fix(admission): restrict approval audit sender to the platform tenant

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

tests/test_senders.py

@@ -314,6 +314,26 @@ def test_a_scope_entry_without_a_token_admits_nothing():
     assert registry.authenticate("Bearer live").name == "user-engine"
 
 
+@pytest.mark.parametrize("tenant", ["platform", "tenant:coulomb", "tenant:Platform", "tenant:platform ", "tenant:customer"])
+def test_approval_scope_restricts_a_stale_wildcard_registration(tenant):
+    registry = SenderRegistry.from_env({
+        "AUDIT_CORE_SENDERS": json.dumps([{
+            "name": "approval-engine", "tokens": ["fixture-only"],
+            "sources": ["*"], "tenants": ["*"],
+            "may_read": True, "secret_policy": "redact",
+        }]),
+        "AUDIT_CORE_SENDERS_SCOPE_PATH": str(SCOPE_FILE),
+    })
+    identity = registry.authenticate("Bearer fixture-only")
+    assert identity.permits_tenant("tenant:platform")
+    assert not identity.permits_tenant(tenant)
+    assert identity.permits_source("approval-engine")
+    assert not identity.permits_source("user-engine")
+    assert identity.may_write and not identity.may_read
+    assert identity.secret_policy == "redact"
+    assert identity.is_load_bearing
+
+
 def test_user_engine_evidence_kind_is_not_asserted_on_its_behalf():
     """Undeclared means attributive by default, not a claim audit-core made."""
     scope = json.loads(SCOPE_FILE.read_text())