fix(evidence): qualify replay status and unsigned peer metadata for upstream #330

integrations/agentrust-confidential-workflow-harness/EDRG-FEDERATION-SOFTWARE-2026-10-16.md

@@ -86,3 +86,13 @@ For implementation About, licensing boundaries, protocol/version pinning,
 dependency attribution and glossary mapping, see
 [REMOTE-CA2A-PEER.md](REMOTE-CA2A-PEER.md), the reproducible packet in
 [evidence/](evidence/), and the original [README](README.md).
+
+## Replay-observation qualification
+
+The exact old-request replay row observes a returned status 403 only. Its
+original client occurrence has already been consumed, so the matrix does not
+verify a second response MAC for it. The row reports
+`response_authentication: not-verified`; it is not an authenticated cA2A
+refusal claim. A fresh client occurrence reusing the consumed challenge can
+provide a separately authenticated refusal control. The historical packet's
+peer channel key is also unsigned metadata, as reported by the offline verifier.

integrations/agentrust-confidential-workflow-harness/evidence/README.md

@@ -42,3 +42,11 @@ external observer independently measured the job or confidential execution.
 The underlying Conduit receipt log remains under the same operator.
 
 See [About, licensing, glossary and assurance boundaries](../REMOTE-CA2A-PEER.md).
+
+The packet's `peer_public_key` is unsigned export metadata. Comparing it to
+`--peer-public` checks metadata consistency; the TRACE/companion signatures
+do not cryptographically bind that channel key. The verifier reports
+`peer_channel_binding: metadata-only-not-signed`. Relabelling that metadata
+and supplying a different expected peer pin does not invalidate the software
+signatures. Authenticate the live cA2A channel separately; offline signature
+verification cannot establish which channel carried the recorded exchange.

integrations/agentrust-confidential-workflow-harness/harness/replay_export.py

@@ -66,5 +66,6 @@ def verify_packet(packet: dict, *, trace_public_key: str,
         "independent_custody": False,
         "hardware_attested": False,
         "origin_response_authentication": "not-offline-replayable",
+        "peer_channel_binding": "metadata-only-not-signed",
         "freshness": "historical-signature-only-not-current",
     }

integrations/agentrust-confidential-workflow-harness/run_remote_ca2a_matrix.py

@@ -18,6 +18,20 @@ def private(path):
         bytes.fromhex(Path(path).read_text().strip()))
 
 
+
+def exact_replay_observation(response):
+    """Classify a transport status; consumed client state cannot verify its MAC."""
+    refused = isinstance(response, dict) and response.get("status") == 403
+    return {
+        "case": "one-time-challenge-replay",
+        "expected": "observed-status-403",
+        "observed": "observed-status-403" if refused else "unexpected",
+        "passed": refused,
+        "response_authentication": "not-verified",
+        "evidence_class": "live-software-two-host-same-operator",
+    }
+
+
 def main():
     parser=argparse.ArgumentParser()
     parser.add_argument("--config",type=Path,required=True)
@@ -99,10 +113,7 @@ def record_submit(request):
         return base_send(request)
     scenario("replay-valid-twin",valid,send=record_submit)
     repeated=base_send(last[0])
-    replay_ok=repeated.get("status")==403
-    rr={"case":"one-time-challenge-replay","expected":"authenticated-peer-denial",
-        "observed":"authenticated-peer-denial" if replay_ok else "unexpected",
-        "passed":replay_ok,"evidence_class":"live-software-two-host-same-operator"}
+    rr=exact_replay_observation(repeated)
     results.append(rr)
     print(json.dumps(rr,sort_keys=True),flush=True)
 

integrations/agentrust-confidential-workflow-harness/tests/test_replay_reporting.py

@@ -0,0 +1,32 @@
+"""Keep status observations and signed channel attribution claims explicit."""
+import copy
+import unittest
+
+import test_replay_export as replay_fixture
+from run_remote_ca2a_matrix import exact_replay_observation
+
+
+class ReplayReportingTests(unittest.TestCase):
+    def test_forged_mac_cannot_be_labelled_authenticated(self):
+        observation = exact_replay_observation({
+            "status": 403, "envelope": {"mac": "forged"}})
+        self.assertTrue(observation["passed"])
+        self.assertEqual(observation["observed"], "observed-status-403")
+        self.assertEqual(observation["response_authentication"], "not-verified")
+
+    def test_absent_or_other_status_is_not_a_denial_observation(self):
+        for response in (None, {}, {"status": 200}, {"status": "403"}):
+            with self.subTest(response=response):
+                self.assertFalse(exact_replay_observation(response)["passed"])
+
+    def test_relabelled_unsigned_peer_is_reported_as_metadata(self):
+        fixture = replay_fixture.ReplayExportTests()
+        fixture.setUp()
+        packet = copy.deepcopy(fixture.packet)
+        packet["peer_public_key"] = "ee" * 32
+        result = fixture.verify(packet, peer_public_key="ee" * 32)
+        self.assertTrue(result["verified"])
+        self.assertEqual(result["peer_channel_binding"], "metadata-only-not-signed")
+        with self.assertRaises(ValueError):
+            fixture.verify(packet)  # Original pin still rejects inconsistent metadata.
+        self.assertTrue(fixture.verify()["verified"])