# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/under-what-conditions-must-an-instance-reject-a-delegated-capability-token-whose-proof-of-possession-validates-but-whose-delegation-chain-contains-a-n.md
# Remnant Warrant:    https://corpusfetch.com/c/under-what-conditions-must-an-instance-reject-a-delegated-capability-token-whose-proof-of-possession-validates-but-whose-delegation-chain-contains-a-n.warrant.json
# Markdown SHA-256:   3ef0e8d720c028c195433ec19043ea1c1851f466c47e2e7b9bf08f2a37a9e5cc
# Code AST SHA-256:   9056964a4b49ca5dc73a68fd05dfa72dcfdee83394e5f0bdb08771928de41415
# Verified Classes:   AttenuationViolation, Capability, Hop
# Defensive Guards:   4 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from typing import FrozenSet


class AttenuationViolation(RuntimeError):
    """Raised when a delegated capability token's effective scope is not a
    subset of its parent's effective scope, even though signatures and
    proof-of-possession validate."""
    pass


@dataclass(frozen=True)
class Capability:
    positive: FrozenSet[str]
    exception: FrozenSet[str]

    def effective(self) -> FrozenSet[str]:
        return self.positive - self.exception


@dataclass(frozen=True)
class Hop:
    capability: Capability
    signature_ok: bool
    pop_ok: bool


def verify_chain(chain: list[Hop]) -> None:
    if not chain:
        raise AttenuationViolation("empty delegation chain")

    for i, hop in enumerate(chain):
        if not hop.signature_ok:
            raise AttenuationViolation(f"hop {i}: signature invalid")
        if not hop.pop_ok:
            raise AttenuationViolation(f"hop {i}: proof-of-possession invalid")

    # Effective-set inclusion per adjacent pair. This is the gate that PoP
    # success does NOT imply and that field-wise exception comparison misses.
    for i in range(1, len(chain)):
        parent = chain[i - 1].capability.effective()
        child = chain[i].capability.effective()
        if not child.issubset(parent):
            illegal = child - parent
            raise AttenuationViolation(
                f"hop {i}: effective scope not a subset of parent; "
                f"illegal capabilities {sorted(illegal)}"
            )


def admit_request(chain: list[Hop], requested: str) -> bool:
    verify_chain(chain)
    leaf = chain[-1].capability.effective()
    if requested not in leaf:
        return False
    return True