NK-WP-0056-T01 done: Bounded Execution Admission v0.1 (proposed)

Standard, schema and validator for the founder's admission of one bounded
executor run: exact plan by digest, window by risk class, SI MODE @ SCOPE
ceiling with least-privilege coverage, blast radius by consumer, named
source-pinned checks, revert per mutating step, budget, single use, and the
NK-WP-0040 receipt. check-approval verifies a carrier record (Approval
Engine or founder SSH signature): aal2 human approver, not the executor,
consumed at most once in the window. Examples express the bind split;
step 10 is refused as human-intrinsic. 22 tests; make targets; tool index.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87

examples/bounded-execution-admission/bind-split-switch-super-admin.yaml

@@ -0,0 +1,136 @@
+# NK-WP-0056-T01 example: the bind split (NK-WP-0054) as admissions. Illustrative: the executor
+# (T03) and its operations do not exist yet; files are pinned at the commit named in plan.source.
+apiVersion: netkingdom.io/bounded-execution-admission/v0.1
+kind: BoundedExecutionAdmission
+spec:
+  id: BEA-2026-0003
+  title: Switch LLDAP's configured super-admin to ld-admin (bind-split step 9, root-class)
+  purpose: Change LLDAP_LDAP_USER_DN from admin to ld-admin and restart LLDAP; admin keeps its rights through lldap_admin
+    membership. Changes who administers the directory, so the founder admits the run.
+  work_ref: NK-WP-0056-T01 example
+  risk_class: high
+  window:
+    not_before: '2026-11-03T09:00:00Z'
+    not_after: '2026-11-03T11:00:00Z'
+  approval:
+    approvers:
+    - admin
+    principal_type: HUMAN
+    assurance: aal2
+    carriers:
+    - approval-engine
+    - founder-ssh-signature
+  executor:
+    identity: service:nk-bind-executor
+    principal_type: WORKLOAD
+    runtime: k8s sso/serviceaccount nk-bind-executor (planned, NK-WP-0056-T03)
+  scope_ceiling:
+  - mode: ADMINISTER
+    scope: lldap
+    environments: &id001
+    - PRODUCTION
+  - mode: OPERATE
+    scope: k8s/sso/deployment/lldap
+    environments: *id001
+  blast_radius:
+    unit: consumer
+    consumers:
+    - lldap
+    max_concurrent: 1
+  trust_requires:
+  - runtime_secret_trust
+  - runtime_identity_trust
+  plan:
+    source:
+      repo: net-kingdom
+      commit: b8d3dacc4195
+      files:
+      - path: sso-mfa/k8s/lldap/bind-split.py
+        sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
+      - path: sso-mfa/k8s/synthetic-journey/journey.py
+        sha256: c639054597be7647a3ae88ac7da53490a43b38d9f4f95e24cf4e9f54b18f997c
+    steps:
+    - id: switch-user-dn
+      operation: lldap.config.set-ldap-user-dn
+      target: k8s:sso/secret/lldap-secrets#LLDAP_LDAP_USER_DN
+      consumer: lldap
+      class: root-class
+      mutates: true
+      requires:
+        mode: ADMINISTER
+        scope: lldap
+      checks_after:
+      - ld-admin-administers
+      revert: switch-back
+    - id: restart-lldap
+      operation: k8s.rollout-restart
+      target: k8s:sso/deployment/lldap
+      consumer: lldap
+      class: root-class
+      mutates: true
+      requires:
+        mode: OPERATE
+        scope: k8s/sso/deployment/lldap
+      checks_after:
+      - synthetic-journey
+      revert: restart-lldap-again
+    revert_steps:
+    - id: switch-back
+      operation: lldap.config.set-ldap-user-dn
+      target: k8s:sso/secret/lldap-secrets#LLDAP_LDAP_USER_DN
+      consumer: lldap
+      class: root-class
+      mutates: true
+      requires:
+        mode: ADMINISTER
+        scope: lldap
+    - id: restart-lldap-again
+      operation: k8s.rollout-restart
+      target: k8s:sso/deployment/lldap
+      consumer: lldap
+      class: root-class
+      mutates: true
+      requires:
+        mode: OPERATE
+        scope: k8s/sso/deployment/lldap
+  plan_digest: sha256:c15793ccaad212eaf24de12a1d13709970be84ee917a994463b68880e905dedf
+  checks:
+  - id: ld-admin-administers
+    description: ld-admin signs in and administers; admin keeps lldap_admin membership
+    ref: sso-mfa/k8s/lldap/bind-split.py
+    sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
+    timeout_seconds: 60
+    expect: pass
+  - id: synthetic-journey
+    description: 'all three binds still serve sign-in: syn-journey reaches aal2'
+    ref: sso-mfa/k8s/synthetic-journey/journey.py
+    sha256: c639054597be7647a3ae88ac7da53490a43b38d9f4f95e24cf4e9f54b18f997c
+    timeout_seconds: 90
+    expect: pass
+    settle_seconds: 125
+  stop_and_revert:
+    on_check_failure: revert
+    on_budget_exhausted: revert
+    on_unknown: stop
+    on_revert_failure: stop-and-alert
+    alert: founder via State Hub message; crisis list item for ld-admin
+  budget:
+    wall_time_seconds: 900
+    attempts: 1
+    cost:
+      compute_cpu_seconds: 60
+      egress_bytes: 1000000
+      currency: EUR
+      amount: 0.02
+  consumption:
+    single_use: true
+    consume_before_first_step: true
+  receipt:
+    schema: netkingdom.playbook-capability-contract/v0.2#execution-attribution-receipt
+    emit_to: audit-core
+    retain: by-hash-no-secret-values
+    independent_verifier: tools/bounded-execution-admission/validate.py check-approval + receipt source hashes
+  not_authorized:
+  - changing admin's own password
+  - sealing ld-admin's password (human-intrinsic, step 10)
+  - any service bind change