Harden the PEP harness and KeyCape registration request

Close remaining in-repo APPROVAL-WP-0002 gaps: drive GH-DEC-2026-003 against
the real HTTP surface, fail closed on JWT/human-consume/static-token paths,
treat audit 200 duplicates as drained, and ask KeyCape for the production
audience and client grants.

Assistant: grok
Assistant-Session: 01a06253-e557-7971-93d9-4f4c2cfbf455

tests/test_auth.py

@@ -64,6 +64,9 @@ def test_jwt_authenticator_verifies_signature_issuer_audience_and_claims():
         {"iss": "https://wrong.example"},
         {"aud": "somewhere-else"},
         {"exp": 1},
+        {"scope": ""},
+        {"principal_type": "unknown"},
+        {"assurance": "not-an-object"},
     ],
 )
 def test_jwt_authenticator_fails_closed(claims):
@@ -78,6 +81,37 @@ def test_jwt_authenticator_fails_closed(claims):
         auth.authenticate("Bearer " + _jwt(private, **claims))
 
 
+def test_jwt_authenticator_rejects_wrong_signature_and_hs256():
+    private = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    other = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    auth = JWTAuthenticator(
+        issuer="https://keycape.example",
+        audience="approval-engine",
+        jwks_url="https://keycape.example/jwks",
+        jwks_client=_JWKS(private.public_key()),
+    )
+    with pytest.raises(Unauthenticated):
+        auth.authenticate("Bearer " + _jwt(other))
+    hs = jwt.encode(
+        {
+            "iss": "https://keycape.example",
+            "sub": "service:secrets-engine",
+            "aud": "approval-engine",
+            "exp": 2**31 - 1,
+            "iat": 1,
+            "tenant": "tenant:coulomb",
+            "principal_type": "service",
+            "roles": ["secrets-engine"],
+            "scope": "approval:read approval:consume",
+            "assurance": {"level": "aal1"},
+        },
+        "not-an-rsa-key",
+        algorithm="HS256",
+    )
+    with pytest.raises(Unauthenticated):
+        auth.authenticate("Bearer " + hs)
+
+
 def test_api_requires_scope_and_binds_create_actor(engine):
     identity = Identity(
         subject="service:creator",
@@ -165,3 +199,84 @@ def test_wrong_tenant_is_forbidden(engine):
     status, body = call(app, "GET", "/v1/cadence", authorization="Bearer wrong")
     assert status == 403
     assert body["error"] == "forbidden"
+
+
+def test_deny_all_default_does_not_mutate(engine):
+    from approval_engine.api import App
+
+    app = App(engine)
+    status, body = call(
+        app,
+        "POST",
+        "/v1/approvals",
+        {"binding": binding(), "validity": validity()},
+        authorization="Bearer anything",
+    )
+    assert status == 401
+    assert body["error"] == "unauthenticated"
+    assert engine.transition_counts()["issuance"] == 0
+
+
+def test_human_principal_cannot_consume(engine):
+    from approval_engine.api import App
+
+    service = Identity(
+        subject="agt-secrets-engine",
+        issuer="test",
+        audiences=("approval-engine",),
+        principal_type="service",
+        tenant="platform",
+        roles=frozenset(),
+        scopes=frozenset(
+            {"approval:create", "approval:approve", "approval:read", "approval:consume"}
+        ),
+        assurance={"level": "aal1"},
+        evidence_ref="service",
+    )
+    human = Identity(
+        subject="user:alice",
+        issuer="test",
+        audiences=("approval-engine",),
+        principal_type="human",
+        tenant="platform",
+        roles=frozenset(),
+        scopes=frozenset({"approval:consume"}),
+        assurance={"level": "aal2"},
+        evidence_ref="human",
+    )
+    app = App(
+        engine,
+        StaticTokenAuthenticator({"service": service, "human": human}),
+    )
+    _, created = call(
+        app,
+        "POST",
+        "/v1/approvals",
+        {"binding": binding(), "validity": validity()},
+        authorization="Bearer service",
+    )
+    call(
+        app,
+        "POST",
+        f"/v1/approvals/{created['id']}/entries",
+        {},
+        authorization="Bearer service",
+    )
+    status, body = call(
+        app,
+        "POST",
+        f"/v1/approvals/{created['id']}/consume",
+        {"request_digest": "sha256:" + "ab" * 32},
+        authorization="Bearer human",
+    )
+    assert status == 403
+    assert body["error"] == "forbidden"
+    status, claim = call(
+        app,
+        "GET",
+        f"/v1/approvals/{created['id']}/claim",
+        authorization="Bearer service",
+    )
+    assert status == 200
+    assert claim["consumed"] is False
+    assert claim["valid_now"] is True