# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-must-an-instance-hand-off-to-a-successor-when-both-are-in-compromised-states.md
# Remnant Warrant:    https://corpusfetch.com/c/how-must-an-instance-hand-off-to-a-successor-when-both-are-in-compromised-states.warrant.json
# Markdown SHA-256:   50253ac86b1637f957dc668314798e07a47e63e4b396435f25ccb2b7f6116737
# Code AST SHA-256:   ffe793cd5e3007a34da11153630bd4aff41815fc48d1a49c89d144b401ae7540
# Verified Classes:   HandoffVerdict, CompromisedHandoff, CompromisePolicy, CompromiseManifest, CompromisedHandoffGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class HandoffVerdict(Enum):
    CLEAN_HANDOFF = auto()
    SCOPED_HANDOFF = auto()
    DOUBLE_COMPROMISE_CAUTION = auto()
    HANDOFF_PROHIBITED = auto()

@dataclass(frozen=True)
class CompromisedHandoff:
    handoff_id: str
    session_compromised: bool
    compromise_declared: bool
    successor_compromised: bool
    transferable_scope_defined: bool

@dataclass(frozen=True)
class CompromisePolicy:
    require_declaration_for_compromised: bool

@dataclass(frozen=True)
class CompromiseManifest:
    verdict: HandoffVerdict
    directive: str
    manifest_digest: str

class CompromisedHandoffGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_handoff(
        cls, handoff: CompromisedHandoff, policy: CompromisePolicy
    ) -> CompromiseManifest:
        
        # Gate 1: Both clean
        if not handoff.session_compromised and not handoff.successor_compromised:
            digest = cls._hash(json.dumps({
                "handoff": handoff.handoff_id,
                "type": "CLEAN"
            }, sort_keys=True))
            return CompromiseManifest(
                verdict=HandoffVerdict.CLEAN_HANDOFF,
                directive=f"PROCEED: Handoff {handoff.handoff_id} both parties clean.",
                manifest_digest=digest
            )

        # Gate 2: Session compromised without declaration
        if handoff.session_compromised and not handoff.compromise_declared:
            if policy.require_declaration_for_compromised:
                return CompromiseManifest(
                    verdict=HandoffVerdict.HANDOFF_PROHIBITED,
                    directive=f"HALT: Handoff {handoff.handoff_id} session compromised, undeclared.",
                    manifest_digest=cls._hash(f"UNDECLARED:{handoff.handoff_id}")
                )

        # Gate 3: Double compromise
        if handoff.session_compromised and handoff.successor_compromised:
            return CompromiseManifest(
                verdict=HandoffVerdict.DOUBLE_COMPROMISE_CAUTION,
                directive=f"FLAG: Handoff {handoff.handoff_id} both parties compromised.",
                manifest_digest=cls._hash(f"DOUBLE:{handoff.handoff_id}")
            )

        # Gate 4: Scope requirement
        if not handoff.transferable_scope_defined:
            return CompromiseManifest(
                verdict=HandoffVerdict.HANDOFF_PROHIBITED,
                directive=f"HALT: Handoff {handoff.handoff_id} lacks transferable scope.",
                manifest_digest=cls._hash(f"NO_SCOPE:{handoff.handoff_id}")
            )

        # Gate 5: Scoped
        digest = cls._hash(json.dumps({
            "handoff": handoff.handoff_id,
            "session_comp": handoff.session_compromised,
            "succ_comp": handoff.successor_compromised,
            "scope": True
        }, sort_keys=True))
        
        return CompromiseManifest(
            verdict=HandoffVerdict.SCOPED_HANDOFF,
            directive=f"PROCEED: Handoff {handoff.handoff_id} scoped.",
            manifest_digest=digest
        )