net-kingdom/workplans/NK-WP-0053-identity-restore-drill-cadence.md

id	type	title	domain	repo	status	flavor	owner	topic_slug	created	updated	related
NK-WP-0053	workplan	Quarterly isolated identity restore drill	infotech	net-kingdom	active	implementation	claude	netkingdom	2026-10-23	2026-10-23	NK-WP-0049 disaster-control/BackupPolicy.md

NK-WP-0053 — Quarterly isolated identity restore drill

Intake for gap G3 of NK-WP-0049-T24. On 2026-10-23 the founder resolved decision e4c288d9 with the recommended split: G1 (a single off-host provider) is an accepted residual risk until 2027-01-31; G2 (off-host host-loss detection) is linked to the outside-node watchdog that RAPP-TELEMETRY-WP-0001-T04 already owes; G3 (no recurring drill) is this workplan.

So far each identity restore has been proved once: LLDAP (NK49-T16), privacyIDEA token material (T31) and audit (T20), and the archive recovery. This workplan turns the existing isolated tooling into a recurring, evidenced drill. It adds no grant, scheduler or production effect; each live drill is an attended owner run.

Define the drill and register it with disaster-control

id: NK-WP-0053-T01
status: wait
blocking_reason: "Drill document written 2026-10-23 (docs/identity-restore-drill.md); waiting for disaster-control to record the identity lane (message ef2bf2a9)."
priority: medium

Write docs/identity-restore-drill.md: a quarterly cadence aligned with disaster-control BackupPolicy.md, the fixed scope (archive retrieval and verification, isolated LLDAP stage, privacyIDEA token-material check), reuse of tools/bootstrap-recovery/run-isolated-*.sh without changes, the evidence location docs/evidence/<date>-identity-restore-drill/, and pass/fail criteria. Ask disaster-control to add the identity lane to its restore-proof register.

Done when: the drill document is reviewed and disaster-control records the identity lane with a quarterly restore-proof schedule.

Run the first scheduled drill

id: NK-WP-0053-T02
status: wait
priority: medium
depends_on: [NK-WP-0053-T01]
blocking_reason: "Attended owner run; the operator holds the backup age key. Due by 2027-01-31, the end of the G1 risk-acceptance window."

Run the drill in an attended session and retain the value-safe receipts. Any failure becomes a finding in NK-WP-0049 or its successor; it is never repaired silently.

Done when: a dated, verified evidence set exists and the next due date is recorded.

Review the G1 residual-risk acceptance

id: NK-WP-0053-T03
status: wait
priority: low
blocking_reason: "Founder review due 2027-01-31: renew the single-provider acceptance or open a second-provider intake."

Use the drill results to put the single-provider question back to the founder.