path = "../diagnostics", features = ["uniffi-bindings"] }
-rules = { path = "../rules", features = ["uniffi-bindings"] }
-template-model = { path = "../template-model", features = ["uniffi-bindings"] }
-rego-engine = { path = "../rego-engine" }
-cel-engine = { path = "../cel-engine" }
-schema-validator = { path = "../schema-validator", features = ["uniffi-bindings"] }
+data-source = { workspace = true, features = ["uniffi-bindings"] }
+validation-engine = { workspace = true, features = ["uniffi-bindings"] }
+diagnostics = { workspace = true, features = ["uniffi-bindings"] }
+rules = { workspace = true, features = ["uniffi-bindings"] }
+template-model = { workspace = true, features = ["uniffi-bindings"] }
+rego-engine = { workspace = true }
+cel-engine = { workspace = true }
+schema-validator = { workspace = true, features = ["uniffi-bindings"] }
 uniffi = { workspace = true }
 thiserror = "2"
 
diff --git a/src/bindings-rust/Cargo.toml b/src/bindings-rust/Cargo.toml
new file mode 100644
index 00000000..7457968b
--- /dev/null
+++ b/src/bindings-rust/Cargo.toml
@@ -0,0 +1,28 @@
+[package]
+name = "cloudformation-validate"
+publish = true
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+description.workspace = true
+repository.workspace = true
+keywords.workspace = true
+categories.workspace = true
+
+[lib]
+name = "cloudformation_validate"
+path = "src/lib.rs"
+
+[dependencies]
+cel-engine = { workspace = true }
+data-source = { workspace = true }
+diagnostics = { workspace = true }
+rego-engine = { workspace = true }
+rules = { workspace = true }
+schema-validator = { workspace = true }
+template-model = { workspace = true }
+validation-engine = { workspace = true }
+
+[lints]
+workspace = true
diff --git a/src/bindings-rust/README.md b/src/bindings-rust/README.md
new file mode 100644
index 00000000..9cfb0cb2
--- /dev/null
+++ b/src/bindings-rust/README.md
@@ -0,0 +1,210 @@
+# CloudFormation Validate for Rust
+
+Validate AWS CloudFormation templates from Rust and catch schema violations, semantic errors, security risks, and
+best-practice findings before deployment - in an editor, build, service, or CI system.
+
+- **Offline** - all rules and CloudFormation resource schemas are bundled.
+- **Fast** - engines and schemas compile once and can be reused across validations.
+- **Embeddable** - validation accepts template bytes and returns structured Rust types.
+
+Common types are exported from the top-level `cloudformation_validate` crate. The underlying engine, diagnostics,
+rules, schema, and template-model crates are also re-exported as modules for advanced use.
+
+## Installation
+
+Available on [crates.io](https://crates.io/crates/cloudformation-validate) as `cloudformation-validate`.
+
+```bash
+cargo add cloudformation-validate
+```
+
+Or add a version requirement directly:
+
+```toml
+[dependencies]
+cloudformation-validate = "1.10.0"
+```
+
+The library requires Rust 1.96 or later. The repository pins that toolchain in
+[`rust-toolchain.toml`](../rust-toolchain.toml). Call `cloudformation_validate::version()` when an application needs the
+loaded library version at runtime. The library performs no runtime network requests and needs no AWS credentials.
+
+## Quick start
+
+```rust
+use cloudformation_validate::{
+    EngineConfig, RegoEngine, SchemaValidator, Severity, ValidateConfig, validate_bytes_with_path,
+};
+
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let schema_validator = SchemaValidator::default();
+    let engine = RegoEngine::new(EngineConfig::default())?;
+    let template = b"Resources:\n  Bucket:\n    Type: AWS::S3::Bucket\n";
+
+    let report = validate_bytes_with_path(
+        &engine,
+        &schema_validator,
+        template,
+        ValidateConfig::default(),
+        "template.yaml".to_string(),
+    )?;
+
+    for diagnostic in &report.diagnostics {
+        println!(
+            "[{}] {}: {}",
+            diagnostic.severity, diagnostic.rule_id, diagnostic.message
+        );
+    }
+    assert!(report.diagnostics.iter().all(|diagnostic| diagnostic.severity != Severity::Fatal));
+    Ok(())
+}
+```
+
+Each diagnostic includes a rule ID, severity, message, source location, affected entity and property path when
+available, and optional remediation context. See [`Diagnostic`](#reports-and-diagnostics).
+
+Engines are expensive to construct and cheap to reuse. Construct an engine and `SchemaValidator` once, then retain them
+for many calls to `validate_bytes_with_path`.
+
+## Engines
+
+`RegoEngine` and `CelEngine` both implement `ValidationEngine` and are interchangeable. Given the same template and
+configuration, they produce the same diagnostics.
+
+```rust
+use cloudformation_validate::{CelEngine, EngineConfig, RegoEngine, ValidationEngine};
+
+fn engine_names() -> Result<(String, String), Box<dyn std::error::Error>> {
+    let rego = RegoEngine::new(EngineConfig::default())?;
+    let cel = CelEngine::new(EngineConfig::default())?;
+    Ok((rego.engine_name().to_string(), cel.engine_name().to_string()))
+}
+
+assert_eq!(engine_names()?, ("rego".to_string(), "cel".to_string()));
+# Ok::<(), Box<dyn std::error::Error>>(())
+```
+
+The `ValidationEngine` trait also exposes `list_rules`, built-in and external rule metadata, and initialization metrics.
+
+### EngineConfig
+
+`EngineConfig` controls rules and schema-aware engine construction. `EngineConfig::default()` and
+`EngineConfig::new()` use only bundled rules and schemas.
+
+| Field                     | Default | Description                                                                  |
+|---------------------------|---------|------------------------------------------------------------------------------|
+| `custom_rules`            | empty   | Engine-native rules: Rego source for `RegoEngine`, CEL JSON for `CelEngine`. |
+| `guard_rules`             | empty   | CloudFormation Guard DSL source translated by either engine.                 |
+| `schema_validator_config` | `None`  | Additional resource provider schemas used for schema-aware metadata.         |
+
+Rule sources are supplied as `ExternalRuleSource { name, content }`. `name` identifies the source in errors and
+logging; `content` is the complete rule text.
+
+```rust
+use cloudformation_validate::{EngineConfig, ExternalRuleSource, RegoEngine};
+
+let config = EngineConfig::new().with_guard_rules([ExternalRuleSource {
+    name: "s3.guard".to_string(),
+    content: "rule bucket_name { AWS::S3::Bucket { Properties.BucketName EXISTS } }".to_string(),
+}]);
+let _engine = RegoEngine::new(config)?;
+# Ok::<(), Box<dyn std::error::Error>>(())
+```
+
+See [Custom Rules](../CUSTOM_RULES.md) for Rego, CEL, and Guard formats.
