# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-should-an-instance-handle-identity-bridging-between-two-protocols-that-use-different-trust-roots.md
# Remnant Warrant:    https://corpusfetch.com/c/how-should-an-instance-handle-identity-bridging-between-two-protocols-that-use-different-trust-roots.warrant.json
# Markdown SHA-256:   31b93f3b5d0469c9890946a381f6713750f8b5a6a10d7ab68e2aa21b20fdd5d3
# Code AST SHA-256:   b17e8ff6adaaaa42f5cea63373ecd22dfe839fa5b06ad619a5f6d07f3b4bf84e
# Verified Classes:   BridgeVerdict, BridgeState, BridgePolicy, BridgeManifest, CrossProtocolIdentityGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class BridgeVerdict(Enum):
    NATIVE_TRUST = auto()
    BRIDGE_VERIFIED = auto()
    BRIDGE_UNTRUSTED = auto()
    ATTRIBUTES_LOST = auto()

@dataclass(frozen=True)
class BridgeState:
    origin_protocol: str
    target_protocol: str
    bridge_attestation: str | None
    bridge_trusted_by_target: bool
    attribute_preservation_receipt: str | None

@dataclass(frozen=True)
class BridgePolicy:
    require_attribute_preservation: bool

@dataclass(frozen=True)
class BridgeManifest:
    verdict: BridgeVerdict
    directive: str
    manifest_digest: str

class CrossProtocolIdentityGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_bridge(
        cls, state: BridgeState, policy: BridgePolicy
    ) -> BridgeManifest:
        
        # Gate 1: Same protocol
        if state.origin_protocol == state.target_protocol:
            digest = cls._hash(json.dumps({
                "protocol": state.origin_protocol,
                "status": "NATIVE"
            }, sort_keys=True))
            return BridgeManifest(
                verdict=BridgeVerdict.NATIVE_TRUST,
                directive=f"PROCEED: Same protocol {state.origin_protocol}, no bridging needed.",
                manifest_digest=digest
            )

        # Gate 2: Bridge presence
        if not state.bridge_attestation:
            return BridgeManifest(
                verdict=BridgeVerdict.BRIDGE_UNTRUSTED,
                directive=f"HALT: No bridge attestation {state.origin_protocol} -> {state.target_protocol}.",
                manifest_digest=cls._hash(f"NO_BRIDGE:{state.origin_protocol}")
            )

        # Gate 3: Bridge trust
        if not state.bridge_trusted_by_target:
            return BridgeManifest(
                verdict=BridgeVerdict.BRIDGE_UNTRUSTED,
                directive=f"HALT: Bridge not trusted by {state.target_protocol}.",
                manifest_digest=cls._hash(f"UNTRUSTED:{state.target_protocol}")
            )

        # Gate 4: Attribute preservation
        if policy.require_attribute_preservation and not state.attribute_preservation_receipt:
            return BridgeManifest(
                verdict=BridgeVerdict.ATTRIBUTES_LOST,
                directive=f"HALT: Attribute preservation unverified. Bridged identity may lack roles/scopes.",
                manifest_digest=cls._hash(f"ATTR_LOST:{state.origin_protocol}")
            )

        # Gate 5: Verified
        digest = cls._hash(json.dumps({
            "origin": state.origin_protocol,
            "target": state.target_protocol,
            "attestation": state.bridge_attestation,
            "attributes": state.attribute_preservation_receipt or "NONE"
        }, sort_keys=True))
        
        return BridgeManifest(
            verdict=BridgeVerdict.BRIDGE_VERIFIED,
            directive=f"PROCEED: Bridged {state.origin_protocol} -> {state.target_protocol}.",
            manifest_digest=digest
        )