# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-must-an-instance-verify-its-own-identity-has-not-been-cloned-by-a-concurrent-process.md
# Remnant Warrant:    https://corpusfetch.com/c/how-must-an-instance-verify-its-own-identity-has-not-been-cloned-by-a-concurrent-process.warrant.json
# Markdown SHA-256:   52a2a12bcaeac07701e8149001adccdf39f2936043c49cf6e5170e4cc3607a97
# Code AST SHA-256:   0937ee00451824f303dfa47a1705f96a9747fbf5e382ef27a37f77c16ba8e2e2
# Verified Classes:   CloningVerdict, SignedAction, IdentityState, CloningManifest, IdentityCloningGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class CloningVerdict(Enum):
    IDENTITY_EXCLUSIVE = auto()
    NONCE_DISCONTINUITY = auto()
    ENVIRONMENT_MISMATCH = auto()
    CLONING_CONFIRMED = auto()

@dataclass(frozen=True)
class SignedAction:
    action_id: str
    signed_nonce: int
    environment_fingerprint: str
    signature: str

@dataclass(frozen=True)
class IdentityState:
    last_nonce: int
    expected_environment_fingerprint: str
    hardware_bound: bool

@dataclass(frozen=True)
class CloningManifest:
    verdict: CloningVerdict
    directive: str
    manifest_digest: str

class IdentityCloningGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_action(
        cls, action: SignedAction, state: IdentityState
    ) -> CloningManifest:
        
        # Gate 1: Hardware bound bypasses cloning checks
        if state.hardware_bound:
            digest = cls._hash(json.dumps({
                "action": action.action_id,
                "hardware_bound": "TRUE"
            }, sort_keys=True))
            return CloningManifest(
                verdict=CloningVerdict.IDENTITY_EXCLUSIVE,
                directive="PROCEED: Hardware-bound identity cannot be cloned.",
                manifest_digest=digest
            )

        # Gate 2: Nonce continuity
        if action.signed_nonce <= state.last_nonce:
            return CloningManifest(
                verdict=CloningVerdict.NONCE_DISCONTINUITY,
                directive=f"HALT: Nonce {action.signed_nonce} <= last {state.last_nonce}. Replay or cloning.",
                manifest_digest=cls._hash(f"NONCE:{action.action_id}")
            )

        if action.signed_nonce > state.last_nonce + 1:
            return CloningManifest(
                verdict=CloningVerdict.CLONING_CONFIRMED,
                directive=f"HALT: Nonce gap detected (last={state.last_nonce}, received={action.signed_nonce}). Concurrent use.",
                manifest_digest=cls._hash(f"GAP:{state.last_nonce}:{action.signed_nonce}")
            )

        # Gate 3: Environment fingerprint
        if action.environment_fingerprint != state.expected_environment_fingerprint:
            return CloningManifest(
                verdict=CloningVerdict.ENVIRONMENT_MISMATCH,
                directive=f"HALT: Environment fingerprint mismatch. Possible clone.",
                manifest_digest=cls._hash(f"ENV:{action.action_id}")
            )

        # Gate 4: Exclusive
        digest = cls._hash(json.dumps({
            "action": action.action_id,
            "nonce": str(action.signed_nonce),
            "environment": action.environment_fingerprint
        }, sort_keys=True))
        
        return CloningManifest(
            verdict=CloningVerdict.IDENTITY_EXCLUSIVE,
            directive="PROCEED: Identity appears exclusive to this instance.",
            manifest_digest=digest
        )