feature: updating attestation to use repository in sig per spec

crates/atproto-attestation/src/bin/atproto-attestation-sign.rs

···
 //!
 //! ### Remote Attestation
 //! ```bash
-//! atproto-attestation-sign remote <source_record> <repository_did> <metadata_record>
+//! atproto-attestation-sign remote <source_repository_did> <source_record> <attestation_repository_did> <metadata_record>
 //! ```
 //!
 //! ### Inline Attestation
 //! ```bash
-//! atproto-attestation-sign inline <source_record> <signing_key> <metadata_record>
+//! atproto-attestation-sign inline <source_record> <repository_did> <signing_key> <metadata_record>
 //! ```
 //!
 //! ## Arguments
 //!
+//! - `source_repository_did`: (Remote mode) DID of the repository housing the source record (prevents replay attacks)
 //! - `source_record`: JSON string or path to JSON file containing the record being attested
-//! - `repository_did`: (Remote mode) DID of the repository that will contain the remote attestation record
+//! - `attestation_repository_did`: (Remote mode) DID of the repository where the attestation proof will be stored
+//! - `repository_did`: (Inline mode) DID of the repository that will house the record (prevents replay attacks)
 //! - `signing_key`: (Inline mode) Private key string (did:key format) used to sign the attestation
 //! - `metadata_record`: JSON string or path to JSON file with attestation metadata used during CID creation
 //!
···
 //! ```bash
 //! # Remote attestation - creates proof record and strongRef
 //! atproto-attestation-sign remote \
+//!   did:plc:sourceRepo... \
 //!   record.json \
-//!   did:plc:xyz123... \
+//!   did:plc:attestationRepo... \
 //!   metadata.json
 //!
 //! # Inline attestation - embeds signature in record
 //! atproto-attestation-sign inline \
 //!   record.json \
+//!   did:plc:xyz123... \
 //!   did:key:z42tv1pb3... \
 //!   '{"$type":"com.example.attestation","purpose":"demo"}'
 //!
 //! # Read from stdin
-//! cat record.json | atproto-attestation-sign inline \
+//! cat record.json | atproto-attestation-sign remote \
+//!   did:plc:sourceRepo... \
 //!   - \
-//!   did:key:z42tv1pb3... \
+//!   did:plc:attestationRepo... \
 //!   metadata.json
 //! ```
 
···
 
 MODES:
   remote    Creates a separate proof record with strongRef reference
-            Syntax: remote <source_record> <repository_did> <metadata_record>
+            Syntax: remote <source_repository_did> <source_record> <attestation_repository_did> <metadata_record>
 
   inline    Embeds signature bytes directly in the record
-            Syntax: inline <source_record> <signing_key> <metadata_record>
+            Syntax: inline <source_record> <repository_did> <signing_key> <metadata_record>
 
 ARGUMENTS:
-  source_record      JSON string or file path to the record being attested
-  repository_did     (Remote) DID of repository containing the attestation record
-  signing_key        (Inline) Private key in did:key format for signing
-  metadata_record    JSON string or file path with attestation metadata
+  source_repository_did      (Remote) DID of repository housing the source record (for replay prevention)
+  source_record              JSON string or file path to the record being attested
+  attestation_repository_did (Remote) DID of repository where attestation proof will be stored
+  repository_did             (Inline) DID of repository that will house the record (for replay prevention)
+  signing_key                (Inline) Private key in did:key format for signing
+  metadata_record            JSON string or file path with attestation metadata
 
 EXAMPLES:
   # Remote attestation (creates proof record + strongRef):
   atproto-attestation-sign remote \\
+    did:plc:sourceRepo... \\
     record.json \\
-    did:plc:xyz123abc... \\
+    did:plc:attestationRepo... \\
     metadata.json
 
   # Inline attestation (embeds signature):
   atproto-attestation-sign inline \\
     record.json \\
+    did:plc:xyz123abc... \\
     did:key:z42tv1pb3Dzog28Q1udyieg1YJP3x1Un5vraE1bttXeCDSpW \\
     '{\"$type\":\"com.example.attestation\",\"purpose\":\"demo\"}'
 
