Approve sitting-requester CCRs and add the attended provisioner.

CCR-2026-0026/0027 are approved for the create-only informed-decision
client. Live KeyCape registration and CAS=0 custody stay in the
contained helper; no sitting POST.

Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a

tests/test_sitting_requester_provisioning.py

@@ -0,0 +1,38 @@
+import importlib.util
+from pathlib import Path
+import unittest
+
+spec = importlib.util.spec_from_file_location(
+    'sitting', Path(__file__).resolve().parents[1] / 'scripts/provision-sitting-requester.py')
+m = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(m)
+
+
+class SittingRequesterProvisioningTests(unittest.TestCase):
+    def test_contract_is_create_only_informed_decision(self):
+        m.contract()
+        self.assertEqual(m.CLIENT['clientId'], 'informed-decision-sitting-requester')
+        self.assertEqual(m.CLIENT['allowedScopes'], ['approval:create'])
+        self.assertEqual(m.CLIENT['serviceSubject'], 'informed-decision')
+        self.assertEqual(m.CCRS, ('CCR-2026-0026', 'CCR-2026-0027'))
+        self.assertNotIn('CCR-2026-0024', m.CCRS)
+        self.assertNotIn('CCR-2026-0025', m.CCRS)
+
+    def test_contract_refuses_widened_scopes(self):
+        original = list(m.CLIENT['allowedScopes'])
+        m.CLIENT['allowedScopes'] = ['approval:create', 'approval:consume']
+        with self.assertRaises(Exception):
+            m.contract()
+        m.CLIENT['allowedScopes'] = original
+
+    def test_source_keycape_registration_matches_helper(self):
+        import yaml
+        clients = yaml.safe_load(Path('/home/worsch/key-cape/config/service-clients.example.yaml').read_text())['clients']
+        named = next(c for c in clients if c['clientId'] == 'informed-decision-sitting-requester')
+        self.assertEqual(named['secretRef'], 'env:' + m.ENV_NAME)
+        self.assertEqual(named['allowedScopes'], ['approval:create'])
+        self.assertEqual(named['serviceSubject'], 'informed-decision')
+
+
+if __name__ == '__main__':
+    unittest.main()