test: harden result annotation reconciliation

server/domain/result.go

@@ -94,6 +94,24 @@ func (s *ResultStore) Submit(resultID string, result MatchResult, binding Worklo
 	return receipt, true, nil
 }
 
+// ResultAnnotation is the non-secret Agones spool representation. Its
+// signature is checked by the workload-credential adapter before Reconcile;
+// the digest check here prevents annotation/payload drift even after trust
+// has been established.
+type ResultAnnotation struct {
+	ResultID      string
+	Result        MatchResult
+	PayloadDigest [32]byte
+	Signature     []byte
+}
+
+func (s *ResultStore) Reconcile(annotation ResultAnnotation, verify func(ResultAnnotation) bool, binding WorkloadBinding, now time.Time) (ResultReceipt, bool, error) {
+	if len(annotation.Signature) == 0 || verify == nil || !verify(annotation) || annotation.PayloadDigest != resultDigest(annotation.Result) {
+		return ResultReceipt{}, false, ErrResultBinding
+	}
+	return s.Submit(annotation.ResultID, annotation.Result, binding, now)
+}
+
 func (s *ResultStore) Commit(resultID, matchID string, now time.Time) (ResultReceipt, error) {
 	receipt, ok := s.receipts[matchID]
 	if !ok || receipt.ResultID != resultID {

server/domain/result_test.go

@@ -61,6 +61,23 @@ func TestConflictingResultIsInertAndIntegritySuppressesRating(t *testing.T) {
 	}
 }
 
+func TestAnnotationReconcileChecksSignatureAndDigest(t *testing.T) {
+	now := time.Unix(1000, 0)
+	binding := testBinding()
+	store, _ := NewResultStore(binding)
+	result := testResult()
+	annotation := ResultAnnotation{ResultID: "result-1", Result: result, PayloadDigest: resultDigest(result), Signature: []byte("sig")}
+	verify := func(candidate ResultAnnotation) bool { return string(candidate.Signature) == "sig" }
+	if _, created, err := store.Reconcile(annotation, verify, binding, now); err != nil || !created {
+		t.Fatalf("valid annotation = created=%v err=%v", created, err)
+	}
+	forged := annotation
+	forged.Result.Team0Score = 99
+	if _, _, err := store.Reconcile(forged, verify, binding, now); !errors.Is(err, ErrResultBinding) {
+		t.Fatalf("forged annotation accepted: %v", err)
+	}
+}
+
 func TestResultDeliveryHealthSeparatesOutageFromIntegrity(t *testing.T) {
 	now := time.Unix(1000, 0)
 	binding := testBinding()