   # Read source record from stdin:
-  cat record.json | atproto-attestation-sign inline \\
+  cat record.json | atproto-attestation-sign remote \\
+    did:plc:sourceRepo... \\
     - \\
-    did:key:z42tv1pb3... \\
+    did:plc:attestationRepo... \\
     metadata.json
 
 OUTPUT:
···
     /// Create a remote attestation with separate proof record
     ///
     /// Generates a proof record containing the CID and returns both the proof
-    /// record (to be stored in the repository) and the source record with a
-    /// strongRef attestation reference.
+    /// record (to be stored in the attestation repository) and the source record
+    /// with a strongRef attestation reference.
     #[command(visible_alias = "r")]
     Remote {
+        /// DID of the repository housing the source record (for replay attack prevention)
+        source_repository_did: String,
+
         /// Source record JSON string or file path (use '-' for stdin)
         source_record: String,
 
-        /// Repository DID that will contain the remote attestation record
-        repository_did: String,
+        /// DID of the repository where the attestation proof will be stored
+        attestation_repository_did: String,
 
         /// Attestation metadata JSON string or file path
         metadata_record: String,
···
         /// Source record JSON string or file path (use '-' for stdin)
         source_record: String,
 
+        /// Repository DID that will house the record (for replay attack prevention)
+        repository_did: String,
+
         /// Private signing key in did:key format (e.g., did:key:z...)
         signing_key: String,
 
···
 
     match args.command {
         Commands::Remote {
+            source_repository_did,
             source_record,
-            repository_did,
+            attestation_repository_did,
             metadata_record,
-        } => handle_remote_attestation(&source_record, &repository_did, &metadata_record)?,
+        } => {
+            handle_remote_attestation(&source_record, &source_repository_did, &metadata_record, &attestation_repository_did)?
+        }
 
         Commands::Inline {
             source_record,
+            repository_did,
             signing_key,
             metadata_record,
-        } => handle_inline_attestation(&source_record, &signing_key, &metadata_record)?,
+        } => handle_inline_attestation(&source_record, &repository_did, &signing_key, &metadata_record)?,
     }
 
     Ok(())
···
 ///
 /// Creates a proof record and appends a strongRef to the source record.
 /// Outputs both the proof record and the updated source record.
+///
+/// - `source_repository_did`: Used for signature binding (prevents replay attacks)
+/// - `attestation_repository_did`: Where the attestation proof record will be stored
 fn handle_remote_attestation(
     source_record: &str,
-    repository_did: &str,
+    source_repository_did: &str,
     metadata_record: &str,
+    attestation_repository_did: &str,
 ) -> Result<()> {
     // Load source record and metadata
     let record_json = load_json_input(source_record)?;
···
         return Err(anyhow!("Metadata record must be a JSON object"));
     }
 
-    // Validate repository DID
-    if !repository_did.starts_with("did:") {
+    // Validate repository DIDs
+    if !source_repository_did.starts_with("did:") {
         return Err(anyhow!(
-            "Repository DID must start with 'did:' prefix, got: {}",
-            repository_did
+            "Source repository DID must start with 'did:' prefix, got: {}",
+            source_repository_did
         ));
     }
 
-    // Create the remote attestation proof record
-    let proof_record = create_remote_attestation(&record_json, &metadata_json)
+    if !attestation_repository_did.starts_with("did:") {
+        return Err(anyhow!(
+            "Attestation repository DID must start with 'did:' prefix, got: {}",
+            attestation_repository_did
+        ));
+    }
+
+    // Create the remote attestation proof record with source repository binding
+    let proof_record = create_remote_attestation(&record_json, &metadata_json, source_repository_did)
         .context("Failed to create remote attestation proof record")?;
 
-    // Create the source record with strongRef reference
+    // Create the source record with strongRef reference pointing to attestation repository
     let attested_record =
-        create_remote_attestation_reference(&record_json, &proof_record, repository_did)
+        create_remote_attestation_reference(&record_json, &proof_record, attestation_repository_did)
             .context("Failed to create remote attestation reference")?;
 
     // Output both records
···
 /// Outputs the record with inline attestation.
 fn handle_inline_attestation(
     source_record: &str,
+    repository_did: &str,
     signing_key: &str,
     metadata_record: &str,
 ) -> Result<()> {
···
         return Err(anyhow!("Metadata record must be a JSON object"));
     }
 
