admissions/BEA-2026-0002: live pilot rotation of svc-authelia's bind (NK-WP-0056-T06), window 2026-11-04T22:39Z-2026-11-05T00:39Z, pins at 9bd7bf0

admission_digest sha256:71d7337aaedfb8ab162e734db776f097f391680886480b02b02102ca4e7ecd3e

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 523928@bnt-lap001
Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350

admissions/BEA-2026-0002.yaml

@@ -0,0 +1,209 @@
+# NK-WP-0056-T06 live pilot admission. Immutable once requested: a change is a new id.
+apiVersion: netkingdom.io/bounded-execution-admission/v0.1
+kind: BoundedExecutionAdmission
+spec:
+  id: BEA-2026-0002
+  title: Rotate the svc-authelia directory bind (live pilot, one consumer)
+  purpose: 'Pilot shape for NK-WP-0056-T06: generate a new bind password into OpenBao, set it in LLDAP, let ESO deliver it,
+    restart Authelia, prove sign-in with the synthetic journey; revert on any failed check.'
+  work_ref: NK-WP-0056-T06
+  risk_class: medium
+  window:
+    not_before: '2026-11-04T22:39:00Z'
+    not_after: '2026-11-05T00:39:00Z'
+  approval:
+    approvers:
+    - admin
+    principal_type: HUMAN
+    assurance: aal2
+    carriers:
+    - approval-engine
+    - founder-ssh-signature
+  executor:
+    identity: service:nk-bind-executor
+    principal_type: WORKLOAD
+    runtime: k8s sso/serviceaccount nk-bind-executor (planned, NK-WP-0056-T03)
+  scope_ceiling:
+  - mode: OPERATE
+    scope: openbao/platform/workloads/net-kingdom/directory-binds/svc-authelia
+    environments:
+    - PRODUCTION
+  - mode: OPERATE
+    scope: lldap/people/svc-authelia
+    environments:
+    - PRODUCTION
+  - mode: OPERATE
+    scope: k8s/sso/externalsecret/authelia-secrets
+    environments:
+    - PRODUCTION
+  - mode: OPERATE
+    scope: k8s/sso/deployment/authelia
+    environments:
+    - PRODUCTION
+  blast_radius:
+    unit: consumer
+    consumers:
+    - authelia
+    max_concurrent: 1
+  trust_requires:
+  - runtime_secret_trust
+  - runtime_identity_trust
+  plan:
+    source:
+      repo: net-kingdom
+      commit: 9bd7bf0bdc34
+      files:
+      - path: bounded-executor/executor.py
+        sha256: 2a09c7252cd5b43dd03988f37f06c01c116e9d4dd18bf19c6e1c97bf05c47e55
+      - path: bounded-executor/operations.py
+        sha256: 10d0ba1a2a45edf6d5b137b0702468fb570703347eff81b7f52073dc44b92041
+      - path: sso-mfa/k8s/synthetic-journey/journey.py
+        sha256: c639054597be7647a3ae88ac7da53490a43b38d9f4f95e24cf4e9f54b18f997c
+    steps:
+    - id: generate
+      operation: openbao.kv.write-next-version
+      target: openbao:platform/workloads/net-kingdom/directory-binds/svc-authelia
+      consumer: authelia
+      class: delegable
+      mutates: true
+      requires:
+        mode: OPERATE
+        scope: openbao/platform/workloads/net-kingdom/directory-binds/svc-authelia
+      checks_after:
+      - kv-advanced
+      revert: restore-kv
+    - id: set-directory
+      operation: lldap.user.change-own-password-from-kv
+      target: lldap:svc-authelia
+      consumer: authelia
+      class: delegable
+      mutates: true
+      requires:
+        mode: OPERATE
+        scope: lldap/people/svc-authelia
+      checks_after:
+      - bind-signs-in
+      revert: restore-directory
+    - id: deliver
+      operation: eso.force-sync
+      target: k8s:sso/externalsecret/authelia-secrets
+      consumer: authelia
+      class: delegable
+      mutates: true
+      requires:
+        mode: OPERATE
+        scope: k8s/sso/externalsecret/authelia-secrets
+      checks_after:
+      - eso-synced
+      revert: redeliver
+    - id: restart
+      operation: k8s.rollout-restart
+      target: k8s:sso/deployment/authelia
+      consumer: authelia
