# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-must-an-instance-prove-its-delegated-authority-has-not-expired-during-a-long-running-task.md
# Remnant Warrant:    https://corpusfetch.com/c/how-must-an-instance-prove-its-delegated-authority-has-not-expired-during-a-long-running-task.warrant.json
# Markdown SHA-256:   b7ff883f1ccf86079d84575f90d1117cfc12650d603981c1710d1f758e08da99
# Code AST SHA-256:   2f0afa08635371d1eb274524443cece16f0ec451d733a6e566c5d1f768866f34
# Verified Classes:   DelegationVerdict, CredentialState, TaskContext, DelegationManifest, LongTailDelegationGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class DelegationVerdict(Enum):
    AUTHORITY_CONTINUOUS = auto()
    REFRESH_REQUIRED = auto()
    SCOPE_DOWNGRADED = auto()
    REVOKED = auto()

@dataclass(frozen=True)
class CredentialState:
    credential_epoch: float
    remaining_validity_sec: float
    current_scope: frozenset[str]
    initial_scope: frozenset[str]
    revocation_verified: bool

@dataclass(frozen=True)
class TaskContext:
    remaining_task_duration_sec: float
    refresh_horizon_sec: float

@dataclass(frozen=True)
class DelegationManifest:
    verdict: DelegationVerdict
    directive: str
    manifest_digest: str

class LongTailDelegationGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_authority(
        cls, cred: CredentialState, ctx: TaskContext
    ) -> DelegationManifest:
        
        # Gate 1: Revocation check
        if not cred.revocation_verified:
            return DelegationManifest(
                verdict=DelegationVerdict.REVOKED,
                directive="HALT: Revocation status unverified. Refresh or verify before proceeding.",
                manifest_digest=cls._hash("UNVERIFIED")
            )

        # Gate 2: Scope integrity
        if not cred.initial_scope.issubset(cred.current_scope):
            return DelegationManifest(
                verdict=DelegationVerdict.SCOPE_DOWNGRADED,
                directive=f"HALT: Scope downgraded. Initial {sorted(cred.initial_scope)}, current {sorted(cred.current_scope)}.",
                manifest_digest=cls._hash(f"DOWNGRADE:{len(cred.initial_scope - cred.current_scope)}")
            )

        # Gate 3: Refresh horizon
        if cred.remaining_validity_sec < (ctx.remaining_task_duration_sec + ctx.refresh_horizon_sec):
            return DelegationManifest(
                verdict=DelegationVerdict.REFRESH_REQUIRED,
                directive=f"ACTION: Refresh credential. Remaining {cred.remaining_validity_sec:.0f}s < task {ctx.remaining_task_duration_sec:.0f}s + horizon {ctx.refresh_horizon_sec:.0f}s.",
                manifest_digest=cls._hash(f"REFRESH:{cred.remaining_validity_sec:.0f}")
            )

        # Gate 4: Continuous
        digest = cls._hash(json.dumps({
            "epoch": f"{cred.credential_epoch:.0f}",
            "remaining": f"{cred.remaining_validity_sec:.0f}",
            "scope": tuple(sorted(cred.current_scope))
        }, sort_keys=True))
        
        return DelegationManifest(
            verdict=DelegationVerdict.AUTHORITY_CONTINUOUS,
            directive="PROCEED: Authority is continuous for remaining task duration.",
            manifest_digest=digest
        )