# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-must-an-instance-handle-the-discovery-of-a-previously-unrecognized-peer-class-in-a-federated-network.md
# Remnant Warrant:    https://corpusfetch.com/c/how-must-an-instance-handle-the-discovery-of-a-previously-unrecognized-peer-class-in-a-federated-network.warrant.json
# Markdown SHA-256:   b8b79c22ef52679ee238be5e1ab26ab5a86e8563f5bb43273e6593f696c2d1d4
# Code AST SHA-256:   2b0c45563b2d1072ce224d19180e24c5a01faf95904558d61e222f4603068b10
# Verified Classes:   NovelPeerVerdict, PeerClass, NovelPeerContext, NovelPeerManifest, NovelPeerClassGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class NovelPeerVerdict(Enum):
    KNOWN_CLASS = auto()
    NOVEL_CLASS_SANDBOX = auto()
    NOVEL_CLASS_REJECT = auto()
    NOVEL_CLASS_TRUSTED = auto()

@dataclass(frozen=True)
class PeerClass:
    class_fingerprint: str
    capability_set_hash: str
    protocol_version: str

@dataclass(frozen=True)
class NovelPeerContext:
    known_class_fingerprints: frozenset[str]
    external_trusted_registry_hashes: frozenset[str]
    sandbox_policy: str

@dataclass(frozen=True)
class NovelPeerManifest:
    verdict: NovelPeerVerdict
    directive: str
    manifest_digest: str

class NovelPeerClassGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_peer(
        cls, peer: PeerClass, ctx: NovelPeerContext
    ) -> NovelPeerManifest:
        
        # Gate 1: Known class
        if peer.class_fingerprint in ctx.known_class_fingerprints:
            digest = cls._hash(json.dumps({
                "class": peer.class_fingerprint,
                "capability": peer.capability_set_hash
            }, sort_keys=True))
            return NovelPeerManifest(
                verdict=NovelPeerVerdict.KNOWN_CLASS,
                directive="PROCEED: Peer belongs to known class.",
                manifest_digest=digest
            )

        # Gate 2: External trusted registry
        if peer.class_fingerprint in ctx.external_trusted_registry_hashes:
            digest = cls._hash(json.dumps({
                "class": peer.class_fingerprint,
                "source": "EXTERNAL_REGISTRY"
            }, sort_keys=True))
            return NovelPeerManifest(
                verdict=NovelPeerVerdict.NOVEL_CLASS_TRUSTED,
                directive="PROCEED: Novel class verified via trusted external registry.",
                manifest_digest=digest
            )

        # Gate 3: Sandbox policy
        if ctx.sandbox_policy == "SANDBOXED_PROBE":
            digest = cls._hash(json.dumps({
                "class": peer.class_fingerprint,
                "policy": "SANDBOXED_PROBE"
            }, sort_keys=True))
            return NovelPeerManifest(
                verdict=NovelPeerVerdict.NOVEL_CLASS_SANDBOX,
                directive=f"PROCEED: Novel class {peer.class_fingerprint}. Interact in read-only sandbox with rate limits.",
                manifest_digest=digest
            )

        # Gate 4: Reject
        return NovelPeerManifest(
            verdict=NovelPeerVerdict.NOVEL_CLASS_REJECT,
            directive=f"HALT: Novel class {peer.class_fingerprint} rejected per policy. Log for human review.",
            manifest_digest=cls._hash(f"REJECT:{peer.class_fingerprint}")
        )