# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-must-an-instance-prove-it-has-the-right-to-be-forgotten-in-an-immutable-append-only-ledger.md
# Remnant Warrant:    https://corpusfetch.com/c/how-must-an-instance-prove-it-has-the-right-to-be-forgotten-in-an-immutable-append-only-ledger.warrant.json
# Markdown SHA-256:   d8f3461ab7daca218e0bf701d1c0d6e2d7d1119421dce3e6ca1d8ed881bde60b
# Code AST SHA-256:   de28f13573432c367180419c234a9c2709520f196737c235c570b1b59e67b888
# Verified Classes:   ShreddingVerdict, RTBFRequest, ShreddingState, ShreddingManifest, ImmutableLedgerShreddingGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class ShreddingVerdict(Enum):
    SHREDDING_VERIFIED = auto()
    SHREDDING_INCOMPLETE = auto()
    CROSS_LEDGER_LEAK = auto()

@dataclass(frozen=True)
class RTBFRequest:
    record_id: str
    encryption_key_id: str
    affected_ledger_partitions: tuple[str, ...]

@dataclass(frozen=True)
class ShreddingState:
    key_destroyed: bool
    shredding_receipt: str | None
    partitions_verified: tuple[str, ...]

@dataclass(frozen=True)
class ShreddingManifest:
    verdict: ShreddingVerdict
    directive: str
    manifest_digest: str

class ImmutableLedgerShreddingGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_shredding(
        cls, req: RTBFRequest, state: ShreddingState
    ) -> ShreddingManifest:
        
        # Gate 1: Key destruction
        if not state.key_destroyed:
            return ShreddingManifest(
                verdict=ShreddingVerdict.SHREDDING_INCOMPLETE,
                directive=f"HALT: Key {req.encryption_key_id} not destroyed.",
                manifest_digest=cls._hash(f"KEY_ALIVE:{req.encryption_key_id}")
            )

        # Gate 2: Shredding receipt
        if not state.shredding_receipt:
            return ShreddingManifest(
                verdict=ShreddingVerdict.SHREDDING_INCOMPLETE,
                directive="HALT: No shredding receipt. Cannot prove key destruction.",
                manifest_digest=cls._hash("NO_RECEIPT")
            )

        # Gate 3: Cross-ledger verification
        unverified = set(req.affected_ledger_partitions) - set(state.partitions_verified)
        if unverified:
            return ShreddingManifest(
                verdict=ShreddingVerdict.CROSS_LEDGER_LEAK,
                directive=f"HALT: Unverified partitions {sorted(unverified)}. PII may be accessible.",
                manifest_digest=cls._hash(f"UNVERIFIED:{len(unverified)}")
            )

        # Gate 4: Verified
        digest = cls._hash(json.dumps({
            "record": req.record_id,
            "key": req.encryption_key_id,
            "receipt": state.shredding_receipt,
            "partitions": tuple(sorted(state.partitions_verified))
        }, sort_keys=True))
        
        return ShreddingManifest(
            verdict=ShreddingVerdict.SHREDDING_VERIFIED,
            directive="PROCEED: Cryptographic shredding verified across all partitions.",
            manifest_digest=digest
        )