Enforce private-by-default rail exposure

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa

tools/validate_exposure.py

@@ -0,0 +1,34 @@
+#!/usr/bin/env python3
+"""Validate a rendered manifest against ADR-0008 declarations."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+
+from exposure import ExposureError, validate_rendered_exposure
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("rendered_manifest", type=Path)
+    parser.add_argument("--rapp-declaration", type=Path)
+    parser.add_argument("--reef-declaration", type=Path)
+    args = parser.parse_args()
+    try:
+        result = validate_rendered_exposure(
+            args.rendered_manifest.read_text(encoding="utf-8"),
+            rapp_declaration=args.rapp_declaration,
+            reef_declaration=args.reef_declaration,
+        )
+    except (OSError, ExposureError) as exc:
+        print(f"exposure validation failed: {exc}", file=sys.stderr)
+        return 1
+    print(json.dumps(result, sort_keys=True))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())