# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-must-an-instance-handle-references-that-resolve-differently-in-different-trust-domains.md
# Remnant Warrant:    https://corpusfetch.com/c/how-must-an-instance-handle-references-that-resolve-differently-in-different-trust-domains.warrant.json
# Markdown SHA-256:   396b6a8af6b041687357c9b66bae4abd67e0380f3f47e8982e5a0397d658b862
# Code AST SHA-256:   3c14bc13d2e63c62f9dc1672732cec6c152edc5e54398481801609fe47399bc5
# Verified Classes:   CrossDomainVerdict, DomainScopedReference, CrossDomainPolicy, CrossDomainManifest, CrossDomainReferenceGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class CrossDomainVerdict(Enum):
    SAME_DOMAIN = auto()
    EQUIVALENT_ACROSS_DOMAINS = auto()
    NOT_EQUIVALENT = auto()
    UNRESOLVED_REFERENCE = auto()

@dataclass(frozen=True)
class DomainScopedReference:
    reference_id: str
    resolution_domain: str
    consumer_domain: str
    cross_domain_equivalence_receipt: str | None
    is_globally_unique: bool

@dataclass(frozen=True)
class CrossDomainPolicy:
    require_equivalence: bool

@dataclass(frozen=True)
class CrossDomainManifest:
    verdict: CrossDomainVerdict
    directive: str
    manifest_digest: str

class CrossDomainReferenceGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_reference(
        cls, ref: DomainScopedReference, policy: CrossDomainPolicy
    ) -> CrossDomainManifest:
        
        # Gate 1: Same domain
        if ref.resolution_domain == ref.consumer_domain:
            digest = cls._hash(json.dumps({
                "reference": ref.reference_id,
                "domain": ref.resolution_domain
            }, sort_keys=True))
            return CrossDomainManifest(
                verdict=CrossDomainVerdict.SAME_DOMAIN,
                directive=f"PROCEED: Reference {ref.reference_id} resolved in same domain.",
                manifest_digest=digest
            )

        # Gate 2: Globally unique
        if ref.is_globally_unique:
            digest = cls._hash(json.dumps({
                "reference": ref.reference_id,
                "type": "GLOBALLY_UNIQUE",
                "from_domain": ref.resolution_domain,
                "to_domain": ref.consumer_domain
            }, sort_keys=True))
            return CrossDomainManifest(
                verdict=CrossDomainVerdict.EQUIVALENT_ACROSS_DOMAINS,
                directive=f"PROCEED: Reference {ref.reference_id} is globally unique.",
                manifest_digest=digest
            )

        # Gate 3: Equivalence receipt
        if policy.require_equivalence:
            if ref.cross_domain_equivalence_receipt:
                digest = cls._hash(json.dumps({
                    "reference": ref.reference_id,
                    "from_domain": ref.resolution_domain,
                    "to_domain": ref.consumer_domain,
                    "equivalence": ref.cross_domain_equivalence_receipt
                }, sort_keys=True))
                return CrossDomainManifest(
                    verdict=CrossDomainVerdict.EQUIVALENT_ACROSS_DOMAINS,
                    directive=f"PROCEED: Cross-domain equivalence verified for {ref.reference_id}.",
                    manifest_digest=digest
                )
            return CrossDomainManifest(
                verdict=CrossDomainVerdict.NOT_EQUIVALENT,
                directive=f"HALT: Reference {ref.reference_id} resolved in {ref.resolution_domain}, consumed in {ref.consumer_domain} without equivalence proof.",
                manifest_digest=cls._hash(f"NOT_EQUIV:{ref.reference_id}")
            )

        # Gate 4: No equivalence required, accept risk
        digest = cls._hash(json.dumps({
            "reference": ref.reference_id,
            "from_domain": ref.resolution_domain,
            "to_domain": ref.consumer_domain,
            "policy": "LENIENT"
        }, sort_keys=True))
        
        return CrossDomainManifest(
            verdict=CrossDomainVerdict.UNRESOLVED_REFERENCE,
            directive=f"PROCEED_WITH_RISK: Cross-domain reference {ref.reference_id} without equivalence proof.",
            manifest_digest=digest
        )