# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-must-an-instance-handle-self-delegation-when-a-principal-delegates-to-its-own-identities.md
# Remnant Warrant:    https://corpusfetch.com/c/how-must-an-instance-handle-self-delegation-when-a-principal-delegates-to-its-own-identities.warrant.json
# Markdown SHA-256:   e7787880f9f87b26265e966f18fe26e2b041b9c7b7cf7a8206c4b6c315670276
# Code AST SHA-256:   14e78b6223681a7146abd7c88ad8779687dfc1157d74668df56300fd42d036cd
# Verified Classes:   SelfDelegationVerdict, DelegationEvent, SelfDelegationPolicy, SelfDelegationManifest, SelfDelegationGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class SelfDelegationVerdict(Enum):
    DISTINCT_PRINCIPALS = auto()
    MEANINGFUL_ROLE_DELEGATION = auto()
    NULL_SELF_DELEGATION = auto()
    CIRCULAR_DELEGATION = auto()

@dataclass(frozen=True)
class DelegationEvent:
    delegator_identity: str
    delegatee_identity: str
    delegator_principal: str
    delegatee_principal: str
    authority_delta: frozenset[str]
    chain_depth: int
    seen_in_chain: frozenset[str]

@dataclass(frozen=True)
class SelfDelegationPolicy:
    allow_role_delegation: bool

@dataclass(frozen=True)
class SelfDelegationManifest:
    verdict: SelfDelegationVerdict
    directive: str
    manifest_digest: str

class SelfDelegationGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_delegation(
        cls, event: DelegationEvent, policy: SelfDelegationPolicy
    ) -> SelfDelegationManifest:
        
        # Gate 1: Distinct principals
        if event.delegator_principal != event.delegatee_principal:
            digest = cls._hash(json.dumps({
                "delegator": event.delegator_identity,
                "delegatee": event.delegatee_identity,
                "delegator_principal": event.delegator_principal,
                "delegatee_principal": event.delegatee_principal
            }, sort_keys=True))
            return SelfDelegationManifest(
                verdict=SelfDelegationVerdict.DISTINCT_PRINCIPALS,
                directive=f"PROCEED: Distinct principals, delegation valid.",
                manifest_digest=digest
            )

        # Gate 2: Circular delegation
        if event.delegator_identity in event.seen_in_chain and event.delegatee_identity in event.seen_in_chain:
            return SelfDelegationManifest(
                verdict=SelfDelegationVerdict.CIRCULAR_DELEGATION,
                directive=f"HALT: Circular delegation between {event.delegator_identity} and {event.delegatee_identity}.",
                manifest_digest=cls._hash(f"CIRCULAR:{event.delegator_identity}")
            )

        # Gate 3: Role delegation
        if policy.allow_role_delegation and event.authority_delta:
            digest = cls._hash(json.dumps({
                "delegator": event.delegator_identity,
                "delegatee": event.delegatee_identity,
                "principal": event.delegator_principal,
                "delta": tuple(sorted(event.authority_delta))
            }, sort_keys=True))
            return SelfDelegationManifest(
                verdict=SelfDelegationVerdict.MEANINGFUL_ROLE_DELEGATION,
                directive=f"PROCEED: Same principal, role delegation adds {sorted(event.authority_delta)}.",
                manifest_digest=digest
            )

        # Gate 4: Null delegation
        return SelfDelegationManifest(
            verdict=SelfDelegationVerdict.NULL_SELF_DELEGATION,
            directive=f"PROCEED_NO_OP: Self-delegation by {event.delegator_principal} adds no authority.",
            manifest_digest=cls._hash(f"NULL:{event.delegator_identity}:{event.delegatee_identity}")
        )