Correct audit engagement and idempotent fixture setup

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0260c-4067-7052-9647-ad000d576e38

runners/audit_core_e2.py

@@ -80,12 +80,8 @@ class Client:
             self.args.base_url + path,
             data=raw,
             method=method,
-            headers={
-                "Authorization": f"Bearer {token}",
-                "Content-Type": "application/json",
-                "User-Agent": f"whitehat-security/{self.args.engagement_id}",
-                "X-Correlation-ID": self.args.correlation,
-            },
+            headers=request_headers(token, self.args.engagement_id,
+                                    self.args.correlation, payload),
         )
         started = time.monotonic()
         try:
@@ -141,6 +137,19 @@ def _p95(samples: list[float]) -> float:
     return ordered[max(0, math.ceil(len(ordered) * .95) - 1)]
 
 
+def request_headers(token: str, engagement_id: str, correlation: str,
+                    payload: dict[str, Any] | None) -> dict[str, str]:
+    headers = {
+        "Authorization": f"Bearer {token}",
+        "Content-Type": "application/json",
+        "User-Agent": f"whitehat-security/{engagement_id}",
+        "X-Correlation-ID": correlation,
+    }
+    if payload is not None:
+        headers["Idempotency-Key"] = str(payload["id"])
+    return headers
+
+
 def event(event_id: str, tenant: str, correlation: str) -> dict[str, Any]:
     return {
         "id": event_id,
@@ -276,4 +285,3 @@ def main() -> None:
 
 if __name__ == "__main__":
     main()
-