+    // Validate repository DID
+    if !repository_did.starts_with("did:") {
+        return Err(anyhow!(
+            "Repository DID must start with 'did:' prefix, got: {}",
+            repository_did
+        ));
+    }
+
     // Parse the signing key
     let key_data = identify_key(signing_key)
         .with_context(|| format!("Failed to parse signing key: {}", signing_key))?;
 
-    // Create inline attestation
-    let signed_record = create_inline_attestation(&record_json, &metadata_json, &key_data)
-        .context("Failed to create inline attestation")?;
+    // Create inline attestation with repository binding
+    let signed_record =
+        create_inline_attestation(&record_json, &metadata_json, repository_did, &key_data)
+            .context("Failed to create inline attestation")?;
 
     // Output the signed record
     println!("{}", serde_json::to_string_pretty(&signed_record)?);

crates/atproto-attestation/src/bin/atproto-attestation-verify.rs

···
 //!
 //! ### Verify all signatures in a record
 //! ```bash
-//! atproto-attestation-verify <record>
+//! atproto-attestation-verify <record> <repository_did>
 //! ```
 //!
 //! ### Verify a specific attestation against a record
 //! ```bash
-//! atproto-attestation-verify <record> <attestation>
+//! atproto-attestation-verify <record> <repository_did> <attestation>
 //! ```
 //!
 //! ## Parameter Formats
···
 //!
 //! ```bash
 //! # Verify all signatures in a record from file
-//! atproto-attestation-verify ./signed_post.json
+//! atproto-attestation-verify ./signed_post.json did:plc:repo123
 //!
 //! # Verify all signatures in a record from AT-URI
-//! atproto-attestation-verify at://did:plc:abc123/app.bsky.feed.post/3k2k4j5h6g
+//! atproto-attestation-verify at://did:plc:abc123/app.bsky.feed.post/3k2k4j5h6g did:plc:abc123
 //!
 //! # Verify specific attestation against a record (both from files)
-//! atproto-attestation-verify ./record.json ./attestation.json
+//! atproto-attestation-verify ./record.json did:plc:repo123 ./attestation.json
 //!
 //! # Verify specific attestation (from AT-URI) against record (from file)
-//! atproto-attestation-verify ./record.json at://did:plc:xyz/com.example.attestation/abc123
+//! atproto-attestation-verify ./record.json did:plc:repo123 at://did:plc:xyz/com.example.attestation/abc123
 //!
 //! # Read record from stdin, verify all signatures
-//! cat signed.json | atproto-attestation-verify -
+//! cat signed.json | atproto-attestation-verify - did:plc:repo123
 //!
 //! # Verify inline JSON
-//! atproto-attestation-verify '{"$type":"app.bsky.feed.post","text":"Hello","signatures":[...]}'
+//! atproto-attestation-verify '{"$type":"app.bsky.feed.post","text":"Hello","signatures":[...]}' did:plc:repo123
 //! ```
 
 use anyhow::{Context, Result, anyhow};
-use atproto_attestation::{VerificationStatus, verify_all_signatures_with_resolver};
+use atproto_attestation::VerificationStatus;
 use clap::Parser;
 use serde_json::Value;
 use std::{
···
 /// Validates attestation signatures by reconstructing signed content and checking
 /// ECDSA signatures against embedded public keys. Supports verifying all signatures
 /// in a record or validating a specific attestation record.
+///
+/// The repository DID parameter is now REQUIRED to prevent replay attacks where
+/// attestations might be copied to different repositories.
 #[derive(Parser)]
 #[command(
     name = "atproto-attestation-verify",
···
 A command-line tool for verifying cryptographic signatures of AT Protocol records.
 