+      class: delegable
+      mutates: true
+      requires:
+        mode: OPERATE
+        scope: k8s/sso/deployment/authelia
+      checks_after:
+      - synthetic-journey
+      revert: restart-again
+    revert_steps:
+    - id: restore-kv
+      operation: openbao.kv.write-previous-value-as-next-version
+      target: openbao:platform/workloads/net-kingdom/directory-binds/svc-authelia
+      consumer: authelia
+      class: delegable
+      mutates: true
+      requires:
+        mode: OPERATE
+        scope: openbao/platform/workloads/net-kingdom/directory-binds/svc-authelia
+      checks_after:
+      - kv-advanced
+    - id: restore-directory
+      operation: lldap.user.change-own-password-from-kv
+      target: lldap:svc-authelia
+      consumer: authelia
+      class: delegable
+      mutates: true
+      requires:
+        mode: OPERATE
+        scope: lldap/people/svc-authelia
+      checks_after:
+      - bind-signs-in
+    - id: redeliver
+      operation: eso.force-sync
+      target: k8s:sso/externalsecret/authelia-secrets
+      consumer: authelia
+      class: delegable
+      mutates: true
+      requires:
+        mode: OPERATE
+        scope: k8s/sso/externalsecret/authelia-secrets
+      checks_after:
+      - eso-synced
+    - id: restart-again
+      operation: k8s.rollout-restart
+      target: k8s:sso/deployment/authelia
+      consumer: authelia
+      class: delegable
+      mutates: true
+      requires:
+        mode: OPERATE
+        scope: k8s/sso/deployment/authelia
+      checks_after:
+      - synthetic-journey
+  plan_digest: sha256:ae8af25ffd15a4f419e9610c915ba0487572fef2fbf294ea3ce794c70414f826
+  checks:
+  - id: kv-advanced
+    description: KV svc-authelia has exactly one new version, CAS on the previous one
+    ref: bounded-executor/operations.py
+    sha256: 10d0ba1a2a45edf6d5b137b0702468fb570703347eff81b7f52073dc44b92041
+    timeout_seconds: 30
+    expect: pass
+  - id: bind-signs-in
+    description: the new KV value signs in to LLDAP as svc-authelia
+    ref: bounded-executor/operations.py
+    sha256: 10d0ba1a2a45edf6d5b137b0702468fb570703347eff81b7f52073dc44b92041
+    timeout_seconds: 30
+    expect: pass
+  - id: eso-synced
+    description: the ExternalSecret is Ready with a refresh after the step started; the executor never reads the Secret
+    ref: bounded-executor/operations.py
+    sha256: 10d0ba1a2a45edf6d5b137b0702468fb570703347eff81b7f52073dc44b92041
+    timeout_seconds: 120
+    expect: pass
+  - id: synthetic-journey
+    description: syn-journey signs in through KeyCape, Authelia and privacyIDEA at aal2
+    ref: bounded-executor/operations.py
+    sha256: 10d0ba1a2a45edf6d5b137b0702468fb570703347eff81b7f52073dc44b92041
+    timeout_seconds: 90
+    expect: pass
+  stop_and_revert:
+    on_check_failure: revert
+    on_budget_exhausted: revert
+    on_unknown: stop
+    on_revert_failure: stop-and-alert
+    alert: founder via State Hub message and audit-core
+  budget:
+    wall_time_seconds: 1200
+    attempts: 2
+    cost:
+      compute_cpu_seconds: 120
+      egress_bytes: 5000000
+      currency: EUR
+      amount: 0.05
+  consumption:
+    single_use: true
+    consume_before_first_step: true
+  receipt:
+    schema: netkingdom.playbook-capability-contract/v0.2#execution-attribution-receipt
+    emit_to: audit-core
+    retain: by-hash-no-secret-values
+    independent_verifier: tools/bounded-execution-admission/validate.py check-approval + receipt source hashes
+  not_authorized:
+  - any bind other than svc-authelia
+  - any LLDAP group change
+  - changing LLDAP's configured super-admin
+  - reading or changing any human account
+  - any change outside the sso namespace