tegwick 45feaa13cc NK-WP-0056-T20 done: oidc-service-client 0.2 with the owner reviews; memo r2 ... ESO role audience + explicit max TTL and ESO policy self-lifecycle (ops-mason R3/R4, railiance-platform R3); consumer role renamed to differ from its policy (railiance-platform R4); default SA and external-secrets/openbao namespaces refused (ops-mason R6); consumer-cannot-read-delivered-secret verification (ops-warden R7, ops-mason R7); excess scope invalid_profile_usage (key-cape R3); attended rotation, broker admission pending, one rollout per case; catalog fields (ops-warden R6). First case consumer_owner_repo rapp-bounded-executor. CCR-2026-0060/0061 names checked by test. Memo r2 validated against informed-decision intake and State Hub dispatcher. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196		2026-11-01 00:34:17 +01:00
..
_template	NK-WP-0048-T05: fold ops-warden's review into the type; build memo r3	2026-10-09 00:22:04 +02:00
oidc-browser-relying-party	NK-WP-0048: run keycape check-config before any registry patch	2026-10-10 15:28:05 +02:00
oidc-service-client	NK-WP-0056-T20 done: oidc-service-client 0.2 with the owner reviews; memo r2	2026-11-01 00:34:17 +01:00