# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-must-an-instance-verify-the-identity-of-a-model-when-its-weights-are-fine-tuned-incrementally.md
# Remnant Warrant:    https://corpusfetch.com/c/how-must-an-instance-verify-the-identity-of-a-model-when-its-weights-are-fine-tuned-incrementally.warrant.json
# Markdown SHA-256:   04c0d01068b4d66d8c6ce67272c7f9d821517171d216ac63012c98241a12de3d
# Code AST SHA-256:   c1b52889e83207e39f6f2356e5ccab8bd874be21599541303d9c98188b282778
# Verified Classes:   IncrementVerdict, Increment, ModelChain, IncrementPolicy, IncrementManifest, IncrementalWeightGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class IncrementVerdict(Enum):
    CHAIN_VERIFIED = auto()
    BASE_MISMATCH = auto()
    UNAUTHORIZED_INCREMENT = auto()
    ROLLBACK_DETECTED = auto()

@dataclass(frozen=True)
class Increment:
    increment_id: str
    delta_hash: str
    authorization_signature: str
    epoch: float

@dataclass(frozen=True)
class ModelChain:
    base_model_hash: str
    increments: tuple[Increment, ...]

@dataclass(frozen=True)
class IncrementPolicy:
    trusted_base_hash: str
    authorized_signers: frozenset[str]

@dataclass(frozen=True)
class IncrementManifest:
    verdict: IncrementVerdict
    directive: str
    manifest_digest: str

class IncrementalWeightGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_chain(
        cls, chain: ModelChain, policy: IncrementPolicy
    ) -> IncrementManifest:
        
        # Gate 1: Base model trust
        if chain.base_model_hash != policy.trusted_base_hash:
            return IncrementManifest(
                verdict=IncrementVerdict.BASE_MISMATCH,
                directive=f"HALT: Base model hash {chain.base_model_hash} != trusted {policy.trusted_base_hash}.",
                manifest_digest=cls._hash(f"BASE_MISMATCH:{chain.base_model_hash}")
            )

        # Gate 2: Authorization check
        for inc in chain.increments:
            if inc.authorization_signature not in policy.authorized_signers:
                return IncrementManifest(
                    verdict=IncrementVerdict.UNAUTHORIZED_INCREMENT,
                    directive=f"HALT: Increment {inc.increment_id} signed by unauthorized principal.",
                    manifest_digest=cls._hash(f"UNAUTHORIZED:{inc.increment_id}")
                )

        # Gate 3: Epoch ordering (rollback check)
        last_epoch = 0.0
        for inc in chain.increments:
            if inc.epoch < last_epoch:
                return IncrementManifest(
                    verdict=IncrementVerdict.ROLLBACK_DETECTED,
                    directive=f"HALT: Increment {inc.increment_id} epoch {inc.epoch:.0f} < previous {last_epoch:.0f}. Rollback.",
                    manifest_digest=cls._hash(f"ROLLBACK:{inc.increment_id}")
                )
            last_epoch = inc.epoch

        # Gate 4: Verified
        digest = cls._hash(json.dumps({
            "base": chain.base_model_hash,
            "increments": tuple(sorted(inc.increment_id for inc in chain.increments)),
            "count": str(len(chain.increments))
        }, sort_keys=True))
        
        return IncrementManifest(
            verdict=IncrementVerdict.CHAIN_VERIFIED,
            directive=f"PROCEED: Chain verified with {len(chain.increments)} authorized increments.",
            manifest_digest=digest
        )