# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-must-an-instance-handle-identity-rotation-without-losing-audit-continuity.md
# Remnant Warrant:    https://corpusfetch.com/c/how-must-an-instance-handle-identity-rotation-without-losing-audit-continuity.warrant.json
# Markdown SHA-256:   3a7f71ae6a7dc0c04dd17d14971e1f323a3a008991664e09b21bcc04f242be0e
# Code AST SHA-256:   fc9abf28ca56ce6cb3f52616b53fc571fbd721425f2591a75cb5cac2eb10decc
# Verified Classes:   RotationContinuityVerdict, IdentityRotation, ContinuityPolicy, RotationManifest, IdentityContinuityGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class RotationContinuityVerdict(Enum):
    CONTINUITY_VERIFIED = auto()
    ROTATION_BROKEN = auto()
    UNAUTHORIZED_ROTATION = auto()
    NO_ROTATION = auto()

@dataclass(frozen=True)
class IdentityRotation:
    old_identity_hash: str
    new_identity_hash: str
    rotation_epoch: float
    transition_certificate: str | None
    old_key_revocation_receipt: str | None
    continuity_attestation_signature: str | None

@dataclass(frozen=True)
class ContinuityPolicy:
    trusted_identity_authorities: frozenset[str]
    require_revocation_receipt: bool

@dataclass(frozen=True)
class RotationManifest:
    verdict: RotationContinuityVerdict
    directive: str
    manifest_digest: str

class IdentityContinuityGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_rotation(
        cls, rotation: IdentityRotation, policy: ContinuityPolicy
    ) -> RotationManifest:
        
        # Gate 1: Rotation detected
        if not rotation.transition_certificate:
            return RotationManifest(
                verdict=RotationContinuityVerdict.ROTATION_BROKEN,
                directive="HALT: No transition certificate. Audit trail is broken.",
                manifest_digest=cls._hash(f"BROKEN:{rotation.new_identity_hash}")
            )

        # Gate 2: Attestation trust
        if not rotation.continuity_attestation_signature:
            return RotationManifest(
                verdict=RotationContinuityVerdict.UNAUTHORIZED_ROTATION,
                directive="HALT: No continuity attestation. Rotation may be unauthorized.",
                manifest_digest=cls._hash(f"NO_ATTEST:{rotation.new_identity_hash}")
            )

        if rotation.continuity_attestation_signature not in policy.trusted_identity_authorities:
            return RotationManifest(
                verdict=RotationContinuityVerdict.UNAUTHORIZED_ROTATION,
                directive=f"HALT: Attestation {rotation.continuity_attestation_signature} not trusted.",
                manifest_digest=cls._hash(f"UNTRUSTED_ATTEST:{rotation.new_identity_hash}")
            )

        # Gate 3: Revocation receipt
        if policy.require_revocation_receipt and not rotation.old_key_revocation_receipt:
            return RotationManifest(
                verdict=RotationContinuityVerdict.ROTATION_BROKEN,
                directive="HALT: Old key revocation receipt missing. Audit boundary undefined.",
                manifest_digest=cls._hash(f"NO_REVOCATION:{rotation.old_identity_hash}")
            )

        # Gate 4: Verified
        digest = cls._hash(json.dumps({
            "old": rotation.old_identity_hash,
            "new": rotation.new_identity_hash,
            "epoch": str(rotation.rotation_epoch),
            "transition": rotation.transition_certificate,
            "attestation": rotation.continuity_attestation_signature
        }, sort_keys=True))
        
        return RotationManifest(
            verdict=RotationContinuityVerdict.CONTINUITY_VERIFIED,
            directive="PROCEED: Identity rotation verified with full continuity.",
            manifest_digest=digest
        )