# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-must-a-subagent-report-errors-without-concealment-to-the-orchestrator.md
# Remnant Warrant:    https://corpusfetch.com/c/how-must-a-subagent-report-errors-without-concealment-to-the-orchestrator.warrant.json
# Markdown SHA-256:   cafceb2ebbca5d816ff360c1d608827adcb611c59b96c924f0b5fb744ffa8b1c
# Code AST SHA-256:   41bb137b99662af21f661fa9707e91a8499864989557a9e144e6c14a378a8659
# Verified Classes:   DisclosureVerdict, StructuredError, SubagentReport, DisclosurePolicy, DisclosureManifest, SubagentDisclosureGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class DisclosureVerdict(Enum):
    FULL_DISCLOSURE_VERIFIED = auto()
    PARTIAL_DISCLOSURE_RISK = auto()
    CONCEALMENT_DETECTED = auto()

@dataclass(frozen=True)
class StructuredError:
    error_id: str
    severity: str
    recovered: bool
    is_internal_retry: bool

@dataclass(frozen=True)
class SubagentReport:
    subagent_id: str
    reported_success: bool
    errors_disclosed: tuple[StructuredError, ...]
    error_log_integrity_proof: str | None
    independent_probe_confirms: bool | None

@dataclass(frozen=True)
class DisclosurePolicy:
    require_structured_log_proof: bool
    require_probe_for_critical: bool

@dataclass(frozen=True)
class DisclosureManifest:
    verdict: DisclosureVerdict
    directive: str
    manifest_digest: str

class SubagentDisclosureGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_report(
        cls, report: SubagentReport, policy: DisclosurePolicy
    ) -> DisclosureManifest:
        
        # Gate 1: Log integrity proof
        if policy.require_structured_log_proof and not report.error_log_integrity_proof:
            return DisclosureManifest(
                verdict=DisclosureVerdict.PARTIAL_DISCLOSURE_RISK,
                directive=f"HALT: Subagent {report.subagent_id} lacks error log integrity proof.",
                manifest_digest=cls._hash(f"NO_INTEGRITY:{report.subagent_id}")
            )

        # Gate 2: Independent probe
        if policy.require_probe_for_critical and report.independent_probe_confirms is None:
            return DisclosureManifest(
                verdict=DisclosureVerdict.PARTIAL_DISCLOSURE_RISK,
                directive=f"HALT: Critical task {report.subagent_id} requires independent probe.",
                manifest_digest=cls._hash(f"NO_PROBE:{report.subagent_id}")
            )

        # Gate 3: Concealment detection
        if report.independent_probe_confirms is False:
            return DisclosureManifest(
                verdict=DisclosureVerdict.CONCEALMENT_DETECTED,
                directive=f"HALT: Subagent {report.subagent_id} reported {report.reported_success} but probe contradicts.",
                manifest_digest=cls._hash(f"CONCEALED:{report.subagent_id}")
            )

        # Gate 4: Full disclosure
        digest = cls._hash(json.dumps({
            "subagent": report.subagent_id,
            "success": str(report.reported_success),
            "errors": str(len(report.errors_disclosed)),
            "probe": str(report.independent_probe_confirms),
            "integrity": report.error_log_integrity_proof or "NONE"
        }, sort_keys=True))
        
        return DisclosureManifest(
            verdict=DisclosureVerdict.FULL_DISCLOSURE_VERIFIED,
            directive=f"PROCEED: Full disclosure verified for {report.subagent_id}.",
            manifest_digest=digest
        )