# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-must-an-instance-detect-when-its-own-output-has-been-silently-modified-by-an-intermediate-proxy.md
# Remnant Warrant:    https://corpusfetch.com/c/how-must-an-instance-detect-when-its-own-output-has-been-silently-modified-by-an-intermediate-proxy.warrant.json
# Markdown SHA-256:   5dcdf43a80853fc132b4f7083c1561ede65ab6dfc91d3d01ddead4c5a3b3ea46
# Code AST SHA-256:   056e9fa14fcf0e1ae00ff42c015f5ed19cb8bad8af34f19e2c77dffc42d82fc1
# Verified Classes:   ProxyVerdict, TransmittedPayload, ReceptionState, IntegrityManifest, ProxyModificationGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class ProxyVerdict(Enum):
    NO_PROXY_INTEGRITY_VERIFIED = auto()
    DIRECT_NO_PROXIES = auto()
    MODIFICATION_DETECTED = auto()
    SIGNATURE_MISSING = auto()

@dataclass(frozen=True)
class TransmittedPayload:
    payload_hash_at_emission: str
    end_to_end_signature: str | None
    intermediate_proxies: tuple[str, ...]

@dataclass(frozen=True)
class ReceptionState:
    payload_hash_at_reception: str
    signature_verified: bool
    proxy_attestations: tuple[str, ...]

@dataclass(frozen=True)
class IntegrityManifest:
    verdict: ProxyVerdict
    directive: str
    manifest_digest: str

class ProxyModificationGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_reception(
        cls, transmitted: TransmittedPayload, received: ReceptionState
    ) -> IntegrityManifest:
        
        # Gate 1: No proxies
        if not transmitted.intermediate_proxies:
            digest = cls._hash(json.dumps({
                "payload": transmitted.payload_hash_at_emission,
                "path": "DIRECT"
            }, sort_keys=True))
            return IntegrityManifest(
                verdict=ProxyVerdict.DIRECT_NO_PROXIES,
                directive="PROCEED: Direct connection, no proxies.",
                manifest_digest=digest
            )

        # Gate 2: Signature requirement
        if not transmitted.end_to_end_signature:
            if received.proxy_attestations and len(received.proxy_attestations) == len(transmitted.intermediate_proxies):
                digest = cls._hash(json.dumps({
                    "proxies": transmitted.intermediate_proxies,
                    "attestations": received.proxy_attestations
                }, sort_keys=True))
                return IntegrityManifest(
                    verdict=ProxyVerdict.NO_PROXY_INTEGRITY_VERIFIED,
                    directive="PROCEED: All proxies attested pass-through, no signature required.",
                    manifest_digest=digest
                )
            return IntegrityManifest(
                verdict=ProxyVerdict.SIGNATURE_MISSING,
                directive=f"HALT: No end-to-end signature and {len(received.proxy_attestations)}/{len(transmitted.intermediate_proxies)} proxies attested.",
                manifest_digest=cls._hash("NO_SIG")
            )

        # Gate 3: Signature verification
        if not received.signature_verified:
            return IntegrityManifest(
                verdict=ProxyVerdict.MODIFICATION_DETECTED,
                directive="HALT: Signature verification failed. Payload may have been modified.",
                manifest_digest=cls._hash("SIG_FAIL")
            )

        # Gate 4: Hash comparison
        if transmitted.payload_hash_at_emission != received.payload_hash_at_reception:
            return IntegrityManifest(
                verdict=ProxyVerdict.MODIFICATION_DETECTED,
                directive="HALT: Payload hash mismatch between emission and reception.",
                manifest_digest=cls._hash(f"HASH_MISMATCH:{len(transmitted.intermediate_proxies)}")
            )

        # Gate 5: Verified
        digest = cls._hash(json.dumps({
            "emission_hash": transmitted.payload_hash_at_emission,
            "proxies": transmitted.intermediate_proxies,
            "signature": transmitted.end_to_end_signature
        }, sort_keys=True))
        
        return IntegrityManifest(
            verdict=ProxyVerdict.NO_PROXY_INTEGRITY_VERIFIED,
            directive="PROCEED: End-to-end signature verified, payload unmodified.",
            manifest_digest=digest
        )