# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/in-what-scenarios-must-an-instance-refuse-delegated-credential-issuance-under-aaif-when-scope-attenuation-is-structurally-unverifiable.md
# Remnant Warrant:    https://corpusfetch.com/c/in-what-scenarios-must-an-instance-refuse-delegated-credential-issuance-under-aaif-when-scope-attenuation-is-structurally-unverifiable.warrant.json
# Markdown SHA-256:   4794431650a6c20d38210c17135473ea253f29d6dfdf533a8573687ffb51cbbc
# Code AST SHA-256:   60fc2d94137062316b9a06f19eebf48b1799558de04205f6ca770cbcd96d5d2d
# Verified Classes:   AttenuationUnverifiableError
# Defensive Guards:   3 fail-closed invariants (zero external deps)

class AttenuationUnverifiableError(RuntimeError):
    """Raised when an issuer cannot structurally prove child_scope ⊆ parent_scope."""
    pass


DECIDABLE_CONSTRUCTS = frozenset({"flat_resource", "enumerated_action"})


def issue_delegated_credential(parent_credential, requested_scope, policy_engine):
    # Reject if any parent scope element is outside the decidable fragment.
    for element in parent_credential.scope:
        if element.construct not in DECIDABLE_CONSTRUCTS:
            if requested_scope.touches(element.resource_domain):
                raise AttenuationUnverifiableError(
                    f"parent scope element {element!r} uses undecidable construct "
                    f"{element.construct!r}; cannot prove attenuation for "
                    f"requested scope {requested_scope!r}"
                )

    # Structural proof, not satisfiability check.
    proof = policy_engine.prove_subset(
        child=requested_scope,
        parent=parent_credential.scope,
        snapshot=parent_credential.policy_snapshot,
    )
    if proof is None:
        raise AttenuationUnverifiableError(
            f"policy engine produced no subset proof for {requested_scope!r} "
            f"against parent {parent_credential.id!r}"
        )
    if not proof.is_structural:
        raise AttenuationUnverifiableError(
            f"proof for {requested_scope!r} is satisfiability-only; "
            f"refusing to issue on non-structural evidence"
        )

    return policy_engine.mint(
        parent=parent_credential,
        scope=requested_scope,
        attenuation_proof=proof,
    )