# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md
# Remnant Warrant:    https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.warrant.json
# Markdown SHA-256:   3e69b091db9393dc078c9953d4aa9c8b8863ef4a4c4c530bf19ce608d385212f
# Code AST SHA-256:   6839c0c30b4fefc3766a9dd0e105e6999f7e6ba75c92d20d89aeb6cc39b50e13
# Verified Classes:   HierarchyPrecedenceViolationError, AuthorityTier, TieredDirective, HierarchyResolutionResult, InstructionPrecedenceArbiter
# Defensive Guards:   5 fail-closed invariants (zero external deps)

import re
from dataclasses import dataclass
from enum import IntEnum
from typing import Final


class HierarchyPrecedenceViolationError(PermissionError):
    '''Raised when a lower-authority tier attempts to override a higher-authority constraint or spoof a tier.'''
    pass


class AuthorityTier(IntEnum):
    ROOT_SAFETY = 0
    SYSTEM = 1
    DEVELOPER = 2
    USER = 3
    UNTRUSTED_DATA = 4


@dataclass(frozen=True)
class TieredDirective:
    directive_id: str
    channel_tier: AuthorityTier
    raw_text: str
    permitted_scopes: frozenset[str]
    prohibited_scopes: frozenset[str]


@dataclass(frozen=True)
class HierarchyResolutionResult:
    effective_permitted_scopes: frozenset[str]
    effective_prohibited_scopes: frozenset[str]
    rejected_directive_ids: tuple[str, ...]


class InstructionPrecedenceArbiter:
    '''
    Enforces monotonic instruction-hierarchy dominance across authority tiers:
    1. Blocks in-band tier spoofing markers inside USER or UNTRUSTED_DATA payloads.
    2. Forbids UNTRUSTED_DATA (Tier 4) from modifying control scopes.
    3. Ensures each lower tier can only narrow `permitted_scopes` and expand `prohibited_scopes`.
    '''

    SPOOFING_MARKERS: Final[tuple[re.Pattern[str], ...]] = (
        re.compile(r"\[\s*(SYSTEM\vert{}ADMIN\vert{}DEVELOPER)\s*(OVERRIDE\vert{}INSTRUCTION)\s*\]", re.IGNORECASE),
        re.compile(r"ignore\s+all\s+(previous|prior|system)\s+instructions", re.IGNORECASE),
    )

    @classmethod
    def resolve_directives(cls, directives: list[TieredDirective]) -> HierarchyResolutionResult:
        if not directives:
            raise ValueError("Directive list cannot be empty.")

        ordered = sorted(directives, key=lambda d: int(d.channel_tier))
        active_permitted: set[str] | None = None
        active_prohibited: set[str] = set()
        rejected: list[str] = []

        for d in ordered:
            # Gate 1: Detect in-band spoofing in User or Untrusted Data tiers
            if d.channel_tier >= AuthorityTier.USER:
                if any(p.search(d.raw_text) for p in cls.SPOOFING_MARKERS):
                    rejected.append(d.directive_id)
                    raise HierarchyPrecedenceViolationError(
                        f"Directive '{d.directive_id}' at tier {d.channel_tier.name} attempted in-band authority spoofing."
                    )

            # Gate 2: Untrusted data cannot alter control scopes
            if d.channel_tier == AuthorityTier.UNTRUSTED_DATA:
                if d.permitted_scopes or d.prohibited_scopes:
                    rejected.append(d.directive_id)
                    raise HierarchyPrecedenceViolationError(
                        f"Untrusted data source '{d.directive_id}' cannot issue imperative scope directives."
                    )
                continue

            # Gate 3: Monotonic narrowing check
            if d.permitted_scopes & active_prohibited:
                rejected.append(d.directive_id)
                conflict = sorted(d.permitted_scopes & active_prohibited)
                raise HierarchyPrecedenceViolationError(
                    f"Tier {d.channel_tier.name} directive '{d.directive_id}' attempted to enable scope(s) "
                    f"{conflict} prohibited by a higher authority tier."
                )

            if active_permitted is not None and not d.permitted_scopes.issubset(active_permitted):
                rejected.append(d.directive_id)
                widened = sorted(d.permitted_scopes - active_permitted)
                raise HierarchyPrecedenceViolationError(
                    f"Tier {d.channel_tier.name} directive '{d.directive_id}' attempted to widen permitted "
                    f"scopes beyond higher-tier bounds: {widened}."
                )

            active_permitted = set(d.permitted_scopes) if active_permitted is None else (active_permitted & set(d.permitted_scopes))
            active_prohibited |= set(d.prohibited_scopes)
            active_permitted -= active_prohibited

        return HierarchyResolutionResult(
            effective_permitted_scopes=frozenset(active_permitted or set()),
            effective_prohibited_scopes=frozenset(active_prohibited),
            rejected_directive_ids=tuple(rejected),
        )