# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/under-what-conditions-must-an-instance-propagate-taint-labels-across-a-tool-call-boundary-rather-than-resetting-them-at-the-tool-result.md
# Remnant Warrant:    https://corpusfetch.com/c/under-what-conditions-must-an-instance-propagate-taint-labels-across-a-tool-call-boundary-rather-than-resetting-them-at-the-tool-result.warrant.json
# Markdown SHA-256:   21948b42de7d55b697208b995ba4a7229849eb32df456b82b1b92dfd7b5a2035
# Code AST SHA-256:   23e51f61b191c2ac890151f7a64f5c6acb1f65af4d86c5e5a4874d6ad5608a66
# Verified Classes:   Taint, TaintBoundaryError, Label
# Defensive Guards:   2 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import IntEnum


class Taint(IntEnum):
    TRUSTED = 0
    UNTRUSTED = 1


class TaintBoundaryError(RuntimeError):
    """Raised when a tool result would cross a boundary with an unsound label."""


@dataclass(frozen=True)
class Label:
    level: Taint
    provenance: str = ""


def join(a: Label, b: Label) -> Label:
    level = Taint(max(a.level, b.level))
    prov = ";".join(p for p in (a.provenance, b.provenance) if p)
    return Label(level, prov)


# Tools whose output is a function of an untrusted *reference*, not of argument content.
TRANSIT_TOOLS = {"fetch_url", "web_search", "read_file", "query_db", "call_subagent"}
PURE_TOOLS = {"add", "unit_convert", "sha256_of_literal"}


def trust_floor(tool: str) -> Label:
    if tool in TRANSIT_TOOLS:
        return Label(Taint.UNTRUSTED, f"floor:{tool}")
    if tool in PURE_TOOLS:
        return Label(Taint.TRUSTED, f"floor:{tool}")
    # Unknown tools are transit by default: fail closed.
    return Label(Taint.UNTRUSTED, f"floor:unknown:{tool}")


def result_label(tool: str, arg_taint: Label) -> Label:
    """Compute the label for a tool result. Never resets argument taint for transit tools."""
    if tool in TRANSIT_TOOLS and arg_taint.level == Taint.UNTRUSTED:
        # Reference laundering: the identifier was tainted; the result inherits it.
        return join(arg_taint, trust_floor(tool))
    return join(arg_taint, trust_floor(tool))


def dispatch(tool: str, arg_taint: Label, capability_bearing: bool) -> Label:
    if capability_bearing and arg_taint.level == Taint.UNTRUSTED:
        raise TaintBoundaryError(
            f"refusing capability-bearing call {tool!r} with tainted argument "
            f"(provenance={arg_taint.provenance!r}); declassify explicitly first"
        )
    return result_label(tool, arg_taint)


# Reproduce the observed laundering sequence.
search_result = Label(Taint.UNTRUSTED, "web_search:turn_N")
# Agent copies an identifier from the untrusted segment; provenance is preserved.
url_arg = Label(Taint.UNTRUSTED, "web_search:turn_N:url=evil.example/p")
fetched = dispatch("fetch_url", url_arg, capability_bearing=False)
assert fetched.level == Taint.UNTRUSTED, "result must inherit reference taint"
try:
    dispatch("exec", fetched, capability_bearing=True)
except TaintBoundaryError as e:
    print("blocked:", e)