 USAGE:
-  atproto-attestation-verify <record>                 Verify all signatures in record
-  atproto-attestation-verify <record> <attestation>   Verify specific attestation
+  atproto-attestation-verify <record> <repository_did>                      Verify all signatures
+  atproto-attestation-verify <record> <repository_did> <attestation>        Verify specific attestation
 
 PARAMETER FORMATS:
   Each parameter accepts JSON strings, file paths, or AT-URIs:
···
 
 EXAMPLES:
   # Verify all signatures in a record:
-  atproto-attestation-verify ./signed_post.json
-  atproto-attestation-verify at://did:plc:abc/app.bsky.feed.post/123
+  atproto-attestation-verify ./signed_post.json did:plc:repo123
+  atproto-attestation-verify at://did:plc:abc/app.bsky.feed.post/123 did:plc:abc
 
   # Verify specific attestation:
-  atproto-attestation-verify ./record.json ./attestation.json
-  atproto-attestation-verify ./record.json at://did:plc:xyz/com.example.attestation/abc
+  atproto-attestation-verify ./record.json did:plc:repo123 ./attestation.json
+  atproto-attestation-verify ./record.json did:plc:repo123 at://did:plc:xyz/com.example.attestation/abc
 
   # Read from stdin:
-  cat signed.json | atproto-attestation-verify -
+  cat signed.json | atproto-attestation-verify - did:plc:repo123
 
 OUTPUT:
   Single record mode:   Reports each signature with ✓ (valid), ✗ (invalid), or ? (unverified)
···
     /// Record to verify - JSON string, file path, AT-URI, or '-' for stdin
     record: String,
 
+    /// Repository DID that houses the record (required for replay attack prevention)
+    repository_did: String,
+
     /// Optional attestation record to verify against the record - JSON string, file path, or AT-URI
     attestation: Option<String>,
 }
···
         return Err(anyhow!("Record must be a JSON object"));
     }
 
+    // Validate repository DID
+    if !args.repository_did.starts_with("did:") {
+        return Err(anyhow!(
+            "Repository DID must start with 'did:' prefix, got: {}",
+            args.repository_did
+        ));
+    }
+
     // Determine verification mode
     match args.attestation {
         None => {
             // Mode 1: Verify all signatures in the record
-            verify_all_mode(&record).await
+            verify_all_mode(&record, &args.repository_did).await
         }
         Some(attestation_input) => {
             // Mode 2: Verify specific attestation against record
···
                 return Err(anyhow!("Attestation must be a JSON object"));
             }
 
-            verify_attestation_mode(&record, &attestation).await
+            verify_attestation_mode(&record, &attestation, &args.repository_did).await
         }
     }
 }
···
 /// - ✓ Valid signature
 /// - ✗ Invalid signature
 /// - ? Unverified (e.g., remote attestations requiring proof record fetch)
-async fn verify_all_mode(record: &Value) -> Result<()> {
+async fn verify_all_mode(record: &Value, repository_did: &str) -> Result<()> {
     // Create an identity resolver for fetching remote attestations
     use atproto_identity::resolve::{HickoryDnsResolver, InnerIdentityResolver};
     use std::sync::Arc;
···
         identity_resolver,
     };
 
-    let reports = verify_all_signatures_with_resolver(record, None, Some(&record_resolver))
-        .await
-        .context("Failed to verify signatures")?;
+    let reports = atproto_attestation::verify_all_signatures_with_resolver(
+        record,
+        repository_did,
+        None,
+        Some(&record_resolver),
+    )
+    .await
+    .context("Failed to verify signatures")?;
 
     if reports.is_empty() {
         return Err(anyhow!("No signatures found in record"));
···
 ///
 /// The attestation should be a standalone attestation object (e.g., from a remote proof record)
 /// that will be verified against the record's content.
-async fn verify_attestation_mode(record: &Value, attestation: &Value) -> Result<()> {
+async fn verify_attestation_mode(
+    record: &Value,
+    attestation: &Value,
+    repository_did: &str,
+) -> Result<()> {
     // The attestation should have a CID field that we can use to verify
     let attestation_obj = attestation
         .as_object()
···
         .and_then(Value::as_str)
         .ok_or_else(|| anyhow!("Attestation must contain a 'cid' field"))?;
 
-    // Prepare the signing record with the attestation metadata
+    // Prepare the signing record with the attestation metadata and repository DID
     let mut signing_metadata = attestation_obj.clone();
     signing_metadata.remove("cid");
     signing_metadata.remove("signature");
 
