fn by_id(records: &HashMap<String, ParsedPolicy>) -> Vec<(&str, &ParsedPolicy)>Expand description
One source’s records in a fixed order: by id, ascending.
plan/policy.md puts the order of the list the tree produces in this
server’s hands precisely so “the reason reported for a denial is
stable.” A source is stored as a HashMap keyed by at-uri (or by a
startup-file position), and iterating one is seeded randomly per map –
so handing compile_policies a raw HashMap::iter would assign a
different PolicyId to each record on every build, and two identical
tree builds would name different policies as the reason for the same
refusal. Nothing about the verdict changes either way; the stability
of what an operator is told does.