net-kingdom/docs/legacy-lldap-lifecycle-retirement.md

Legacy LLDAP lifecycle retirement

Effective 2026-10-14; source reconciliation under NK-WP-0049-T02.

The three commands below now exit 2 before inspecting arguments, discovering credentials, or calling any external program. Their old arguments are ignored. The two Make targets and three console commands also refuse execution. No account, membership, password, token or deployed workload is changed by this source retirement. Existing credentials are not revoked.

Retired command	Why withdrawn	Owner route
sso-mfa/k8s/lldap/create-user.sh	Direct creation bypassed governed lifecycle/linking; test mode used predictable passwords; admin credentials were sourced or discovered and passed through unsafe shell paths.	Ordinary onboarding through User Engine and the existing identity-provisioner. Platform-root bootstrap remains a separate reviewed IAM procedure.
sso-mfa/k8s/lldap/dry-run-nonroot-user.sh	The “dry-run” mutated real users and passwords; pattern cleanup lacked creation provenance; generated evidence overstated verification.	An explicitly scoped owner lifecycle trial with exact created-identity receipts and actual consumer checks.
sso-mfa/k8s/lldap/break-glass.sh	Repeated execution could overwrite credentials and depended on an unsupported password GraphQL mutation. This is not an accepted provider recovery path.	Preserve existing offline custody; obtain the IAM owner's exact recovery procedure and native independent-recovery evidence under NK-WP-0049-T03.

Ordinary onboarding and lifecycle

Use the existing public registration contract: User Engine orchestrates mailbox verification for an admitted client/tenant, links the canonical subject, and invokes identity-provisioner. The IAM provider owns the single-use password-setup handoff. A fresh KeyCape login establishes the application session. No predictable password or direct administrative shell creation is a substitute. Completed NK-WP-0025 and NK-WP-0038 record earlier registration and scoped tenant-access delivery; those receipts do not establish current deployment availability. Check the owner’s current service and contract before a trial; this document does not introduce a new provisioning API.

The User Engine boundary contract keeps domain accounts/product memberships in User Engine and coarse authentication groups, passwords and MFA in IAM. Protected lifecycle mutations require the existing authorization path. Tenant-access changes must preserve other tenants, the global identity and unrelated suspension state. Group removal alone does not prove global lockout or session revocation. Public registration cannot create a platform-root or platform-admin identity.

Evidence and cleanup

The console's lifecycle-flow-template and onboarding-dry-run-template now produce blank worksheets with false assurances. Fill them only from actual owner/consumer results. Their existing validators check structure and assertions; a valid document is not independent proof that a native operation happened. Historic evidence is retained as historic evidence.

For an authorized trial, retain exact subject/tenant/client identifiers and creation provenance, actual issued-claims and effective-access observations, negative access tests, and the disposition of the exact test identity and its sessions/credentials. Retain non-secret receipt references, never token or password values. Do not infer issued claims from a directory group list or delete accounts selected by a name pattern. Resource transfer and cross-tenant effects must be resolved through the lifecycle owner before offboarding.

Recovery and remaining work

Keep the existing break-glass account and offline custody material until the owner explicitly authorizes a change. This retirement neither rotates its password nor proves it works independently of a failed identity provider. Disabling MFA is not evidence of independent recovery. The provider dependency limitation was already recorded in the KeyCape exposure map. NK-WP-0049-T03 still needs the exact owner-approved recovery ceremony, separated key/snapshot custody, failed-key refusal, native restore and cleanup receipts.

bootstrap-users.sh, manage-group-members.sh and verify-t07.sh remain separate IAM caller repairs under NK-WP-0049-T02. Their credential extraction and current verification claims have not been repaired by this change. Incident cutover helpers and the complete root-output inventory also remain open. This document and these source tests do not close NK-WP-0049 or establish live recovery readiness.