-    let signing_record =
-        atproto_attestation::prepare_signing_record(record, &Value::Object(signing_metadata))
-            .context("Failed to prepare signing record")?;
+    let signing_record = atproto_attestation::prepare_signing_record(
+        record,
+        &Value::Object(signing_metadata),
+        repository_did,
+    )
+    .context("Failed to prepare signing record")?;
 
     // Generate the CID from the signing record
     let computed_cid =

crates/atproto-attestation/src/lib.rs

···
         return Err(AttestationError::SigMetadataMissingType);
     }
 
+    if !sig_object
+        .get("repository")
+        .and_then(Value::as_str)
+        .filter(|value| !value.is_empty())
+        .is_some()
+    {
+        return Err(AttestationError::SigMetadataMissingType);
+    }
+
     let dag_cbor_bytes = serde_ipld_dagcbor::to_vec(record)?;
     let digest = Sha256::digest(&dag_cbor_bytes);
     let multihash = Multihash::wrap(0x12, &digest)
···
 /// - Removes any existing `signatures`, `sigs`, and `$sig` fields.
 /// - Inserts the provided `attestation` metadata as the new `$sig` object.
 /// - Ensures the metadata contains a string `$type` discriminator.
+/// - Ensures the metadata contains a `repository` field with the repository DID to prevent replay attacks.
 pub fn prepare_signing_record(
     record: &Value,
     attestation: &Value,
+    repository_did: &str,
 ) -> Result<Value, AttestationError> {
     let mut prepared = record
         .as_object()
···
     {
         return Err(AttestationError::MetadataMissingSigType);
     }
+
+    // CRITICAL: Always set repository field for attestations to prevent replay attacks
+    sig_metadata.insert("repository".to_string(), Value::String(repository_did.to_string()));
 
     sig_metadata.remove("signature");
     sig_metadata.remove("cid");
···
 }
 
 /// Creates an inline attestation by signing the prepared record with the provided key.
+///
+/// Signs the prepared record with the provided key and includes the repository DID
+/// in the `$sig` metadata during CID generation to bind the attestation to a specific repository.
 pub fn create_inline_attestation(
     record: &Value,
     attestation_metadata: &Value,
+    repository_did: &str,
     signing_key: &KeyData,
 ) -> Result<Value, AttestationError> {
-    let signing_record = prepare_signing_record(record, attestation_metadata)?;
+    let signing_record = prepare_signing_record(record, attestation_metadata, repository_did)?;
     let cid = create_cid(&signing_record)?;
 
     let raw_signature = sign(signing_key, &cid.to_bytes())
···
 
     inline_object.remove("signature");
     inline_object.remove("cid");
+    inline_object.remove("repository");  // Don't include repository in final attestation object
     inline_object.insert(
         "signature".to_string(),
         json!({"$bytes": BASE64.encode(signature_bytes)}),
···
 
 /// Creates a remote attestation by generating a proof record and strongRef entry.
 ///
-/// Returns a tuple containing:
-/// - Remote proof record containing the CID for storage in a repository.
+/// Generates a proof record containing the CID with the repository DID included
+/// in the `$sig` metadata during CID generation to bind the attestation to a specific repository.
+///
+/// Returns the remote proof record for storage in a repository.
 pub fn create_remote_attestation(
     record: &Value,
     attestation_metadata: &Value,
+    repository_did: &str,
 ) -> Result<Value, AttestationError> {
     let metadata = attestation_metadata
         .as_object()
···
         .ok_or(AttestationError::MetadataMustBeObject)?;
 
     let metadata_value = Value::Object(metadata.clone());
-    let signing_record = prepare_signing_record(record, &metadata_value)?;
+    let signing_record = prepare_signing_record(record, &metadata_value, repository_did)?;
     let cid = create_cid(&signing_record)?;
 
     let mut remote_attestation = metadata.clone();
+    remote_attestation.remove("repository");  // Don't include repository in final proof record
     remote_attestation.insert("cid".to_string(), Value::String(cid.to_string()));
 
