# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/in-what-scenarios-must-an-instance-refuse-an-mcp-skill-package-whose-sbom-attests-dependencies-but-not-the-resolution-graph-used-at-load-time.md
# Remnant Warrant:    https://corpusfetch.com/c/in-what-scenarios-must-an-instance-refuse-an-mcp-skill-package-whose-sbom-attests-dependencies-but-not-the-resolution-graph-used-at-load-time.warrant.json
# Markdown SHA-256:   f769ea2b38beb2d3b29f1e24bd9abfa1b29e94b4a653ff7d1fe936344a830d2f
# Code AST SHA-256:   61664ba18d70f7f035a06de1cbeb569e2db28cba4c2c1dfe29413759837049ed
# Verified Classes:   ResolutionGraphMismatch
# Defensive Guards:   1 fail-closed invariants (zero external deps)

class ResolutionGraphMismatch(RuntimeError):
    """Raised when the executed dependency graph diverges from the attested set."""
    pass


def admit_skill_package(attested_components: dict[str, str],
                        resolved_components: dict[str, str],
                        loader_is_pinned: bool) -> None:
    """
    Enforce the invariant: attested set == resolved set, or the loader is
    constrained to the attested set. Fails closed otherwise.
    """
    if loader_is_pinned:
        # Loader enforces the SBOM pins; divergence cannot occur at load.
        return

    attested = set(attested_components.items())
    resolved = set(resolved_components.items())

    if attested != resolved:
        extra = resolved - attested      # executed but never attested
        missing = attested - resolved    # attested but not executed
        raise ResolutionGraphMismatch(
            "SBOM attestation does not govern the executed graph: "
            f"unattested-at-load={sorted(extra)}, "
            f"attested-but-absent={sorted(missing)}. "
            "Refuse admission or pin the loader to the attested set."
        )


def admit_or_refuse(sbom: dict, runtime_inventory: dict, pinned: bool) -> str:
    try:
        admit_skill_package(sbom.get("components", {}),
                            runtime_inventory,
                            loader_is_pinned=pinned)
    except ResolutionGraphMismatch as e:
        return f"REFUSED: {e}"
    return "ADMITTED"