# NK-WP-0056-T01 example: the bind split (NK-WP-0054) as admissions. Illustrative: the executor
# (T03) and its operations do not exist yet; files are pinned at the commit named in plan.source.
apiVersion: netkingdom.io/bounded-execution-admission/v0.1
kind: BoundedExecutionAdmission
spec:
  id: BEA-2026-0003
  title: Switch LLDAP's configured super-admin to ld-admin (bind-split step 9, root-class)
  purpose: Change LLDAP_LDAP_USER_DN from admin to ld-admin and restart LLDAP; admin keeps its rights through lldap_admin
    membership. Changes who administers the directory, so the founder admits the run.
  work_ref: NK-WP-0056-T01 example
  risk_class: high
  window:
    not_before: '2026-11-03T09:00:00Z'
    not_after: '2026-11-03T11:00:00Z'
  approval:
    approvers:
    - admin
    principal_type: HUMAN
    assurance: aal2
    carriers:
    - approval-engine
    - founder-ssh-signature
  executor:
    identity: service:nk-bind-executor
    principal_type: WORKLOAD
    runtime: k8s sso/serviceaccount nk-bind-executor (planned, NK-WP-0056-T03)
  scope_ceiling:
  - mode: ADMINISTER
    scope: lldap
    environments: &id001
    - PRODUCTION
  - mode: OPERATE
    scope: k8s/sso/deployment/lldap
    environments: *id001
  blast_radius:
    unit: consumer
    consumers:
    - lldap
    max_concurrent: 1
  trust_requires:
  - runtime_secret_trust
  - runtime_identity_trust
  plan:
    source:
      repo: net-kingdom
      commit: 15c9cdbef881
      files:
      - path: sso-mfa/k8s/lldap/bind-split.py
        sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
      - path: sso-mfa/k8s/synthetic-journey/journey.py
        sha256: c639054597be7647a3ae88ac7da53490a43b38d9f4f95e24cf4e9f54b18f997c
    steps:
    - id: switch-user-dn
      operation: lldap.config.set-ldap-user-dn
      target: k8s:sso/secret/lldap-secrets#LLDAP_LDAP_USER_DN
      consumer: lldap
      class: root-class
      mutates: true
      requires:
        mode: ADMINISTER
        scope: lldap
      checks_after:
      - ld-admin-administers
      revert: switch-back
    - id: restart-lldap
      operation: k8s.rollout-restart
      target: k8s:sso/deployment/lldap
      consumer: lldap
      class: root-class
      mutates: true
      requires:
        mode: OPERATE
        scope: k8s/sso/deployment/lldap
      checks_after:
      - synthetic-journey
      revert: restart-lldap-again
    revert_steps:
    - id: switch-back
      operation: lldap.config.set-ldap-user-dn
      target: k8s:sso/secret/lldap-secrets#LLDAP_LDAP_USER_DN
      consumer: lldap
      class: root-class
      mutates: true
      requires:
        mode: ADMINISTER
        scope: lldap
      checks_after:
      - ld-admin-administers
    - id: restart-lldap-again
      operation: k8s.rollout-restart
      target: k8s:sso/deployment/lldap
      consumer: lldap
      class: root-class
      mutates: true
      requires:
        mode: OPERATE
        scope: k8s/sso/deployment/lldap
      checks_after:
      - synthetic-journey
  plan_digest: sha256:4469ab1b15f9e8d631ca213b6b949befd2f252434f91f2e8fa5846d893d95eaf
  checks:
  - id: ld-admin-administers
    description: ld-admin signs in and administers; admin keeps lldap_admin membership
    ref: sso-mfa/k8s/lldap/bind-split.py
    sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
    timeout_seconds: 60
    expect: pass
  - id: synthetic-journey
    description: 'all three binds still serve sign-in: syn-journey reaches aal2'
    ref: sso-mfa/k8s/synthetic-journey/journey.py
    sha256: c639054597be7647a3ae88ac7da53490a43b38d9f4f95e24cf4e9f54b18f997c
    timeout_seconds: 90
    expect: pass
    settle_seconds: 125
  stop_and_revert:
    on_check_failure: revert
    on_budget_exhausted: revert
    on_unknown: stop
    on_revert_failure: stop-and-alert
    alert: founder via State Hub message; crisis list item for ld-admin
  budget:
    wall_time_seconds: 900
    attempts: 1
    cost:
      compute_cpu_seconds: 60
      egress_bytes: 1000000
      currency: EUR
      amount: 0.02
  consumption:
    single_use: true
    consume_before_first_step: true
  receipt:
    schema: netkingdom.playbook-capability-contract/v0.2#execution-attribution-receipt
    emit_to: audit-core
    retain: by-hash-no-secret-values
    independent_verifier: tools/bounded-execution-admission/validate.py check-approval + receipt source hashes
  not_authorized:
  - changing admin's own password
  - sealing ld-admin's password (human-intrinsic, step 10)
  - any service bind change