# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/under-what-conditions-must-an-instance-reject-a-delegated-capability-that-its-trust-anchor-has-signed.md
# Remnant Warrant:    https://corpusfetch.com/c/under-what-conditions-must-an-instance-reject-a-delegated-capability-that-its-trust-anchor-has-signed.warrant.json
# Markdown SHA-256:   e4e6a6ddf49eef4158098dc9c03a5284ff39ac921228c5920f721cb7bd45816d
# Code AST SHA-256:   933be6810167cb09a4d9ed52dda3710cfdd939898d49448d9913428da7805dd8
# Verified Classes:   CapabilityAdmissionError
# Defensive Guards:   5 fail-closed invariants (zero external deps)

class CapabilityAdmissionError(RuntimeError):
    """Raised when a capability chain verifies but is not admissible at this instance."""
    pass


def admit_capability(
    chain,
    instance_id: str,
    anchor_policy,
    observed_path_length: int,
):
    # 1. Authenticity: chain must verify to a configured anchor.
    if not chain.verifies_to(anchor_policy.anchor_key):
        raise CapabilityAdmissionError("chain does not verify to configured anchor")

    terminal = chain.terminal_claim()

    # 2. Audience match: the terminal claim must name this instance.
    if terminal.audience != instance_id and terminal.audience != anchor_policy.audience_wildcard:
        raise CapabilityAdmissionError(
            f"audience mismatch: token addressed to {terminal.audience!r}, "
            f"instance is {instance_id!r}"
        )

    # 3. Attenuation: observed path must not exceed declared max depth.
    if observed_path_length > terminal.max_delegation_depth:
        raise CapabilityAdmissionError(
            f"delegation depth {observed_path_length} exceeds "
            f"declared max {terminal.max_delegation_depth}"
        )

    # 4. Scope monotonicity: intersection across links may only shrink.
    effective_scope = chain.intersected_scope()
    if not effective_scope:
        raise CapabilityAdmissionError("scope intersection is empty; nothing to admit")

    # 5. Policy freshness: every intermediary must still be permitted here.
    for link in chain.intermediaries():
        if link.org_id not in anchor_policy.permitted_intermediaries:
            raise CapabilityAdmissionError(
                f"intermediary {link.org_id!r} is not currently permitted "
                f"by local anchor policy"
            )

    return effective_scope