Complete CoulombCore identity backup gate

docs/railiance01-coulombcore-cutover-inventory-2026-07-28.md

@@ -62,14 +62,69 @@ equivalence.
   DNS moved. Keep these intact only for the bounded rollback window; prevent
   new authoritative writes once state migration begins.
 
+## Encrypted source backup
+
+A fresh source backup set was created on CoulombCore at
+`~/identity-cutover-backups/2026-07-28T0100Z`, encrypted directly to the
+existing SOPS/age custody recipient. The directory is mode `0700`; encrypted
+artifacts and `SHA256SUMS` are mode `0600`.
+
+The set contains:
+
+- hot SQLite backups for LLDAP and Authelia;
+- a complete `pg_dumpall` stream for `net-kingdom-pg`;
+- privacyIDEA encryption/signing custody files;
+- encrypted Kubernetes identity Secrets and ConfigMaps;
+- encrypted workload/recovery manifests.
+
+All encrypted checksums pass. Every artifact decrypts with the custody key;
+both restored SQLite databases return `pragma integrity_check = ok`. Plaintext
+verification used `/dev/shm` or streams and was removed, and the temporary
+export pod was deleted.
+
+The encrypted set was copied to independent custody on railiance01 at
+`~/identity-cutover-backups/coulombcore/2026-07-28T0100Z`. The destination
+directory is mode `0700`, every file is mode `0600`, and all source hashes
+match. The original checksum manifest contains absolute CoulombCore paths, so
+the independent-copy check preserved the manifest and resolved each entry by
+basename.
+
+An isolated restore drill started a temporary PostgreSQL 16 pod with no
+service, ingress, or persistent volume. The decrypted dump recreated
+`interhub` and `privacyidea_db`; the restored privacyIDEA database contained
+the expected one token, one token owner, two realms, two resolvers, and two
+policies. The pod and transient restore log were deleted automatically.
+
+## Semantic comparison
+
+| State | CoulombCore | railiance01 | Result |
+| --- | ---: | ---: | --- |
+| LLDAP users | 4 | 3 | divergent |
+| LLDAP groups | 7 | 7 | stable-identifier digest divergent |
+| LLDAP memberships | 7 | 3 | divergent |
+| privacyIDEA tokens | 1 | 0 | critical migration required |
+| privacyIDEA token owners | 1 | 0 | critical migration required |
+| privacyIDEA realms | 2 | 0 | configuration migration required |
+| privacyIDEA resolvers | 2 | 0 | configuration migration required |
+| privacyIDEA policies | 2 | 0 | configuration migration required |
+
+Authelia schemas match. Session, consent, access-token, authorization-code,
+and audit counts differ because both instances have been independently active;
+those ephemeral sessions should not be merged as authoritative identity data.
+
+Every compared privacyIDEA custody fingerprint (`enckey`, signing keypair, and
+instance UUID) differs. Migrating only database rows would make the enrolled
+token unusable. The CoulombCore privacyIDEA database plus its encryption and
+signing custody must move as one rollback-tested unit.
+
 ## Required next evidence
 
-1. Create and verify fresh encrypted CoulombCore identity backups.
-2. Compare semantic user/group counts and stable identifiers without exporting
-   credential material into logs.
-3. Compare privacyIDEA realms, resolver mappings, token counts, and encryption
-   custody using redacted/count-only probes.
-4. Compare NetKingdom PostgreSQL schemas and row counts.
-5. Freeze writes, merge the authoritative source into railiance01, rerun the
-   comparisons, and then exercise platform-root and Binky login/MFA.
+1. Copy the encrypted backup set to independent custody and perform an
+   isolated PostgreSQL/privacyIDEA restore drill.
+2. Decide the LLDAP merge rule for the one source-only user and four
+   source-only memberships while preserving railiance01-only lifecycle groups.
+3. Freeze writes, migrate privacyIDEA database and custody as one unit, and
+   migrate/merge authoritative LLDAP state.
+4. Rerun semantic counts/digests and restart recovery probes.
+5. Exercise platform-root and Binky login/MFA.
 6. Move LLDAP and privacyIDEA DNS only after those gates pass.