feat(k1): add physical acceptance transport

tests/test_cli.py

@@ -25,6 +25,41 @@ def test_doctor_json() -> None:
     assert any(item["name"] == "tcpdump" for item in payload["tools"])
 
 
+def test_authority_provision_requires_explicit_reviewed_value_confirmation() -> None:
+    result = runner.invoke(app, ["authority", "provision"])
+
+    assert result.exit_code == 2
+    assert "provisioning not confirmed" in result.stdout
+
+
+def test_authority_provision_never_accepts_the_secret_as_a_cli_value(monkeypatch: Any) -> None:
+    calls = 0
+
+    class FakeSnapshot:
+        service = "fixed-service"
+        account = "fixed-account"
+
+    class FakeProvisioner:
+        def provision_interactively(self) -> FakeSnapshot:
+            nonlocal calls
+            calls += 1
+            return FakeSnapshot()
+
+    monkeypatch.setattr(
+        "k1link.device_plugins.xgrids_k1.cli.MacOSKeychainApplicationAuthorityProvisioner",
+        FakeProvisioner,
+    )
+    result = runner.invoke(
+        app,
+        ["authority", "provision", "--confirm-reviewed-authority"],
+    )
+
+    assert result.exit_code == 0
+    assert calls == 1
+    assert "Keychain item validated" in result.stdout
+    assert "No K1 command was sent" in " ".join(result.stdout.split())
+
+
 def test_mqtt_capture_requires_owned_device_confirmation(tmp_path: Path) -> None:
     result = runner.invoke(
         app,