test: harden result annotation reconciliation

server/domain/result.go

@@ -94,6 +94,24 @@ func (s *ResultStore) Submit(resultID string, result MatchResult, binding Worklo
 	return receipt, true, nil
 }
 
+// ResultAnnotation is the non-secret Agones spool representation. Its
+// signature is checked by the workload-credential adapter before Reconcile;
+// the digest check here prevents annotation/payload drift even after trust
+// has been established.
+type ResultAnnotation struct {
+	ResultID      string
+	Result        MatchResult
+	PayloadDigest [32]byte
+	Signature     []byte
+}
+
+func (s *ResultStore) Reconcile(annotation ResultAnnotation, verify func(ResultAnnotation) bool, binding WorkloadBinding, now time.Time) (ResultReceipt, bool, error) {
+	if len(annotation.Signature) == 0 || verify == nil || !verify(annotation) || annotation.PayloadDigest != resultDigest(annotation.Result) {
+		return ResultReceipt{}, false, ErrResultBinding
+	}
+	return s.Submit(annotation.ResultID, annotation.Result, binding, now)
+}
+
 func (s *ResultStore) Commit(resultID, matchID string, now time.Time) (ResultReceipt, error) {
 	receipt, ok := s.receipts[matchID]
 	if !ok || receipt.ResultID != resultID {