tegwick
034eacab9b
The founder's three-identity model and the finding that the human admin is also the directory bind account lead to a proposed workplan: svc-<service> bind accounts, per-service admin accounts, a governing standard and a conformance health check. docs/crisis-custody-list.md is the first concrete list of what unlocks recovery, with unknowns marked TO CONFIRM. NK-WP-0053-T04 extends the quarterly drill to the Authelia and by-user MFA stages with admin as operator. Hub decision routes the three founder gates. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 328925@bnt-lap001 Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
3.1 KiB
Quarterly isolated identity restore drill
Work record: NK-WP-0053 (from NK-WP-0049-T24 gap G3, founder decision
e4c288d9, 2026-10-23). Cadence: quarterly, aligned with disaster-control
BackupPolicy.md. First drill due by 2027-01-31, the end of the
single-provider risk acceptance.
The drill re-proves restores that have each been proven once (NK49-T16 LLDAP, T31 privacyIDEA token material, T20 audit). It uses the existing reviewed tooling unchanged and adds no grant, scheduler or production write. One attended operator runs it in their own terminal, using the independently held backup age key and the Backup-account credential through Platform custody.
Scope
| Step | Tool | Proves |
|---|---|---|
| 1. Independent retrieval | tools/bootstrap-recovery/retrieve-identity.py --source-receipt <node receipt> --receipt <private transfer receipt> (ceremony step 5) |
The newest successful generation re-downloads and binds by ETag/size/hash |
| 2. LLDAP | tools/bootstrap-recovery/run-isolated-lldap.sh <user> <transfer receipt> |
Directory restore and authentication in isolation |
| 3. privacyIDEA | tools/bootstrap-recovery/run-isolated-privacyidea.sh <transfer receipt> |
Database, token-material decryption and audit signatures in isolation |
Out of scope: KeyCape consumer continuity (NK49-T18, a separate admitted
attempt), retained-factor MFA (T19), any production restore or cutover, and
run-offline-recovery.sh (it publishes kit files, which is a production
effect).
Before the drill
- Review the crisis custody list: every row must have a holder, a location and a last-proven date, and no row may rely on a login to a service being restored. The operator of record is
admin. - Pick the generation from the daily backup (the newest that passed health). Record its date, not its content.
- Stage the pinned images locally. Each launcher refuses if they are missing.
- Confirm no outbound notification or provider write is configured. The launchers enforce isolation; confirm their preflight passes.
Pass and fail
A drill passes only if every launcher exits 0, each safe receipt reports cleanup verified with no uncertainty, and the ciphertext digest in every receipt equals the transfer receipt. Any other result is a failed drill. Record it as a finding under NK-WP-0049 or its successor, with the safe receipts. Do not rerun with modified inputs until the cause is understood, and never repair a receipt by hand.
Evidence
Keep the value-safe receipts under
docs/evidence/<YYYY-MM-DD>-identity-restore-drill/:
transfer.json (public fields only), lldap-recovery.json,
privacyidea-recovery.json and a short drill.json with the date, generation,
operator role, verdict and next due date. Before committing, run the repository
secret scan (the pre-commit hook does this). No key, password, token or
plaintext may enter Git, State Hub or chat.
After each drill, put the next due date (drill date plus 3 months) on the NK-WP-0053 record and tell disaster-control, so its restore-proof register stays current.