tegwick
1ed7953ae8
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 696317@bnt-lap001 Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6
56 lines
2.9 KiB
Markdown
56 lines
2.9 KiB
Markdown
# Quarterly isolated identity restore drill
|
|
|
|
Work record: `NK-WP-0053` (from `NK-WP-0049-T24` gap G3, founder decision
|
|
`e4c288d9`, 2026-10-23). Cadence: quarterly, aligned with disaster-control
|
|
`BackupPolicy.md`. First drill due by **2027-01-31**, the end of the
|
|
single-provider risk acceptance.
|
|
|
|
The drill re-proves restores that have each been proven once (NK49-T16 LLDAP,
|
|
T31 privacyIDEA token material, T20 audit). It uses the existing reviewed
|
|
tooling unchanged and adds no grant, scheduler or production write. One
|
|
attended operator runs it in their own terminal, using the independently held
|
|
backup age key and the Backup-account credential through Platform custody.
|
|
|
|
## Scope
|
|
|
|
| Step | Tool | Proves |
|
|
|---|---|---|
|
|
| 1. Independent retrieval | `tools/bootstrap-recovery/retrieve-identity.py --source-receipt <node receipt> --receipt <private transfer receipt>` ([ceremony](bootstrap-recovery-ceremony.md) step 5) | The newest successful generation re-downloads and binds by ETag/size/hash |
|
|
| 2. LLDAP | `tools/bootstrap-recovery/run-isolated-lldap.sh <user> <transfer receipt>` | Directory restore and authentication in isolation |
|
|
| 3. privacyIDEA | `tools/bootstrap-recovery/run-isolated-privacyidea.sh <transfer receipt>` | Database, token-material decryption and audit signatures in isolation |
|
|
|
|
Out of scope: KeyCape consumer continuity (NK49-T18, a separate admitted
|
|
attempt), retained-factor MFA (T19), any production restore or cutover, and
|
|
`run-offline-recovery.sh` (it publishes kit files, which is a production
|
|
effect).
|
|
|
|
## Before the drill
|
|
|
|
- Pick the generation from the daily backup (the newest that passed health).
|
|
Record its date, not its content.
|
|
- Stage the pinned images locally. Each launcher refuses if they are missing.
|
|
- Confirm no outbound notification or provider write is configured. The
|
|
launchers enforce isolation; confirm their preflight passes.
|
|
|
|
## Pass and fail
|
|
|
|
A drill passes only if every launcher exits 0, each safe receipt reports
|
|
cleanup verified with no uncertainty, and the ciphertext digest in every receipt
|
|
equals the transfer receipt. Any other result is a **failed drill**. Record it
|
|
as a finding under NK-WP-0049 or its successor, with the safe receipts. Do not
|
|
rerun with modified inputs until the cause is understood, and never repair a
|
|
receipt by hand.
|
|
|
|
## Evidence
|
|
|
|
Keep the value-safe receipts under
|
|
`docs/evidence/<YYYY-MM-DD>-identity-restore-drill/`:
|
|
`transfer.json` (public fields only), `lldap-recovery.json`,
|
|
`privacyidea-recovery.json` and a short `drill.json` with the date, generation,
|
|
operator role, verdict and next due date. Before committing, run the repository
|
|
secret scan (the pre-commit hook does this). No key, password, token or
|
|
plaintext may enter Git, State Hub or chat.
|
|
|
|
After each drill, put the next due date (drill date plus 3 months) on the
|
|
NK-WP-0053 record and tell disaster-control, so its restore-proof register
|
|
stays current.
|