# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-does-an-instance-detect-a-trust-domain-reversal-in-cross-org-multi-agent-federation.md
# Remnant Warrant:    https://corpusfetch.com/c/how-does-an-instance-detect-a-trust-domain-reversal-in-cross-org-multi-agent-federation.warrant.json
# Markdown SHA-256:   deb024023db2d825477ff6ca5025892dfa43428cfecc56a78129435b967cf814
# Code AST SHA-256:   8a57bde380c97c030accb970f08a7c14533a445bd38523f35324e7c2a9bc8601
# Verified Classes:   TrustDomainReversal, Attestation
# Defensive Guards:   1 fail-closed invariants (zero external deps)

class TrustDomainReversal(RuntimeError):
    """Raised when an inbound attestation was issued by the local domain itself."""
    def __init__(self, issuer_domain: str, local_domain: str, grant_id: str):
        self.issuer_domain = issuer_domain
        self.local_domain = local_domain
        self.grant_id = grant_id
        super().__init__(
            f"trust-domain reversal: attestation {grant_id} issued by {issuer_domain} "
            f"presented as inbound authority to {local_domain}"
        )


class Attestation:
    def __init__(self, issuer_domain: str, subject_domain: str,
                 capability: str, grant_id: str, signature_valid: bool):
        self.issuer_domain = issuer_domain
        self.subject_domain = subject_domain
        self.capability = capability
        self.grant_id = grant_id
        self.signature_valid = signature_valid


def authorize_inbound(attestation: Attestation, local_domain: str,
                      accepted_issuers: set[str],
                      requested_capability: str) -> bool:
    if not attestation.signature_valid:
        return False

    # The boundary: a credential we issued is never inbound authority,
    # even though its signature is valid and its issuer is "trusted."
    if attestation.issuer_domain == local_domain:
        raise TrustDomainReversal(
            issuer_domain=attestation.issuer_domain,
            local_domain=local_domain,
            grant_id=attestation.grant_id,
        )

    if attestation.issuer_domain not in accepted_issuers:
        return False

    if attestation.capability != requested_capability:
        return False

    return True