Land attended sitting create now that CCR-2026-0026/0027 is live.

Platform verified create-only exchange; this shell cannot POST.
create_sitting_approvals.py requires attended reader, skips c01, and
refuses a non-loopback approval origin. Dry-run lists the seven memos.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267

tests/test_create_sitting_approvals.py

@@ -0,0 +1,40 @@
+import importlib.util
+from pathlib import Path
+
+import pytest
+
+spec = importlib.util.spec_from_file_location(
+    "create_sitting_approvals",
+    Path(__file__).resolve().parents[1] / "tools" / "create_sitting_approvals.py",
+)
+create = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(create)
+
+
+def test_dry_run_lists_seven_and_skips_c01():
+    report = create.dry_run()
+    assert report["posted"] is False
+    assert report["skipped"] == ["infd-20260914-c01"]
+    assert len(report["memo_ids"]) == 7
+    assert "infd-20260914-c01" not in report["memo_ids"]
+    assert report["memo_ids"][0] == "infd-20260914-c02"
+    assert report["memo_ids"][-1] == "infd-20260914-d04"
+
+
+def test_require_attended_refuses_this_shell():
+    with pytest.raises(ValueError, match="attended_reader_required"):
+        create.require_attended()
+
+
+@pytest.mark.parametrize(
+    "origin,ok",
+    [
+        ("http://127.0.0.1:18281", True),
+        ("http://approval-engine.approval-engine.svc.cluster.local:8080", True),
+        ("https://evil.example", False),
+        ("http://10.43.103.108:8080", False),
+        (None, False),
+    ],
+)
+def test_approval_origin_is_loopback_or_in_cluster_only(origin, ok):
+    assert create._approval_origin_ok(origin) is ok

tests/test_sitting_requester_registration.py

@@ -9,7 +9,7 @@ REG = json.loads((ROOT / "docs" / "keycape-sitting-requester-registration.json")
 INTENTS = json.loads((ROOT / "docs" / "batches" / "2026-09-14" / "approval-create-intents.json").read_text())
 
 
-def test_sitting_requester_is_create_only_and_unapplied():
+def test_sitting_requester_is_create_only_and_applied():
     assert REG["clientId"] == "informed-decision-sitting-requester"
     assert REG["audience"] == "approval-engine"
     assert REG["allowedScopes"] == ["approval:create"]
@@ -17,7 +17,8 @@ def test_sitting_requester_is_create_only_and_unapplied():
     assert REG["clientType"] == "confidential"
     assert REG["serviceSubject"] == "informed-decision"
     assert REG["tenant"] == "tenant:platform"
-    assert REG["applied"] is False
+    assert REG["applied"] is True
+    assert REG["ccrs"] == ["CCR-2026-0026", "CCR-2026-0027"]
     assert "redirect" not in json.dumps(REG).lower()
     forbidden = {"approval:approve", "approval:consume", "approval:read", "openid"}
     assert forbidden.isdisjoint(REG["allowedScopes"])