up

src/Scanner/__Tests/StellaOps.Scanner.Worker.Tests/SurfaceManifestStageExecutorTests.cs

@@ -25,6 +25,7 @@ using StellaOps.Scanner.Worker.Processing.Surface;
 using StellaOps.Scanner.Worker.Tests.TestInfrastructure;
 using Xunit;
 using StellaOps.Cryptography;
+using StellaOps.Scanner.Worker.Determinism;
 
 namespace StellaOps.Scanner.Worker.Tests;
 
@@ -99,6 +100,7 @@ public sealed class SurfaceManifestStageExecutorTests
         Assert.True(context.Analysis.TryGet<SurfaceManifestPublishResult>(ScanAnalysisKeys.SurfaceManifest, out var result));
         Assert.NotNull(result);
         Assert.Equal(publisher.LastManifestDigest, result!.ManifestDigest);
+        Assert.Equal(result.DeterminismMerkleRoot, publisher.LastRequest!.DeterminismMerkleRoot);
 
         Assert.Equal(4, cache.Entries.Count);
         Assert.Contains(cache.Entries.Keys, key => key.Namespace == "surface.artifacts.entrytrace.graph" && key.Tenant == "tenant-a");
@@ -163,6 +165,10 @@ public sealed class SurfaceManifestStageExecutorTests
         Assert.Equal("feed-001", json.RootElement.GetProperty("pins").GetProperty("feed").GetString());
         Assert.Equal("rev-77", json.RootElement.GetProperty("pins").GetProperty("policy").GetString());
         Assert.True(json.RootElement.GetProperty("artifacts").EnumerateObject().Any());
+
+        Assert.True(context.Analysis.TryGet<DeterminismEvidence>(ScanAnalysisKeys.DeterminismEvidence, out var evidence));
+        Assert.False(string.IsNullOrWhiteSpace(evidence!.MerkleRootSha256));
+        Assert.Equal(evidence.PayloadHashes["entrytrace.ndjson"], json.RootElement.GetProperty("artifacts").GetProperty("entrytrace.ndjson").GetString());
     }
 
     [Fact]
@@ -500,7 +506,8 @@ public sealed class SurfaceManifestStageExecutorTests
                 ManifestDigest: manifestDigest,
                 ManifestUri: $"cas://test/manifests/{manifestDigest}",
                 ArtifactId: $"surface-manifest::{manifestDigest}",
-                Document: document);
+                Document: document,
+                DeterminismMerkleRoot: request.DeterminismMerkleRoot);
 
             return Task.FromResult(result);
         }