Harden the PEP harness and KeyCape registration request

Close remaining in-repo APPROVAL-WP-0002 gaps: drive GH-DEC-2026-003 against
the real HTTP surface, fail closed on JWT/human-consume/static-token paths,
treat audit 200 duplicates as drained, and ask KeyCape for the production
audience and client grants.

Assistant: grok
Assistant-Session: 01a06253-e557-7971-93d9-4f4c2cfbf455

tests/test_cli.py

@@ -20,3 +20,51 @@ def test_migrate_verify_and_backup_commands(tmp_path, capsys):
 def test_production_refuses_memory_store_before_serving():
     with pytest.raises(SystemExit):
         main(["serve", "--production", "--db", ":memory:"])
+
+
+def test_production_requires_jwt_verifier_not_static_token(tmp_path, capsys):
+    database = tmp_path / "approval.sqlite"
+    assert main(["migrate", "--db", str(database)]) == 0
+    capsys.readouterr()
+    audit = tmp_path / "audit.token"
+    audit.write_text("audit")
+    static = tmp_path / "dev.token"
+    static.write_text("dev")
+    with pytest.raises(SystemExit):
+        main(
+            [
+                "serve",
+                "--production",
+                "--db",
+                str(database),
+                "--audit-url",
+                "http://audit-core:8080",
+                "--audit-token-file",
+                str(audit),
+                "--dev-token-file",
+                str(static),
+            ]
+        )
+    assert "KeyCape JWT verifier" in capsys.readouterr().err
+
+
+def test_production_requires_authenticated_audit_delivery(tmp_path, capsys):
+    database = tmp_path / "approval.sqlite"
+    assert main(["migrate", "--db", str(database)]) == 0
+    capsys.readouterr()
+    with pytest.raises(SystemExit):
+        main(
+            [
+                "serve",
+                "--production",
+                "--db",
+                str(database),
+                "--jwt-issuer",
+                "https://keycape.example",
+                "--jwt-audience",
+                "approval-engine",
+                "--jwks-url",
+                "https://keycape.example/jwks",
+            ]
+        )
+    assert "authenticated audit delivery" in capsys.readouterr().err