# NK-WP-0056-T01 example: the bind split (NK-WP-0054) as admissions. Illustrative: the executor
# (T03) and its operations do not exist yet; files are pinned at the commit named in plan.source.
apiVersion: netkingdom.io/bounded-execution-admission/v0.1
kind: BoundedExecutionAdmission
spec:
  id: BEA-2026-0004
  title: Read-only verification of the directory split (bind-split steps 2, 4 and 10 verify)
  purpose: 'Plan and verify reads that the founder used to do signed in as admin: account inventory, group membership, bind
    identities of the consumers. No mutation, so nothing to revert.'
  work_ref: NK-WP-0056-T01 example
  risk_class: low
  window:
    not_before: '2026-11-03T09:00:00Z'
    not_after: '2026-11-04T09:00:00Z'
  approval:
    approvers:
    - admin
    principal_type: HUMAN
    assurance: aal2
    carriers:
    - approval-engine
    - founder-ssh-signature
  executor:
    identity: service:nk-bind-executor
    principal_type: WORKLOAD
    runtime: k8s sso/serviceaccount nk-bind-executor (planned, NK-WP-0056-T03)
  scope_ceiling:
  - mode: OBSERVE
    scope: lldap/people
    environments: &id001
    - PRODUCTION
  - mode: OBSERVE
    scope: k8s/sso
    environments: *id001
  blast_radius:
    unit: consumer
    consumers:
    - lldap
    - authelia
    - keycape
    - privacyidea
    max_concurrent: 4
  trust_requires:
  - runtime_secret_trust
  - runtime_identity_trust
  plan:
    source:
      repo: net-kingdom
      commit: c9ab01e23e92
      files:
      - path: sso-mfa/k8s/lldap/bind-split.py
        sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
    steps:
    - id: inventory
      operation: lldap.read.users-and-groups
      target: lldap:people
      consumer: lldap
      class: delegable
      mutates: false
      requires:
        mode: OBSERVE
        scope: lldap/people
      checks_after:
      - split-shape
    - id: consumer-binds
      operation: k8s.read.bind-identities
      target: k8s:sso
      consumer: authelia
      class: delegable
      mutates: false
      requires:
        mode: OBSERVE
        scope: k8s/sso
      checks_after:
      - split-shape
  plan_digest: sha256:0459999b93bb8aee0dacb1b36ea95d114ac74d0ed775095f3ee5dc2ee66203cd
  checks:
  - id: split-shape
    description: every consumer binds as its own svc- account; no service binds as admin
    ref: sso-mfa/k8s/lldap/bind-split.py
    sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
    timeout_seconds: 60
    expect: pass
  stop_and_revert:
    on_check_failure: stop
    on_budget_exhausted: stop
    on_unknown: stop
    on_revert_failure: stop-and-alert
  budget:
    wall_time_seconds: 300
    attempts: 3
    cost:
      compute_cpu_seconds: 30
      egress_bytes: 500000
      currency: EUR
      amount: 0.01
  consumption:
    single_use: true
    consume_before_first_step: true
  receipt:
    schema: netkingdom.playbook-capability-contract/v0.2#execution-attribution-receipt
    emit_to: audit-core
    retain: by-hash-no-secret-values
    independent_verifier: tools/bounded-execution-admission/validate.py check-approval + receipt source hashes
  not_authorized:
  - any write to LLDAP, Kubernetes or OpenBao