# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-must-an-instance-verify-the-authenticity-of-a-mathematical-proof-generated-by-an-external-solver.md
# Remnant Warrant:    https://corpusfetch.com/c/how-must-an-instance-verify-the-authenticity-of-a-mathematical-proof-generated-by-an-external-solver.warrant.json
# Markdown SHA-256:   3db999e7d0798b0e3150900aff56a41ab786ee4fbf24a0e1ea41c08e51d35245
# Code AST SHA-256:   4b9824b9df81864f771095bc0dc34d2b4ef45ce8bfe6755c1f658a5fece6583c
# Verified Classes:   ProofVerdict, ProofCertificate, ProofPolicy, ProofManifest, ProofAuthenticityGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class ProofVerdict(Enum):
    AUTHENTIC_PROOF = auto()
    THEOREM_MISMATCH = auto()
    PARAMETER_TAMPERING = auto()
    UNTRUSTED_SOLVER = auto()

@dataclass(frozen=True)
class ProofCertificate:
    proof_hash: str
    solver_identity_signature: str
    input_theorem_hash: str
    parameter_bundle_hash: str
    checker_identity_signature: str

@dataclass(frozen=True)
class ProofPolicy:
    trusted_solvers: frozenset[str]
    expected_theorem_hash: str
    expected_parameter_hash: str
    trusted_checkers: frozenset[str]

@dataclass(frozen=True)
class ProofManifest:
    verdict: ProofVerdict
    directive: str
    manifest_digest: str

class ProofAuthenticityGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_proof(
        cls, cert: ProofCertificate, policy: ProofPolicy
    ) -> ProofManifest:
        
        # Gate 1: Solver trust
        if cert.solver_identity_signature not in policy.trusted_solvers:
            return ProofManifest(
                verdict=ProofVerdict.UNTRUSTED_SOLVER,
                directive=f"HALT: Solver {cert.solver_identity_signature} not in trusted set.",
                manifest_digest=cls._hash(f"UNTRUSTED_SOLVER:{cert.proof_hash}")
            )

        # Gate 2: Theorem match
        if cert.input_theorem_hash != policy.expected_theorem_hash:
            return ProofManifest(
                verdict=ProofVerdict.THEOREM_MISMATCH,
                directive=f"HALT: Theorem hash mismatch. Expected {policy.expected_theorem_hash}, got {cert.input_theorem_hash}.",
                manifest_digest=cls._hash(f"THEOREM_MISMATCH:{cert.proof_hash}")
            )

        # Gate 3: Parameter match
        if cert.parameter_bundle_hash != policy.expected_parameter_hash:
            return ProofManifest(
                verdict=ProofVerdict.PARAMETER_TAMPERING,
                directive=f"HALT: Parameter hash mismatch.",
                manifest_digest=cls._hash(f"PARAMETER:{cert.proof_hash}")
            )

        # Gate 4: Checker trust
        if cert.checker_identity_signature not in policy.trusted_checkers:
            return ProofManifest(
                verdict=ProofVerdict.UNTRUSTED_SOLVER,
                directive=f"HALT: Checker {cert.checker_identity_signature} not trusted.",
                manifest_digest=cls._hash(f"UNTRUSTED_CHECKER:{cert.proof_hash}")
            )

        # Gate 5: Verified
        digest = cls._hash(json.dumps({
            "proof": cert.proof_hash,
            "solver": cert.solver_identity_signature,
            "theorem": cert.input_theorem_hash,
            "params": cert.parameter_bundle_hash,
            "checker": cert.checker_identity_signature
        }, sort_keys=True))
        
        return ProofManifest(
            verdict=ProofVerdict.AUTHENTIC_PROOF,
            directive="PROCEED: Proof authenticity verified.",
            manifest_digest=digest
        )