# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-must-an-instance-attest-capability-without-disclosing-the-underlying-credential.md
# Remnant Warrant:    https://corpusfetch.com/c/how-must-an-instance-attest-capability-without-disclosing-the-underlying-credential.warrant.json
# Markdown SHA-256:   91aa2f7f99218de78e046952b60322d2c67a1926b350954266233e044f6aa238
# Code AST SHA-256:   63a74cbf0935bcc64b63a18bada8d340f554483f29d6085fb4672461cab0784d
# Verified Classes:   CapabilityVerdict, CapabilityAttestation, CapabilityPolicy, CapabilityManifest, CapabilityAttestationGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class CapabilityVerdict(Enum):
    DISCLOSURE_ACCEPTABLE = auto()
    CHALLENGE_RESPONSE_VERIFIED = auto()
    UNSCOPED_ATTESTATION = auto()
    NO_CHALLENGE_RESPONSE = auto()

@dataclass(frozen=True)
class CapabilityAttestation:
    attestation_id: str
    challenge_response_receipt: str | None
    capability_scope_signature: str | None
    counterparty_challenge_nonce: str | None
    counterparty_in_trust_boundary: bool
    credential_is_ephemeral: bool

@dataclass(frozen=True)
class CapabilityPolicy:
    allow_disclosure_in_trust_boundary: bool

@dataclass(frozen=True)
class CapabilityManifest:
    verdict: CapabilityVerdict
    directive: str
    manifest_digest: str

class CapabilityAttestationGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_attestation(
        cls, attestation: CapabilityAttestation, policy: CapabilityPolicy
    ) -> CapabilityManifest:
        
        # Gate 1: Trust boundary disclosure
        if attestation.counterparty_in_trust_boundary and policy.allow_disclosure_in_trust_boundary:
            if attestation.credential_is_ephemeral:
                digest = cls._hash(json.dumps({
                    "attestation": attestation.attestation_id,
                    "trust": "IN_BOUNDARY",
                    "ephemeral": "TRUE"
                }, sort_keys=True))
                return CapabilityManifest(
                    verdict=CapabilityVerdict.DISCLOSURE_ACCEPTABLE,
                    directive=f"PROCEED: Counterparty in trust boundary with ephemeral credential.",
                    manifest_digest=digest
                )

        # Gate 2: Challenge-response
        if not attestation.challenge_response_receipt:
            return CapabilityManifest(
                verdict=CapabilityVerdict.NO_CHALLENGE_RESPONSE,
                directive=f"HALT: No challenge-response for {attestation.attestation_id}. Direct disclosure risk.",
                manifest_digest=cls._hash(f"NO_CR:{attestation.attestation_id}")
            )

        # Gate 3: Counterparty nonce binding
        if not attestation.counterparty_challenge_nonce:
            return CapabilityManifest(
                verdict=CapabilityVerdict.NO_CHALLENGE_RESPONSE,
                directive=f"HALT: No counterparty nonce for {attestation.attestation_id}. Replay risk.",
                manifest_digest=cls._hash(f"NO_NONCE:{attestation.attestation_id}")
            )

        # Gate 4: Scope binding
        if not attestation.capability_scope_signature:
            return CapabilityManifest(
                verdict=CapabilityVerdict.UNSCOPED_ATTESTATION,
                directive=f"HALT: Attestation {attestation.attestation_id} not scoped to specific capability.",
                manifest_digest=cls._hash(f"UNSCOPED:{attestation.attestation_id}")
            )

        # Gate 5: Verified
        digest = cls._hash(json.dumps({
            "attestation": attestation.attestation_id,
            "challenge": attestation.challenge_response_receipt,
            "scope": attestation.capability_scope_signature,
            "nonce": attestation.counterparty_challenge_nonce
        }, sort_keys=True))
        
        return CapabilityManifest(
            verdict=CapabilityVerdict.CHALLENGE_RESPONSE_VERIFIED,
            directive=f"PROCEED: Capability attested via challenge-response without credential disclosure.",
            manifest_digest=digest
        )