+
+## Validation configuration
+
+`ValidateConfig` controls each validation call.
+
+| Field                        | Default        | Description                                                                                  |
+|------------------------------|----------------|----------------------------------------------------------------------------------------------|
+| `filters`                    | no filtering   | Include and exclude rules by ID, category, ranges, resource, logical ID, type, or service.  |
+| `detail_level`               | `Detailed`     | Controls standard versus extended diagnostic context.                                        |
+| `severity_level`             | `Info`         | Drops diagnostics below the configured severity.                                             |
+| `parameter_overrides`        | empty          | Overrides template parameter values during intrinsic resolution.                             |
+| `pseudo_parameter_overrides` | built-in values| Overrides `AWS::AccountId`, `AWS::Region`, and other CloudFormation pseudo-parameters.       |
+| `strict`                     | `false`        | Upgrades Warn diagnostics to Error.                                                           |
+| `disable_builtin_rules`      | `false`        | Runs only custom and Guard rules when enabled.                                                |
+
+`FilterConfig` and its filter types are exported at the top level. See the
+[`rules` crate README](../rules/README.md) for rule metadata, severities, categories, and filter behavior.
+
+## Additional resource provider schemas
+
+`SchemaValidatorConfig` accepts `AdditionalSchemaSource` values that merge over bundled schemas or register a resource
+type that is not bundled yet. When overlays are used, construct the engine and validator from the same schema config so
+schema-aware rule metadata stays consistent.
+
+```rust
+use cloudformation_validate::{
+    AdditionalSchemaSource, EngineConfig, RegoEngine, SchemaValidator, SchemaValidatorConfig, ValidationEngine,
+};
+
+let additional_schema = AdditionalSchemaSource {
+    type_name: None,
+    schema: r#"{
+        "typeName": "Example::Service::Resource",
+        "properties": {"Name": {"type": "string"}}
+    }"#
+    .to_string(),
+};
+let schema_config = SchemaValidatorConfig::new().with_additional_schemas([additional_schema]);
+let schema_validator = SchemaValidator::new(schema_config.clone())?;
+let engine = RegoEngine::new(EngineConfig::new().with_schema_validator_config(schema_config))?;
+
+assert!(schema_validator.schema_count() > 0);
+assert_eq!(engine.engine_name(), "rego");
+# Ok::<(), Box<dyn std::error::Error>>(())
+```
+
+Malformed, contradictory, cyclic, or unsupported overlays return an error rather than silently weakening validation.
+See [Additional Resource Provider Schemas](../validation-engine/API.md#additional-resource-provider-schemas) for the
+merge model and constraints.
+
+## Reports and diagnostics
+
+`validate_bytes_with_path` returns `Result<ValidationReport, ValidationError>`.
+
+| Type               | Purpose                                                                                         |
+|--------------------|-------------------------------------------------------------------------------------------------|
+| `ValidationReport` | File label, status, diagnostics, summary counts, suppression metadata, and performance metrics. |
+| `Diagnostic`       | Rule ID, severity, message, origin, entity, property path, source span, and optional context.   |
+| `ReportStatus`     | `Ok`, `AnalysisIncomplete`, or `Error`.                                                         |
+| `Severity`         | `Debug`, `Info`, `Warn`, `Error`, or `Fatal`.                                                   |
+| `DetailLevel`      | `Standard` or `Detailed`.                                                                       |
+
+A template syntax failure is returned as a report with `ReportStatus::Error` and an `F1101` diagnostic, preserving the
+structured-report contract. Infrastructure or engine failures return `ValidationError`.
+
+Call `ValidationReport::to_standard()` for flattened diagnostics or `ValidationReport::to_detailed()` for extended
+rule descriptions, phase data, documentation URLs, related resources, condition scenarios, and violation context.
+
+## Error handling
+
+- `RegoEngine::new` and `CelEngine::new` return an error if built-in, custom, Guard, or overlay-derived engine setup
+  fails.
+- `SchemaValidator::new` returns `SchemaValidatorConfigError` when an additional schema cannot be resolved or applied.
+- `validate_bytes_with_path` returns `ValidationError` for unexpected pipeline failures.
+- Template parse defects remain structured diagnostics instead of process-level errors.
+
+The library does not intentionally panic on caller-controlled input. Language-boundary panic handling is implemented by
+the separate binding packages; native Rust callers receive normal `Result` values.
+
+## Advanced modules
+
+The facade re-exports these implementation crates for callers that need APIs beyond the common top-level exports:
+
+| Module                  | Contents                                                              |
+|-------------------------|-----------------------------------------------------------------------|
+| `cel_engine`            | `CelEngine` implementation.                                           |
+| `rego_engine`           | `RegoEngine` implementation.                                          |
+| `validation_engine`     | Orchestration, configs, traits, helpers, and validation entry points. |
+| `schema_validator`      | Compiled schema store, overlays, and standalone schema validation.    |
+| `template_model`        | Parser, semantic model, intrinsic resolution, and source spans.       |
+| `diagnostics`           | Reports, diagnostics, metrics, detail levels, and phases.             |
+| `rules`                 | Registry metadata, filters, categories, origins, and severities.      |
+| `data_source`           | Embedded schema and reference data plus additional schema sources.    |
+
+See the [full Rust embedding API](../validation-engine/API.md) and the repository's
+[Custom Rules guide](../CUSTOM_RULES.md) for deeper examples.
diff --git a/src/bindings-rust/src/lib.rs b/src/bindings-rust/src/lib.rs
new file mode 100644
index 00000000..db6a6ca1
--- /dev/null
+++ b/src/bindings-rust/src/lib.rs
@@ -0,0 +1,33 @@
+#![doc = include_str!("../README.md")]
+
+pub use cel_engine;
+pub use data_source;
+pub use diagnostics;
+pub use rego_engine;
+pub use rules;
+pub use schema_validator;
+pub use template_model;
+pub use validation_engine;
+
+pub use cel_engine::CelEngine;
+pub use data_source::{AdditionalSchemaSource, SchemaSourceError};
+pub use diagnostics::{DetailLevel, Diagnostic, ReportStatus, ValidationReport};
+pub use rego_engine::RegoEngine;
+pub use rules::{
+    Category, FilterConfig, IdRange, LogicalIdFilter, ResourceIdFilter, ResourceTypeFilter, RuleFilterConfig,
+    RuleOrigin, ServiceFilter, Severity,
+};
+pub use schema_validator::{
+    OverlayCatalog, SchemaValidator, SchemaValidatorConfig, SchemaValidatorConfigError, prewarm_embedded_data,
+};
+pub use template_model::{ParseConfig, PseudoParameterOverrides, SemanticModel, SourceSpan};
+pub use validation_engine::{
+    EngineConfig, EngineType, ExternalRuleSource, ValidateConfig, ValidationEngine, ValidationError,
+    validate_bytes_with_path, validate_catching_panics,
+};
+
+/// Returns the version of the published Rust facade.
