# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/in-what-scenarios-must-an-instance-reject-a-federated-capability-attestation-whose-trust-anchor-chain-resolves-but-whose-policy-translation-closure-di.md
# Remnant Warrant:    https://corpusfetch.com/c/in-what-scenarios-must-an-instance-reject-a-federated-capability-attestation-whose-trust-anchor-chain-resolves-but-whose-policy-translation-closure-di.warrant.json
# Markdown SHA-256:   5c52a3241c9f78d635cb5a76c8bd023d439125561547f72154654181f7003d56
# Code AST SHA-256:   d06c23508bd456c55b0442f16bc3d5173e96da151eab817c5ac7612c1324f069
# Verified Classes:   FederationClosureError, Attestation, TranslationTable
# Defensive Guards:   5 fail-closed invariants (zero external deps)

from dataclasses import dataclass, field
from typing import Optional


class FederationClosureError(RuntimeError):
    """Raised when a valid trust chain yields a non-total or widening translation."""


@dataclass
class Attestation:
    issuer: str
    capability: str
    scope_predicates: list[str]
    signature_chain: list[str]


@dataclass
class TranslationTable:
    version: str
    content_hash: str
    # maps (capability, scope_predicate) -> local rule or None if unmapped
    rules: dict[tuple[str, str], Optional[str]] = field(default_factory=dict)


def resolve_trust_chain(att: Attestation, anchors: set[str]) -> bool:
    return bool(att.signature_chain) and att.signature_chain[-1] in anchors


def check_translation_closure(
    att: Attestation,
    table: TranslationTable,
    expected_hash: str,
) -> dict[str, str]:
    if table.content_hash != expected_hash:
        raise FederationClosureError(
            f"policy table {table.version} hash {table.content_hash} "
            f"!= pinned {expected_hash}; closure not evaluable"
        )

    resolved: dict[str, str] = {}
    for pred in att.scope_predicates:
        key = (att.capability, pred)
        if key not in table.rules:
            # partial closure: unmapped predicate inside requested scope
            raise FederationClosureError(
                f"no translation rule for capability={att.capability!r} "
                f"scope={pred!r} in table {table.version}; refusing to "
                f"default to unconstrained"
            )
        local = table.rules[key]
        if local is None:
            raise FederationClosureError(
                f"translation for {pred!r} is explicitly null; "
                f"treating as deny, not as allow-all"
            )
        # widening check: local rule must be at least as narrow as attested
        if _widens(local, pred):
            raise FederationClosureError(
                f"translation widens scope: attested {pred!r} -> local "
                f"{local!r}; requires signed scope-widening grant"
            )
        resolved[pred] = local
    return resolved


def _widens(local: str, attested: str) -> bool:
    # placeholder for a real subsumption check; conservative default = no widen
    return local == "*" and attested != "*"


def admit_federated_call(
    att: Attestation,
    anchors: set[str],
    table: TranslationTable,
    expected_hash: str,
) -> dict[str, str]:
    if not resolve_trust_chain(att, anchors):
        raise FederationClosureError(
            f"trust chain for issuer {att.issuer!r} does not resolve to an anchor"
        )
    # trust resolved; closure is an independent gate
    return check_translation_closure(att, table, expected_hash)