Add sitting-requester create-only token-exchange proof.

Reader lane login, sibling-path denial, and KeyCape exchange checks.
No sitting POST. Attended wrapper selects the exact OIDC reader role.

Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a

tests/test_openbao_operator_loopback_callback.py

@@ -87,6 +87,17 @@ def test_receipt_records_apply_and_failure(tmp_path, monkeypatch):
     assert json.loads(failed.read_text())['status'] == 'bao_write_failed'
 
 
+def test_attended_wrapper_selects_sitting_requester_lane():
+    spec = importlib.util.spec_from_file_location(
+        'attended', Path(__file__).resolve().parents[1] / 'scripts/openbao-attended-exec.py')
+    wrapper = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(wrapper)
+    command = Path(__file__).resolve().parents[1] / 'scripts/prove-sitting-requester-exchange.sh'
+    lane, args = wrapper.parse_argv(['--lane', 'informed-decision-sitting-requester-login', str(command)])
+    assert lane == 'informed-decision-sitting-requester-login'
+    assert args[0] == str(command.resolve())
+
+
 def test_attended_wrapper_pins_operator_tunnel_address(monkeypatch):
     spec = importlib.util.spec_from_file_location(
         'attended', Path(__file__).resolve().parents[1] / 'scripts/openbao-attended-exec.py')

tests/test_sitting_requester_provisioning.py

@@ -34,5 +34,18 @@ class SittingRequesterProvisioningTests(unittest.TestCase):
         self.assertEqual(named['serviceSubject'], 'informed-decision')
 
 
+class SittingRequesterExchangeTests(unittest.TestCase):
+    def test_exchange_helper_does_not_post_sittings(self):
+        spec = importlib.util.spec_from_file_location(
+            'exchange', Path(__file__).resolve().parents[1] / 'scripts/prove-sitting-requester-exchange.py')
+        exchange = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(exchange)
+        source = Path(exchange.__file__).read_text()
+        self.assertNotIn('/v1/approvals', source)
+        self.assertEqual(exchange.CLIENT_ID, 'informed-decision-sitting-requester')
+        self.assertEqual(exchange.POLICY, 'workload-kv-read-informed-decision-sitting-requester-client')
+        self.assertIn('approval-requester', exchange.SIBLING)
+
+
 if __name__ == '__main__':
     unittest.main()