+#[must_use]
+pub const fn version() -> &'static str {
+    env!("CARGO_PKG_VERSION")
+}
diff --git a/src/bindings-rust/tests/smoke.rs b/src/bindings-rust/tests/smoke.rs
new file mode 100644
index 00000000..4f0bc9c0
--- /dev/null
+++ b/src/bindings-rust/tests/smoke.rs
@@ -0,0 +1,278 @@
+use cloudformation_validate::{
+    AdditionalSchemaSource, CelEngine, EngineConfig, ExternalRuleSource, RegoEngine, ReportStatus, SchemaValidator,
+    SchemaValidatorConfig, SemanticModel, Severity, ValidateConfig, ValidationEngine, ValidationReport,
+    validate_bytes_with_path, version,
+};
+
+const GOOD_TEMPLATE: &[u8] = br#"
+AWSTemplateFormatVersion: "2010-09-09"
+Resources:
+  Bucket:
+    Type: AWS::S3::Bucket
+"#;
+
+const UNENCRYPTED_BUCKET: &[u8] = br#"
+Resources:
+  MyBucket:
+    Type: AWS::S3::Bucket
+    Properties:
+      BucketName: my-test-bucket
+"#;
+
+const TEMPLATE_WITH_OVERLAY_PROPERTY: &[u8] = br#"
+Resources:
+  Function:
+    Type: AWS::Lambda::Function
+    Properties:
+      Code:
+        ZipFile: "exports.handler = async () => {};"
+      Role: arn:aws:iam::123456789012:role/lambda-role
+      Runtime: nodejs18.x
+      Handler: index.handler
+      TestForOverride: enabled
+"#;
+
+const LAMBDA_OVERLAY_SCHEMA: &str = r#"{
+  "typeName": "AWS::Lambda::Function",
+  "properties": {"TestForOverride": {"type": "string"}}
+}"#;
+
+const REGO_CUSTOM_RULE: &str = r#"
+package custom_test
+import rego.v1
+violation contains v if {
+    some name, resource in input.resources
+    resource.resourceType == "AWS::S3::Bucket"
+    not resource.properties.BucketEncryption
+    v := {
+        "rule_id": "CUSTOM001",
+        "severity": "error",
+        "message": "S3 bucket must have encryption configured",
+        "resource_id": name,
+    }
+}
+"#;
+
+const CEL_CUSTOM_RULE: &str = r#"{
+  "rules": [{
+    "rule_id": "CUSTOM001",
+    "severity": "ERROR",
+    "resource_type": "AWS::S3::Bucket",
+    "expression": "!has(properties.BucketEncryption)",
+    "message": "S3 bucket must have encryption configured"
+  }]
+}"#;
+
+const GUARD_RULE: &str = r#"
+rule check_bucket_encryption {
+    AWS::S3::Bucket {
+        Properties.BucketEncryption EXISTS
+        <<S3 bucket must have encryption configured>>
+    }
+}
+"#;
+
+fn validate(
+    engine: &dyn ValidationEngine,
+    schema_validator: &SchemaValidator,
+    template: &[u8],
+    config: ValidateConfig,
+) -> ValidationReport {
+    validate_bytes_with_path(engine, schema_validator, template, config, "template.yaml".to_string())
+        .expect("the public facade must return a validation report")
+}
+
+fn diagnostic_signatures(report: &ValidationReport) -> Vec<(String, Severity, String)> {
+    report
+        .diagnostics
+        .iter()
+        .map(|diagnostic| (diagnostic.rule_id.clone(), diagnostic.severity, diagnostic.message.clone()))
+        .collect()
+}
+
+fn both_engines(config: EngineConfig) -> Vec<Box<dyn ValidationEngine>> {
+    vec![
+        Box::new(RegoEngine::new(config.clone()).expect("Rego engine must initialize")),
+        Box::new(CelEngine::new(config).expect("CEL engine must initialize")),
+    ]
+}
+
+#[test]
+fn facade_version_matches_cargo_package_version() {
+    assert_eq!(version(), env!("CARGO_PKG_VERSION"));
+}
+
+#[test]
+fn engine_names_and_rule_lists_match() {
+    let engines = both_engines(EngineConfig::default());
+    assert_eq!(engines[0].engine_name(), "rego");
+    assert_eq!(engines[1].engine_name(), "cel");
+
+    let listings: Vec<Vec<_>> = engines
+        .iter()
+        .map(|engine| {
+            let rules = engine.list_rules();
+            assert!(!rules.is_empty(), "built-in rule listing must not be empty");
+            assert!(rules.windows(2).all(|pair| pair[0].id <= pair[1].id), "rules must be sorted by ID");
+            rules
+                .into_iter()
+                .map(|rule| (rule.id, rule.severity, rule.category, rule.description, rule.origin))
+                .collect()
+        })
+        .collect();
+    assert_eq!(listings[0], listings[1]);
+}
+
+#[test]
+fn good_template_passes_both_engines_with_the_file_label() {
+    let schema_validator = SchemaValidator::default();
+    for engine in both_engines(EngineConfig::default()) {
+        let report = validate(engine.as_ref(), &schema_validator, GOOD_TEMPLATE, ValidateConfig::default());
+        assert_eq!(report.status, ReportStatus::Ok);
+        assert_eq!(report.file_path, "template.yaml");
+        assert!(
+            report
+                .diagnostics
+                .iter()
+                .all(|diagnostic| !matches!(diagnostic.severity, Severity::Error | Severity::Fatal)),
+            "good template must not produce errors: {:?}",
+            report.diagnostics
+        );
+    }
+}
+
+#[test]
+fn both_engines_return_identical_diagnostics() {
+    let schema_validator = SchemaValidator::default();
+    let engines = both_engines(EngineConfig::default());
+    let reports: Vec<_> = engines
+        .iter()
+        .map(|engine| validate(engine.as_ref(), &schema_validator, UNENCRYPTED_BUCKET, ValidateConfig::default()))
+        .collect();
+
+    assert!(!reports[0].diagnostics.is_empty(), "unencrypted bucket must produce diagnostics");
+    assert_eq!(diagnostic_signatures(&reports[0]), diagnostic_signatures(&reports[1]));
+    assert!(
+        reports[0]
+            .diagnostics
+            .iter()
