# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-must-an-instance-verify-that-a-vulnerability-database-has-not-been-poisoned-before-acting-on-a-cve.md
# Remnant Warrant:    https://corpusfetch.com/c/how-must-an-instance-verify-that-a-vulnerability-database-has-not-been-poisoned-before-acting-on-a-cve.warrant.json
# Markdown SHA-256:   2eb690f3f806556da103fcbf8f2bdbec31b556330a20278b27b67438f8792892
# Code AST SHA-256:   1b72772f2e89760598ae4879e3df2ce928cac5dcfb1598fcf014e491931c8ec5
# Verified Classes:   CVEVerdict, CVEEntry, CVEPolicy, CVEManifest, CVEPoisoningGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class CVEVerdict(Enum):
    VERIFIED_CVE = auto()
    UNTRUSTED_SIGNATURE = auto()
    MIRROR_MISMATCH = auto()
    INSUFFICIENT_CROSS_REFERENCE = auto()

@dataclass(frozen=True)
class CVEEntry:
    cve_id: str
    upstream_signature_chain_hash: str
    mirror_consistency_hash: str
    cross_reference_count: int
    patch_provenance_signed: bool

@dataclass(frozen=True)
class CVEPolicy:
    trusted_upstream_hashes: frozenset[str]
    min_cross_references: int
    require_patch_provenance: bool

@dataclass(frozen=True)
class CVEManifest:
    verdict: CVEVerdict
    directive: str
    manifest_digest: str

class CVEPoisoningGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_cve(
        cls, entry: CVEEntry, policy: CVEPolicy
    ) -> CVEManifest:
        
        # Gate 1: Upstream trust
        if entry.upstream_signature_chain_hash not in policy.trusted_upstream_hashes:
            return CVEManifest(
                verdict=CVEVerdict.UNTRUSTED_SIGNATURE,
                directive=f"HALT: CVE {entry.cve_id} signature chain not in trusted set. Possible poisoning.",
                manifest_digest=cls._hash(f"UNTRUSTED:{entry.cve_id}")
            )

        # Gate 2: Mirror consistency
        if not entry.mirror_consistency_hash.strip():
            return CVEManifest(
                verdict=CVEVerdict.MIRROR_MISMATCH,
                directive=f"HALT: CVE {entry.cve_id} mirror consistency unverified.",
                manifest_digest=cls._hash(f"NO_MIRROR:{entry.cve_id}")
            )

        # Gate 3: Cross-reference
        if entry.cross_reference_count < policy.min_cross_references:
            return CVEManifest(
                verdict=CVEVerdict.INSUFFICIENT_CROSS_REFERENCE,
                directive=f"HALT: CVE {entry.cve_id} has {entry.cross_reference_count} cross-refs, minimum {policy.min_cross_references}.",
                manifest_digest=cls._hash(f"CROSS_REF:{entry.cve_id}")
            )

        # Gate 4: Patch provenance
        if policy.require_patch_provenance and not entry.patch_provenance_signed:
            return CVEManifest(
                verdict=CVEVerdict.UNTRUSTED_SIGNATURE,
                directive=f"HALT: CVE {entry.cve_id} patch lacks provenance signature.",
                manifest_digest=cls._hash(f"NO_PATCH:{entry.cve_id}")
            )

        # Gate 5: Verified
        digest = cls._hash(json.dumps({
            "cve": entry.cve_id,
            "upstream": entry.upstream_signature_chain_hash,
            "cross_refs": str(entry.cross_reference_count),
            "patch_signed": str(entry.patch_provenance_signed)
        }, sort_keys=True))
        
        return CVEManifest(
            verdict=CVEVerdict.VERIFIED_CVE,
            directive="PROCEED: CVE verified across signatures, mirrors, and cross-references.",
            manifest_digest=digest
        )