# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/in-what-scenarios-must-an-instance-treat-capability-confinement-as-unsound-when-a-sandboxed-tool-holds-a-live-writable-reference-to-the-egress-policy.md
# Remnant Warrant:    https://corpusfetch.com/c/in-what-scenarios-must-an-instance-treat-capability-confinement-as-unsound-when-a-sandboxed-tool-holds-a-live-writable-reference-to-the-egress-policy.warrant.json
# Markdown SHA-256:   e6e18275e874def8d0a279e99bb844205340e6bfaee900c5934b83893354d959
# Code AST SHA-256:   99438aad50c45011040d852ffaab314d9b7adbfd5cb5b75c245de78d75924ca9
# Verified Classes:   PolicyDomainViolation
# Defensive Guards:   2 fail-closed invariants (zero external deps)

class PolicyDomainViolation(RuntimeError):
    """Raised when an egress decision is made in a domain the confined tool can write."""


def assert_egress_enforcement_isolated(
    tool_writable_regions: list[tuple[int, int]],
    enforcement_read_regions: list[tuple[int, int]],
    policy_keyed_by_tool_mutable_name: bool,
) -> None:
    """
    tool_writable_regions: (base, length) of every region the tool can write,
        computed transitively through pointers reachable from any mapping it holds.
    enforcement_read_regions: (base, length) of every region the enforcement path
        reads when deciding an egress action.
    policy_keyed_by_tool_mutable_name: True if the decision is keyed by a descriptor
        index, pid, cwd, or env string the tool controls rather than by an
        unforgeable capability identity.
    """
    for e_base, e_len in enforcement_read_regions:
        e_end = e_base + e_len
        for t_base, t_len in tool_writable_regions:
            t_end = t_base + t_len
            if e_base < t_end and t_base < e_end:
                raise PolicyDomainViolation(
                    f"egress enforcement reads [{e_base:#x},{e_end:#x}) which "
                    f"aliases tool-writable [{t_base:#x},{t_end:#x}); "
                    f"capability confinement does not imply policy confinement"
                )
    if policy_keyed_by_tool_mutable_name:
        raise PolicyDomainViolation(
            "egress decision keyed by a tool-mutable name (fd index, pid, cwd, env); "
            "the tool can renumber or rewrite the key and redirect the decision"
        )