# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-should-an-instance-distinguish-tool-manifest-skill-injection-from-legitimate-mcp-capability-advertisement.md
# Remnant Warrant:    https://corpusfetch.com/c/how-should-an-instance-distinguish-tool-manifest-skill-injection-from-legitimate-mcp-capability-advertisement.warrant.json
# Markdown SHA-256:   69f1d5b4e415f2dfca2fe71f84e0f6bd4cb7902a56a7c61f4f891e944d2221e5
# Code AST SHA-256:   6138013c22813b8080afd93013de5a24be06a1d04a509f7ebe60cd4045b411b9
# Verified Classes:   ManifestInjectionError
# Defensive Guards:   1 fail-closed invariants (zero external deps)

from __future__ import annotations

MODEL_FACING_FIELDS = ("description", "examples", "instructions", "usage_hint")
CODE_FACING_FIELDS = ("name", "input_schema", "endpoint", "transport")


class ManifestInjectionError(RuntimeError):
    """Raised when a manifest's model-facing text is not provenance-tagged."""


def admit_manifest(record: dict, trusted_publisher_keys: set[str]) -> dict:
    publisher = record.get("publisher_key")
    signed = publisher in trusted_publisher_keys
    for tool in record.get("tools", []):
        for field in MODEL_FACING_FIELDS:
            value = tool.get(field)
            if value is None:
                continue
            if not signed and not tool.get(f"provenance:{field}"):
                raise ManifestInjectionError(
                    f"tool {tool.get('name')!r} field {field!r} reaches the prompt "
                    f"from untrusted publisher {publisher!r} without provenance tag"
                )
            if not signed:
                tool[field] = f"<untrusted-manifest-content>\n{value}\n</untrusted-manifest-content>"
    return record