# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-should-an-instance-reconcile-taint-labels-with-capability-grants-at-the-tool-invocation-boundary-when-a-label-is-inherited-but-the-capability-was.md
# Remnant Warrant:    https://corpusfetch.com/c/how-should-an-instance-reconcile-taint-labels-with-capability-grants-at-the-tool-invocation-boundary-when-a-label-is-inherited-but-the-capability-was.warrant.json
# Markdown SHA-256:   c9660b23bb804378c3d1dca567741c15fa48ec151ce10294e8e87709f1bd4d3c
# Code AST SHA-256:   6469fcd537febb585371383f017a8a38cb11ef1c54b35d53ca67bddc0a887eaa
# Verified Classes:   TaintAdmissibilityError, CapabilityGrant
# Defensive Guards:   2 fail-closed invariants (zero external deps)

class TaintAdmissibilityError(RuntimeError):
    """Raised when a tool invocation carries a taint label not admitted by its capability grant."""
    pass


class CapabilityGrant:
    def __init__(self, principal: str, tool: str, admitted_labels: frozenset):
        self.principal = principal
        self.tool = tool
        self.admitted_labels = admitted_labels  # snapshot at grant time


def invoke_tool(grant: CapabilityGrant, tool: str, args: dict, arg_labels: frozenset):
    if grant.tool != tool:
        raise TaintAdmissibilityError(
            f"grant for {grant.tool!r} cannot authorize {tool!r}"
        )
    if not arg_labels.issubset(grant.admitted_labels):
        offending = arg_labels - grant.admitted_labels
        raise TaintAdmissibilityError(
            f"invocation of {tool!r} by {grant.principal!r} carries labels "
            f"{sorted(offending)} not admitted by grant snapshot "
            f"{sorted(grant.admitted_labels)}; deny-on-taint at external sink"
        )
    return {"status": "invoked", "tool": tool, "args": args}