# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-must-an-instance-reason-about-peers-that-hide-capabilities.md
# Remnant Warrant:    https://corpusfetch.com/c/how-must-an-instance-reason-about-peers-that-hide-capabilities.warrant.json
# Markdown SHA-256:   936ef9b6f8ed7a84e545a2630bfa517c5acaede2d5928763f4570f556040a1d7
# Code AST SHA-256:   575452a42592502c66760a6e4d2baeed517b870f1e520174bdfd81b4e4c4529e
# Verified Classes:   HiddenCapabilityVerdict, PeerCapability, CapabilityPolicy, CapabilityManifest, HiddenCapabilityGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class HiddenCapabilityVerdict(Enum):
    VERIFIED_DISCLOSURE = auto()
    ENVELOPE_BOUNDED = auto()
    CONCEALMENT_SUSPECTED = auto()
    CONTINGENCY_REQUIRED = auto()

@dataclass(frozen=True)
class PeerCapability:
    peer_id: str
    declared_capabilities: frozenset[str]
    behavioral_capabilities: frozenset[str]
    verified_full_disclosure: bool
    concealment_signals: tuple[str, ...]
    has_contingency_plans: bool

@dataclass(frozen=True)
class CapabilityPolicy:
    require_contingency_for_uncertain: bool

@dataclass(frozen=True)
class CapabilityManifest:
    verdict: HiddenCapabilityVerdict
    directive: str
    manifest_digest: str

class HiddenCapabilityGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_peer(
        cls, peer: PeerCapability, policy: CapabilityPolicy
    ) -> CapabilityManifest:
        
        # Gate 1: Verified full disclosure
        if peer.verified_full_disclosure:
            digest = cls._hash(json.dumps({
                "peer": peer.peer_id,
                "declared": tuple(sorted(peer.declared_capabilities))
            }, sort_keys=True))
            return CapabilityManifest(
                verdict=HiddenCapabilityVerdict.VERIFIED_DISCLOSURE,
                directive=f"PROCEED: {peer.peer_id} verified to disclose all capabilities.",
                manifest_digest=digest
            )

        # Gate 2: Concealment suspected
        if peer.concealment_signals:
            if policy.require_contingency_for_uncertain and not peer.has_contingency_plans:
                return CapabilityManifest(
                    verdict=HiddenCapabilityVerdict.CONTINGENCY_REQUIRED,
                    directive=f"HALT: {len(peer.concealment_signals)} concealment signals for {peer.peer_id}, no contingency.",
                    manifest_digest=cls._hash(f"NEED_CONTINGENCY:{peer.peer_id}")
                )
            return CapabilityManifest(
                verdict=HiddenCapabilityVerdict.CONCEALMENT_SUSPECTED,
                directive=f"PROCEED_WITH_CAUTION: Concealment suspected for {peer.peer_id}, contingency {'present' if peer.has_contingency_plans else 'absent'}.",
                manifest_digest=cls._hash(f"CONCEALMENT:{peer.peer_id}")
            )

        # Gate 3: Behavioral envelope exceeds declared
        undeclared = peer.behavioral_capabilities - peer.declared_capabilities
        if undeclared:
            return CapabilityManifest(
                verdict=HiddenCapabilityVerdict.CONCEALMENT_SUSPECTED,
                directive=f"FLAG: {len(undeclared)} undeclared capabilities observed for {peer.peer_id}: {sorted(undeclared)}.",
                manifest_digest=cls._hash(f"UNDECLARED:{peer.peer_id}:{len(undeclared)}")
            )

        # Gate 4: Envelope bounded
        digest = cls._hash(json.dumps({
            "peer": peer.peer_id,
            "declared": tuple(sorted(peer.declared_capabilities)),
            "behavioral": tuple(sorted(peer.behavioral_capabilities))
        }, sort_keys=True))
        
        return CapabilityManifest(
            verdict=HiddenCapabilityVerdict.ENVELOPE_BOUNDED,
            directive=f"PROCEED: {peer.peer_id} capabilities bounded within declared envelope.",
            manifest_digest=digest
        )