coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
net-kingdom/tools/bounded-execution-admission/README.md
tegwick 989d5d4f5d
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
NK-WP-0056-T01 done: Bounded Execution Admission v0.1 (proposed) 
Standard, schema and validator for the founder's admission of one bounded
executor run: exact plan by digest, window by risk class, SI MODE @ SCOPE
ceiling with least-privilege coverage, blast radius by consumer, named
source-pinned checks, revert per mutating step, budget, single use, and the
NK-WP-0040 receipt. check-approval verifies a carrier record (Approval
Engine or founder SSH signature): aal2 human approver, not the executor,
consumed at most once in the window. Examples express the bind split;
step 10 is refused as human-intrinsic. 22 tests; make targets; tool index.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
2026-10-31 13:55:18 +01:00

1.1 KiB
Raw Blame History

Bounded Execution Admission validator (NK-WP-0056-T01)

Offline, deterministic checks for canon/standards/bounded-execution-admission_v0.1.md.

python3 tools/bounded-execution-admission/validate.py validate [--as-of T] FILE...   # BEA-1..BEA-14
python3 tools/bounded-execution-admission/validate.py check-approval ADMISSION RECORD # BEA-C1..BEA-C7
python3 tools/bounded-execution-admission/validate.py digest FILE                    # plan and admission digests
python3 tools/bounded-execution-admission/generate_examples.py                       # re-pin and regenerate examples
make bounded-execution-admission-test bounded-execution-admission-check

A valid document is a well-formed request, not an admission: an admission also needs a carrier record approved by a person (Approval Engine, or a founder SSH signature). Findings name the rule and a location, never a value. Needs jsonschema and PyYAML.

Examples (examples/bounded-execution-admission/) express the NK-WP-0054 bind split as admissions. generate_examples.py pins real files at the current commit; re-run it when those files change.