Register the approver client now its callback exists

informed-decision submitted client_id informed-decision-approver and redirect
https://decisions.coulomb.social/auth/callback, with the origin already live and
verified by them rather than reported: both / and /auth/callback return 200 on a
Let's Encrypt certificate valid to 2026-12-09. The host is decisions, not the
decide of an earlier draft. Its path serves a placeholder for now, which does not
matter -- the redirect is matched as an exact string and never fetched.

Published as a public authorization_code client with S256 PKCE, audience
approval-engine, scopes openid/approval:read/approval:approve, mfaRequired true
and a declared tenant:platform. No secretRef, since PKCE is the whole proof.

TestApproverRegistrationShapeIsExact pins every field, so widening a scope or
relaxing MFA fails the build rather than reading as an edit, and asserts the
registration passes startup validation -- proving the KEY-WP-0028 tenant
exemption holds for the registration that actually depends on it.

Two existing guards fired on the way in and neither was loosened. The tenant pin
refused an unreviewed client carrying a tenant, which is its purpose, so the
approver was added to its reviewed set deliberately. And the audience test
panicked slicing secretRef[4:], an assumption that held while the fixture had
only confidential clients; the approver is the first public one, so the loop now
guards on the env: prefix.

The declared tenant reaches the token by the GH-DEC-2026-013 gap route by
construction, and tenant_source says so: registration, never directory.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 713576@bnt-lap001
Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6

src/cmd/keycape/clients_test.go

@@ -2,6 +2,9 @@ package main
 
 import (
 	"keycape/internal/config"
+	"os"
+	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 )
@@ -12,7 +15,12 @@ func TestServiceRegistrationAudienceAndScopeIsolation(t *testing.T) {
 		t.Fatal(err)
 	}
 	for _, c := range cfg.Clients {
-		t.Setenv(c.SecretRef[4:], "test-only-secret")
+		// Public clients carry no secretRef -- the approver registration added in
+		// KEY-WP-0013-T05 is the first in this fixture. Slicing unconditionally
+		// assumed every entry was confidential, which was true when written.
+		if strings.HasPrefix(c.SecretRef, "env:") {
+			t.Setenv(c.SecretRef[len("env:"):], "test-only-secret")
+		}
 	}
 	registry, err := buildClientRegistry(cfg.Clients)
 	if err != nil {
@@ -51,6 +59,11 @@ func TestServiceRegistrationTenantsAreExactPerDecision(t *testing.T) {
 		"approval-engine-operator": "tenant:platform",
 		"codex-railiance-platform": "tenant:coulomb",
 		"secrets-engine-openbao":   "tenant:coulomb",
+		// The only browser client here, and the only registration-supplied
+		// human tenant. Reviewed and added deliberately: this guard exists so a
+		// new client carrying a tenant cannot arrive unnoticed, and it did its
+		// job when the approver registration first landed (KEY-WP-0013-T05).
+		"informed-decision-approver": "tenant:platform",
 	}
 	seen := map[string]bool{}
 	for _, c := range cfg.Clients {
@@ -69,3 +82,87 @@ func TestServiceRegistrationTenantsAreExactPerDecision(t *testing.T) {
 		}
 	}
 }
+
+// The approver registration is a human-in-the-loop control's entry point, so its
+// shape is pinned rather than left to review: a widened scope, a relaxed MFA
+// requirement or an added redirect would each be a security change that reads
+// like an edit (KEY-WP-0013-T05).
+func TestApproverRegistrationShapeIsExact(t *testing.T) {
+	cfg, err := config.Load("../../../config/service-clients.example.yaml")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var approver *config.ClientConfig
+	for i := range cfg.Clients {
+		if cfg.Clients[i].ClientID == "informed-decision-approver" {
+			approver = &cfg.Clients[i]
+		}
+	}
+	if approver == nil {
+		t.Fatal("the approver registration is absent")
+	}
+
+	// The exact string informed-decision submitted, verified live on 2026-09-10.
+	// decisions.coulomb.social, not the decide.coulomb.social of an earlier draft.
+	if len(approver.RedirectURIs) != 1 || approver.RedirectURIs[0] != "https://decisions.coulomb.social/auth/callback" {
+		t.Errorf("redirect URIs = %v; exactly one exact callback is registered", approver.RedirectURIs)
+	}
+	if approver.ClientType != "public" || len(approver.GrantTypes) != 1 || approver.GrantTypes[0] != "authorization_code" {
+		t.Errorf("client type %q grants %v; want a public authorization_code client", approver.ClientType, approver.GrantTypes)
+	}
+	// A public client must carry no secret reference: PKCE is the whole proof.
+	if approver.SecretRef != "" {
+		t.Errorf("public approver client carries a secretRef: %q", approver.SecretRef)
+	}
+	if approver.MFARequired == nil || !*approver.MFARequired {
+		t.Error("mfaRequired must be explicitly true: approval is a human-in-the-loop control")
+	}
+	if approver.Tenant != "tenant:platform" {
+		t.Errorf("tenant = %q, want tenant:platform", approver.Tenant)
+	}
+	if approver.Audience != "approval-engine" {
+		t.Errorf("audience = %q, want approval-engine", approver.Audience)
+	}
+
+	// Exactly these scopes. consume is the one that must never appear, but an
+	// unreviewed addition of any kind is what this pins.
+	want := map[string]bool{"openid": true, "approval:read": true, "approval:approve": true}
+	if len(approver.AllowedScopes) != len(want) {
+		t.Errorf("scopes = %v; want exactly %v", approver.AllowedScopes, want)
+	}
+	for _, scope := range approver.AllowedScopes {
+		if !want[scope] {
+			t.Errorf("unreviewed scope %q on the approver client", scope)
+		}
+		if scope == "approval:consume" {
+			t.Fatal("approval:consume on the human approver client")
+		}
+	}
+
+	// It must also survive startup validation. KEY-WP-0028 rejects
+	// serviceSubject and roles on a browser client, and tenant is deliberately
+	// exempt from that rule -- this asserts the exemption actually holds for the
+	// registration that depends on it, rather than only in a synthetic case.
+	key := writeTestKeyPEM(t)
+	full := &config.Config{
+		Issuer:        "https://kc.coulomb.social",
+		Port:          8080,
+		TokenLifetime: "15m",
+		PrivateKeyPEM: key,
+		Clients:       []config.ClientConfig{*approver},
+	}
+	if errs := config.ValidateConfig(full); len(errs) != 0 {
+		t.Fatalf("the approver registration fails startup validation: %v", errs)
+	}
+}
+
+// writeTestKeyPEM writes a placeholder key file; ValidateConfig checks the path
+// exists, not the key material.
+func writeTestKeyPEM(t *testing.T) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "key.pem")
+	if err := os.WriteFile(path, []byte("placeholder"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}