DISCTL-WP-0004: adopt the NetKingdom identity backup lane

Register backup-netkingdom-identity (LLDAP, privacyIDEA DB/token
material/audit, KeyCape client registry archive) as a T0 backup stream:
daily 03:45 UTC age-encrypted upload to one off-host provider (Storage
Share), hourly on-host health check with a 25h freshness bound, RPO 24h.
Activation evidence net-kingdom NK-WP-0049-T14 (2026-10-16).

Record accepted residual risks G1 (single off-host provider) and G2
(on-host-only freshness detection, watchdog owed by
RAPP-TELEMETRY-WP-0001-T04) until 2027-01-31, and the quarterly
isolated identity restore drill (net-kingdom NK-WP-0053, first due by
2027-01-31) in BackupPolicy, RTO-RPO matrix and TestEvidence cadence.

Requested by net-kingdom (hub message ef2bf2a9); founder decision
e4c288d9 resolved 2026-10-23.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 696317@bnt-lap001
Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6

workplans/DISCTL-WP-0004-netkingdom-identity-backup-lane.md

@@ -0,0 +1,91 @@
+---
+id: DISCTL-WP-0004
+type: workplan
+title: "Adopt the NetKingdom identity backup lane"
+domain: infotech
+repo: disaster-control
+status: active
+owner: claude
+topic_slug: custodian
+created: "2026-10-23"
+updated: "2026-10-23"
+---
+
+# Adopt the NetKingdom identity backup lane
+
+Bring the NetKingdom identity backup lane on railiance01 under
+disaster-control governance, as requested by net-kingdom (State Hub message
+`ef2bf2a9`; founder decision `e4c288d9`, resolved 2026-10-23). This repo
+tracks and evidences the lane; implementation and restore tooling stay in
+`net-kingdom`, backup account and custody in `railiance-platform`.
+
+**Lane facts (non-secret):**
+
+| Item | Value |
+| --- | --- |
+| Scope | LLDAP; privacyIDEA (database, token material, audit); KeyCape client registry archive |
+| Owner | `net-kingdom` (profile, restore tooling); `railiance-platform` (backup account / custody) |
+| Backup | Daily 03:45 UTC (+≤5 min jitter), age-encrypted, ONE off-host provider (Storage Share) |
+| Monitoring | Hourly on-host health check; 25-hour freshness bound |
+| RPO | 24h |
+| Activation evidence | `net-kingdom` NK-WP-0049-T14 (2026-10-16) |
+| Accepted residual risk G1 | Single off-host provider — accepted until 2027-01-31 |
+| Accepted residual risk G2 | On-host-only freshness detection — accepted until 2027-01-31; linked to the outside-node watchdog owed by RAPP-TELEMETRY-WP-0001-T04 |
+| Restore proof | Quarterly isolated identity restore drill, `net-kingdom` NK-WP-0053, procedure `net-kingdom/docs/identity-restore-drill.md`; first due by 2027-01-31; evidence under `net-kingdom/docs/evidence/<date>-identity-restore-drill/` |
+| Prior one-off proofs | NK-WP-0049-T16 (LLDAP), T31 (privacyIDEA token material), T20 (audit) |
+
+## Register the lane in AssetRegister and DataRegister
+
+```task
+id: DISCTL-WP-0004-T01
+status: done
+priority: high
+```
+
+Add `backup-netkingdom-identity` to `AssetRegister.yaml` → `backup_streams`
+(T0) with the schedule, destination, freshness bound, accepted residual risks
+G1/G2 as `gaps`, and prior one-off proofs. Point the older
+`related_streams` → `backup-adjacent-sso` entry at the new stream. Add
+`DataRegister.yaml` data classes for the LLDAP directory, privacyIDEA
+database/token material/audit, and the KeyCape client registry archive.
+
+## Update BackupPolicy, RTO-RPO matrix and TestEvidence cadence
+
+```task
+id: DISCTL-WP-0004-T02
+status: done
+priority: high
+```
+
+Add the lane to the `BackupPolicy.md` 3-2-1 compliance table, the per-stream
+mechanisms table, the monitoring checks, and the open-gaps table (G1/G2 with
+their acceptance expiry). Add an RTO-RPO matrix row and list the quarterly
+identity drill under `TestEvidence/README.md` next targets.
+
+## Import the first quarterly identity restore drill evidence
+
+```task
+id: DISCTL-WP-0004-T03
+status: wait
+priority: high
+```
+
+Waits on `net-kingdom` NK-WP-0053: when the first isolated identity restore
+drill runs (due by 2027-01-31), add
+`TestEvidence/restore-drill-<date>-netkingdom-identity.md` linking the
+canonical evidence under `net-kingdom/docs/evidence/<date>-identity-restore-drill/`,
+record measured RPO/RTO in `RTO-RPO-Matrix.md`, and set the register
+`evidence.last_drill`.
+
+## Review accepted residual risks G1/G2 at expiry
+
+```task
+id: DISCTL-WP-0004-T04
+status: wait
+priority: medium
+```
+
+By 2027-01-31, confirm whether a second off-host provider (G1) and the
+outside-node freshness watchdog from RAPP-TELEMETRY-WP-0001-T04 (G2) have
+landed. Close the gaps in the registers and `BackupPolicy.md`, or route a
+founder decision to re-accept or escalate them.