docs use-cases.md

Operational use cases

LEMC is for the operational job that already matters but still depends on one person's laptop, memory, credentials, or time zone. Turn that job into one cookbook that carries its explanation, executable contract, timing, access policy, and receipt.

The selection test: if a teammate or model should be able to run the author's approved job without recreating the author's workstation, it belongs in a cookbook.

Choose the first jobs

Good first candidates have several of these properties:

Repeated: the team performs the same known sequence more than once.
Privileged: callers need one operation, not broad shell or cloud access.
Infrequent: the procedure is important enough to keep but rare enough to forget.
Time-bound: provision and cleanup must remain paired.
Evidence-bearing: the team needs logs, artifacts, terminal reason, or a reviewable report.
Multi-caller: a teammate may click it today and an agent may need the same action tomorrow.

Google SRE describes manual, repetitive, automatable operational work as toil and notes that remediation instructions often amount to pseudocode. That is the sweet spot for a reviewed LEMC recipe: preserve the judgment in the wiki and move the repeatable portion onto one execution path. See Eliminating Toil.

Pattern: BYOK WordPress patch + migration

The offer is one governed recovery job: an operator binds a scoped, expiring DigitalOcean token and source-site access, then LEMC snapshots the existing WordPress site, provisions a clean target, installs fixed WordPress core, migrates reviewed content, and produces a preview for approval. A separate, narrowly authorized action performs DNS and TLS cutover after review; the old host stays available for a bounded rollback window before retirement.

The July 2026 WordPress security release identifies CVE-2026-60137; the researcher advisory names the pre-authentication remote-code execution chain WP2Shell and identifies WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1 as affected. The recipe must select a supported release containing the fix, such as 6.9.5 or 7.0.2, rather than treating migration alone as the remediation.

BYOK means bring your own cloud key, not “paste a token into the job form.” Declare DIGITALOCEAN_TOKEN and source credentials by name in the cookbook, then bind their values through LEMC's authenticated secret path. DigitalOcean supports custom-scoped, expiring personal access tokens; grant only the Droplet, firewall, volume, DNS, and read permissions this migration actually needs.

Job phase	What the recipe does	What LEMC retains
Bind	The operator supplies the scoped DigitalOcean token and source-site credentials through named server-side bindings. App ACLs limit who may stage or cut over a migration.	Binding name, version, scope, and audit metadata—not plaintext values.
Preserve	Capture a source backup and inventory core version, users, plugins, themes, uploads, checksums, and logs before changing anything.	Backup manifest, source inventory, checksums, task ID, and collection logs.
Provision	A digest-pinned Terraform step creates a clean Droplet, firewall, storage, and staging hostname. Another pinned step installs a supported WordPress release containing the WP2Shell fix.	Exact image digests, fixed WordPress version, plan/apply output, and durable `terraform.tfstate`.
Migrate	Import the reviewed database, uploads, and approved plugin/theme code. Do not copy the old WordPress core or an unreviewed PHP tree onto the clean target.	Import log, content counts, selected component versions, integrity results, and any fail-closed finding.
Verify	Run health, login, content, plugin/theme, permission, malware, and outbound-link checks against a private preview. A suspicious result stops before cutover.	Preview URL metadata, redacted verification report, artifact checksums, and terminal reason.
Cut over	A separately ACL'd action changes DNS/TLS only after operator approval, confirms the public site, and starts the declared rollback window.	Approver identity, before/after DNS data, TLS and HTTP checks, cutover time, rollback and retirement proof.

cookbook:
  environment:
    secrets:
      - DIGITALOCEAN_TOKEN
      - WORDPRESS_SOURCE_CREDENTIALS
recipe: stage-wordpress-migration
now:
  steps:
    - name: snapshot-and-inventory
      image: registry/.../wordpress-source-audit@sha256:...
    - name: provision-clean-target
      image: registry/.../wordpress-do-terraform@sha256:...
    - name: install-fixed-core-and-migrate
      image: registry/.../wordpress-migrate@sha256:...
    - name: verify-private-preview
      image: registry/.../wordpress-verify@sha256:...

recipe: approve-wordpress-cutover
now:
  steps:
    - name: cut-over-and-verify
      image: registry/.../wordpress-cutover@sha256:...
in:
  duration: 7.days
  steps:
    - name: retire-source-after-approved-cutover
      image: registry/.../wordpress-retire@sha256:...

A clean migration is not a substitute for incident response. If the source was exposed while vulnerable, preserve evidence, rotate WordPress salts and infrastructure credentials, review admin users and persistence in plugins, themes, uploads, and scheduled tasks, and investigate the access logs. Bind each declared value with lemcli cookbooks secrets set; LEMC versions and encrypts the server-side value at rest while cookbook YAML remains declaration-only. Do not retire the source until the fixed target, cutover, rollback, and evidence-retention requirements have all passed.

Pattern: corporate network scan report

Give the security team a report action, not an unrestricted scanner. The wiki names the owned CIDRs and hostnames, maintenance window, exclusions, expected impact, escalation contact, scan profiles, and retention policy. The form lets a teammate or agent select a reviewed target set and profile; it does not accept arbitrary Nmap flags or an unbounded target string.

Cookbook layer	What it carries
Wiki	Asset owner, owned target sets, exclusions, scan window, impact guidance, escalation path, and report audience.
Form	Declared target-set ID, fixed scan profile, ticket, and report label—never free-form flags.
Recipe	A digest-pinned Nmap step writes normal XML output; a second pinned step normalizes the evidence and renders a branded PDF.
ACL	Only the corporate security app members can discover and run the scan; report readers can receive the artifact without recipe edit rights.
Proof	Target-set revision, exact scan profile, image digests, task events, raw XML checksum, PDF checksum, terminal reason, and retention deadline.

recipe: corporate-network-scan
now:
  steps:
    - name: collect-nmap-xml
      image: registry/.../nmap-scan@sha256:...
    - name: render-pdf-report
      image: registry/.../network-report@sha256:...