     Ok(Value::Object(remote_attestation))
···
     Ok(Value::Object(result))
 }
 
-/// Verify a single attestation entry at the specified index without a record resolver.
-///
-/// Inline signatures are reconstructed into `$sig` metadata, a CID is generated,
-/// and the signature bytes are validated against the resolved public key.
-/// Remote attestations will be reported as unverified.
+/// Verify a single attestation entry with repository binding.
 ///
-/// This is a convenience function for the common case where no record resolver is needed.
-/// For verifying remote attestations, use [`verify_signature_with_resolver`].
+/// Validates that the attestation was created for the specified repository DID
+/// to prevent replay attacks.
 pub async fn verify_signature(
     record: &Value,
     index: usize,
+    repository_did: &str,
     key_resolver: Option<&dyn KeyResolver>,
 ) -> Result<VerificationReport, AttestationError> {
     verify_signature_with_resolver::<atproto_client::record_resolver::HttpRecordResolver>(
         record,
         index,
+        repository_did,
         key_resolver,
         None,
     )
     .await
 }
 
-/// Verify a single attestation entry at the specified index with optional record resolver.
+
+
+/// Verify a single attestation entry with repository binding and optional record resolver.
 ///
-/// Inline signatures are reconstructed into `$sig` metadata, a CID is generated,
-/// and the signature bytes are validated against the resolved public key.
-/// Remote attestations can be verified if a `record_resolver` is provided to fetch
-/// the proof record via AT-URI. Without a record resolver, remote attestations are
-/// reported as unverified.
+/// Validates that the attestation was created for the specified repository DID
+/// to prevent replay attacks across different repositories.
 pub async fn verify_signature_with_resolver<R>(
     record: &Value,
     index: usize,
+    repository_did: &str,
     key_resolver: Option<&dyn KeyResolver>,
     record_resolver: Option<&R>,
 ) -> Result<VerificationReport, AttestationError>
···
         AttestationKind::Remote => {
             match record_resolver {
                 Some(resolver) => {
-                    match verify_remote_attestation(record, signature_map, resolver).await {
+                    match verify_remote_attestation(record, signature_map, repository_did, resolver).await {
                         Ok(cid) => VerificationStatus::Valid { cid },
                         Err(error) => VerificationStatus::Invalid { error },
                     }
···
             }
         }
         AttestationKind::Inline => {
-            match verify_inline_attestation(record, signature_map, key_resolver).await {
+            match verify_inline_attestation(record, signature_map, repository_did, key_resolver).await {
                 Ok(cid) => VerificationStatus::Valid { cid },
                 Err(error) => VerificationStatus::Invalid { error },
             }
···
     })
 }
 
-/// Verify all attestation entries attached to the record without a record resolver.
-///
-/// Returns a report per signature. Structural issues with the record (for
-/// example, a missing `signatures` array) are returned as an error.
+/// Verify all attestation entries with repository binding.
 ///
-/// Remote attestations will be reported as unverified. For verifying remote
-/// attestations, use [`verify_all_signatures_with_resolver`].
+/// Validates that attestations were created for the specified repository DID
+/// to prevent replay attacks.
 pub async fn verify_all_signatures(
     record: &Value,
+    repository_did: &str,
     key_resolver: Option<&dyn KeyResolver>,
 ) -> Result<Vec<VerificationReport>, AttestationError> {
     verify_all_signatures_with_resolver::<atproto_client::record_resolver::HttpRecordResolver>(
         record,
+        repository_did,
         key_resolver,
         None,
     )
     .await
 }
 
-/// Verify all attestation entries attached to the record with optional record resolver.
-///
-/// Returns a report per signature. Structural issues with the record (for
-/// example, a missing `signatures` array) are returned as an error.
+/// Verify all attestation entries with repository binding and optional record resolver.
 ///
-/// If a `record_resolver` is provided, remote attestations will be fetched and verified.
-/// Otherwise, remote attestations will be reported as unverified.
+/// Validates that all attestations were created for the specified repository DID
+/// to prevent replay attacks across different repositories.
 pub async fn verify_all_signatures_with_resolver<R>(
     record: &Value,
+    repository_did: &str,
     key_resolver: Option<&dyn KeyResolver>,
     record_resolver: Option<&R>,
 ) -> Result<Vec<VerificationReport>, AttestationError>
···
 
     for index in 0..signatures_array.len() {
         reports.push(
-            verify_signature_with_resolver(record, index, key_resolver, record_resolver).await?,
+            verify_signature_with_resolver(
+                record,
+                index,
+                repository_did,
+                key_resolver,
+                record_resolver
+            ).await?,
         );
     }
 