+            .any(|diagnostic| { diagnostic.entity.as_ref().is_some_and(|entity| entity.logical_id == "MyBucket") })
+    );
+}
+
+#[test]
+fn schema_validator_exposes_bundled_schemas_and_rules() {
+    let validator = SchemaValidator::default();
+    assert!(validator.schema_count() > 0);
+    let rules = validator.list_rules();
+    assert!(!rules.is_empty());
+    assert!(rules.iter().all(|rule| !rule.id.is_empty()));
+}
+
+#[test]
+fn severity_threshold_filters_lower_diagnostics() {
+    let schema_validator = SchemaValidator::default();
+    let engine = RegoEngine::new(EngineConfig::default()).expect("Rego engine must initialize");
+    let config = ValidateConfig { severity_level: Severity::Error, ..ValidateConfig::default() };
+    let report = validate(&engine, &schema_validator, UNENCRYPTED_BUCKET, config);
+
+    assert!(
+        report.diagnostics.iter().all(|diagnostic| matches!(diagnostic.severity, Severity::Error | Severity::Fatal))
+    );
+}
+
+#[test]
+fn detailed_metadata_counts_and_performance_are_populated() {
+    let schema_validator = SchemaValidator::default();
+    let engine = RegoEngine::new(EngineConfig::default()).expect("Rego engine must initialize");
+    let report = validate(&engine, &schema_validator, UNENCRYPTED_BUCKET, ValidateConfig::default());
+    let counts = &report.metadata.counts;
+    let diagnostic_count = counts.fatal + counts.errors + counts.warnings + counts.informational + counts.debug;
+
+    assert_eq!(report.diagnostics.len() as u32, diagnostic_count);
+    assert!(report.performance.validate_total.duration_ms > 0.0);
+    assert!(report.performance.schema_validate.duration_ms >= 0.0);
+    assert!(report.performance.rule_evaluation.duration_ms >= 0.0);
+}
+
+#[test]
+fn additional_schema_config_applies_to_both_engines() {
+    let baseline_validator = SchemaValidator::default();
+    for baseline_engine in both_engines(EngineConfig::default()) {
+        let baseline = validate(
+            baseline_engine.as_ref(),
+            &baseline_validator,
+            TEMPLATE_WITH_OVERLAY_PROPERTY,
+            ValidateConfig::default(),
+        );
+        assert!(baseline.diagnostics.iter().any(|diagnostic| diagnostic.rule_id == "F3002"));
+    }
+
+    let source = AdditionalSchemaSource { type_name: None, schema: LAMBDA_OVERLAY_SCHEMA.to_string() };
+    let schema_config = SchemaValidatorConfig::new().with_additional_schemas([source]);
+    let schema_validator = SchemaValidator::new(schema_config.clone()).expect("overlay schema must apply");
+    let engine_config = EngineConfig::new().with_schema_validator_config(schema_config);
+    for engine in both_engines(engine_config) {
+        let report =
+            validate(engine.as_ref(), &schema_validator, TEMPLATE_WITH_OVERLAY_PROPERTY, ValidateConfig::default());
+        assert!(!report.diagnostics.iter().any(|diagnostic| diagnostic.rule_id == "F3002"));
+    }
+}
+
+#[test]
+fn engine_native_custom_rules_fire() {
+    let schema_validator = SchemaValidator::default();
+    let engines: Vec<Box<dyn ValidationEngine>> = vec![
+        Box::new(
+            RegoEngine::new(EngineConfig::new().with_custom_rules([ExternalRuleSource {
+                name: "custom.rego".to_string(),
+                content: REGO_CUSTOM_RULE.to_string(),
+            }]))
+            .expect("custom Rego rule must compile"),
+        ),
+        Box::new(
+            CelEngine::new(EngineConfig::new().with_custom_rules([ExternalRuleSource {
+                name: "custom.json".to_string(),
+                content: CEL_CUSTOM_RULE.to_string(),
+            }]))
+            .expect("custom CEL rule must compile"),
+        ),
+    ];
+
+    for engine in engines {
+        let report = validate(engine.as_ref(), &schema_validator, UNENCRYPTED_BUCKET, ValidateConfig::default());
+        let hits: Vec<_> = report.diagnostics.iter().filter(|diagnostic| diagnostic.rule_id == "CUSTOM001").collect();
+        assert_eq!(hits.len(), 1);
+        assert_eq!(hits[0].message, "S3 bucket must have encryption configured");
+    }
+}
+
+#[test]
+fn guard_rule_fires_on_both_engines() {
+    let schema_validator = SchemaValidator::default();
+    let config = EngineConfig::new().with_guard_rules([ExternalRuleSource {
+        name: "encryption.guard".to_string(),
+        content: GUARD_RULE.to_string(),
+    }]);
+
+    for engine in both_engines(config) {
+        let report = validate(engine.as_ref(), &schema_validator, UNENCRYPTED_BUCKET, ValidateConfig::default());
+        assert!(
+            report
+                .diagnostics
+                .iter()
+                .any(|diagnostic| { diagnostic.message.to_ascii_lowercase().contains("encryption") })
+        );
+    }
+}
+
+#[test]
+fn semantic_model_is_available_through_the_facade() {
+    let model = SemanticModel::from_bytes(UNENCRYPTED_BUCKET).expect("template must parse");
+    let bucket = model.resources.get("MyBucket").expect("MyBucket resource must exist");
+    assert_eq!(bucket.resource_type, "AWS::S3::Bucket");
+    assert!(model.parameters.is_empty());
+    assert!(model.outputs.is_empty());
+    assert!(model.conditions.names().next().is_none());
+    assert!(model.transforms.is_empty());
+}
diff --git a/src/bindings-wasm/Cargo.toml b/src/bindings-wasm/Cargo.toml
index 2b55bf88..6c60ab8a 100644
--- a/src/bindings-wasm/Cargo.toml
+++ b/src/bindings-wasm/Cargo.toml
@@ -1,5 +1,6 @@
 [package]
 name = "bindings-wasm"
+publish = false