Nmap documents XML as the stable format software should consume in its output reference. Retain that machine-readable evidence beside the PDF so a later reviewer can verify that the presentation matches the scan.

Pattern: timed pentest jump host

A pentesting shop needs a consistent entry point for an engagement, but it should not leave a long-lived bastion or hand every tester the infrastructure credentials used to create it. AWS describes a bastion as a controlled access point into a private network and recommends narrow access without persistent inbound exposure or long-lived SSH keys in its Session Manager and EC2 Instance Connect pattern.

Cookbook layer	What it carries
Wiki	Rules of engagement, approved targets, access path, owner, emergency teardown, and success criteria.
Form	Engagement ID, region, network profile, ticket, and approved operator inputs.
NOW	A digest-pinned Terraform image plans and applies the jump-host infrastructure, verifies connectivity, and returns bounded connection guidance.
IN	A paired destroy image uses the retained private Terraform state after a fixed TTL, such as four hours.
ACL	Cookbook authors may edit the runbook; only the assigned engagement team may run the app; a narrower admin group manages destructive overrides.
Proof	Task ID, plan/apply logs, provisioned endpoint metadata, teardown terminal state, and cleanup artifacts.

recipe: open-engagement-jump-host
now:
  steps:
    - name: provision-and-verify
      image: registry/.../jump-host-apply@sha256:...
in:
  duration: 4.hours
  steps:
    - name: destroy
      image: registry/.../jump-host-destroy@sha256:...

Pattern: 24-hour training environment

Package the Terraform configuration and its exact provider tooling inside managed recipe images. The page wiki holds the lab guide and expected outcomes. A learner or instructor launches the stack with the same declared form; the result exposes approved endpoints and artifacts; an IN phase destroys the environment after 24 hours from the retained private state.

The platform author builds and tests the apply and destroy images, then publishes their managed digests.
The cookbook composes those images with the page wiki, form fields, fixed 24-hour lifecycle, and app ACL.
People use the browser; an instructor agent can discover and invoke the same action with lemcli.
LEMC stores the job trail and artifacts, then the paired destroy phase removes the external infrastructure.

This follows the same broad self-service principle HashiCorp describes for standardized infrastructure templates: platform authors maintain the approved pattern while application teams use it without rebuilding the underlying workflow. See HCP Waypoint concepts and using a standardized template.

More high-value patterns

Pattern	Composition	Why LEMC helps
Backup restore drill	`EVERY` restore into non-production → integrity/application checks → evidence artifact → teardown	The wiki records the recovery standard; recurring proof exposes drift before an incident. Google recommends regular non-production restoration tests across the full application stack in its data-loss recovery guidance.
Incident diagnostic bundle	`NOW` collect approved signals → redact → archive under `/lemc/public`	The on-call human and incident agent use one known collector and preserve one task-bound artifact instead of improvising commands.
Day-2 self-service	Restart, feature-flag change, certificate rotation, cache warm, backup, or rollback	A page wiki explains the decision; a narrow app ACL delegates the action. AWS likewise uses sequential shared runbooks for common restart, image, API, and infrastructure operations in Systems Manager Automation.
Cloud drift and cost hygiene	`EVERY` inventory idle, expired, or untagged resources → report; separate admin cleanup action	Read-only inspection can be broadly shared while destructive work stays behind a narrower ACL. AWS recommends automated decommissioning to reduce lifecycle cost in its Cost Optimization guidance.
Preview environment	`NOW` provision from a reviewed template → artifact with URL → `IN` cleanup	The environment, its expiration, and its outputs stay paired instead of relying on a later manual ticket.
Ephemeral CI runner	`NOW` provision clean runner → execute one bounded workload → preserve logs → destroy	Fresh infrastructure limits cross-job residue. GitHub similarly recommends ephemeral self-hosted runners and external log retention.

Compose the recipe with containers

Build: put the tool, code, and runtime dependencies for each step in an OCI/Docker image.
Publish: push or import it through LEMC's managed registry flow and retain the digest-pinned reference.
Compose: sequence those images in cookbook YAML with declared inputs, timeouts, and NOW, IN, or EVERY phases.
Communicate: use LEMC verbs for live user-facing output, /lemc/public for artifacts, and private state only where a later phase must hydrate it.
Distribute: instantiate an app, set the narrow ACL, and expose the same page wiki and action contract to web and CLI callers.

Docker is a developer-side build format here, not the hosted trust boundary. Hosted recipe steps run from authorized managed images inside the operator-selected job runtime.

Job shapes and lifecycle hooks

NOW: Run the immediate phase for a user click, agent call, API request, or admitted scheduler action.
IN: Run a paired phase once after a declared delay—for teardown, revocation, expiry, or deferred validation.
EVERY: Register a recurring phase for audits, checks, reports, and maintenance.

The shipped v1 callback vocabulary is page on_action and recipe before_run, after_run, and on_deactivate. An accepted action runs eligible hooks as ordered hosted-untrusted child jobs around the target NOW work. Whole-transition image preflight, idempotency admission, immutable activation snapshots, task-scoped logs and artifacts, and browser/lemcli status keep the lifecycle reviewable. Invalid callback schemas or unauthorized images still fail closed before execution.

Define “same result” honestly

The author, teammate, and model execute the same pinned steps under the same declared input and policy contract. If they call an outside API at different times, that outside state can still change. LEMC makes the execution path stable and preserves the exact observed events, terminal reason, logs, rendered output, and artifacts for each run.