Request sitting-requester OpenBao custody without allocating a CCR.

Verifier + attended reader on a new informed-decision KV path, not a
widening of CCR-2026-0024/0025. Intents still match approval-engine
canonical binding. No secret, no apply, no bind.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267

tests/test_sitting_requester_registration.py

@@ -1,4 +1,5 @@
 import json
+import sys
 from pathlib import Path
 
 from informed_decision.records import memo_from
@@ -45,3 +46,26 @@ def test_create_intents_cover_the_sitting_and_are_not_posted():
         memo = memo_from(json.loads((batch_root / batch / f"{row['memo_id']}.memo.json").read_text()))
         assert binding["target"]["id"] == memo.binding.target.id
         assert memo.question.startswith(binding["purpose"][:20]) or binding["purpose"] in memo.question or memo.question.rstrip("?") in binding["purpose"]
+
+
+def test_create_intents_match_approval_engine_canonical_binding():
+    engine = Path("/home/worsch/approval-engine")
+    sys.path.insert(0, str(engine))
+    from approval_engine.binding import BINDING_FIELDS, binding_digest, canonical_binding
+
+    for row in INTENTS["intents"]:
+        canon = canonical_binding(row["binding"])
+        assert tuple(canon) == BINDING_FIELDS
+        digest = binding_digest(canon)
+        assert digest.startswith("sha256:") and len(digest) == 71
+
+
+def test_custody_request_is_unallocated_and_does_not_widen_t03_path():
+    text = (ROOT / "docs" / "sitting-requester-custody-request.yaml").read_text()
+    assert "status: requested" in text
+    assert "id: unallocated" in text
+    assert "kv_path: platform/workloads/informed-decision/sitting-requester" in text
+    assert "kv_path: platform/workloads/secrets-engine/approval-requester" not in text
+    md = (ROOT / "docs" / "sitting-requester-custody-request.md").read_text()
+    assert "Do not widen" in md
+    assert "No secret" in md