tegwick
d042d7f4d2
NK-WP-0053 drill and G1 review run now with the first admin MFA run instead of at the 2027-01-31 deadline; the quarterly repeat moves to disaster-control's restore-proof register once the workplan closes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 308701@bnt-lap001 Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
3.9 KiB
Quarterly isolated identity restore drill
Work record: NK-WP-0053 (from NK-WP-0049-T24 gap G3, founder decision
e4c288d9, 2026-10-23). Cadence: quarterly, aligned with disaster-control
BackupPolicy.md. First drill: the attended admin run of the week of 2026-10-28, well ahead of
2027-01-31, the end of the single-provider risk acceptance. Later drills are
scheduled through disaster-control's restore-proof register.
The drill re-proves restores that have each been proven once (NK49-T16 LLDAP, T31 privacyIDEA token material, T20 audit). It uses the existing reviewed tooling unchanged and adds no grant, scheduler or production write. One attended operator runs it in their own terminal, using the independently held backup age key and the Backup-account credential through Platform custody.
Scope
| Step | Tool | Proves |
|---|---|---|
| 1. Independent retrieval | tools/bootstrap-recovery/retrieve-identity.py --source-receipt <node receipt> --receipt <private transfer receipt> (ceremony step 5) |
The newest successful generation re-downloads and binds by ETag/size/hash |
| 2. LLDAP | tools/bootstrap-recovery/run-isolated-lldap.sh <user> <transfer receipt> |
Directory restore and authentication in isolation |
| 3. privacyIDEA | tools/bootstrap-recovery/run-isolated-privacyidea.sh <transfer receipt> |
Database, token-material decryption and audit signatures in isolation |
| 4. Authelia | tools/bootstrap-recovery/run-isolated-authelia.sh admin <transfer receipt> |
Authelia restored against the restored directory accepts the existing user admin in isolation |
| 5. By-user MFA | tools/bootstrap-recovery/run-isolated-privacyidea-mfa.sh <transfer receipt>, login admin |
admin's retained OTP token from the backup validates a fresh code in isolation |
Every stage is run by admin, the operator of record and the MFA test subject;
platform-root is kept for break-glass. Stage 5 needs a generation captured after
2026-10-25 03:45 UTC, the first daily capture holding admin's OTP token; an older
generation proves nothing for admin.
Out of scope: KeyCape consumer continuity (NK49-T18, a separate admitted
attempt), any production restore or cutover, and
run-offline-recovery.sh (it publishes kit files, which is a production
effect).
Before the drill
- Review the crisis custody list: every row must have a holder, a location and a last-proven date, and no row may rely on a login to a service being restored. The operator of record is
admin. - Pick the generation from the daily backup (the newest that passed health). Record its date, not its content.
- Stage the pinned images locally. Each launcher refuses if they are missing.
- Confirm no outbound notification or provider write is configured. The launchers enforce isolation; confirm their preflight passes.
Pass and fail
A drill passes only if every launcher exits 0, each safe receipt reports cleanup verified with no uncertainty, and the ciphertext digest in every receipt equals the transfer receipt. Any other result is a failed drill. Record it as a finding under NK-WP-0049 or its successor, with the safe receipts. Do not rerun with modified inputs until the cause is understood, and never repair a receipt by hand.
Evidence
Keep the value-safe receipts under
docs/evidence/<YYYY-MM-DD>-identity-restore-drill/:
transfer.json (public fields only), lldap-recovery.json,
privacyidea-recovery.json, authelia-recovery.json, privacyidea-mfa-recovery.json
and a short drill.json with the date, generation, verdict, next due date and, per
stage, the identity that ran it and the login it tested. Before committing, run the repository
secret scan (the pre-commit hook does this). No key, password, token or
plaintext may enter Git, State Hub or chat.
After each drill, put the next due date (drill date plus 3 months) on the NK-WP-0053 record and tell disaster-control, so its restore-proof register stays current.