···
 async fn verify_remote_attestation<R>(
     record: &Value,
     signature_object: &Map<String, Value>,
+    repository_did: &str,
     record_resolver: &R,
 ) -> Result<Cid, AttestationError>
 where
···
         .ok_or(AttestationError::RecordMustBeObject)?;
     proof_metadata.remove("cid");
 
-    let signing_record = prepare_signing_record(record, &Value::Object(proof_metadata))?;
+    let signing_record = prepare_signing_record(record, &Value::Object(proof_metadata), repository_did)?;
     let computed_cid = create_cid(&signing_record)?;
 
     // Verify the CID matches
···
 async fn verify_inline_attestation(
     record: &Value,
     signature_object: &Map<String, Value>,
+    repository_did: &str,
     key_resolver: Option<&dyn KeyResolver>,
 ) -> Result<Cid, AttestationError> {
     let key_reference = signature_object
···
     let mut sig_metadata = signature_object.clone();
     sig_metadata.remove("signature");
 
-    let signing_record = prepare_signing_record(record, &Value::Object(sig_metadata))?;
+    let signing_record = prepare_signing_record(record, &Value::Object(sig_metadata), repository_did)?;
     let cid = create_cid(&signing_record)?;
     let cid_bytes = cid.to_bytes();
 
···
 
     #[test]
     fn prepare_signing_record_removes_signatures() -> Result<(), AttestationError> {
+        let repository_did = "did:plc:test";
         let record = json!({
             "$type": "app.bsky.feed.post",
             "text": "hello",
···
             "cid": "bafyignored"
         });
 
-        let prepared = prepare_signing_record(&record, &metadata)?;
+        let prepared = prepare_signing_record(&record, &metadata, repository_did)?;
         let object = prepared.as_object().unwrap();
         assert!(object.get("signatures").is_none());
         assert!(object.get("sigs").is_none());
···
             "$type": "com.example.inlineSignature"
         });
 
-        let proof_record = create_remote_attestation(&record, &metadata)?;
+        let proof_record = create_remote_attestation(&record, &metadata, "did:plc:test")?;
 
         let proof_object = proof_record
             .as_object()
···
         let private_key = generate_key(KeyType::K256Private)?;
         let public_key = to_public(&private_key)?;
         let key_reference = format!("{}", &public_key);
+        let repository_did = "did:plc:testrepository123";
 
         let base_record = json!({
             "$type": "app.example.record",
···
             "purpose": "unit-test"
         });
 
-        let signed = create_inline_attestation(&base_record, &sig_metadata, &private_key)?;
+        let signed = create_inline_attestation(
+            &base_record,
+            &sig_metadata,
+            repository_did,
+            &private_key,
+        )?;
 
-        let report = verify_signature(&signed, 0, None).await?;
+        let report = verify_signature(&signed, 0, repository_did, None).await?;
         match report.status {
             VerificationStatus::Valid { .. } => {}
             other => panic!("expected valid signature, got {:?}", other),
···
         let public_key = to_public(&private_key)?;
         let key_multibase = format!("{}", &public_key);
         let key_reference = "did:plc:resolvertest#atproto".to_string();
+        let repository_did = "did:plc:resolvertest";
 
         let document = DocumentBuilder::new()
             .id("did:plc:resolvertest")
···
             "scope": "resolver"
         });
 
-        let signed = create_inline_attestation(&base_record, &sig_metadata, &private_key)?;
+        let signed = create_inline_attestation(
+            &base_record,
+            &sig_metadata,
+            repository_did,
+            &private_key,
+        )?;
 
-        let report = verify_signature(&signed, 0, Some(&key_resolver)).await?;
+        let report =
+            verify_signature(&signed, 0, repository_did, Some(&key_resolver))
+                .await?;
         match report.status {
             VerificationStatus::Valid { .. } => {}
             other => panic!("expected valid signature, got {:?}", other),
···
 
