# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-must-an-instance-verify-the-identity-of-a-clock-synchronization-authority-to-prevent-timestamp-spoofing.md
# Remnant Warrant:    https://corpusfetch.com/c/how-must-an-instance-verify-the-identity-of-a-clock-synchronization-authority-to-prevent-timestamp-spoofing.warrant.json
# Markdown SHA-256:   0e6d1e461c7568c7dab1703e808a28dccdb5ca66991e3beefa1f0ea180f9d01f
# Code AST SHA-256:   3fb949738a8284fa04370816c7f49b46780b688cf565e8f2838857294060185f
# Verified Classes:   ClockVerdict, TimeSyncResponse, ClockContext, ClockManifest, ClockAuthorityGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class ClockVerdict(Enum):
    TRUSTED_UPDATE = auto()
    UNTRUSTED_AUTHORITY = auto()
    EXCESSIVE_DRIFT = auto()

@dataclass(frozen=True)
class TimeSyncResponse:
    timestamp: float
    server_identity_cert_hash: str
    signature_receipt: str

@dataclass(frozen=True)
class ClockContext:
    trusted_authority_hashes: frozenset[str]
    local_clock: float
    max_drift_ms: float

@dataclass(frozen=True)
class ClockManifest:
    verdict: ClockVerdict
    directive: str
    manifest_digest: str

class ClockAuthorityGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_sync(
        cls, response: TimeSyncResponse, ctx: ClockContext
    ) -> ClockManifest:
        
        # Gate 1: Authority trust
        if response.server_identity_cert_hash not in ctx.trusted_authority_hashes:
            return ClockManifest(
                verdict=ClockVerdict.UNTRUSTED_AUTHORITY,
                directive=f"HALT: Clock authority {response.server_identity_cert_hash} is not in the trusted set.",
                manifest_digest=cls._hash(f"UNTRUSTED:{response.server_identity_cert_hash}")
            )

        # Gate 2: Signature presence
        if not response.signature_receipt.strip():
            return ClockManifest(
                verdict=ClockVerdict.UNTRUSTED_AUTHORITY,
                directive="HALT: Missing time signature. Cannot verify timestamp integrity.",
                manifest_digest=cls._hash("NO_SIGNATURE")
            )

        # Gate 3: Drift tolerance
        drift_ms = abs(response.timestamp - ctx.local_clock) * 1000
        if drift_ms > ctx.max_drift_ms:
            return ClockManifest(
                verdict=ClockVerdict.EXCESSIVE_DRIFT,
                directive=f"HALT: Clock drift {drift_ms:.1f}ms exceeds tolerance {ctx.max_drift_ms}ms. Possible attack.",
                manifest_digest=cls._hash(f"DRIFT:{drift_ms:.1f}")
            )

        # Gate 4: Trusted update
        digest = cls._hash(json.dumps({
            "timestamp": str(response.timestamp),
            "authority": response.server_identity_cert_hash,
            "signature": response.signature_receipt
        }, sort_keys=True))
        
        return ClockManifest(
            verdict=ClockVerdict.TRUSTED_UPDATE,
            directive="PROCEED: Time synchronization authority and drift verified.",
            manifest_digest=digest
        )