[the-sarge]

Change

Upstream context: cfrg/draft-irtf-cfrg-cpace#21, including the editor discussion of rejecting reflected equal tags. The upstream clarification is pending publication; this PR is justified by the package-specific regression described below.

When public shares and associated data match, the previous responder accepts its own authentic B tag reflected as C before initiator confirmation. Both Finish paths now reject an otherwise valid peer tag equal to the local tag with ErrConfirmationFailed, before returning a Session or initiator C. No feasible network attack forcing equal shares with fresh production randomness was established.

Adds regression coverage for both roles, production randomness and forced equality, empty/equal/different AD, authentic-tag replay, no outputs on failure, state consumption, cleanup, and honest controls. Documents the security reasoning and narrow behavior-freeze exception. API, wire bytes, MAC derivation, and dependencies are unchanged.

Validation and limits

• Full task check, focused reflection/draft-vector tests, and go mod verify passed at source d2db6ee.
• Exact-source transcript and checksums: docs/evidence/308-reflection-20260923/.
• Analysis: docs/key-confirmation-reflection.md.
• Older dependency/SAST, Capslock, security/spec/vector, and paired long-fuzz evidence does not cover this change. Refresh the affected lanes before stronger release claims; this PR makes none.

Review budget: one fully briefed RAS review, accepted-finding verification if needed, and at most one replacement review, followed by exact pushed-head local certification and all live required hosted checks.

Closes #308

Completed review and local certification

Reviewed and certified live PR head: 2a1500fa6c62bf21987937b572a3c9018e9b8761, base 87528342d68d26db4a5a69386ae5647baf7d05ed.

• Initial RAS run 20260923T181926-6341a5b2c1f098b8d4fb7a12: zero findings / Fix First / follow-ups. Four R1 reviewers completed (Codex Astra, Codex Sol, Claude Opus, Grok); Claude Fable failed at process launch. Configured quorum was met and synthesis completed. The run did not post a RAS review to GitHub.
• Independent dispositions: fix-now 0, defer 0, reject 0, stop-for-decision 0. Contract closure not triggered: no accepted findings. No verification or replacement review required under the bounded loop.
• Exact-head local certification: focused reflection/vector tests, full task --silent check, and go mod verify all passed from the clean pushed head. The earlier committed source-validation packet remains accurately pinned to its source commit.
• All four live required checks passed. Fresh post-ready CI run 35902177502 also passed on the exact reviewed head, using the existing workflow_dispatch entrypoint because this repository's CI does not subscribe to ready_for_review.

Exact-head local certification transcript

UTC 2026-09-23T18:23:20.740283+00:00
$ git rev-parse HEAD origin/main
2a1500fa6c62bf21987937b572a3c9018e9b8761
87528342d68d26db4a5a69386ae5647baf7d05ed
exit_code=0

UTC 2026-09-23T18:23:20.751078+00:00
$ git status --short --branch
## codex/308-reflection-regressions...origin/codex/308-reflection-regressions
exit_code=0

UTC 2026-09-23T18:23:20.764757+00:00
$ go version
go version go1.27.1 darwin/arm64
exit_code=0

UTC 2026-09-23T18:23:20.772111+00:00
$ go test -run ^(TestReflection|TestRistrettoDraft21Vectors|TestIRTranscriptDraftVectorFlow) -count=1 .
ok  	github.com/the-sarge/cpace	0.187s
exit_code=0

UTC 2026-09-23T18:23:21.121869+00:00
$ task --silent check
release helper smoke tests passed
ok  	github.com/the-sarge/cpace/tools/releasepolicy	0.222s
release policy checker passed
CI change classifier tests passed
Go tool helper tests passed
Fuzz input validator tests passed
ok  	github.com/the-sarge/cpace/tools/evidencebaseline	0.361s
evidence baseline checker passed
ok  	github.com/the-sarge/cpace	(cached)
ok  	github.com/the-sarge/cpace	(cached)
0 issues.
No vulnerabilities found.
exit_code=0

UTC 2026-09-23T18:23:31.836384+00:00
$ go mod verify
all modules verified
exit_code=0

Final HEAD and clean worktree verified: 2a1500fa6c62bf21987937b572a3c9018e9b8761

[the-sarge]

Upstream context: cfrg/draft-irtf-cfrg-cpace#21 reports false explicit key confirmation when equal protocol messages and authentication tags are reflected. The editor proposal describes rejecting equal reflected tags; the September 22 update reports approval to incorporate clarification during RFC Editor review. As checked on September 23, the upstream PR remains open and draft-21 is still the published revision.

This package's A/B/C ordering withholds the initiator tag until responder verification, so the upstream single-run initiator attack does not transfer directly. Internal deterministic fixtures nevertheless reproduce a conditional false-confirmation path: with equal shares and equal AD, the responder accepts its own authentic B tag reflected into C before initiator Finish. No feasible network attack forcing that condition with fresh production randomness was established.

This PR adds the narrow equal-tag rejection in both Finish paths, preserving the MAC derivation and wire format. Tests cover authentic-tag reflection, empty/equal/different AD, forced equality, no Session or initiator C on rejection, state consumption/cleanup, and honest controls. The implementation-specific finding justifies the correction; final RFC wording still needs checking when the targeted specification is updated.