tegwick
989d5d4f5d
Standard, schema and validator for the founder's admission of one bounded executor run: exact plan by digest, window by risk class, SI MODE @ SCOPE ceiling with least-privilege coverage, blast radius by consumer, named source-pinned checks, revert per mutating step, budget, single use, and the NK-WP-0040 receipt. check-approval verifies a carrier record (Approval Engine or founder SSH signature): aal2 human approver, not the executor, consumed at most once in the window. Examples express the bind split; step 10 is refused as human-intrinsic. 22 tests; make targets; tool index. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 994874@bnt-lap001 Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
18 lines
1.1 KiB
Markdown
18 lines
1.1 KiB
Markdown
# Bounded Execution Admission validator (NK-WP-0056-T01)
|
|
|
|
Offline, deterministic checks for `canon/standards/bounded-execution-admission_v0.1.md`.
|
|
|
|
```bash
|
|
python3 tools/bounded-execution-admission/validate.py validate [--as-of T] FILE... # BEA-1..BEA-14
|
|
python3 tools/bounded-execution-admission/validate.py check-approval ADMISSION RECORD # BEA-C1..BEA-C7
|
|
python3 tools/bounded-execution-admission/validate.py digest FILE # plan and admission digests
|
|
python3 tools/bounded-execution-admission/generate_examples.py # re-pin and regenerate examples
|
|
make bounded-execution-admission-test bounded-execution-admission-check
|
|
```
|
|
|
|
A valid document is a well-formed request, not an admission: an admission also needs a carrier
|
|
record approved by a person (Approval Engine, or a founder SSH signature). Findings name the rule
|
|
and a location, never a value. Needs `jsonschema` and `PyYAML`.
|
|
|
|
Examples (`examples/bounded-execution-admission/`) express the NK-WP-0054 bind split as admissions.
|
|
`generate_examples.py` pins real files at the current commit; re-run it when those files change.
|