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -12,13 +13,13 @@ categories.workspace = true
 crate-type = ["cdylib"]
 
 [dependencies]
-validation-engine = { path = "../validation-engine", features = ["wasm-bindings"] }
-diagnostics = { path = "../diagnostics", features = ["wasm-bindings"] }
-rules = { path = "../rules", features = ["wasm-bindings"] }
-template-model = { path = "../template-model", features = ["wasm-bindings"] }
-rego-engine = { path = "../rego-engine" }
-cel-engine = { path = "../cel-engine" }
-schema-validator = { path = "../schema-validator", features = ["wasm-bindings"] }
+validation-engine = { workspace = true, features = ["wasm-bindings"] }
+diagnostics = { workspace = true, features = ["wasm-bindings"] }
+rules = { workspace = true, features = ["wasm-bindings"] }
+template-model = { workspace = true, features = ["wasm-bindings"] }
+rego-engine = { workspace = true }
+cel-engine = { workspace = true }
+schema-validator = { workspace = true, features = ["wasm-bindings"] }
 wasm-bindgen = "0.2"
 serde = { version = "1", features = ["derive"] }
 serde-wasm-bindgen = "0.6"
diff --git a/src/cel-engine/Cargo.toml b/src/cel-engine/Cargo.toml
index 946ca16b..a685705f 100644
--- a/src/cel-engine/Cargo.toml
+++ b/src/cel-engine/Cargo.toml
@@ -1,7 +1,9 @@
 [package]
-name = "cel-engine"
+name = "cloudformation-validate-cel-engine"
+publish = true
 version.workspace = true
 edition.workspace = true
+rust-version.workspace = true
 license.workspace = true
 description.workspace = true
 repository.workspace = true
@@ -13,13 +15,13 @@ name = "cel_engine"
 path = "src/lib.rs"
 
 [dependencies]
-validation-engine = { path = "../validation-engine" }
-diagnostics = { path = "../diagnostics" }
-rules = { path = "../rules" }
-template-model = { path = "../template-model" }
-guard-translator = { path = "../guard-translator" }
-data-source = { path = "../data-source", default-features = false }
-schema-validator = { path = "../schema-validator" }
+validation-engine = { workspace = true }
+diagnostics = { workspace = true }
+rules = { workspace = true }
+template-model = { workspace = true }
+guard-translator = { workspace = true }
+data-source = { workspace = true }
+schema-validator = { workspace = true }
 cel-interpreter = { version = "0.10", features = ["json"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
@@ -30,7 +32,7 @@ web-time = "1"
 regex = "1"
 
 [dev-dependencies]
-validation-engine = { path = "../validation-engine", features = ["test"] }
+validation-engine = { workspace = true, features = ["test"] }
 
 [lints]
 workspace = true
diff --git a/src/cfn-validate/Cargo.toml b/src/cfn-validate/Cargo.toml
index 27e29b1a..610bf23e 100644
--- a/src/cfn-validate/Cargo.toml
+++ b/src/cfn-validate/Cargo.toml
@@ -1,5 +1,6 @@
 [package]
 name = "cfn-validate"
+publish = false
 default-run = "cfn-validate"
 version.workspace = true
 edition.workspace = true
@@ -22,14 +23,14 @@ name = "cfn-benchmark"
 path = "src/benchmark.rs"
 
 [dependencies]
-data-source = { path = "../data-source", default-features = false }
-template-model = { path = "../template-model" }
-diagnostics = { path = "../diagnostics" }
-validation-engine = { path = "../validation-engine" }
-rules = { path = "../rules" }
-schema-validator = { path = "../schema-validator" }
-rego-engine = { path = "../rego-engine" }
-cel-engine = { path = "../cel-engine" }
+data-source = { workspace = true }
+template-model = { workspace = true }
+diagnostics = { workspace = true }
+validation-engine = { workspace = true }
+rules = { workspace = true }
+schema-validator = { workspace = true }
+rego-engine = { workspace = true }
+cel-engine = { workspace = true }
 serde_json = { version = "1", features = ["preserve_order"] }
 sha2 = "0.11"
 chrono = { version = "0.4", default-features = false, features = ["clock"] }
@@ -39,7 +40,7 @@ env_logger = "0.11"
 [dev-dependencies]
 resources = { path = "../resources" }
 tempfile = "3"
-validation-engine = { path = "../validation-engine", features = ["test"] }
+validation-engine = { workspace = true, features = ["test"] }
 
 [lints]
 workspace = true
diff --git a/src/cfn-validate/README.md b/src/cfn-validate/README.md
index aed62ce8..756313d4 100644
--- a/src/cfn-validate/README.md
+++ b/src/cfn-validate/README.md
@@ -8,9 +8,6 @@ an engine ([rego-engine](../rego-engine/README.md) or [cel-engine](../cel-engine
 including [schema-validator](../schema-validator/README.md)),
 and renders the resulting report as JSON.
 
-> To embed validation in your own Rust program, depend on `validation-engine`, an engine crate, and `schema-validator`
-> directly - see [validation-engine/API.md](../validation-engine/API.md). This crate is the CLI, not a library facade.
-
 ## How it works
 
 ```
diff --git a/src/data-source/Cargo.toml b/src/data-source/Cargo.toml
index 058f302d..00964928 100644
--- a/src/data-source/Cargo.toml
+++ b/src/data-source/Cargo.toml
@@ -1,7 +1,9 @@
 [package]
-name = "data-source"
+name = "cloudformation-validate-data-source"
+publish = true
 version.workspace = true
 edition.workspace = true
+rust-version.workspace = true
 license.workspace = true
 description.workspace = true
 repository.workspace = true
diff --git a/src/data-source/README.md b/src/data-source/README.md
index 4e32b9e1..c8a8b952 100644
--- a/src/data-source/README.md
+++ b/src/data-source/README.md
@@ -9,10 +9,10 @@ compile time. Everything compiles into the binary - no runtime fetching.
