DISCTL-WP-0004: adopt the NetKingdom identity backup lane

Register backup-netkingdom-identity (LLDAP, privacyIDEA DB/token
material/audit, KeyCape client registry archive) as a T0 backup stream:
daily 03:45 UTC age-encrypted upload to one off-host provider (Storage
Share), hourly on-host health check with a 25h freshness bound, RPO 24h.
Activation evidence net-kingdom NK-WP-0049-T14 (2026-10-16).

Record accepted residual risks G1 (single off-host provider) and G2
(on-host-only freshness detection, watchdog owed by
RAPP-TELEMETRY-WP-0001-T04) until 2027-01-31, and the quarterly
isolated identity restore drill (net-kingdom NK-WP-0053, first due by
2027-01-31) in BackupPolicy, RTO-RPO matrix and TestEvidence cadence.

Requested by net-kingdom (hub message ef2bf2a9); founder decision
e4c288d9 resolved 2026-10-23.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 696317@bnt-lap001
Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6

DataRegister.yaml

@@ -3,7 +3,7 @@
 # Stack data classes (T0/T4): DISCTL-WP-0002-T02. Backup lanes: DISCTL-WP-0003-T01.
 
 schema_version: "0.2"
-updated: "2026-07-07"
+updated: "2026-10-23"
 register_scope: backup_lanes_and_stack
 
 data_classes:
@@ -278,6 +278,59 @@ data_classes:
     owner: Bernd
     status: operational
 
+  - id: data-netkingdom-lldap-directory
+    name: NetKingdom LLDAP user directory
+    tier: T0
+    source_of_truth: LLDAP on railiance01
+    description: >-
+      Users, groups and memberships behind NetKingdom SSO — identity trust
+      boundary asset
+    backup_stream: backup-netkingdom-identity
+    backup: daily age-encrypted backup to Storage Share (net-kingdom identity profile)
+    recovery_method: >-
+      Isolated identity restore per net-kingdom/docs/identity-restore-drill.md;
+      one-off restore proven in NK-WP-0049-T16
+    rpo: 24h
+    rto: TBD (to be measured by first NK-WP-0053 drill)
+    owner: Bernd
+    status: operational
+    gaps:
+      - "Single off-host provider (G1, accepted until 2027-01-31)"
+
+  - id: data-netkingdom-privacyidea
+    name: NetKingdom privacyIDEA database, token material and audit
+    tier: T0
+    source_of_truth: privacyIDEA on railiance01
+    description: >-
+      MFA token enrolments and token material, privacyIDEA configuration
+      database and audit trail — loss forces re-enrolment of every factor
+    backup_stream: backup-netkingdom-identity
+    backup: daily age-encrypted backup to Storage Share (net-kingdom identity profile)
+    recovery_method: >-
+      Isolated identity restore per net-kingdom/docs/identity-restore-drill.md;
+      one-off proofs NK-WP-0049-T31 (token material) and T20 (audit)
+    rpo: 24h
+    rto: TBD (to be measured by first NK-WP-0053 drill)
+    owner: Bernd
+    status: operational
+    gaps:
+      - "Single off-host provider (G1, accepted until 2027-01-31)"
+
+  - id: data-keycape-client-registry
+    name: KeyCape client registry archive
+    tier: T0
+    source_of_truth: KeyCape on railiance01
+    description: OIDC client registrations served by KeyCape — needed to restore relying-party login
+    backup_stream: backup-netkingdom-identity
+    backup: daily age-encrypted archive to Storage Share (net-kingdom identity profile)
+    recovery_method: Isolated identity restore per net-kingdom/docs/identity-restore-drill.md
+    rpo: 24h
+    rto: TBD (to be measured by first NK-WP-0053 drill)
+    owner: Bernd
+    status: operational
+    gaps:
+      - "Single off-host provider (G1, accepted until 2027-01-31)"
+
 status_legend:
   operational: "Backup mechanism exists and has run successfully"
   manual_only: "Restore path exists but backup is operator-triggered only"