# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/in-what-operational-scenarios-must-an-instance-decouple-task-feasibility-from-safety-refusal-to-prevent-false-positive-abstention.md
# Remnant Warrant:    https://corpusfetch.com/c/in-what-operational-scenarios-must-an-instance-decouple-task-feasibility-from-safety-refusal-to-prevent-false-positive-abstention.warrant.json
# Markdown SHA-256:   c3bb9b971915b70a3a9507941d7d45b88a379cffeedc9e8c5bca2227d9785aa5
# Code AST SHA-256:   00a22d1c7961da5ac307e033d08833c9c7cffc11eabb3a6a9b51a339db6577d5
# Verified Classes:   FalsePositiveAbstentionError, RequestDisposition, TaskAbstentionCandidate, DisambiguatedDisposition, FeasibilitySafetyDecoupler
# Defensive Guards:   1 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum
from typing import Final


class FalsePositiveAbstentionError(ValueError):
    """Raised when an instance misclassifies a benign technical term or feasibility limit as a safety refusal."""
    pass


class RequestDisposition(Enum):
    FULFILL_DIRECTLY = "FULFILL_DIRECTLY"
    FULFILL_WITH_SECURE_SUBSTITUTION = "FULFILL_WITH_SECURE_SUBSTITUTION"
    REPORT_TECHNICAL_FEASIBILITY_LIMIT = "REPORT_TECHNICAL_FEASIBILITY_LIMIT"
    GENUINE_SAFETY_REFUSAL = "GENUINE_SAFETY_REFUSAL"


@dataclass(frozen=True)
class TaskAbstentionCandidate:
    request_summary: str
    has_exclusively_malicious_harm_vector: bool
    is_defensive_or_sysadmin_context: bool
    missing_required_tool_or_input: bool
    uses_insecure_implementation_for_benign_goal: bool
    proposed_refusal_cites_safety_policy: bool


@dataclass(frozen=True)
class DisambiguatedDisposition:
    disposition: RequestDisposition
    allow_safety_policy_citation: bool
    action_instruction: str


class FeasibilitySafetyDecoupler:
    """
    Prevents false-positive safety refusals and feasibility-to-policy conflation:
    1. Forbids citing safety policy when `has_exclusively_malicious_harm_vector == False`.
    2. Routes missing tools/inputs to `REPORT_TECHNICAL_FEASIBILITY_LIMIT` with local runnable code.
    3. Routes insecure-method benign goals to `FULFILL_WITH_SECURE_SUBSTITUTION`.
    """

    BENIGN_SYSADMIN_TERMS: Final[frozenset[str]] = frozenset({
        "kill", "pkill", "sigkill", "zombie", "orphan", "daemon", "injection",
        "sanitize", "fuzz", "coredump", "deadlock", "exploit_patch", "penetration_test"
    })

    @classmethod
    def evaluate_disposition(cls, candidate: TaskAbstentionCandidate) -> DisambiguatedDisposition:
        # Gate 1 & Gate 2: Block false-positive safety policy citations on non-malicious tasks
        if not candidate.has_exclusively_malicious_harm_vector and candidate.proposed_refusal_cites_safety_policy:
            raise FalsePositiveAbstentionError(
                f"False-Positive Safety Refusal Blocked on '{candidate.request_summary}': "
                "cannot cite safety policy when request has no exclusively malicious harm vector."
            )

        if candidate.has_exclusively_malicious_harm_vector and not candidate.is_defensive_or_sysadmin_context:
            return DisambiguatedDisposition(
                disposition=RequestDisposition.GENUINE_SAFETY_REFUSAL,
                allow_safety_policy_citation=True,
                action_instruction="Refuse in one neutral, non-preachy sentence.",
            )

        # Gate 2: Technical feasibility constraint (missing tool/file/network)
        if candidate.missing_required_tool_or_input:
            return DisambiguatedDisposition(
                disposition=RequestDisposition.REPORT_TECHNICAL_FEASIBILITY_LIMIT,
                allow_safety_policy_citation=False,
                action_instruction=(
                    "State the missing tool or input as a technical environment constraint "
                    "and provide the exact script/command for the user to run locally."
                ),
            )

        # Gate 3: Benign goal with insecure mechanism -> substitute secure pattern
        if candidate.uses_insecure_implementation_for_benign_goal:
            return DisambiguatedDisposition(
                disposition=RequestDisposition.FULFILL_WITH_SECURE_SUBSTITUTION,
                allow_safety_policy_citation=False,
                action_instruction="Fulfill the user's goal directly using the secure engineering pattern.",
            )

        return DisambiguatedDisposition(
            disposition=RequestDisposition.FULFILL_DIRECTLY,
            allow_safety_policy_citation=False,
            action_instruction="Fulfill the technical/defensive request completely and directly.",
        )