[woksin]

Summary

DPoP replay protection is more predictable when Redis is slow or a request lacks scope, and the Redis replay store is now covered by specs that run against a real Redis.

Changed

• A valid DPoP proof that lacks the required scope now gets HTTP 403 insufficient_scope without reserving its proof identifier. Successful authorization still requires an atomic replay reservation. (Real-Redis integration spec for the DPoP jti replay store #302)
• The replay-store health check now gives up after a bounded wait and fails closed, rejecting the request, instead of holding requests while Redis is unresponsive. (Real-Redis integration spec for the DPoP jti replay store #302)

[woksin]

Folded items

• l113-302-redis-replay-specs at 8b1f3ab2e4199f1f001569aa5651a211a55bffbb; cancelled runs: none

Verification

build: train-h-build (2026-11-12T20:02:11.073053Z)

[woksin]

Reviewer notes

• New Source/AuthProxy.Integration.Specs (Testcontainers Redis): cross-replica reservation, Redis restart without replay evidence, replica/Redis clock disagreement, quarantined replay coverage. The project is a test project only when RunRedisReplaySpecs=true, so solution-level dotnet test stays container-free; the new path-filtered Redis replay specs job (part of gate) opts in.
• Local gate on the train head: Release build with warnings as errors, AuthProxy.Specs (6,432) and AuthProxy.Security.Specs (1,595) green. The Redis specs have not run locally; their first run is this PR's CI.
• Code Health: RedisDpopReplayStore.cs 9.58 -> 9.50, when_caching_replay_store_health.cs 10 -> 9.68 (both at or above 9.5, one refactor pass; the added defensive checks and data-driven cases account for the drop).
• Two review rounds (deep, security lens); the second passed with no findings.

Supersedes #341. Adds one spec-only fix on top of it: the Redis replay specs share one Redis instance, so the final assertion now ignores a synthetic-proof key left by the sibling spec. Product code is identical to #341, whose unit specs passed locally; this head passed a local Release build with warnings as errors.