sprints work

src/Policy/__Tests/StellaOps.Policy.Tests/Deltas/DeltaVerdictTests.cs

@@ -141,12 +141,105 @@ public sealed class DeltaVerdictTests
     }
 
     [Fact]
-    public void Build_GeneratesUniqueVerdictId()
+    public void Build_GeneratesDeterministicVerdictId_ForIdenticalInputs()
     {
         var verdict1 = new DeltaVerdictBuilder().Build("delta:sha256:test");
         var verdict2 = new DeltaVerdictBuilder().Build("delta:sha256:test");
 
-        verdict1.VerdictId.Should().StartWith("dv:");
-        verdict1.VerdictId.Should().NotBe(verdict2.VerdictId);
+        // Content-addressed IDs are deterministic
+        verdict1.VerdictId.Should().StartWith("verdict:sha256:");
+        verdict1.VerdictId.Should().Be(verdict2.VerdictId, "identical inputs must produce identical VerdictId");
+    }
+
+    [Fact]
+    public void Build_GeneratesDifferentVerdictId_ForDifferentInputs()
+    {
+        var verdict1 = new DeltaVerdictBuilder().Build("delta:sha256:test1");
+        var verdict2 = new DeltaVerdictBuilder().Build("delta:sha256:test2");
+
+        verdict1.VerdictId.Should().StartWith("verdict:sha256:");
+        verdict2.VerdictId.Should().StartWith("verdict:sha256:");
+        verdict1.VerdictId.Should().NotBe(verdict2.VerdictId, "different inputs must produce different VerdictId");
+    }
+
+    [Theory]
+    [InlineData(10)]
+    public void Build_IsIdempotent_AcrossMultipleIterations(int iterations)
+    {
+        var driver = new DeltaDriver
+        {
+            Type = "new-reachable-cve",
+            Severity = DeltaDriverSeverity.High,
+            Description = "High severity CVE",
+            CveId = "CVE-2024-999"
+        };
+
+        var expected = new DeltaVerdictBuilder()
+            .AddBlockingDriver(driver)
+            .Build("delta:sha256:determinism-test")
+            .VerdictId;
+
+        for (int i = 0; i < iterations; i++)
+        {
+            var verdict = new DeltaVerdictBuilder()
+                .AddBlockingDriver(driver)
+                .Build("delta:sha256:determinism-test");
+
+            verdict.VerdictId.Should().Be(expected, $"iteration {i}: VerdictId must be stable");
+        }
+    }
+
+    [Fact]
+    public void Build_VerdictIdIsDeterministic_RegardlessOfDriverAddOrder()
+    {
+        var driver1 = new DeltaDriver
+        {
+            Type = "aaa-first",
+            Severity = DeltaDriverSeverity.Medium,
+            Description = "First driver"
+        };
+
+        var driver2 = new DeltaDriver
+        {
+            Type = "zzz-last",
+            Severity = DeltaDriverSeverity.Low,
+            Description = "Second driver"
+        };
+
+        // Add in one order
+        var verdict1 = new DeltaVerdictBuilder()
+            .AddWarningDriver(driver1)
+            .AddWarningDriver(driver2)
+            .Build("delta:sha256:order-test");
+
+        // Add in reverse order
+        var verdict2 = new DeltaVerdictBuilder()
+            .AddWarningDriver(driver2)
+            .AddWarningDriver(driver1)
+            .Build("delta:sha256:order-test");
+
+        // Content-addressed IDs should be same because drivers are sorted by Type
+        verdict1.VerdictId.Should().Be(verdict2.VerdictId, "drivers are sorted by Type before hashing");
+    }
+
+    [Fact]
+    public void VerdictIdGenerator_ComputeFromVerdict_MatchesOriginal()
+    {
+        var driver = new DeltaDriver
+        {
+            Type = "recompute-test",
+            Severity = DeltaDriverSeverity.Critical,
+            Description = "Test driver"
+        };
+
+        var verdict = new DeltaVerdictBuilder()
+            .AddBlockingDriver(driver)
+            .AddException("EXCEPTION-001")
+            .Build("delta:sha256:recompute-test");
+
+        var generator = new VerdictIdGenerator();
+        var recomputed = generator.ComputeVerdictId(verdict);
+
+        recomputed.Should().Be(verdict.VerdictId, "recomputed VerdictId must match original");
     }
 }