diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 20472a8..1c668f6 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -360,8 +360,10 @@
 | task | NK-WP-0056-T15 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T16 | wait | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T17 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
-| task | NK-WP-0056-T18 | progress | — | workplans/NK-WP-0056-bounded-executor-path.md |
+| task | NK-WP-0056-T18 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T19 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
+| task | NK-WP-0056-T20 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
+| task | NK-WP-0056-T21 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
 | intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
 | intake | NET-IN-0001 | open | — | intakes/intakes.md |
diff --git a/workplans/NK-WP-0056-bounded-executor-path.md b/workplans/NK-WP-0056-bounded-executor-path.md
index 0573f41..22c3d55 100644
--- a/workplans/NK-WP-0056-bounded-executor-path.md
+++ b/workplans/NK-WP-0056-bounded-executor-path.md
@@ -757,7 +757,7 @@ Next:
 
 ```task
 id: NK-WP-0056-T18
-status: progress
+status: done
 priority: high
 assignee: claude-code
 depends_on: [NK-WP-0056-T14]
@@ -797,8 +797,9 @@ Presenting the approval to the founder follows the alignment review's "present a
   - the run Job mounts only the audit-core bearer;
   - `make request` adds a request Job.
 
-Left: the image and its pin. A live request also needs the KeyCape client (T14 type acknowledged, then the case
-live) and informed-decision's `present_existing`.
+**Done 2026-10-31.** The image `sha256:c67cb04485ee53b910c2443f43eada0e80273ea879de6853e120a32415194a04`
+(`7bd6033`) has executed files byte-identical to the repo. It is pinned in the rapp (`b90951a`). A live request
+also needs T20 and T21.
 
 ## Executor approval exercise against the real services
 
@@ -891,6 +892,77 @@ Options:
 
 Founder decision needed before T14.
 
+## Service-client type revision r2 from the owner reviews
+
+```task
+id: NK-WP-0056-T20
+status: todo
+priority: high
+assignee: claude-code
+depends_on: [NK-WP-0056-T14]
+```
+
+The 2026-10-31 reviews of `oidc-service-client` 0.1:
+
+- ops-mason: `ops-mason` `3c69a25`;
+- ops-warden: `ops-warden` `95d31c3`, `history/2026-10-31-oidc-service-client-follow-through-review.md`;
+- key-cape: `key-cape` `655d8d3`, `docs/oidc-service-client-type-review.md`;
+- railiance-platform: `railiance-platform` `6858bef`, `docs/credential-lane-designs/oidc-service-client-review.md`.
+
+They ask for these changes before the founder acknowledges the type:
+
+- The ESO role gets `audience: openbao` and `token_explicit_max_ttl`; the ESO policy gets `lookup-self` and
+  `revoke-self`.
+- The consumer role name must differ from its policy name: `keycape-{client_id}-{consuming_service}-workload-kv-read`.
+- Refuse the `default` ServiceAccount and the `external-secrets` and `openbao` namespaces.
+- **Same namespace:** KeyCape's ESO target sits in `sso`, the consumer's namespace. Add the verification
+  `consumer-cannot-read-delivered-secret` (an RBAC can-i denial) and correct the README.
+- An excess scope is refused with `invalid_profile_usage`, not `invalid_scope` (key-cape R3).
+- **Rotation:** the mint step only creates. Rotation is an attended platform-admin write, then an ESO refresh, then
+  a KeyCape restart (railiance-platform R5, ops-warden R5, key-cape R5).
+- The catalog entry body gets the fields ops-warden R6 asks for.
+- The `custody-allowed-to-consumer` wording must mention the two self-lifecycle grants.
+- One restart per case: bind-env and register-client in one rollout (key-cape R4).
+- Open questions:
+  - the workload name, `bounded-executor` or `net-kingdom-bind-executor` (ops-mason R9);
+  - `consumer_owner_repo` as `rapp-bounded-executor` (ops-warden R10);
+  - an independent claims check (ops-warden R8).
+
+Per-case CCRs are still required. railiance-platform drafted CCR-2026-0060 (KeyCape ESO reader) and CCR-2026-0061
+(the executor's reader). The broker must admit the type after acknowledgement (railiance-platform R1, ops-warden
+R1).
+
+**Done when:** the type is at r2 with tests green, the memo r2 is validated, and the CCR names agree with the type.
+
+## Executor submits its admission memo to informed-decision
+
+```task
+id: NK-WP-0056-T21
+status: todo
+priority: high
+assignee: claude-code
+depends_on: [NK-WP-0056-T18]
+```
+
+informed-decision built `present_existing` (`0e66a33`, INFD-WP-0010). The executor submits a memo through
+`/v1/memos` that pins `approval_id` and the binding digest and carries the admission YAML as its packet.
+informed-decision checks the approval by GET and presents it to the founder.
+
+Needed:
+
+- a projected token with audience `informed-decision-intake` in the request Job;
+- a NetworkPolicy path to informed-decision's private listener on 8081;
+- the request phase submitting the memo after creating the approval.
+
+Outside net-kingdom:
+
+- access-engine: review policy v13 hard-codes the requester `informed-decision`;
+- key-cape: the informed-decision requester client needs `approval:read`;
+- informed-decision: its registry entry and release (INFD-WP-0010-T02).
+
+**Done when:** the request phase files the approval and the memo, tested against informed-decision's real intake
+validator.
+
 ## Pilot: unattended bind rotation under one admission
 
 ```task
@@ -900,7 +972,7 @@ priority: high
 assignee: claude-code
 needs_human: true
 intervention_note: "Founder signs the admission for the single live pilot rotation."
-depends_on: [NK-WP-0056-T01, NK-WP-0056-T03, NK-WP-0056-T04, NK-WP-0056-T05, NK-WP-0056-T10, NK-WP-0056-T13, NK-WP-0056-T14, NK-WP-0056-T15, NK-WP-0056-T16, NK-WP-0056-T17, NK-WP-0056-T18, NK-WP-0056-T19]
+depends_on: [NK-WP-0056-T01, NK-WP-0056-T03, NK-WP-0056-T04, NK-WP-0056-T05, NK-WP-0056-T10, NK-WP-0056-T13, NK-WP-0056-T14, NK-WP-0056-T15, NK-WP-0056-T16, NK-WP-0056-T17, NK-WP-0056-T18, NK-WP-0056-T19, NK-WP-0056-T20, NK-WP-0056-T21]
 state_hub_task_id: "6c3939f8-23a9-5f70-a3b1-94f4b291706b"
 ```