feat(production): add attestation and replay HA gates

[thinksyncs]

Summary

• Add an unreleased Azure SEV-SNP Attestation token-to-ASB result bridge.
• Add Redis/Valkey replica acknowledgement and a real failover qualification gate.

Changes

• Verify Azure Attestation RS256 tokens against a pinned issuer and key snapshot.
• Enforce exact binder challenge, policy hash, measurement, guest SVN, debug, migration, and freshness checks.
• Support crypto.Signer for KMS/HSM-backed bridge signing.
• Run WAIT on the same Redis connection after a successful replay insert and fail closed on insufficient acknowledgements.
• Add a two-phase seed/verify command for real multi-node failover testing.
• Add CI/red-team wiring, deployment runbooks, compatibility notes, and evidence boundaries.

Testing

• make product-security-gate
• go test -race -count=1 ./pkg/production ./cmd/redis-failover-redteam
• go vet ./pkg/production ./cmd/redis-failover-redteam
• git diff --check

Notes

• No live Azure confidential-VM token run is claimed; no self-hosted runner or Azure CLI is available in the current environment.
• No live managed Redis/Valkey failover is claimed; the private endpoint and provider control plane are deployment inputs.
• Beads asb-vdf.2 and asb-vdf.3 track those external evidence gates separately.

[Copilot]

Pull request overview

This PR extends the production profile with (1) an Azure SEV-SNP attestation token → ASB attestation-result bridge (pinned issuer + key snapshot, strict claim/binding checks), and (2) a higher-assurance Redis/Valkey replay gate using same-connection WAIT replica acknowledgements plus a two-phase failover qualification command and runbooks.

Changes:

• Add production.AzureMAATokenVerifier + production.AzureSNPAttestationBridge with strict issuer/key/lifetime verification and exact binder-derived nonce enforcement.
• Add optional Redis/Valkey replica acknowledgement (WAIT) after successful SET NX PX, and tests that fail closed on insufficient acks.
• Add cmd/redis-failover-redteam (seed/verify) and documentation/CI wiring for deployment qualification gates.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
README.md	Documents new bridge and Redis failover runbook entries and evidence scope.
pkg/production/redis.go	Adds replica-ack WAIT gate after successful replay insert, plus config validation and RESP integer support.
pkg/production/redis_test.go	Extends Redis adapter tests to require replica ack and to reject insufficient replication.
pkg/production/azure_snp_bridge.go	Implements Azure RS256 token verification (pinned issuer + key snapshot) and token→ASB result issuance with strict policy/binding checks.
pkg/production/azure_snp_bridge_test.go	Adds positive/negative coverage for Azure bridge verification and issuance invariants.
Makefile	Includes the new failover red-team command package in the security gate test target.
docs/redis-failover-runbook.md	Adds deployment runbook for multi-node replay topology and failover qualification using the new command.
docs/production-deployment-profile.md	Updates production profile to describe unreleased Azure bridge + Redis WAIT option and associated qualification requirements.
docs/live-red-team-report.md	Updates red-team report entries to include the new bridge and replay HA gates, clarifying evidence boundaries.
docs/azure-sev-snp-attestation-bridge.md	Documents the Azure bridge boundary, exact binding, appraisal inputs, and real-hardware qualification steps.
docs/API_COMPATIBILITY.md	Marks the bridge and failover command as unreleased/outside supported surface until a minor release.
cmd/redis-failover-redteam/main.go	Adds the seed/verify failover qualification tool using the production Redis adapter over TLS.
cmd/redis-failover-redteam/main_test.go	Adds unit tests covering seed/verify behavior, lost-write detection, TTL expiry, and state file permission constraints.
CHANGELOG.md	Adds Unreleased notes for the Azure bridge, replica ack, and failover qualification tooling.
.github/workflows/security-red-team.yaml	Ensures red-team workflow runs on changes affecting the new command and docs, and executes its tests.
.github/workflows/main.yaml	Adds the new command package to main CI unit and red-team test runs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.