WARDEN-WP-0044-T01: warden case check-type; revised oidc-rp 1.0 type conforms

Mechanical follow-through check (lane, warden_executes, value_handling,
attended justification, read-free verification, rollback coverage). The
revised type passes schema; lanes identity-provisioner-groups and
keycape-client-secret-generate are not yet in the catalog (gate T02).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0

workplans/WARDEN-WP-0044-security-case-follow-through.md

@@ -9,7 +9,7 @@ flavor: implementation
 owner: claude-code
 topic_slug: netkingdom
 created: "2026-10-08"
-updated: "2026-10-08"
+updated: "2026-10-09"
 depends_on: []
 related_repos:
   - net-kingdom
@@ -66,6 +66,15 @@ net-kingdom acknowledges the review (NK-WP-0048-T05).
 `{consuming_service}-keycape-client`, with the entry body templated in the type
 (R4′, see the addendum in the review).
 
+2026-10-09: the revised 1.0 type and canon now carry R1–R3, R4′, R5–R7.
+`warden case check-type <type.yaml>` (`src/warden/case_type.py`, tests in
+`tests/test_case_type.py`) checks a type's follow-through mechanically: the
+live type is schema-conformant, with one attended session
+(`key-cape-oidc-login`). It is not yet plannable, because two lanes are not
+in the catalog: `identity-provisioner-groups` (net-kingdom) and
+`keycape-client-secret-generate` (railiance-platform). These gate T02, not
+T01. T01 still closes on net-kingdom's acknowledgement (NK-WP-0048-T05).
+
 ```task
 id: WARDEN-WP-0044-T02
 status: wait