 
 ```bash
 # Generate from existing upstream data
-cargo run -p data-source --features maintenance --example generate
+cargo run -p cloudformation-validate-data-source --features maintenance --example generate
 
 # Refresh all upstream sources, then generate every output (cfn-lint root is required)
-cargo run -p data-source --features maintenance --example sync -- --cfn-lint-root <DIR>
+cargo run -p cloudformation-validate-data-source --features maintenance --example sync -- --cfn-lint-root <DIR>
 ```
 
 The `generate` and `sync` examples require the `maintenance` feature, which enables dependencies used only by the
diff --git a/src/data-source/build.rs b/src/data-source/build.rs
index 4aee85ba..10d899f3 100644
--- a/src/data-source/build.rs
+++ b/src/data-source/build.rs
@@ -82,12 +82,10 @@ fn main() {
     let generated_sv_dir = generated_dir.join("schema-validator");
     let generated_cel_dir = generated_dir.join("cel-rules");
     let handwritten_dir = manifest_dir.join("handwritten");
-    let rego_hw_dir = manifest_dir.parent().unwrap().join("rego-engine").join("handwritten").join("rego");
 
     for dir in [&generated_data_dir, &generated_sv_dir, &generated_cel_dir, &handwritten_dir] {
         println!("cargo:rerun-if-changed={}", dir.display());
     }
-    println!("cargo:rerun-if-changed={}", rego_hw_dir.display());
 
     let mut code = String::new();
 
@@ -168,16 +166,6 @@ fn main() {
     require_file(&cel_rules_path, "generated CEL rules");
     embed_minified_json(&cel_rules_path, "GENERATED_RULES", &out_dir, &mut code);
 
-    if !rego_hw_dir.is_dir() {
-        panic!("missing required handwritten Rego directory: {}", rego_hw_dir.display());
-    }
-    code.push_str("pub const HANDWRITTEN_REGO_POLICIES: &[(&str, &str)] = &[\n");
-    let rego_file_count = collect_rego_files(&rego_hw_dir, &rego_hw_dir, &mut code);
-    if rego_file_count == 0 {
-        panic!("required handwritten Rego directory contains no .rego files: {}", rego_hw_dir.display());
-    }
-    code.push_str("];\n");
-
     code.push_str(
         "\n/// Force-decompress every embedded data LazyLock. Safe to call multiple times (no-op after first).\n",
     );
@@ -234,22 +222,3 @@ fn embed_minified_json(path: &Path, const_name: &str, out_dir: &Path, code: &mut
         bin_path.display().to_string(),
     ));
 }
-
-fn collect_rego_files(base: &Path, dir: &Path, code: &mut String) -> usize {
-    let mut entries: Vec<_> =
-        fs::read_dir(dir).unwrap().map(|e| e.expect("failed to read rego directory entry")).collect();
-    entries.sort_by_key(|e| e.path());
-    let mut file_count = 0;
-    for entry in entries {
-        let path = entry.path();
-        if path.is_dir() {
-            file_count += collect_rego_files(base, &path, code);
-        } else if path.extension().and_then(|e| e.to_str()) == Some("rego") {
-            let rel = path.strip_prefix(base).unwrap().display().to_string();
-            let content = fs::read_to_string(&path).unwrap();
-            code.push_str(&format!("    ({rel:?}, {:?}),\n", content));
-            file_count += 1;
-        }
-    }
-    file_count
-}
diff --git a/src/data-source/src/embedding_format_bench.rs b/src/data-source/src/embedding_format_bench.rs
index 7e2d9fff..5fa51e92 100644
--- a/src/data-source/src/embedding_format_bench.rs
+++ b/src/data-source/src/embedding_format_bench.rs
@@ -16,7 +16,7 @@
 //!   - lz4+json            (lz4_flex + serde_json)
 //!   - lz4+postcard        (typed only, lz4_flex + postcard)
 //!
-//! Run: cargo run -p data-source --example embedding_format_bench --features bench --release
+//! Run: cargo run -p cloudformation-validate-data-source --example embedding_format_bench --features bench --release
 
 use data_source::types::{
     CodepipelineArtifactCounts, DeprecatedResourceTypes, GetattData, KnownResourceTypes, PrimaryIdentifiers,
diff --git a/src/data-source/src/generate.rs b/src/data-source/src/generate.rs
index 0ad0ebb5..78799e9e 100644
--- a/src/data-source/src/generate.rs
+++ b/src/data-source/src/generate.rs
@@ -7,9 +7,9 @@ fn main() -> anyhow::Result<()> {
     env_logger::Builder::from_env(env_logger::Env::default().default_filter_or("info")).init();
     if env::args().any(|a| a == "-h" || a == "--help") {
         eprintln!(
-            "Usage: cargo run -p data-source --features maintenance --example generate\n\n\
+            "Usage: cargo run -p cloudformation-validate-data-source --features maintenance --example generate\n\n\
              Generates all outputs from existing upstream data.\n\
-             To refresh upstream data first, run `cargo run -p data-source --features maintenance --example sync -- --cfn-lint-root <DIR>`."
+             To refresh upstream data first, run `cargo run -p cloudformation-validate-data-source --features maintenance --example sync -- --cfn-lint-root <DIR>`."
         );
         return Ok(());
     }
diff --git a/src/data-source/src/sync.rs b/src/data-source/src/sync.rs
index bc197357..109a956e 100644
--- a/src/data-source/src/sync.rs
+++ b/src/data-source/src/sync.rs
@@ -61,7 +61,7 @@ fn clear_cache_directory(cache_directory: &Path) -> anyhow::Result<()> {
 
 fn print_usage() {
     eprintln!(
-        "Usage: cargo run -p data-source --features maintenance --example sync -- --cfn-lint-root <DIR>
+        "Usage: cargo run -p cloudformation-validate-data-source --features maintenance --example sync -- --cfn-lint-root <DIR>
 
 Refreshes all upstream sources, records their versions, and generates every output.
 
diff --git a/src/diagnostics/Cargo.toml b/src/diagnostics/Cargo.toml
index bfca594d..24e1c5cf 100644
--- a/src/diagnostics/Cargo.toml
+++ b/src/diagnostics/Cargo.toml
@@ -1,7 +1,9 @@
 [package]
-name = "diagnostics"
+name = "cloudformation-validate-diagnostics"
+publish = true
 version.workspace = true
 edition.workspace = true
+rust-version.workspace = true
 license.workspace = true
 description.workspace = true
 repository.workspace = true
@@ -17,8 +19,8 @@ wasm-bindings = ["dep:tsify", "dep:wasm-bindgen", "rules/wasm-bindings", "templa
 uniffi-bindings = ["dep:uniffi", "rules/uniffi-bindings", "template-model/uniffi-bindings"]
 
 [dependencies]
-rules = { path = "../rules" }
-template-model = { path = "../template-model" }
+rules = { workspace = true }
+template-model = { workspace = true }
 log = "0.4"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
diff --git a/src/guard-translator/Cargo.toml b/src/guard-translator/Cargo.toml
index 45d2ed45..89541a8f 100644
--- a/src/guard-translator/Cargo.toml
