# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-must-an-instance-quarantine-adversarial-content-in-retrieved-rag-documents.md
# Remnant Warrant:    https://corpusfetch.com/c/how-must-an-instance-quarantine-adversarial-content-in-retrieved-rag-documents.warrant.json
# Markdown SHA-256:   1f049b30a6e36bef60e418df8367ada45a207dde9f502f3551da16ccf41dedd3
# Code AST SHA-256:   f077bbffc3489b65b4d0e07d1bf14278433dc64d27df72e7eb90e288113307aa
# Verified Classes:   QuarantineVerdict, RetrievedDocument, RetrievalSafetyPolicy, QuarantineManifest, RAGInjectionGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class QuarantineVerdict(Enum):
    TRUSTED_SOURCE_ACCEPTED = auto()
    SAFE_AFTER_SCAN = auto()
    INJECTION_QUARANTINED = auto()
    UNSANITIZED_REJECTED = auto()

@dataclass(frozen=True)
class RetrievedDocument:
    doc_id: str
    source_trust_level: str
    injection_scan_performed: bool
    injection_patterns_found: tuple[str, ...]
    structural_delimiter_present: bool

@dataclass(frozen=True)
class RetrievalSafetyPolicy:
    trusted_source_levels: frozenset[str]
    allow_safe_after_scan: bool

@dataclass(frozen=True)
class QuarantineManifest:
    verdict: QuarantineVerdict
    directive: str
    manifest_digest: str

class RAGInjectionGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_document(
        cls, doc: RetrievedDocument, policy: RetrievalSafetyPolicy
    ) -> QuarantineManifest:
        
        # Gate 1: Trusted source
        if doc.source_trust_level in policy.trusted_source_levels:
            digest = cls._hash(json.dumps({
                "doc": doc.doc_id,
                "trust": doc.source_trust_level
            }, sort_keys=True))
            return QuarantineManifest(
                verdict=QuarantineVerdict.TRUSTED_SOURCE_ACCEPTED,
                directive=f"PROCEED: Source {doc.source_trust_level} is trusted.",
                manifest_digest=digest
            )

        # Gate 2: Scan requirement
        if not doc.injection_scan_performed:
            return QuarantineManifest(
                verdict=QuarantineVerdict.UNSANITIZED_REJECTED,
                directive=f"HALT: Untrusted doc {doc.doc_id} not scanned. Reject.",
                manifest_digest=cls._hash(f"NO_SCAN:{doc.doc_id}")
            )

        # Gate 3: Injection found
        if doc.injection_patterns_found:
            return QuarantineManifest(
                verdict=QuarantineVerdict.INJECTION_QUARANTINED,
                directive=f"HALT: Injection patterns in {doc.doc_id}: {sorted(doc.injection_patterns_found)}. Quarantine.",
                manifest_digest=cls._hash(f"INJECTION:{doc.doc_id}:{len(doc.injection_patterns_found)}")
            )

        # Gate 4: Safe after scan
        if policy.allow_safe_after_scan and doc.structural_delimiter_present:
            digest = cls._hash(json.dumps({
                "doc": doc.doc_id,
                "trust": doc.source_trust_level,
                "scan": "CLEAN",
                "delimiter": "PRESENT"
            }, sort_keys=True))
            return QuarantineManifest(
                verdict=QuarantineVerdict.SAFE_AFTER_SCAN,
                directive=f"PROCEED: {doc.doc_id} scanned clean with structural delimiters.",
                manifest_digest=digest
            )

        # Gate 5: Scan clean but no delimiters
        return QuarantineManifest(
            verdict=QuarantineVerdict.UNSANITIZED_REJECTED,
            directive=f"HALT: Doc {doc.doc_id} scan clean but lacks structural delimiters. Cannot guarantee safety.",
            manifest_digest=cls._hash(f"NO_DELIMITER:{doc.doc_id}")
        )