# Bounded Execution Admission validator (NK-WP-0056-T01)

Offline, deterministic checks for `canon/standards/bounded-execution-admission_v0.1.md`.

```bash
python3 tools/bounded-execution-admission/validate.py validate [--as-of T] FILE...   # BEA-1..BEA-14
python3 tools/bounded-execution-admission/validate.py check-approval ADMISSION RECORD # BEA-C1..BEA-C7
python3 tools/bounded-execution-admission/validate.py digest FILE                    # plan and admission digests
python3 tools/bounded-execution-admission/generate_examples.py                       # re-pin and regenerate examples
make bounded-execution-admission-test bounded-execution-admission-check
```

A valid document is a well-formed request, not an admission: an admission also needs a carrier
record approved by a person (Approval Engine, or a founder SSH signature). Findings name the rule
and a location, never a value. Needs `jsonschema` and `PyYAML`.

Examples (`examples/bounded-execution-admission/`) express the NK-WP-0054 bind split as admissions.
`generate_examples.py` pins real files at the current commit; re-run it when those files change.