+++ b/src/guard-translator/Cargo.toml
@@ -1,7 +1,9 @@
 [package]
-name = "guard-translator"
+name = "cloudformation-validate-guard-translator"
+publish = true
 version.workspace = true
 edition.workspace = true
+rust-version.workspace = true
 license.workspace = true
 description.workspace = true
 repository.workspace = true
@@ -13,10 +15,10 @@ name = "guard_translator"
 path = "src/lib.rs"
 
 [dependencies]
-guard-lang = { git = "https://github.com/aws-cloudformation/cloudformation-guard.git", branch = "guard-lib" }
+guard-lang = { package = "cloudformation-guard-lang", version = "=1.0.0" }
 serde = { version = "1", features = ["derive"] }
 indexmap = "2"
-rules = { path = "../rules" }
+rules = { workspace = true }
 
 [lints]
 workspace = true
diff --git a/src/rego-engine/Cargo.toml b/src/rego-engine/Cargo.toml
index 78473181..f4e0c64c 100644
--- a/src/rego-engine/Cargo.toml
+++ b/src/rego-engine/Cargo.toml
@@ -1,7 +1,9 @@
 [package]
-name = "rego-engine"
+name = "cloudformation-validate-rego-engine"
+publish = true
 version.workspace = true
 edition.workspace = true
+rust-version.workspace = true
 license.workspace = true
 description.workspace = true
 repository.workspace = true
@@ -13,13 +15,13 @@ name = "rego_engine"
 path = "src/lib.rs"
 
 [dependencies]
-validation-engine = { path = "../validation-engine" }
-diagnostics = { path = "../diagnostics" }
-rules = { path = "../rules" }
-template-model = { path = "../template-model" }
-guard-translator = { path = "../guard-translator" }
-data-source = { path = "../data-source", default-features = false }
-schema-validator = { path = "../schema-validator" }
+validation-engine = { workspace = true }
+diagnostics = { workspace = true }
+rules = { workspace = true }
+template-model = { workspace = true }
+guard-translator = { workspace = true }
+data-source = { workspace = true }
+schema-validator = { workspace = true }
 regorus = { version = "0.9", default-features = false, features = ["arc", "regex", "semver", "std"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
@@ -29,7 +31,7 @@ log = "0.4"
 web-time = "1"
 
 [dev-dependencies]
-validation-engine = { path = "../validation-engine", features = ["test"] }
+validation-engine = { workspace = true, features = ["test"] }
 
 [lints]
 workspace = true
diff --git a/src/rego-engine/README.md b/src/rego-engine/README.md
index b476a682..dd21eaa6 100644
--- a/src/rego-engine/README.md
+++ b/src/rego-engine/README.md
@@ -18,9 +18,9 @@ Rules are organized into Rego packages by category:
 | `resources`      | `data.resources.violation`      | Resource-specific    |
 | `all_violations` | `data.all_violations.violation` | All packages at once |
 
-Rules come from four sources: handwritten Rego policies (embedded), generated data from
-data-source (embedded), user-provided custom Rego policies, and Guard DSL files translated
-to Rego at engine initialization.
+Rules come from four sources: handwritten Rego policies embedded by this crate's build script, generated shared data
+embedded by data-source, user-provided custom Rego policies, and Guard DSL files translated to Rego at engine
+initialization.
 
 ## Custom Builtins
 
diff --git a/src/rego-engine/build.rs b/src/rego-engine/build.rs
new file mode 100644
index 00000000..752b3bc5
--- /dev/null
+++ b/src/rego-engine/build.rs
@@ -0,0 +1,54 @@
+use std::env;
+use std::error::Error;
+use std::fs;
+use std::path::{Path, PathBuf};
+
+const HANDWRITTEN_REGO_OUTPUT: &str = "handwritten_rego.rs";
+
+fn main() -> Result<(), Box<dyn Error>> {
+    let manifest_dir = PathBuf::from(env::var("CARGO_MANIFEST_DIR")?);
+    let output_dir = PathBuf::from(env::var("OUT_DIR")?);
+    let policy_dir = manifest_dir.join("handwritten").join("rego");
+
+    println!("cargo:rerun-if-changed={}", policy_dir.display());
+
+    if !policy_dir.is_dir() {
+        return Err(format!("missing required handwritten Rego directory: {}", policy_dir.display()).into());
+    }
+
+    let mut generated_source = String::from("pub(crate) const HANDWRITTEN_REGO_POLICIES: &[(&str, &str)] = &[\n");
+    let policy_count = collect_rego_files(&policy_dir, &policy_dir, &mut generated_source)?;
+    if policy_count == 0 {
+        return Err(
+            format!("required handwritten Rego directory contains no .rego files: {}", policy_dir.display()).into()
+        );
+    }
+    generated_source.push_str("];\n");
+
+    fs::write(output_dir.join(HANDWRITTEN_REGO_OUTPUT), generated_source)?;
+    Ok(())
+}
+
+fn collect_rego_files(
+    base_dir: &Path,
+    current_dir: &Path,
+    generated_source: &mut String,
+) -> Result<usize, Box<dyn Error>> {
+    let mut entries: Vec<_> = fs::read_dir(current_dir)?.collect::<Result<_, _>>()?;
+    entries.sort_by_key(|entry| entry.path());
+
+    let mut policy_count = 0;
+    for entry in entries {
+        let path = entry.path();
+        if path.is_dir() {
+            policy_count += collect_rego_files(base_dir, &path, generated_source)?;
+        } else if path.extension().and_then(|extension| extension.to_str()) == Some("rego") {
+            let relative_path = path.strip_prefix(base_dir)?.display().to_string();
+            let policy_source = fs::read_to_string(&path)?;
+            generated_source.push_str(&format!("    ({relative_path:?}, {policy_source:?}),\n"));
+            policy_count += 1;
+        }
+    }
+
+    Ok(policy_count)
+}
diff --git a/src/rego-engine/src/engine.rs b/src/rego-engine/src/engine.rs
index 898e784f..625448f0 100644
--- a/src/rego-engine/src/engine.rs
+++ b/src/rego-engine/src/engine.rs
@@ -1,3 +1,4 @@
+use crate::policies;
 use data_source::embedded;
 use data_source::types::KnownResourceTypes;
 use diagnostics::{Diagnostic, PhaseMetric, phase_metric};
@@ -277,13 +278,13 @@ impl RegoEngine {
             rego.add_data(regorus::Value::from_json_str(&merged)?)?;
         }
 
-        for (path, source) in embedded::HANDWRITTEN_REGO_POLICIES {
+        for (path, source) in policies::HANDWRITTEN_REGO_POLICIES {
             rego.add_policy(path.to_string(), source.to_string())?;
         }
         debug!(
             "Loaded {} data files, {} handwritten rules",
             REGORUS_DATA.len(),
-            embedded::HANDWRITTEN_REGO_POLICIES.len()
+            policies::HANDWRITTEN_REGO_POLICIES.len()
         );
 
         let mut translated_guard_sources = Vec::new();
@@ -357,7 +358,7 @@ impl RegoEngine {
 
         info!(
             "RegoEngine initialized: {} handwritten rules, {} data files, {} registry + {} external metadata entries",
