net-kingdom/workplans/NK-WP-0053-identity-restore-drill-cadence.md

id	type	title	domain	repo	status	flavor	owner	topic_slug	created	updated	related	state_hub_workstream_id
NK-WP-0053	workplan	Quarterly isolated identity restore drill	infotech	net-kingdom	active	implementation	claude	netkingdom	2026-10-23	2026-10-28	NK-WP-0049 disaster-control/BackupPolicy.md	7c80ba09-8bd5-540e-8dd3-feb85e201ef3

NK-WP-0053 — Quarterly isolated identity restore drill

2026-10-28 (founder triage): T02, T04 and T03 are finished now, not at the 2027-01-31 deadline. One attended admin run covers T02 and T04; T03 follows from its results. The workplan then closes. The quarterly repeat lives in disaster-control's restore-proof register (next due date recorded there), not in an active workplan.

Intake for gap G3 of NK-WP-0049-T24. On 2026-10-23 the founder resolved decision e4c288d9 with the recommended split: G1 (a single off-host provider) is an accepted residual risk until 2027-01-31; G2 (off-host host-loss detection) is linked to the outside-node watchdog that RAPP-TELEMETRY-WP-0001-T04 already owes; G3 (no recurring drill) is this workplan.

So far each identity restore has been proved once: LLDAP (NK49-T16), privacyIDEA token material (T31) and audit (T20), and the archive recovery. This workplan turns the existing isolated tooling into a recurring, evidenced drill. It adds no grant, scheduler or production effect; each live drill is an attended owner run.

Define the drill and register it with disaster-control

id: NK-WP-0053-T01
status: done
priority: medium
state_hub_task_id: "6bdfac30-75a8-5a1a-8d66-2fbb0c093958"

Write docs/identity-restore-drill.md: a quarterly cadence aligned with disaster-control BackupPolicy.md, the fixed scope (archive retrieval and verification, isolated LLDAP stage, privacyIDEA token-material check), reuse of tools/bootstrap-recovery/run-isolated-*.sh without changes, the evidence location docs/evidence/<date>-identity-restore-drill/, and pass/fail criteria. Ask disaster-control to add the identity lane to its restore-proof register.

Done when: the drill document is reviewed and disaster-control records the identity lane with a quarterly restore-proof schedule.

2026-10-23: done. The drill procedure is docs/identity-restore-drill.md. disaster-control adopted the lane as DISCTL-WP-0004 (commits 9ca7419 and a54ff81). Changes there: AssetRegister backup-netkingdom-identity, three DataRegister classes, BackupPolicy checks M-7 (25-hour freshness) and M-8 (quarterly drill), G1/G2 in its open-gaps table until 2027-01-31, and an RTO/RPO matrix row. RTO stays TBD until the first drill. When the first drill evidence lands, tell disaster-control (its DISCTL-WP-0004-T03 is waiting on it).

Run the first scheduled drill

id: NK-WP-0053-T02
status: wait
priority: medium
depends_on: [NK-WP-0053-T01]
blocking_reason: "Attended founder run as admin this week (target 2026-11-01), combined with the first admin MFA run of T04 on a post-2026-10-25 generation. The operator holds the backup age key."
state_hub_task_id: "8b2cdf5a-69e1-59c6-8e4e-e478f44f77fb"

Run the drill in an attended session and retain the value-safe receipts. Any failure becomes a finding in NK-WP-0049 or its successor; it is never repaired silently.

Done when: a dated, verified evidence set exists and the next due date is recorded.

Extend the drill to Authelia and by-user MFA, operated by admin

id: NK-WP-0053-T04
status: todo
priority: medium
assignee: claude-code
depends_on: [NK-WP-0053-T01]
state_hub_task_id: "20264166-3c88-52d0-a7b4-dd3831c7a685"

The drill document was written before the Authelia stage (run-isolated-authelia.sh) and the by-user MFA stage (run-isolated-privacyidea-mfa.sh) existed, and it lists retained-factor MFA as out of scope. Add both stages to docs/identity-restore-drill.md, and name admin as the operator of record and the MFA test subject (founder intent, 2026-10-24: backup validation is platform operations, with platform-root kept for break-glass). Add the check of docs/crisis-custody-list.md to the drill's preparation, and record in the evidence which identity ran each stage.

admin@coulomb received an OTP on 2026-10-24, so it is first present in the backup captured after 2026-10-25 03:45 UTC. The first admin-operated MFA run must use a generation from after that capture; an older generation holds no token for admin and proves nothing.

Done when: the drill document lists all five stages with admin as operator, the first admin-operated MFA run has passed on a post-enrolment generation, and its evidence names the identity used.

2026-10-28: the drill document now lists all five stages (Authelia and by-user MFA added, retained-factor MFA no longer out of scope) with admin as operator, and the evidence records the identity and login per stage. Remaining: the first admin-operated MFA run on a post-2026-10-25 generation.

Review the G1 residual-risk acceptance

id: NK-WP-0053-T03
status: wait
priority: low
blocking_reason: "Founder review right after the T02 run, using its results: renew the single-provider acceptance or open a second-provider intake. Not deferred to the 2027-01-31 deadline."
state_hub_task_id: "0fa4add7-3d53-51af-a2a2-ea9c63a2d628"

Use the drill results to put the single-provider question back to the founder.