# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/in-what-scenarios-must-an-instance-refuse-delegated-authority-across-a-federation-bridge-when-the-trust-chain-s-attestation-freshness-window-has-expir.md
# Remnant Warrant:    https://corpusfetch.com/c/in-what-scenarios-must-an-instance-refuse-delegated-authority-across-a-federation-bridge-when-the-trust-chain-s-attestation-freshness-window-has-expir.warrant.json
# Markdown SHA-256:   6a8759e4ba126547e7ebe274f9f95b0ba993ded4c17c7b6b425d61173124b626
# Code AST SHA-256:   f237018fdfec9c472c6f81c4153b3059903e825902ef5e96d6e436ca491ee3b7
# Verified Classes:   StaleAttestationError, ScopeCeilingViolation, Attestation, DelegationToken, VerifierPolicy
# Defensive Guards:   4 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from datetime import datetime, timedelta


class StaleAttestationError(RuntimeError):
    """Raised when a bridge's attestation predates the verifier's current policy epoch."""
    pass


class ScopeCeilingViolation(RuntimeError):
    """Raised when a delegated token exceeds the bridge's translatable scope ceiling."""
    pass


@dataclass
class Attestation:
    issuer: str
    issued_at: datetime
    max_translatable_scope: frozenset


@dataclass
class DelegationToken:
    scope: frozenset
    exp: datetime


@dataclass
class VerifierPolicy:
    policy_epoch_start: datetime
    trusted_attestation_issuers: frozenset
    attestation_grace_period: timedelta


def verify_delegation(
    token: DelegationToken,
    attestation: Attestation,
    policy: VerifierPolicy,
    now: datetime,
) -> bool:
    if token.exp <= now:
        return False

    if attestation.issuer not in policy.trusted_attestation_issuers:
        raise StaleAttestationError(
            f"attestation issuer {attestation.issuer!r} not trusted under current policy"
        )

    if attestation.issued_at <= policy.policy_epoch_start:
        age = now - attestation.issued_at
        if age > policy.attestation_grace_period:
            raise StaleAttestationError(
                f"attestation from {attestation.issuer!r} is {age} old under epoch "
                f"starting {policy.policy_epoch_start.isoformat()}; grace period exceeded"
            )
        # Within grace: signal re-attestation needed, do not accept yet.
        raise StaleAttestationError(
            f"attestation from {attestation.issuer!r} predates epoch; re-attestation required"
        )

    if not token.scope.issubset(attestation.max_translatable_scope):
        raise ScopeCeilingViolation(
            f"token scope {sorted(token.scope)} exceeds bridge ceiling "
            f"{sorted(attestation.max_translatable_scope)}"
        )

    return True