-            embedded::HANDWRITTEN_REGO_POLICIES.len(),
+            policies::HANDWRITTEN_REGO_POLICIES.len(),
             REGORUS_DATA.len(),
             registry_metadata.len(),
             external_rule_metadata.len()
diff --git a/src/rego-engine/src/lib.rs b/src/rego-engine/src/lib.rs
index 7ec0501d..53f262c6 100644
--- a/src/rego-engine/src/lib.rs
+++ b/src/rego-engine/src/lib.rs
@@ -1,5 +1,8 @@
 pub(crate) mod builtins;
 pub(crate) mod engine;
 pub(crate) mod guard_to_rego;
+pub(crate) mod policies {
+    include!(concat!(env!("OUT_DIR"), "/handwritten_rego.rs"));
+}
 
 pub use engine::RegoEngine;
diff --git a/src/resources/Cargo.toml b/src/resources/Cargo.toml
index e0de55c8..cd391c73 100644
--- a/src/resources/Cargo.toml
+++ b/src/resources/Cargo.toml
@@ -1,5 +1,6 @@
 [package]
 name = "resources"
+publish = false
 version.workspace = true
 edition.workspace = true
 license.workspace = true
diff --git a/src/rules/Cargo.toml b/src/rules/Cargo.toml
index 2e86767b..a5bd5d82 100644
--- a/src/rules/Cargo.toml
+++ b/src/rules/Cargo.toml
@@ -1,7 +1,9 @@
 [package]
-name = "rules"
+name = "cloudformation-validate-rules"
+publish = true
 version.workspace = true
 edition.workspace = true
+rust-version.workspace = true
 license.workspace = true
 description.workspace = true
 repository.workspace = true
@@ -17,7 +19,7 @@ wasm-bindings = ["dep:tsify", "dep:wasm-bindgen", "template-model/wasm-bindings"
 uniffi-bindings = ["dep:uniffi", "template-model/uniffi-bindings"]
 
 [dependencies]
-template-model = { path = "../template-model" }
+template-model = { workspace = true }
 serde = { version = "1", features = ["derive"] }
 regex = "1"
 log = "0.4"
diff --git a/src/schema-validator/Cargo.toml b/src/schema-validator/Cargo.toml
index a7ca9944..61a14441 100644
--- a/src/schema-validator/Cargo.toml
+++ b/src/schema-validator/Cargo.toml
@@ -1,7 +1,9 @@
 [package]
-name = "schema-validator"
+name = "cloudformation-validate-schema-validator"
+publish = true
 version.workspace = true
 edition.workspace = true
+rust-version.workspace = true
 license.workspace = true
 description.workspace = true
 repository.workspace = true
@@ -18,10 +20,10 @@ wasm-bindings = ["data-source/wasm-bindings", "dep:tsify", "dep:wasm-bindgen"]
 uniffi-bindings = ["data-source/uniffi-bindings", "dep:uniffi"]
 
 [dependencies]
-template-model = { path = "../template-model" }
-diagnostics = { path = "../diagnostics" }
-rules = { path = "../rules" }
-data-source = { path = "../data-source", default-features = false }
+template-model = { workspace = true }
+diagnostics = { workspace = true }
+rules = { workspace = true }
+data-source = { workspace = true }
 serde = { version = "1", features = ["derive"] }
 serde_json = { version = "1", features = ["preserve_order"] }
 log = "0.4"
diff --git a/src/schema-validator/README.md b/src/schema-validator/README.md
index 1fe76460..741994f2 100644
--- a/src/schema-validator/README.md
+++ b/src/schema-validator/README.md
@@ -39,7 +39,7 @@ Key semantics:
   alone are rejected - the overlay must carry at least one validatable constraint.
 
 The merge model, its scope limits, and the input the module rejects are documented on the `overlay` module
-(`cargo doc -p schema-validator`). Library and binding callers construct a `SchemaValidator` via
+(`cargo doc -p cloudformation-validate-schema-validator`). Library and binding callers construct a `SchemaValidator` via
 `SchemaValidator::new(SchemaValidatorConfig { additional_schemas: ... })`. The optional
 `EngineConfig::schema_validator_config` field holds the same config type, so the engine derives overlay-aware metadata
 automatically when constructed standalone.
diff --git a/src/template-model/Cargo.toml b/src/template-model/Cargo.toml
index 25c3a8c5..20302fb5 100644
--- a/src/template-model/Cargo.toml
+++ b/src/template-model/Cargo.toml
@@ -1,7 +1,9 @@
 [package]
-name = "template-model"
+name = "cloudformation-validate-template-model"
+publish = true
 version.workspace = true
 edition.workspace = true
+rust-version.workspace = true
 license.workspace = true
 description.workspace = true
 repository.workspace = true
diff --git a/src/template-model/README.md b/src/template-model/README.md
index 4ad86c22..3b9f69ce 100644
--- a/src/template-model/README.md
+++ b/src/template-model/README.md
@@ -122,5 +122,5 @@ Supports AWS SAM templates with automatic handling of SAM transforms and implici
 Prints a detailed human-readable dump of the semantic model for a template or directory of templates.
 
 ```
-cargo run -p template-model --example inspect -- <TEMPLATE|DIR>
+cargo run -p cloudformation-validate-template-model --example inspect -- <TEMPLATE|DIR>
 ```
diff --git a/src/template-model/src/inspect.rs b/src/template-model/src/inspect.rs
index 05cc2060..e6511901 100644
--- a/src/template-model/src/inspect.rs
+++ b/src/template-model/src/inspect.rs
@@ -17,7 +17,7 @@ fn main() {
     let path = match path {
         Some(p) => p.clone(),
         None => {
-            eprintln!("Usage: cargo run -p template-model --example inspect -- <template|dir>");
+            eprintln!("Usage: cargo run -p cloudformation-validate-template-model --example inspect -- <template|dir>");
             eprintln!();
             eprintln!("Inspect a CloudFormation template or all files in a directory (recursive).");
             process::exit(2);
diff --git a/src/validation-engine/Cargo.toml b/src/validation-engine/Cargo.toml
index 111e3041..a944decb 100644
--- a/src/validation-engine/Cargo.toml
+++ b/src/validation-engine/Cargo.toml
@@ -1,7 +1,9 @@
 [package]
-name = "validation-engine"
+name = "cloudformation-validate-validation-engine"
+publish = true
 version.workspace = true
 edition.workspace = true
+rust-version.workspace = true
 license.workspace = true
 description.workspace = true
 repository.workspace = true
@@ -18,12 +20,12 @@ uniffi-bindings = ["dep:uniffi", "schema-validator/uniffi-bindings"]
 test = []
 
 [dependencies]
-data-source = { path = "../data-source", default-features = false }
-diagnostics = { path = "../diagnostics" }
-rules = { path = "../rules" }
-template-model = { path = "../template-model" }
-schema-validator = { path = "../schema-validator" }
-guard-translator = { path = "../guard-translator" }
+data-source = { workspace = true }
+diagnostics = { workspace = true }
+rules = { workspace = true }
+template-model = { workspace = true }
+schema-validator = { workspace = true }
+guard-translator = { workspace = true }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 log = "0.4"