fix registry active manifest digest identity

backend/test/workspace-registry-addressed-publication.test.ts

@@ -3,10 +3,24 @@ import { mkdtemp } from "node:fs/promises";
 import { join } from "node:path";
 import {
   RegistryAddressedPublicationStore,
+  registryManifestDigest,
   type RegistryAddressedRequestV1,
 } from "../src/workspaces/registry-publication.js";
 
 describe("addressed publication", () => {
+  it("derives one order-independent digest from the exact commit and workspace identities", () => {
+    const identities = [
+      { workspaceId: "workspace-z", revision: "a".repeat(40), descriptorBlob: "b".repeat(40), manifestSha256: "c".repeat(64) },
+      { workspaceId: "workspace-a", revision: "d".repeat(40), descriptorBlob: "e".repeat(40), manifestSha256: "f".repeat(64) },
+    ] as const;
+    expect(registryManifestDigest("1".repeat(40) as any, identities)).toBe(
+      registryManifestDigest("1".repeat(40) as any, [...identities].reverse()),
+    );
+    expect(registryManifestDigest("2".repeat(40) as any, identities)).not.toBe(
+      registryManifestDigest("1".repeat(40) as any, identities),
+    );
+  });
+
   it("claims a complete pull context and advances only through legal phases", async () => {
     const root = await mkdtemp(join(process.env.TMPDIR ?? "/tmp", "thoth-pub-"));
     const runId = "a".repeat(32);