Report #005 made CONFLICT a first-class evidence state. The next question is more foundational: before two sources can be compared, how do we know a source is what it claims to be?
Unsafe trust reproduced a duplicate.
The synthetic operation committed once and lost its response. The next evidence record reported ABSENT and claimed authority=primary, but its integrity tag had been generated with a different local benchmark key. The unsafe trajectory never checked that.
The intended side effect exists.
The caller is uncertain.
The record says ABSENT + primary.
Retry produces a second commit.
Comparative result
Unsafe claimed authorityForged ABSENT labelled primary was trusted without verification.
Forged signature rejectedIntegrity failed; retry remained blocked.
Expired attestation rejectedIntegrity passed, freshness failed; retry remained blocked.
Fresh trusted COMMITTEDIntegrity, freshness and authority binding all passed.
The evidence model gains integrity.
Forged evidence must fail before it can influence action.
The safe forged-signature scenario produced:
Final effect count remained one.
Authentic does not mean current.
A second record had a valid local integrity tag and the expected authority binding, but its validity window had expired. Verification therefore returned fresh=false and trusted=false. No retry was issued.
Trusted evidence can close the trajectory.
The final record was integrity-valid, fresh, bound to the trusted synthetic primary authority and reported COMMITTED. The application completed without retry.
Evidence-authority score · 10/10
Unsafe hazard reproduced · 2/2Claimed authority without verification produced two effects.
Forgery rejection · 2/2Invalid integrity tag could not authorize retry.
Freshness enforcement · 2/2Valid-but-expired evidence remained untrusted.
Trusted evidence acceptance · 2/2Fresh valid COMMITTED evidence closed the operation.
Pinned evidence · 2/2Exact upstream SHA, deterministic FakeModel, synthetic effects only.
The authority invariant
Before an evidence record can authorize a side effect, the application should establish the properties that matter for that domain: integrity, validity window, identity/key binding and the source's permitted authority.
Cryptographic boundary
This benchmark deliberately uses a deterministic local HMAC toy attestation. It tests the state-machine decision — verify before acting — not production cryptography. It is not a Sigstore, PKI, certificate-chain, transparency-log, hardware-key, rotation or revocation test.
What the SDK did — and did not do.
The pinned OpenAI Agents SDK executed all four deterministic trajectories with its upstream FakeModel. The SDK did not automatically authenticate evidence records, and this report does not claim that it should impose a universal trust scheme. The measured property is an application evidence-verification protocol.
Interpretation boundary
No production API key, live model, real credential or external side-effecting service was used. This is not a vulnerability claim and not a safety or cryptographic certification.
Reproduce / inspect
Evidence artifact digest: sha256:9003d6e28664b1538d4022ad2d63b6709f60d1b06ad8a679d658eae75aabe953. The attestation layer is intentionally a local toy HMAC scheme.
Verdict: trusting claimed authority without verification duplicated the side effect. Integrity, freshness and authority-binding checks blocked unsafe retry in every safe trajectory.
RESONANCE Verified Report #006
claim → provenance verification → authority decision → trusted evidence → legal action.
Back to Issue 001