# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-must-an-instance-verify-a-zero-knowledge-credential-has-not-been-revoked.md
# Remnant Warrant:    https://corpusfetch.com/c/how-must-an-instance-verify-a-zero-knowledge-credential-has-not-been-revoked.warrant.json
# Markdown SHA-256:   51761f6753d42fe1efea8946a2d50f833cc52935999a4361d8cd7a2e95524fa2
# Code AST SHA-256:   efa7aa9dd78a97d8a412942058dd98d11493d4286bcf99b1c0a54db313c1b04a
# Verified Classes:   RevocationVerdict, ZKCredentialProof, RevocationState, RevocationPolicy, RevocationManifest, ZKRevocationGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class RevocationVerdict(Enum):
    PROOF_VALID_NOT_REVOCABLE = auto()
    PROOF_VALID_NOT_REVOKED = auto()
    PROOF_VALID_BUT_REVOKED = auto()
    ACCUMULATOR_STALE = auto()

@dataclass(frozen=True)
class ZKCredentialProof:
    proof_hash: str
    proof_generation_epoch: float
    revocation_nonmembership_proof: str | None
    referenced_accumulator_root: str | None

@dataclass(frozen=True)
class RevocationState:
    current_accumulator_root: str
    accumulator_freshness_epoch: float
    current_epoch: float
    credential_is_revocable: bool

@dataclass(frozen=True)
class RevocationPolicy:
    max_accumulator_staleness_sec: float
    max_proof_age_sec: float

@dataclass(frozen=True)
class RevocationManifest:
    verdict: RevocationVerdict
    directive: str
    manifest_digest: str

class ZKRevocationGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_proof(
        cls, proof: ZKCredentialProof, state: RevocationState, policy: RevocationPolicy
    ) -> RevocationManifest:
        
        # Gate 1: Non-revocable credential
        if not state.credential_is_revocable:
            digest = cls._hash(json.dumps({
                "proof": proof.proof_hash,
                "revocable": "FALSE"
            }, sort_keys=True))
            return RevocationManifest(
                verdict=RevocationVerdict.PROOF_VALID_NOT_REVOCABLE,
                directive="PROCEED: Credential is non-revocable. Proof sufficient.",
                manifest_digest=digest
            )

        # Gate 2: Accumulator freshness
        accumulator_age = state.current_epoch - state.accumulator_freshness_epoch
        if accumulator_age > policy.max_accumulator_staleness_sec:
            return RevocationManifest(
                verdict=RevocationVerdict.ACCUMULATOR_STALE,
                directive=f"HALT: Accumulator stale by {accumulator_age:.0f}s > {policy.max_accumulator_staleness_sec:.0f}s.",
                manifest_digest=cls._hash(f"STALE_ACCUM:{accumulator_age:.0f}")
            )

        # Gate 3: Proof age
        proof_age = state.current_epoch - proof.proof_generation_epoch
        if proof_age > policy.max_proof_age_sec:
            return RevocationManifest(
                verdict=RevocationVerdict.PROOF_VALID_BUT_REVOKED,
                directive=f"HALT: Proof is {proof_age:.0f}s old, exceeding {policy.max_proof_age_sec:.0f}s freshness.",
                manifest_digest=cls._hash(f"STALE_PROOF:{proof_age:.0f}")
            )

        # Gate 4: Non-membership proof
        if not proof.revocation_nonmembership_proof:
            return RevocationManifest(
                verdict=RevocationVerdict.PROOF_VALID_BUT_REVOKED,
                directive="HALT: Missing non-membership proof. Cannot confirm non-revocation.",
                manifest_digest=cls._hash("NO_NON_MEMBERSHIP")
            )

        if proof.referenced_accumulator_root != state.current_accumulator_root:
            return RevocationManifest(
                verdict=RevocationVerdict.ACCUMULATOR_STALE,
                directive="HALT: Proof references stale accumulator root.",
                manifest_digest=cls._hash(f"ROOT_MISMATCH:{proof.proof_hash}")
            )

        # Gate 5: Verified
        digest = cls._hash(json.dumps({
            "proof": proof.proof_hash,
            "accumulator": state.current_accumulator_root,
            "non_membership": proof.revocation_nonmembership_proof,
            "proof_age": f"{proof_age:.0f}"
        }, sort_keys=True))
        
        return RevocationManifest(
            verdict=RevocationVerdict.PROOF_VALID_NOT_REVOKED,
            directive="PROCEED: Proof valid and credential confirmed not revoked.",
            manifest_digest=digest
        )