# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/under-what-conditions-must-an-instance-distrust-a-memory-store-that-passes-checksum-verification.md
# Remnant Warrant:    https://corpusfetch.com/c/under-what-conditions-must-an-instance-distrust-a-memory-store-that-passes-checksum-verification.warrant.json
# Markdown SHA-256:   d981ac2a742419b76ddf399b37fcee08aa614db1205fb53228504b8f817ecd6c
# Code AST SHA-256:   870e60e7dd3bc36f77860f599cc251ef1133ed316795dacf53a4434698630983
# Verified Classes:   MemoryIntegrityError, MemoryRecord
# Defensive Guards:   6 fail-closed invariants (zero external deps)

import hashlib
import time
from dataclasses import dataclass
from typing import Optional


class MemoryIntegrityError(RuntimeError):
    """Raised when a memory record passes checksum but fails provenance trust."""
    pass


@dataclass
class MemoryRecord:
    key: str
    content: bytes
    stored_hash: str
    writer_id: str
    write_ts: float
    canonical_writers: frozenset


def verify_record(
    record: MemoryRecord,
    trusted_writers: frozenset,
    corroborating_store: Optional[dict] = None,
    write_density_baseline: float = 1.0,
    recent_write_count: int = 0,
    require_corroboration: bool = False,
) -> bool:
    # Gate 1: consistency (necessary, not sufficient)
    actual = hashlib.sha256(record.content).hexdigest()
    if actual != record.stored_hash:
        # Corruption, not poisoning: replay, don't distrust.
        raise MemoryIntegrityError(
            f"checksum mismatch on {record.key}: expected {record.stored_hash}, got {actual}"
        )

    # Gate 2: provenance — this is where poisoning is caught.
    if record.writer_id not in trusted_writers:
        raise MemoryIntegrityError(
            f"record {record.key} written by untrusted writer {record.writer_id!r} "
            f"despite valid checksum"
        )

    if recent_write_count > write_density_baseline * 10:
        raise MemoryIntegrityError(
            f"record {record.key} falls inside anomalous bulk-write window "
            f"({recent_write_count} writes vs baseline {write_density_baseline})"
        )

    if require_corroboration:
        if corroborating_store is None:
            raise MemoryIntegrityError(
                f"record {record.key} requires corroboration but no store provided"
            )
        expected = corroborating_store.get(record.key)
        if expected is None or expected != record.content:
            raise MemoryIntegrityError(
                f"record {record.key} contradicted by corroborating store "
                f"despite valid checksum"
            )

    return True


def read_with_distrust(record: MemoryRecord, **kwargs) -> bytes:
    try:
        verify_record(record, **kwargs)
        return record.content
    except MemoryIntegrityError:
        # Fall back to cold source; never return unverified memory to the agent.
        raise