up

src/Scanner/__Tests/StellaOps.Scanner.Worker.Tests/SurfaceManifestStageExecutorTests.cs

@@ -228,9 +228,9 @@ public sealed class SurfaceManifestStageExecutorTests
         Assert.Equal(3, cache.Entries.Count);
     }
 
-    private static ScanJobContext CreateContext()
+    private static ScanJobContext CreateContext(Dictionary<string, string>? metadata = null)
     {
-        var lease = new FakeJobLease();
+        var lease = new FakeJobLease(metadata);
         return new ScanJobContext(lease, TimeProvider.System, DateTimeOffset.UtcNow, CancellationToken.None);
     }
 
@@ -379,6 +379,60 @@ public sealed class SurfaceManifestStageExecutorTests
         Assert.Contains(cache.Entries.Keys, key => key.Namespace == "surface.artifacts.deno.observation");
     }
 
+    [Fact]
+    public async Task ExecuteAsync_WritesDeterminismPayloadWithPinsAndSettings()
+    {
+        var metrics = new ScannerWorkerMetrics();
+        var publisher = new TestSurfaceManifestPublisher("tenant-a");
+        var cache = new RecordingSurfaceCache();
+        var environment = new TestSurfaceEnvironment("tenant-a");
+        var hash = CreateCryptoHash();
+        var determinism = new DeterminismContext(
+            fixedClock: true,
+            fixedInstantUtc: DateTimeOffset.Parse("2025-11-30T12:00:00Z"),
+            rngSeed: 4242,
+            filterLogs: true,
+            concurrencyLimit: 2);
+
+        var executor = new SurfaceManifestStageExecutor(
+            publisher,
+            cache,
+            environment,
+            metrics,
+            NullLogger<SurfaceManifestStageExecutor>.Instance,
+            hash,
+            new NullRubyPackageInventoryStore(),
+            determinism);
+
+        var leaseMetadata = new Dictionary<string, string>
+        {
+            ["determinism.feed"] = "sha256:feed",
+            ["determinism.policy"] = "sha256:policy"
+        };
+
+        var context = CreateContext(leaseMetadata);
+        PopulateAnalysis(context);
+
+        await executor.ExecuteAsync(context, CancellationToken.None);
+
+        var determinismPayload = Assert.Single(publisher.LastRequest!.Payloads, p => p.Kind == "determinism.json");
+        using var document = JsonDocument.Parse(determinismPayload.Content);
+        var root = document.RootElement;
+
+        Assert.True(root.GetProperty("fixedClock").GetBoolean());
+        Assert.Equal("2025-11-30T12:00:00+00:00", root.GetProperty("fixedInstantUtc").GetString());
+        Assert.Equal(4242, root.GetProperty("rngSeed").GetInt32());
+        Assert.True(root.GetProperty("filterLogs").GetBoolean());
+        Assert.Equal(2, root.GetProperty("concurrencyLimit").GetInt32());
+
+        var pins = root.GetProperty("pins");
+        Assert.Equal("sha256:feed", pins.GetProperty("feed").GetString());
+        Assert.Equal("sha256:policy", pins.GetProperty("policy").GetString());
+
+        Assert.True(root.TryGetProperty("merkleRoot", out var merkle));
+        Assert.False(string.IsNullOrWhiteSpace(merkle.GetString()));
+    }
+
     private sealed class RecordingSurfaceCache : ISurfaceCache
     {
         private readonly Dictionary<SurfaceCacheKey, byte[]> _entries = new();
@@ -601,11 +655,24 @@ public sealed class SurfaceManifestStageExecutorTests
 
     private sealed class FakeJobLease : IScanJobLease
     {
-        private readonly Dictionary<string, string> _metadata = new()
+        private readonly Dictionary<string, string> _metadata;
+
+        public FakeJobLease(Dictionary<string, string>? extraMetadata = null)
         {
-            ["queue"] = "tests",
-            ["job.kind"] = "unit"
-        };
+            _metadata = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase)
+            {
+                ["queue"] = "tests",
+                ["job.kind"] = "unit"
+            };
+
+            if (extraMetadata is not null)
+            {
+                foreach (var kvp in extraMetadata)
+                {
+                    _metadata[kvp.Key] = kvp.Value;
+                }
+            }
+        }
 
         public string JobId { get; } = Guid.NewGuid().ToString("n");