NK-WP-0053-T01: quarterly isolated identity restore drill procedure

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 696317@bnt-lap001
Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6

docs/identity-restore-drill.md

@@ -0,0 +1,56 @@
+# Quarterly isolated identity restore drill
+
+Work record: `NK-WP-0053` (from `NK-WP-0049-T24` gap G3, founder decision
+`e4c288d9`, 2026-10-23). Cadence: quarterly, aligned with disaster-control
+`BackupPolicy.md`. First drill due by **2027-01-31**, the end of the
+single-provider risk acceptance.
+
+The drill re-proves restores that have each been proven once (NK49-T16 LLDAP,
+T31 privacyIDEA token material, T20 audit). It uses the existing reviewed
+tooling unchanged and adds no grant, scheduler or production write. One
+attended operator runs it in their own terminal, using the independently held
+backup age key and the Backup-account credential through Platform custody.
+
+## Scope
+
+| Step | Tool | Proves |
+|---|---|---|
+| 1. Independent retrieval | `tools/bootstrap-recovery/retrieve-identity.py --source-receipt <node receipt> --receipt <private transfer receipt>` ([ceremony](bootstrap-recovery-ceremony.md) step 5) | The newest successful generation re-downloads and binds by ETag/size/hash |
+| 2. LLDAP | `tools/bootstrap-recovery/run-isolated-lldap.sh <user> <transfer receipt>` | Directory restore and authentication in isolation |
+| 3. privacyIDEA | `tools/bootstrap-recovery/run-isolated-privacyidea.sh <transfer receipt>` | Database, token-material decryption and audit signatures in isolation |
+
+Out of scope: KeyCape consumer continuity (NK49-T18, a separate admitted
+attempt), retained-factor MFA (T19), any production restore or cutover, and
+`run-offline-recovery.sh` (it publishes kit files, which is a production
+effect).
+
+## Before the drill
+
+- Pick the generation from the daily backup (the newest that passed health).
+  Record its date, not its content.
+- Stage the pinned images locally. Each launcher refuses if they are missing.
+- Confirm no outbound notification or provider write is configured. The
+  launchers enforce isolation; confirm their preflight passes.
+
+## Pass and fail
+
+A drill passes only if every launcher exits 0, each safe receipt reports
+cleanup verified with no uncertainty, and the ciphertext digest in every receipt
+equals the transfer receipt. Any other result is a **failed drill**. Record it
+as a finding under NK-WP-0049 or its successor, with the safe receipts. Do not
+rerun with modified inputs until the cause is understood, and never repair a
+receipt by hand.
+
+## Evidence
+
+Keep the value-safe receipts under
+`docs/evidence/<YYYY-MM-DD>-identity-restore-drill/`:
+`transfer.json` (public fields only), `lldap-recovery.json`,
+`privacyidea-recovery.json` and a short `drill.json` with the date, generation,
+operator role, verdict and next due date. Before committing, run the repository
+secret scan (the pre-commit hook does this). No key, password, token or
+plaintext may enter Git, State Hub or chat.
+
+After each drill, put the next due date (drill date plus 3 months) on the
+NK-WP-0053 record and tell disaster-control, so its restore-proof register
+stays current.