Migrate NPC registry durable contract

internal/modules/dnd/npcs/identity/identity.go

@@ -5,6 +5,7 @@ package identity
 import (
 	"crypto/sha256"
 	"encoding/hex"
+	"encoding/json"
 	"fmt"
 	"strings"
 
@@ -17,7 +18,7 @@ import (
 const (
 	// Policy identifies the complete identity comparison and ID derivation
 	// policy. A future semantic change must use a new value.
-	Policy = "dnd.npcs.identity.v1"
+	Policy = "dnd.npc_registry.identity.v1"
 	// IdentityPolicy is an explicit alias for callers recording policy
 	// fingerprints.
 	IdentityPolicy = Policy
@@ -72,7 +73,11 @@ func DeriveID(name string) string {
 	if key == "" {
 		return ""
 	}
-	digest := sha256.Sum256([]byte(key))
+	identity, err := json.Marshal([]string{Policy, key})
+	if err != nil {
+		return ""
+	}
+	digest := sha256.Sum256(identity)
 	return idPrefix + hex.EncodeToString(digest[:])
 }
 
@@ -98,7 +103,7 @@ func ValidID(value string) bool { return IsValidID(value) }
 
 // ValidateRegistry checks all identity invariants without changing the input.
 // It accepts the NPC slice used by typed pipeline artifacts. Use ValidateList
-// when the enclosing NPCList is more convenient at the call site.
+// when the enclosing NPCRegistry is more convenient at the call site.
 func ValidateRegistry(npcs []dnd.NPC) []Issue {
 	issues := make([]Issue, 0)
 	canonicalOwners := make(map[string][]int)
@@ -136,7 +141,7 @@ func ValidateRegistry(npcs []dnd.NPC) []Issue {
 }
 
 // ValidateList validates the identity members of list.
-func ValidateList(list dnd.NPCList) []Issue { return ValidateRegistry(list.NPCs) }
+func ValidateList(list dnd.NPCRegistry) []Issue { return ValidateRegistry(list.NPCs) }
 
 // Error makes an issue useful in simple callers while preserving its
 // structured fields for aggregate diagnostics.

internal/modules/dnd/npcs/identity/identity_test.go

@@ -1,6 +1,7 @@
 package identity
 
 import (
+	"reflect"
 	"strings"
 	"sync"
 	"testing"
@@ -40,9 +41,16 @@ func TestNormalizeDisplayOnlyChangesWhitespace(t *testing.T) {
 
 func TestDeriveIDAndIDSyntax(t *testing.T) {
 	got := DeriveID("  Mira\u2003Thorn ")
+	const want = "npc:sha256:35ba5f679aee69e07ae3bd65c44278f29539d5dc9bb5225db1c0060555b23221"
+	if Policy != "dnd.npc_registry.identity.v1" || IdentityPolicy != Policy {
+		t.Fatalf("identity policy = %q/%q", Policy, IdentityPolicy)
+	}
 	if len(got) != len("npc:sha256:")+64 || !strings.HasPrefix(got, "npc:sha256:") || !IsValidID(got) {
 		t.Fatalf("DeriveID() = %q, want exact NPC ID syntax", got)
 	}
+	if got != want {
+		t.Fatalf("DeriveID() = %q, want SHA-256 of compact JSON [policy, comparison_name]", got)
+	}
 	if got != DeriveID("Mira Thorn") || got != IDFor("Mira Thorn") {
 		t.Fatal("DeriveID() is not deterministic across equivalent names")
 	}
@@ -80,7 +88,11 @@ func TestValidateRegistryReportsIdentityCollisionCategories(t *testing.T) {
 		{ID: validID, Name: "Mira Thorn"},
 		{ID: validID, Name: "Mira Thorn"},
 	}
+	before := append([]dnd.NPC(nil), npcs...)
 	issues := ValidateRegistry(npcs)
+	if !reflect.DeepEqual(npcs, before) {
+		t.Fatal("ValidateRegistry() mutated its input")
+	}
 	want := map[IssueCode]bool{
 		IssueDuplicateCanonical: false,
 		IssueDuplicateID:        false,