diff --git a/integrations/agentrust-confidential-workflow-harness/EDRG-FEDERATION-SOFTWARE-2026-10-16.md b/integrations/agentrust-confidential-workflow-harness/EDRG-FEDERATION-SOFTWARE-2026-10-16.md index 218d825a..710f826d 100644 --- a/integrations/agentrust-confidential-workflow-harness/EDRG-FEDERATION-SOFTWARE-2026-10-16.md +++ b/integrations/agentrust-confidential-workflow-harness/EDRG-FEDERATION-SOFTWARE-2026-10-16.md @@ -86,3 +86,13 @@ For implementation About, licensing boundaries, protocol/version pinning, dependency attribution and glossary mapping, see [REMOTE-CA2A-PEER.md](REMOTE-CA2A-PEER.md), the reproducible packet in [evidence/](evidence/), and the original [README](README.md). + +## Replay-observation qualification + +The exact old-request replay row observes a returned status 403 only. Its +original client occurrence has already been consumed, so the matrix does not +verify a second response MAC for it. The row reports +`response_authentication: not-verified`; it is not an authenticated cA2A +refusal claim. A fresh client occurrence reusing the consumed challenge can +provide a separately authenticated refusal control. The historical packet's +peer channel key is also unsigned metadata, as reported by the offline verifier. diff --git a/integrations/agentrust-confidential-workflow-harness/evidence/README.md b/integrations/agentrust-confidential-workflow-harness/evidence/README.md index 2fd9882a..e2cbf037 100644 --- a/integrations/agentrust-confidential-workflow-harness/evidence/README.md +++ b/integrations/agentrust-confidential-workflow-harness/evidence/README.md @@ -42,3 +42,11 @@ external observer independently measured the job or confidential execution. The underlying Conduit receipt log remains under the same operator. See [About, licensing, glossary and assurance boundaries](../REMOTE-CA2A-PEER.md). + +The packet's `peer_public_key` is unsigned export metadata. Comparing it to +`--peer-public` checks metadata consistency; the TRACE/companion signatures +do not cryptographically bind that channel key. The verifier reports +`peer_channel_binding: metadata-only-not-signed`. Relabelling that metadata +and supplying a different expected peer pin does not invalidate the software +signatures. Authenticate the live cA2A channel separately; offline signature +verification cannot establish which channel carried the recorded exchange. diff --git a/integrations/agentrust-confidential-workflow-harness/harness/replay_export.py b/integrations/agentrust-confidential-workflow-harness/harness/replay_export.py index 772d9f6f..454ca632 100644 --- a/integrations/agentrust-confidential-workflow-harness/harness/replay_export.py +++ b/integrations/agentrust-confidential-workflow-harness/harness/replay_export.py @@ -66,5 +66,6 @@ def verify_packet(packet: dict, *, trace_public_key: str, "independent_custody": False, "hardware_attested": False, "origin_response_authentication": "not-offline-replayable", + "peer_channel_binding": "metadata-only-not-signed", "freshness": "historical-signature-only-not-current", } diff --git a/integrations/agentrust-confidential-workflow-harness/run_remote_ca2a_matrix.py b/integrations/agentrust-confidential-workflow-harness/run_remote_ca2a_matrix.py index 44721b0d..685ac548 100644 --- a/integrations/agentrust-confidential-workflow-harness/run_remote_ca2a_matrix.py +++ b/integrations/agentrust-confidential-workflow-harness/run_remote_ca2a_matrix.py @@ -18,6 +18,20 @@ def private(path): bytes.fromhex(Path(path).read_text().strip())) + +def exact_replay_observation(response): + """Classify a transport status; consumed client state cannot verify its MAC.""" + refused = isinstance(response, dict) and response.get("status") == 403 + return { + "case": "one-time-challenge-replay", + "expected": "observed-status-403", + "observed": "observed-status-403" if refused else "unexpected", + "passed": refused, + "response_authentication": "not-verified", + "evidence_class": "live-software-two-host-same-operator", + } + + def main(): parser=argparse.ArgumentParser() parser.add_argument("--config",type=Path,required=True) @@ -99,10 +113,7 @@ def record_submit(request): return base_send(request) scenario("replay-valid-twin",valid,send=record_submit) repeated=base_send(last[0]) - replay_ok=repeated.get("status")==403 - rr={"case":"one-time-challenge-replay","expected":"authenticated-peer-denial", - "observed":"authenticated-peer-denial" if replay_ok else "unexpected", - "passed":replay_ok,"evidence_class":"live-software-two-host-same-operator"} + rr=exact_replay_observation(repeated) results.append(rr) print(json.dumps(rr,sort_keys=True),flush=True) diff --git a/integrations/agentrust-confidential-workflow-harness/tests/test_replay_reporting.py b/integrations/agentrust-confidential-workflow-harness/tests/test_replay_reporting.py new file mode 100644 index 00000000..21f03d4d --- /dev/null +++ b/integrations/agentrust-confidential-workflow-harness/tests/test_replay_reporting.py @@ -0,0 +1,32 @@ +"""Keep status observations and signed channel attribution claims explicit.""" +import copy +import unittest + +import test_replay_export as replay_fixture +from run_remote_ca2a_matrix import exact_replay_observation + + +class ReplayReportingTests(unittest.TestCase): + def test_forged_mac_cannot_be_labelled_authenticated(self): + observation = exact_replay_observation({ + "status": 403, "envelope": {"mac": "forged"}}) + self.assertTrue(observation["passed"]) + self.assertEqual(observation["observed"], "observed-status-403") + self.assertEqual(observation["response_authentication"], "not-verified") + + def test_absent_or_other_status_is_not_a_denial_observation(self): + for response in (None, {}, {"status": 200}, {"status": "403"}): + with self.subTest(response=response): + self.assertFalse(exact_replay_observation(response)["passed"]) + + def test_relabelled_unsigned_peer_is_reported_as_metadata(self): + fixture = replay_fixture.ReplayExportTests() + fixture.setUp() + packet = copy.deepcopy(fixture.packet) + packet["peer_public_key"] = "ee" * 32 + result = fixture.verify(packet, peer_public_key="ee" * 32) + self.assertTrue(result["verified"]) + self.assertEqual(result["peer_channel_binding"], "metadata-only-not-signed") + with self.assertRaises(ValueError): + fixture.verify(packet) # Original pin still rejects inconsistent metadata. + self.assertTrue(fixture.verify()["verified"])