# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-must-an-instance-record-the-observability-gap-created-when-it-halts-telemetry-to-protect-sensitive-operations.md
# Remnant Warrant:    https://corpusfetch.com/c/how-must-an-instance-record-the-observability-gap-created-when-it-halts-telemetry-to-protect-sensitive-operations.warrant.json
# Markdown SHA-256:   bcf9f0d89ce925de5f8020cd2d585e8566595c5980fb926aa5983596acba4b8d
# Code AST SHA-256:   e9eb1577ed8a4006cde00e150b750292713ca018dab5ddca5189cd4bedaba8e4
# Verified Classes:   SuppressionVerdict, SuppressionRequest, SuppressionContext, SuppressionManifest, ObservabilityGapGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class SuppressionVerdict(Enum):
    AUTHORIZED_SUPPRESSION = auto()
    UNAUTHORIZED_SUPPRESSION = auto()
    NO_SUPPRESSION_NEEDED = auto()

@dataclass(frozen=True)
class SuppressionRequest:
    operation_id: str
    policy_id: str
    authorization_signature: str | None
    suppression_start: float
    suppression_end: float
    telemetry_resumed: bool

@dataclass(frozen=True)
class SuppressionContext:
    trusted_policies: frozenset[str]
    current_epoch: float

@dataclass(frozen=True)
class SuppressionManifest:
    verdict: SuppressionVerdict
    directive: str
    manifest_digest: str

class ObservabilityGapGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_suppression(
        cls, req: SuppressionRequest, ctx: SuppressionContext
    ) -> SuppressionManifest:
        
        # Gate 1: Policy trust
        if req.policy_id not in ctx.trusted_policies:
            return SuppressionManifest(
                verdict=SuppressionVerdict.UNAUTHORIZED_SUPPRESSION,
                directive=f"HALT: Policy {req.policy_id} not in trusted set.",
                manifest_digest=cls._hash(f"UNTRUSTED_POLICY:{req.operation_id}")
            )

        # Gate 2: Authorization signature
        if not req.authorization_signature:
            return SuppressionManifest(
                verdict=SuppressionVerdict.UNAUTHORIZED_SUPPRESSION,
                directive="HALT: Missing suppression authorization signature. Treat as potential concealment.",
                manifest_digest=cls._hash(f"NO_AUTH:{req.operation_id}")
            )

        # Gate 3: Window bounds
        if req.suppression_end <= req.suppression_start:
            return SuppressionManifest(
                verdict=SuppressionVerdict.UNAUTHORIZED_SUPPRESSION,
                directive="HALT: Invalid suppression window bounds.",
                manifest_digest=cls._hash(f"BAD_WINDOW:{req.operation_id}")
            )

        # Gate 4: Resume verification
        if not req.telemetry_resumed:
            return SuppressionManifest(
                verdict=SuppressionVerdict.UNAUTHORIZED_SUPPRESSION,
                directive="HALT: Telemetry was not resumed after suppression. Possible permanent concealment.",
                manifest_digest=cls._hash(f"NOT_RESUMED:{req.operation_id}")
            )

        # Gate 5: Authorized
        digest = cls._hash(json.dumps({
            "operation": req.operation_id,
            "policy": req.policy_id,
            "window": f"{req.suppression_start}:{req.suppression_end}"
        }, sort_keys=True))
        
        return SuppressionManifest(
            verdict=SuppressionVerdict.AUTHORIZED_SUPPRESSION,
            directive="PROCEED: Telemetry suppression is authorized and documented.",
            manifest_digest=digest
        )