     #[tokio::test]
     async fn verify_all_signatures_reports_remote() -> Result<(), Box<dyn std::error::Error>> {
+        let repository_did = "did:plc:example";
         let record = json!({
             "$type": "app.example.record",
             "signatures": [
···
             ]
         });
 
-        let reports = verify_all_signatures(&record, None).await?;
+        let reports = verify_all_signatures(&record, repository_did, None).await?;
         assert_eq!(reports.len(), 1);
         match &reports[0].status {
             VerificationStatus::Unverified { reason } => {
···
         let private_key = generate_key(KeyType::K256Private)?;
         let public_key = to_public(&private_key)?;
         let key_reference = format!("{}", &public_key);
+        let repository_did = "did:plc:tampertest";
 
         let base_record = json!({
             "$type": "app.example.record",
···
             "key": key_reference
         });
 
-        let mut signed = create_inline_attestation(&base_record, &sig_metadata, &private_key)?;
+        let mut signed = create_inline_attestation(
+            &base_record,
+            &sig_metadata,
+            repository_did,
+            &private_key,
+        )?;
         if let Some(object) = signed.as_object_mut() {
             object.insert("body".to_string(), json!("tampered"));
         }
 
-        let report = verify_signature(&signed, 0, None).await?;
+        let report = verify_signature(&signed, 0, repository_did, None).await?;
         match report.status {
             VerificationStatus::Invalid { .. } => {}
             other => panic!("expected invalid signature, got {:?}", other),
         }
+
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn verify_repository_field_prevents_replay_attack(
+    ) -> Result<(), Box<dyn std::error::Error>> {
+        let private_key = generate_key(KeyType::K256Private)?;
+        let public_key = to_public(&private_key)?;
+        let key_reference = format!("{}", &public_key);
+        let original_repository = "did:plc:originalrepo";
+        let attacker_repository = "did:plc:attackerrepo";
+
+        let base_record = json!({
+            "$type": "app.example.record",
+            "body": "Important content"
+        });
+
+        let sig_metadata = json!({
+            "$type": "com.example.inlineSignature",
+            "key": key_reference,
+            "purpose": "original-attestation"
+        });
+
+        // Create attestation for original repository
+        let signed = create_inline_attestation(
+            &base_record,
+            &sig_metadata,
+            original_repository,
+            &private_key,
+        )?;
+
+        // Verify succeeds with correct repository
+        let report =
+            verify_signature(&signed, 0, original_repository, None).await?;
+        match report.status {
+            VerificationStatus::Valid { .. } => {}
+            other => panic!("expected valid signature for original repo, got {:?}", other),
+        }
+
+        // Verify FAILS with different repository (simulating replay attack)
+        let report =
+            verify_signature(&signed, 0, attacker_repository, None).await?;
+        match report.status {
+            VerificationStatus::Invalid { .. } => {}
+            other => panic!(
+                "expected invalid signature for attacker repo, got {:?}",
+                other
+            ),
+        }
+
+        Ok(())
+    }
+
+    #[test]
+    fn prepare_signing_record_enforces_repository() -> Result<(), AttestationError> {
+        let record = json!({
+            "$type": "app.example.record",
+            "text": "Test content"
+        });
+
+        let metadata = json!({
+            "$type": "com.example.attestationType",
+            "purpose": "test"
+        });
+
+        let repository_did = "did:plc:testrepo123";
+
+        // Prepare with repository field
+        let prepared = prepare_signing_record(&record, &metadata, repository_did)?;
+        let prepared_obj = prepared.as_object().unwrap();
+        let sig_obj = prepared_obj.get("$sig").unwrap().as_object().unwrap();
+
+        // Verify repository field is set correctly
+        assert_eq!(
+            sig_obj.get("repository").and_then(Value::as_str),
+            Some(repository_did)
+        );
+
+        // Verify $type is preserved
+        assert_eq!(
+            sig_obj.get("$type").and_then(Value::as_str),
+            Some("com.example.attestationType")
+        );
+
+        // Verify original metadata fields are preserved
+        assert_eq!(
+            sig_obj.get("purpose").and_then(Value::as_str),
+            Some("test")
+        );
 
         Ok(())
     }