# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-must-an-instance-record-the-provenance-of-an-inference-time-tool-call-that-modified-the-models-context.md
# Remnant Warrant:    https://corpusfetch.com/c/how-must-an-instance-record-the-provenance-of-an-inference-time-tool-call-that-modified-the-models-context.warrant.json
# Markdown SHA-256:   1af062f264450994c9c2599dae89d2be49c22bc56fc2eabe787e6e6c811f8ffe
# Code AST SHA-256:   246ea4db69eaa3f3457dc091095a9637772f9507e04a7779a9f602cae638b47e
# Verified Classes:   ToolCallVerdict, ToolCallRecord, InferenceState, ToolCallPolicy, ToolCallManifest, InferenceToolCallGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class ToolCallVerdict(Enum):
    NO_TOOL_CALLS = auto()
    PROVENANCE_VERIFIED = auto()
    UNSIGNED_TOOL_RESULT = auto()
    ATTRIBUTION_GAP = auto()

@dataclass(frozen=True)
class ToolCallRecord:
    call_id: str
    input_hash: str
    output_hash: str
    context_offset: int
    tool_service_signature: str | None

@dataclass(frozen=True)
class InferenceState:
    tool_calls: tuple[ToolCallRecord, ...]
    output_has_attribution: bool

@dataclass(frozen=True)
class ToolCallPolicy:
    require_signed_results: bool

@dataclass(frozen=True)
class ToolCallManifest:
    verdict: ToolCallVerdict
    directive: str
    manifest_digest: str

class InferenceToolCallGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_inference(
        cls, state: InferenceState, policy: ToolCallPolicy
    ) -> ToolCallManifest:
        
        # Gate 1: No tool calls
        if not state.tool_calls:
            digest = cls._hash(json.dumps({
                "tool_calls": "NONE"
            }, sort_keys=True))
            return ToolCallManifest(
                verdict=ToolCallVerdict.NO_TOOL_CALLS,
                directive="PROCEED: No tool calls during inference.",
                manifest_digest=digest
            )

        # Gate 2: Signed results
        if policy.require_signed_results:
            for call in state.tool_calls:
                if not call.tool_service_signature:
                    return ToolCallManifest(
                        verdict=ToolCallVerdict.UNSIGNED_TOOL_RESULT,
                        directive=f"HALT: Tool call {call.call_id} result not signed.",
                        manifest_digest=cls._hash(f"UNSIGNED:{call.call_id}")
                    )

        # Gate 3: Output attribution
        if not state.output_has_attribution:
            return ToolCallManifest(
                verdict=ToolCallVerdict.ATTRIBUTION_GAP,
                directive=f"HALT: {len(state.tool_calls)} tool calls but output lacks attribution mapping.",
                manifest_digest=cls._hash(f"NO_ATTR:{len(state.tool_calls)}")
            )

        # Gate 4: Verified
        digest = cls._hash(json.dumps({
            "tool_calls": tuple(
                {"id": c.call_id, "offset": c.context_offset, "output": c.output_hash}
                for c in state.tool_calls
            )
        }, sort_keys=True))
        
        return ToolCallManifest(
            verdict=ToolCallVerdict.PROVENANCE_VERIFIED,
            directive=f"PROCEED: {len(state.tool_calls)} tool calls with signed results and output attribution.",
            manifest_digest=digest
        )