From 9ce0d6068a577fdd6f609980c2f1b687f3edfc54 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 1 Nov 2026 10:18:09 +0100 Subject: [PATCH] oidc-service-client 0.2 acknowledged (founder accepted memo r2 in informed-decision) Hub decision f8044f81. Becomes implemented when nk-bind-executor-approval is live and verified. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196 --- security-case-types/oidc-service-client/README.md | 7 ++++--- security-case-types/oidc-service-client/type.yaml | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/security-case-types/oidc-service-client/README.md b/security-case-types/oidc-service-client/README.md index 81c4301..f0a3c10 100644 --- a/security-case-types/oidc-service-client/README.md +++ b/security-case-types/oidc-service-client/README.md @@ -7,9 +7,9 @@ grant. The type covers: - the client secret, minted straight into OpenBao custody and readable only by KeyCape (through ESO) and by the consuming workload (through its own Kubernetes-auth login). -Canon: `canon/standards/security-case-types_v0.1.md`. Status: **proposed** (0.2, 2026-11-01): complete, tests -green, owner reviews folded in, Decision Memo r2 prepared (`decision/`, hub decision `f8044f81`). Next: -`acknowledged` by the founder through informed-decision. Its first case and +Canon: `canon/standards/security-case-types_v0.1.md`. Status: **acknowledged** (0.2, 2026-11-01). The founder +accepted informed-decision memo `nk-wp-0056-t14-oidc-service-client-r2` (hub decision `f8044f81`). The type becomes +`implemented` once its first case, `nk-bind-executor-approval`, is live and verified. Its first case and reference instance is the bounded executor's approval client (NK-WP-0056-T14, `examples/nk-bind-executor-approval.yaml`). ## Purpose @@ -159,3 +159,4 @@ complete once the consumer's tokens have expired (at most 15m) or been revoked ( Decided here: `consuming_service` stays `bounded-executor`, matching CCR-2026-0061 (ops-mason R9). The first case's `consumer_owner_repo` is `rapp-bounded-executor`, where the consumer's configuration lives (ADR-0015; ops-warden R10). Memo r2 replaces r1. +- 0.2 acknowledged (2026-11-01): founder accepted memo r2 in informed-decision. diff --git a/security-case-types/oidc-service-client/type.yaml b/security-case-types/oidc-service-client/type.yaml index a140281..eccda33 100644 --- a/security-case-types/oidc-service-client/type.yaml +++ b/security-case-types/oidc-service-client/type.yaml @@ -3,7 +3,7 @@ kind: SecurityCaseType spec: id: oidc-service-client version: "0.2" - status: proposed + status: acknowledged title: "Confidential OIDC service client (client_credentials) for an internal workload" purpose: >- Let an internal workload obtain short-lived KeyCape access tokens for one