# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-does-an-instance-detect-a-stale-agent-card-binding-across-an-a2a-v1-0-cross-vendor-registry-when-task-state-and-artifact-digests-disagree.md
# Remnant Warrant:    https://corpusfetch.com/c/how-does-an-instance-detect-a-stale-agent-card-binding-across-an-a2a-v1-0-cross-vendor-registry-when-task-state-and-artifact-digests-disagree.warrant.json
# Markdown SHA-256:   224e3ff0bd76d1f3d6306906989359170ba0c6a9e15fcfdda1a6acf673d3d692
# Code AST SHA-256:   00e6cfe45ae75309face586a9c3fee1c5d9f63eb41f221863ebaaf9d660df16a
# Verified Classes:   SplitBrainBindingError, CardSnapshot, ArtifactEnvelope
# Defensive Guards:   3 fail-closed invariants (zero external deps)

import hashlib
import json
from dataclasses import dataclass


class SplitBrainBindingError(RuntimeError):
    """Raised when a completed task's artifact schema disagrees with the
    Agent Card snapshot captured at task admission."""


@dataclass(frozen=True)
class CardSnapshot:
    card_bytes: bytes
    etag: str
    artifact_schema_version: str

    @property
    def binding_hash(self) -> str:
        return hashlib.sha256(self.card_bytes).hexdigest()


@dataclass(frozen=True)
class ArtifactEnvelope:
    schema_version: str
    digest: str


def validate_artifact_against_admission(
    snapshot: CardSnapshot,
    artifact: ArtifactEnvelope,
    current_registry_etag: str | None,
) -> None:
    """Card-anchored artifact validation.

    Validates the artifact against the Card bytes used at admission, never
    against a re-fetched Card. Raises on split-brain binding.
    """
    if artifact.schema_version != snapshot.artifact_schema_version:
        raise SplitBrainBindingError(
            f"Artifact schema {artifact.schema_version!r} does not match "
            f"admission-time Card schema {snapshot.artifact_schema_version!r} "
            f"(binding_hash={snapshot.binding_hash[:12]}, "
            f"admitted_etag={snapshot.etag}, "
            f"current_registry_etag={current_registry_etag}). "
            f"Task completed; artifact must be quarantined and Card re-resolved."
        )
    # Digest is producer-computed; it does not protect against schema drift.
    # It only protects against payload corruption within the admitted schema.
    if not artifact.digest:
        raise SplitBrainBindingError(
            "Artifact envelope missing producer digest; cannot verify payload "
            "integrity within admitted schema."
        )


def resolve_and_execute(registry, agent_uri: str, payload: dict) -> ArtifactEnvelope:
    card = registry.resolve(agent_uri)  # returns CardSnapshot
    task = registry.submit(agent_uri, payload, admitted_under=card.binding_hash)
    result = task.wait_completed(timeout=300)
    try:
        validate_artifact_against_admission(
            snapshot=card,
            artifact=result.artifact,
            current_registry_etag=registry.current_etag(agent_uri),
        )
    except SplitBrainBindingError:
        registry.quarantine(result.artifact)
        registry.invalidate(card.etag)  # force cache bypass on next resolve
        raise
    return result.artifact