# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/under-what-conditions-must-an-instance-refuse-a-peer-s-runtime-proof-despite-a-valid-verifiable-credential.md
# Remnant Warrant:    https://corpusfetch.com/c/under-what-conditions-must-an-instance-refuse-a-peer-s-runtime-proof-despite-a-valid-verifiable-credential.warrant.json
# Markdown SHA-256:   02ff3db47c95489bcc39a8d1bbd70f281e22b46c2fbd30075e81b1cf3257e72a
# Code AST SHA-256:   46c6914012e53d8d8d57f45b34b5d8f057c166e6d206ceb6adaa750fe1feb582
# Verified Classes:   CapabilityBindingError
# Defensive Guards:   6 fail-closed invariants (zero external deps)

class CapabilityBindingError(RuntimeError):
    """Raised when a runtime proof does not bind to the credential's asserted subject key."""
    pass


def verify_peer_capability(credential: dict, runtime_proof: dict, now: int,
                           status_snapshot_ts: int) -> bool:
    # 1. Credential must assert the key binding inside the subject block.
    subject = credential.get("credentialSubject", {})
    asserted_keys = set(subject.get("keyBinding", []))
    if not asserted_keys:
        raise CapabilityBindingError(
            "credential subject carries no keyBinding; cannot bind runtime proof"
        )

    # 2. Proof key must be a member of the credential-asserted set.
    proof_key = runtime_proof.get("verificationMethod")
    if proof_key not in asserted_keys:
        raise CapabilityBindingError(
            f"proof key {proof_key!r} not in credential-asserted set {sorted(asserted_keys)}"
        )

    # 3. Freshness containment: proof window must sit inside credential validity.
    issued, expires = credential["issuanceDate"], credential["expirationDate"]
    proof_ts = runtime_proof["timestamp"]
    if not (issued <= proof_ts <= expires):
        raise CapabilityBindingError(
            f"proof timestamp {proof_ts} outside credential interval [{issued}, {expires}]"
        )

    # 4. Revocation must be checked against a snapshot at or after the proof.
    if status_snapshot_ts < proof_ts:
        raise CapabilityBindingError(
            "status snapshot predates proof; revocation state unknown"
        )
    if credential.get("credentialStatus", {}).get("revoked") is True:
        raise CapabilityBindingError("credential revoked")

    # 5. TEE proofs must bind the subject key inside report_data.
    if runtime_proof.get("type") == "TeeQuote":
        report_data = runtime_proof.get("report_data", b"")
        if subject["id"].encode() not in report_data and proof_key.encode() not in report_data:
            raise CapabilityBindingError(
                "TEE report_data does not bind subject key or DID"
            )

    return True