History

tegwick 2387409d08 All checks were successful CI Smoke / host-smoke (push) Successful in 0s Details CI Smoke / container-smoke (push) Successful in 2s Details NK-WP-0056-T03 done: executor identity and authority ceiling, in source Executor credentials declared (planned) with executor_subject; service-identity gains convention executor (SI-15: approved-only grants, no person, not interactive) and --admissions, checking that an admission's ceiling lies inside the executor's declared grants (pilot covered). RBAC in sso-mfa/k8s/bounded-executor (not applied): ServiceAccount without automount, a Role limited to the authelia Deployment and ExternalSecret, no read of credential objects; tests tie Role, declaration and pilot ceiling. The pilot example's delivery check now reads the ExternalSecret status. railiance-apps and glas-harness answers recorded (T02). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 994874@bnt-lap001 Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87		2026-10-31 14:21:04 +01:00
..
fixtures/invalid	NK-WP-0056-T03 done: executor identity and authority ceiling, in source	2026-10-31 14:21:04 +01:00
tests	NK-WP-0056-T01 done: Bounded Execution Admission v0.1 (proposed)	2026-10-31 13:55:18 +01:00
generate_examples.py	NK-WP-0056-T03 done: executor identity and authority ceiling, in source	2026-10-31 14:21:04 +01:00
README.md	NK-WP-0056-T01 done: Bounded Execution Admission v0.1 (proposed)	2026-10-31 13:55:18 +01:00
validate.py	NK-WP-0056-T01 done: Bounded Execution Admission v0.1 (proposed)	2026-10-31 13:55:18 +01:00

README.md

Bounded Execution Admission validator (NK-WP-0056-T01)

Offline, deterministic checks for canon/standards/bounded-execution-admission_v0.1.md.

python3 tools/bounded-execution-admission/validate.py validate [--as-of T] FILE...   # BEA-1..BEA-14
python3 tools/bounded-execution-admission/validate.py check-approval ADMISSION RECORD # BEA-C1..BEA-C7
python3 tools/bounded-execution-admission/validate.py digest FILE                    # plan and admission digests
python3 tools/bounded-execution-admission/generate_examples.py                       # re-pin and regenerate examples
make bounded-execution-admission-test bounded-execution-admission-check

A valid document is a well-formed request, not an admission: an admission also needs a carrier record approved by a person (Approval Engine, or a founder SSH signature). Findings name the rule and a location, never a value. Needs jsonschema and PyYAML.

Examples (examples/bounded-execution-admission/) express the NK-WP-0054 bind split as admissions. generate_examples.py pins real files at the current commit; re-run it when those files change.