oidc-service-client 0.2 acknowledged (founder accepted memo r2 in informed-decision)

Hub decision f8044f81. Becomes implemented when nk-bind-executor-approval is
live and verified.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196

security-case-types/oidc-service-client/README.md

@@ -7,9 +7,9 @@ grant. The type covers:
 - the client secret, minted straight into OpenBao custody and readable only by KeyCape (through ESO) and by the
   consuming workload (through its own Kubernetes-auth login).
 
-Canon: `canon/standards/security-case-types_v0.1.md`. Status: **proposed** (0.2, 2026-11-01): complete, tests
-green, owner reviews folded in, Decision Memo r2 prepared (`decision/`, hub decision `f8044f81`). Next:
-`acknowledged` by the founder through informed-decision. Its first case and
+Canon: `canon/standards/security-case-types_v0.1.md`. Status: **acknowledged** (0.2, 2026-11-01). The founder
+accepted informed-decision memo `nk-wp-0056-t14-oidc-service-client-r2` (hub decision `f8044f81`). The type becomes
+`implemented` once its first case, `nk-bind-executor-approval`, is live and verified. Its first case and
 reference instance is the bounded executor's approval client (NK-WP-0056-T14, `examples/nk-bind-executor-approval.yaml`).
 
 ## Purpose
@@ -159,3 +159,4 @@ complete once the consumer's tokens have expired (at most 15m) or been revoked (
   Decided here: `consuming_service` stays `bounded-executor`, matching CCR-2026-0061 (ops-mason R9). The first case's
   `consumer_owner_repo` is `rapp-bounded-executor`, where the consumer's configuration lives (ADR-0015; ops-warden
   R10). Memo r2 replaces r1.
+- 0.2 acknowledged (2026-11-01): founder accepted memo r2 in informed-decision.

security-case-types/oidc-service-client/type.yaml

@@ -3,7 +3,7 @@ kind: SecurityCaseType
 spec:
   id: oidc-service-client
   version: "0.2"
-  status: proposed
+  status: acknowledged
   title: "Confidential OIDC service client (client_credentials) for an internal workload"
   purpose: >-
     Let an internal workload obtain short-lived KeyCape access tokens for one