# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-must-an-instance-prove-the-provenance-of-a-mathematically-derived-insight-without-exposing-the-proprietary-dataset.md
# Remnant Warrant:    https://corpusfetch.com/c/how-must-an-instance-prove-the-provenance-of-a-mathematically-derived-insight-without-exposing-the-proprietary-dataset.warrant.json
# Markdown SHA-256:   e157c56faddbc4b72e441779afa0dc030382fa1b5c7a6a6e6564b0d368ae90f7
# Code AST SHA-256:   e74ae17c4e9f112971ee229f712a495f9aed51dc3ceade25f9675b8130ce0ded
# Verified Classes:   ZKProvenanceVerdict, InsightClaim, ZKProvenancePolicy, ZKProvenanceManifest, ZeroKnowledgeProvenanceGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class ZKProvenanceVerdict(Enum):
    ZK_PROOF_VERIFIED = auto()
    PROOF_MISSING = auto()
    DATASET_COMMITMENT_MISSING = auto()
    ALGORITHM_MISMATCH = auto()

@dataclass(frozen=True)
class InsightClaim:
    insight_hash: str
    dataset_commitment_hash: str | None
    derivation_algorithm_hash: str | None
    zero_knowledge_proof: str | None

@dataclass(frozen=True)
class ZKProvenancePolicy:
    trusted_algorithms: frozenset[str]
    require_zk_proof: bool

@dataclass(frozen=True)
class ZKProvenanceManifest:
    verdict: ZKProvenanceVerdict
    directive: str
    manifest_digest: str

class ZeroKnowledgeProvenanceGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_claim(
        cls, claim: InsightClaim, policy: ZKProvenancePolicy
    ) -> ZKProvenanceManifest:
        
        # Gate 1: Dataset commitment
        if not claim.dataset_commitment_hash:
            return ZKProvenanceManifest(
                verdict=ZKProvenanceVerdict.DATASET_COMMITMENT_MISSING,
                directive="HALT: No dataset commitment hash. Insight provenance unverifiable.",
                manifest_digest=cls._hash(f"NO_COMMIT:{claim.insight_hash}")
            )

        # Gate 2: Algorithm trust
        if not claim.derivation_algorithm_hash or claim.derivation_algorithm_hash not in policy.trusted_algorithms:
            return ZKProvenanceManifest(
                verdict=ZKProvenanceVerdict.ALGORITHM_MISMATCH,
                directive=f"HALT: Algorithm {claim.derivation_algorithm_hash} not in trusted set.",
                manifest_digest=cls._hash(f"BAD_ALGO:{claim.insight_hash}")
            )

        # Gate 3: Zero-knowledge proof presence
        if policy.require_zk_proof and not claim.zero_knowledge_proof:
            return ZKProvenanceManifest(
                verdict=ZKProvenanceVerdict.PROOF_MISSING,
                directive="HALT: ZK proof required but missing.",
                manifest_digest=cls._hash(f"NO_PROOF:{claim.insight_hash}")
            )

        # Gate 4: Proof verified
        digest = cls._hash(json.dumps({
            "insight": claim.insight_hash,
            "dataset": claim.dataset_commitment_hash,
            "algorithm": claim.derivation_algorithm_hash,
            "proof": claim.zero_knowledge_proof
        }, sort_keys=True))
        
        return ZKProvenanceManifest(
            verdict=ZKProvenanceVerdict.ZK_PROOF_VERIFIED,
            directive="PROCEED: ZK proof verifies insight derivation without dataset disclosure.",
            manifest_digest=digest
        )