NK-WP-0053-T01: quarterly isolated identity restore drill procedure

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 696317@bnt-lap001
Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6

WORK-RECORDS.md

@@ -50,7 +50,7 @@
 | workplan | NK-WP-0050 | active | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
 | workplan | NK-WP-0051 | finished | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
 | workplan | NK-WP-0052 | finished | — | workplans/NK-WP-0052-wave2-resource-right-sizing.md |
-| workplan | NK-WP-0053 | proposed | — | workplans/NK-WP-0053-identity-restore-drill-cadence.md |
+| workplan | NK-WP-0053 | active | — | workplans/NK-WP-0053-identity-restore-drill-cadence.md |
 | task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
 | task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md |
 | task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md |
@@ -300,7 +300,7 @@
 | task | NK-WP-0051-T05 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
 | task | NK-WP-0051-T06 | done | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
 | task | NK-WP-0052-T01 | done | — | workplans/NK-WP-0052-wave2-resource-right-sizing.md |
-| task | NK-WP-0053-T01 | todo | — | workplans/NK-WP-0053-identity-restore-drill-cadence.md |
+| task | NK-WP-0053-T01 | wait | — | workplans/NK-WP-0053-identity-restore-drill-cadence.md |
 | task | NK-WP-0053-T02 | wait | — | workplans/NK-WP-0053-identity-restore-drill-cadence.md |
 | task | NK-WP-0053-T03 | wait | — | workplans/NK-WP-0053-identity-restore-drill-cadence.md |
 | intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |

docs/identity-restore-drill.md

@@ -0,0 +1,56 @@
+# Quarterly isolated identity restore drill
+
+Work record: `NK-WP-0053` (from `NK-WP-0049-T24` gap G3, founder decision
+`e4c288d9`, 2026-10-23). Cadence: quarterly, aligned with disaster-control
+`BackupPolicy.md`. First drill due by **2027-01-31**, the end of the
+single-provider risk acceptance.
+
+The drill re-proves restores that have each been proven once (NK49-T16 LLDAP,
+T31 privacyIDEA token material, T20 audit). It uses the existing reviewed
+tooling unchanged and adds no grant, scheduler or production write. One
+attended operator runs it in their own terminal, using the independently held
+backup age key and the Backup-account credential through Platform custody.
+
+## Scope
+
+| Step | Tool | Proves |
+|---|---|---|
+| 1. Independent retrieval | `tools/bootstrap-recovery/retrieve-identity.py --source-receipt <node receipt> --receipt <private transfer receipt>` ([ceremony](bootstrap-recovery-ceremony.md) step 5) | The newest successful generation re-downloads and binds by ETag/size/hash |
+| 2. LLDAP | `tools/bootstrap-recovery/run-isolated-lldap.sh <user> <transfer receipt>` | Directory restore and authentication in isolation |
+| 3. privacyIDEA | `tools/bootstrap-recovery/run-isolated-privacyidea.sh <transfer receipt>` | Database, token-material decryption and audit signatures in isolation |
+
+Out of scope: KeyCape consumer continuity (NK49-T18, a separate admitted
+attempt), retained-factor MFA (T19), any production restore or cutover, and
+`run-offline-recovery.sh` (it publishes kit files, which is a production
+effect).
+
+## Before the drill
+
+- Pick the generation from the daily backup (the newest that passed health).
+  Record its date, not its content.
+- Stage the pinned images locally. Each launcher refuses if they are missing.
+- Confirm no outbound notification or provider write is configured. The
+  launchers enforce isolation; confirm their preflight passes.
+
+## Pass and fail
+
+A drill passes only if every launcher exits 0, each safe receipt reports
+cleanup verified with no uncertainty, and the ciphertext digest in every receipt
+equals the transfer receipt. Any other result is a **failed drill**. Record it
+as a finding under NK-WP-0049 or its successor, with the safe receipts. Do not
+rerun with modified inputs until the cause is understood, and never repair a
+receipt by hand.
+
+## Evidence
+
+Keep the value-safe receipts under
+`docs/evidence/<YYYY-MM-DD>-identity-restore-drill/`:
+`transfer.json` (public fields only), `lldap-recovery.json`,
+`privacyidea-recovery.json` and a short `drill.json` with the date, generation,
+operator role, verdict and next due date. Before committing, run the repository
+secret scan (the pre-commit hook does this). No key, password, token or
+plaintext may enter Git, State Hub or chat.
+
+After each drill, put the next due date (drill date plus 3 months) on the
+NK-WP-0053 record and tell disaster-control, so its restore-proof register
+stays current.

workplans/NK-WP-0053-identity-restore-drill-cadence.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Quarterly isolated identity restore drill"
 domain: infotech
 repo: net-kingdom
-status: proposed
+status: active
 flavor: implementation
 owner: claude
 topic_slug: netkingdom
@@ -32,7 +32,8 @@ grant, scheduler or production effect; each live drill is an attended owner run.
 
 ```task
 id: NK-WP-0053-T01
-status: todo
+status: wait
+blocking_reason: "Drill document written 2026-10-23 (docs/identity-restore-drill.md); waiting for disaster-control to record the identity lane (message ef2bf2a9)."
 priority: medium
 ```