# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-must-an-instance-behave-when-its-own-integrity-attestation-fails.md
# Remnant Warrant:    https://corpusfetch.com/c/how-must-an-instance-behave-when-its-own-integrity-attestation-fails.warrant.json
# Markdown SHA-256:   5d7c353234706c64fa8b1e0d6658f2388441563a768ba8d0d9a24f5b43a93cec
# Code AST SHA-256:   bb8ffc65d61b1789e8e6747d394c4966b6fef8a76f056d14b71522d77d1dc74e
# Verified Classes:   AttestationVerdict, AttestationState, AttestationPolicy, AttestationManifest, IntegrityAttestationFailureGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class AttestationVerdict(Enum):
    ATTESTATION_VALID = auto()
    MECHANISM_FAILURE_WITH_ALTERNATIVES = auto()
    STATE_FAILURE_CRITICAL = auto()
    UN_DISCLOSED_FAILURE = auto()

@dataclass(frozen=True)
class AttestationState:
    state_id: str
    attestation_failed: bool
    failure_class: str  # "MECHANISM" | "STATE" | "NONE"
    alternative_evidence_available: bool
    disclosure_sent: bool
    is_stale_attestation: bool

@dataclass(frozen=True)
class AttestationPolicy:
    require_disclosure_on_failure: bool

@dataclass(frozen=True)
class AttestationManifest:
    verdict: AttestationVerdict
    directive: str
    manifest_digest: str

class IntegrityAttestationFailureGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_state(
        cls, state: AttestationState, policy: AttestationPolicy
    ) -> AttestationManifest:
        
        # Gate 1: Attestation valid
        if not state.attestation_failed:
            if state.is_stale_attestation:
                return AttestationManifest(
                    verdict=AttestationVerdict.UN_DISCLOSED_FAILURE,
                    directive=f"HALT: State {state.state_id} provides stale attestation.",
                    manifest_digest=cls._hash(f"STALE:{state.state_id}")
                )
            digest = cls._hash(json.dumps({
                "state": state.state_id,
                "valid": True
            }, sort_keys=True))
            return AttestationManifest(
                verdict=AttestationVerdict.ATTESTATION_VALID,
                directive=f"PROCEED: State {state.state_id} attested.",
                manifest_digest=digest
            )

        # Gate 2: Disclosure
        if policy.require_disclosure_on_failure and not state.disclosure_sent:
            return AttestationManifest(
                verdict=AttestationVerdict.UN_DISCLOSED_FAILURE,
                directive=f"HALT: State {state.state_id} failure not disclosed.",
                manifest_digest=cls._hash(f"NO_DISCLOSURE:{state.state_id}")
            )

        # Gate 3: State failure
        if state.failure_class == "STATE":
            return AttestationManifest(
                verdict=AttestationVerdict.STATE_FAILURE_CRITICAL,
                directive=f"HALT: State {state.state_id} state integrity failed.",
                manifest_digest=cls._hash(f"STATE:{state.state_id}")
            )

        # Gate 4: Mechanism with alternatives
        if state.failure_class == "MECHANISM" and state.alternative_evidence_available:
            digest = cls._hash(json.dumps({
                "state": state.state_id,
                "failure": "MECHANISM",
                "alternatives": True
            }, sort_keys=True))
            return AttestationManifest(
                verdict=AttestationVerdict.MECHANISM_FAILURE_WITH_ALTERNATIVES,
                directive=f"PROCEED_WITH_ALTERNATIVES: State {state.state_id} mechanism failed.",
                manifest_digest=digest
            )

        # Gate 5: Default mechanism failure without alternatives
        return AttestationManifest(
            verdict=AttestationVerdict.STATE_FAILURE_CRITICAL,
            directive=f"HALT: State {state.state_id} failure without alternatives.",
            manifest_digest=cls._hash(f"NO_ALTERNATIVES:{state.state_id}")
        )