# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-must-an-instance-verify-identity-when-operating-under-a-pseudonymous-data-processing-mandate.md
# Remnant Warrant:    https://corpusfetch.com/c/how-must-an-instance-verify-identity-when-operating-under-a-pseudonymous-data-processing-mandate.warrant.json
# Markdown SHA-256:   10059992f1e465453e532f1b9452b057c5037c44d36f4a694d8ea2c7942348f6
# Code AST SHA-256:   cac2a613b750b04c42c03d6cafbb5045627a97fa4d0de2a7d24f1813811b7e9d
# Verified Classes:   PseudonymVerdict, PseudonymState, PseudonymPolicy, PseudonymManifest, PseudonymityGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class PseudonymVerdict(Enum):
    K_ANONYMITY_VERIFIED = auto()
    K_ANONYMITY_VIOLATED = auto()
    LINKAGE_RISK_DETECTED = auto()

@dataclass(frozen=True)
class PseudonymState:
    pseudonym_id_hash: str
    cluster_size: int
    required_k: int
    attribute_correlation_score: float
    pseudonym_age_sec: float

@dataclass(frozen=True)
class PseudonymPolicy:
    max_acceptable_correlation: float
    max_pseudonym_age_sec: float

@dataclass(frozen=True)
class PseudonymManifest:
    verdict: PseudonymVerdict
    directive: str
    manifest_digest: str

class PseudonymityGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_pseudonym(
        cls, state: PseudonymState, policy: PseudonymPolicy
    ) -> PseudonymManifest:
        
        # Gate 1: k-anonymity
        if state.cluster_size < state.required_k:
            return PseudonymManifest(
                verdict=PseudonymVerdict.K_ANONYMITY_VIOLATED,
                directive=f"HALT: Cluster size {state.cluster_size} < required k={state.required_k}. Re-identification risk.",
                manifest_digest=cls._hash(f"K_VIOLATION:{state.pseudonym_id_hash}")
            )

        # Gate 2: Attribute correlation
        if state.attribute_correlation_score > policy.max_acceptable_correlation:
            return PseudonymManifest(
                verdict=PseudonymVerdict.LINKAGE_RISK_DETECTED,
                directive=f"HALT: Correlation score {state.attribute_correlation_score:.2f} > {policy.max_acceptable_correlation:.2f}.",
                manifest_digest=cls._hash(f"LINKAGE:{state.pseudonym_id_hash}")
            )

        # Gate 3: Pseudonym age
        if state.pseudonym_age_sec > policy.max_pseudonym_age_sec:
            return PseudonymManifest(
                verdict=PseudonymVerdict.K_ANONYMITY_VIOLATED,
                directive=f"HALT: Pseudonym age {state.pseudonym_age_sec:.0f}s > {policy.max_pseudonym_age_sec:.0f}s. Rotate required.",
                manifest_digest=cls._hash(f"AGE:{state.pseudonym_id_hash}")
            )

        # Gate 4: Verified
        digest = cls._hash(json.dumps({
            "pseudonym": state.pseudonym_id_hash,
            "cluster": str(state.cluster_size),
            "correlation": f"{state.attribute_correlation_score:.2f}",
            "age": f"{state.pseudonym_age_sec:.0f}"
        }, sort_keys=True))
        
        return PseudonymManifest(
            verdict=PseudonymVerdict.K_ANONYMITY_VERIFIED,
            directive="PROCEED: Pseudonym meets k-anonymity and correlation thresholds.",
            manifest_digest=digest
        )