DISCTL-WP-0004: adopt the NetKingdom identity backup lane

Register backup-netkingdom-identity (LLDAP, privacyIDEA DB/token
material/audit, KeyCape client registry archive) as a T0 backup stream:
daily 03:45 UTC age-encrypted upload to one off-host provider (Storage
Share), hourly on-host health check with a 25h freshness bound, RPO 24h.
Activation evidence net-kingdom NK-WP-0049-T14 (2026-10-16).

Record accepted residual risks G1 (single off-host provider) and G2
(on-host-only freshness detection, watchdog owed by
RAPP-TELEMETRY-WP-0001-T04) until 2027-01-31, and the quarterly
isolated identity restore drill (net-kingdom NK-WP-0053, first due by
2027-01-31) in BackupPolicy, RTO-RPO matrix and TestEvidence cadence.

Requested by net-kingdom (hub message ef2bf2a9); founder decision
e4c288d9 resolved 2026-10-23.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 696317@bnt-lap001
Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6

AssetRegister.yaml

@@ -3,7 +3,7 @@
 # Backup lanes: DISCTL-WP-0003-T01. Stack assets (T0/T4): DISCTL-WP-0002-T02.
 
 schema_version: "0.2"
-updated: "2026-07-07"
+updated: "2026-10-23"
 register_scope: backup_lanes_and_stack
 
 tier_definitions:
@@ -214,6 +214,46 @@ backup_streams:
       - history/2026-07-04-forgejo-backup-strategy-assessment.md
       - specs/ResilienceControlSetup.md
 
+  - id: backup-netkingdom-identity
+    name: NetKingdom identity stack (LLDAP, privacyIDEA, KeyCape client registry)
+    tool: net-kingdom identity backup profile
+    tool_path: null
+    owner_repo: net-kingdom
+    operator: Bernd
+    tier: T0
+    host: railiance01
+    backup_mechanism: >-
+      LLDAP directory; privacyIDEA database, token material and audit; KeyCape
+      client registry archive; age encrypt; upload to one off-host provider.
+      Profile and restore tooling owned by net-kingdom; backup account and
+      custody owned by railiance-platform.
+    destination:
+      primary: Storage Share (single off-host provider)
+      offsite: Storage Share (same provider — no second off-host copy)
+    backup_schedule: "daily 03:45 UTC (+<=5 min jitter); hourly on-host health check, 25h freshness bound"
+    retention: "per net-kingdom identity backup profile"
+    encryption: age
+    recovery_method: >-
+      Isolated identity restore per net-kingdom/docs/identity-restore-drill.md
+      (NK-WP-0053). Prior one-off proofs: NK-WP-0049-T16 (LLDAP), T31
+      (privacyIDEA token material), T20 (audit).
+    rpo: 24h
+    rto: TBD (to be measured by first NK-WP-0053 drill)
+    status: operational
+    gaps:
+      - "G1 (accepted until 2027-01-31): single off-host provider"
+      - "G2 (accepted until 2027-01-31): freshness detection on-host only; outside-node watchdog owed by RAPP-TELEMETRY-WP-0001-T04"
+      - "Quarterly isolated restore drill not yet run — first due by 2027-01-31 (NK-WP-0053); component proofs only so far"
+    evidence:
+      restore_tested: false
+      last_drill: null
+      evidence_ref: net-kingdom/docs/evidence/<date>-identity-restore-drill/
+    references:
+      - net-kingdom NK-WP-0049-T14 (activation evidence, 2026-10-16)
+      - net-kingdom/docs/identity-restore-drill.md
+      - net-kingdom/workplans NK-WP-0049, NK-WP-0053
+      - workplans/DISCTL-WP-0004-netkingdom-identity-backup-lane.md
+
 assets:
   # ── T0 Identity / trust / money ──────────────────────────────────────────────
 
@@ -472,7 +512,10 @@ related_streams:
     host: railiance01
     backup_schedule: daily CronJobs on railiance01
     status: operational
-    note: "Only scheduled backup CronJobs found on cluster as of 2026-07-04 assessment"
+    note: >-
+      Only scheduled backup CronJobs found on cluster as of 2026-07-04 assessment.
+      Since 2026-10-23 LLDAP and privacyIDEA are governed as backup_streams
+      backup-netkingdom-identity (DISCTL-WP-0004); Authelia coverage unchanged here.
 
   - id: backup-apps-pg
     name: apps-pg shared CloudNativePG cluster