fix(multiplayer): repair allocated compose verification

server/domain/result.go

@@ -177,7 +177,22 @@ func RatingEligible(receipt ResultReceipt) bool {
 }
 
 func validateBinding(binding WorkloadBinding) error {
-	if binding.Issuer == "" || binding.Audience == "" || binding.Namespace == "" || binding.ServiceAcct == "" || binding.PodUID == "" || binding.GameServerUID == "" || binding.AllocationID == "" || binding.MatchID == "" || binding.ServerID == "" {
+	// A Kubernetes JWT supplies the six workload-identity fields below, while
+	// the signed workload credential is deliberately bound through the durable
+	// allocation record and therefore supplies only allocation/match/server.
+	// Accept either complete authority model, but never a partial Kubernetes
+	// identity that could accidentally look authenticated.
+	if binding.AllocationID == "" || binding.MatchID == "" || binding.ServerID == "" {
+		return ErrResultBinding
+	}
+	kubernetesIdentity := []string{binding.Issuer, binding.Audience, binding.Namespace, binding.ServiceAcct, binding.PodUID, binding.GameServerUID}
+	present := 0
+	for _, value := range kubernetesIdentity {
+		if value != "" {
+			present++
+		}
+	}
+	if present != 0 && present != len(kubernetesIdentity) {
 		return ErrResultBinding
 	}
 	return nil

server/domain/result_test.go

@@ -47,6 +47,20 @@ func TestResultStoreRejectsMissingAuthoritativeTime(t *testing.T) {
 	}
 }
 
+func TestResultStoreAcceptsDurablyBoundSignedWorkloadIdentity(t *testing.T) {
+	// Signed workload tokens resolve this three-part binding from the durable
+	// allocation record; they intentionally carry no Kubernetes JWT claims.
+	binding := WorkloadBinding{AllocationID: "allocation-1", MatchID: "match-1", ServerID: "server-1"}
+	if _, err := NewResultStore(binding); err != nil {
+		t.Fatalf("signed workload binding rejected: %v", err)
+	}
+	partial := binding
+	partial.Issuer = "https://issuer"
+	if _, err := NewResultStore(partial); !errors.Is(err, ErrResultBinding) {
+		t.Fatalf("partial Kubernetes identity error = %v, want ErrResultBinding", err)
+	}
+}
+
 func TestConflictingResultIsInertAndIntegritySuppressesRating(t *testing.T) {
 	now := time.Unix(1000, 0)
 	binding := testBinding()