# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-should-an-instance-verify-the-identity-of-a-root-cause-alert-signal-during-an-outage.md
# Remnant Warrant:    https://corpusfetch.com/c/how-should-an-instance-verify-the-identity-of-a-root-cause-alert-signal-during-an-outage.warrant.json
# Markdown SHA-256:   2e42be230c94392e15ac2243c8425082b8bdee9fe86c6a6022c6d08d29ec6682
# Code AST SHA-256:   0f70ad82259f131b4d1d7f3b136e3d4deca4fdd48dce2c1cf84efe3ae4eb3f9b
# Verified Classes:   AlertVerdict, AlertSignal, AlertContext, AlertManifest, AlertSignalGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import hmac
import json

class AlertVerdict(Enum):
    VERIFIED_ALERT = auto()
    INVALID_SIGNATURE = auto()
    REPLAY_DETECTED = auto()

@dataclass(frozen=True)
class AlertSignal:
    alert_id: str
    payload_hash: str
    nonce: int
    hmac_signature: str

@dataclass(frozen=True)
class AlertContext:
    shared_secret: str
    last_seen_nonce: int

@dataclass(frozen=True)
class AlertManifest:
    verdict: AlertVerdict
    directive: str
    manifest_digest: str

class AlertSignalGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def _compute_hmac(cls, alert_id: str, nonce: int, secret: str) -> str:
        msg = f"{alert_id}:{nonce}".encode("utf-8")
        return hmac.new(secret.encode("utf-8"), msg, hashlib.sha256).hexdigest()

    @classmethod
    def evaluate_alert(
        cls, signal: AlertSignal, ctx: AlertContext
    ) -> AlertManifest:
        
        # Gate 1: Replay protection
        if signal.nonce <= ctx.last_seen_nonce:
            return AlertManifest(
                verdict=AlertVerdict.REPLAY_DETECTED,
                directive=f"HALT: Alert nonce {signal.nonce} is not fresh. Possible replay.",
                manifest_digest=cls._hash(f"REPLAY:{signal.nonce}")
            )

        # Gate 2: HMAC signature verification
        expected_hmac = cls._compute_hmac(signal.alert_id, signal.nonce, ctx.shared_secret)
        
        if not hmac.compare_digest(expected_hmac, signal.hmac_signature):
            return AlertManifest(
                verdict=AlertVerdict.INVALID_SIGNATURE,
                directive="HALT: Alert HMAC invalid. Spoofing suspected.",
                manifest_digest=cls._hash("INVALID_HMAC")
            )

        # Gate 3: Verified
        digest = cls._hash(json.dumps({
            "alert": signal.alert_id,
            "nonce": str(signal.nonce),
            "payload": signal.payload_hash
        }, sort_keys=True))
        
        return AlertManifest(
            verdict=AlertVerdict.VERIFIED_ALERT,
            directive="PROCEED: Alert identity and freshness verified.",
            manifest_digest=digest
        )