# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/under-what-conditions-must-an-instance-treat-a-tool-output-as-tainted-when-the-taint-label-itself-was-produced-by-a-tainted-model-call.md
# Remnant Warrant:    https://corpusfetch.com/c/under-what-conditions-must-an-instance-treat-a-tool-output-as-tainted-when-the-taint-label-itself-was-produced-by-a-tainted-model-call.warrant.json
# Markdown SHA-256:   63026af0cec602819ab90cc27704b7182da85f1c833e4251b880d1f481ddf266
# Code AST SHA-256:   1043c0c8f41982f15e6a25c7ae4734a8080ecb4b37b60d31f3a8e4628cddd7fc
# Verified Classes:   TaintAssertionError
# Defensive Guards:   3 fail-closed invariants (zero external deps)

class TaintAssertionError(RuntimeError):
    """Raised when a model-asserted provenance label would declassify content
    without an independent, runtime-owned provenance record."""
    pass


def effective_taint(asserted_taint: str, label_producer_taint: str,
                    has_runtime_provenance: bool) -> str:
    """Compute taint for content given its label.

    Labels may only RAISE taint. Declassification requires a runtime-owned
    provenance record that does not depend on model output.
    """
    order = {"untrusted": 2, "internal": 1, "trusted": 0}
    if asserted_taint not in order or label_producer_taint not in order:
        raise TaintAssertionError(f"unknown taint level: {asserted_taint!r}")

    inherited = max((asserted_taint, label_producer_taint), key=order.get)

    # Attempted declassification below the producer's own taint.
    if order[asserted_taint] < order[label_producer_taint]:
        if not has_runtime_provenance:
            raise TaintAssertionError(
                "model-asserted declassification without runtime provenance: "
                f"asserted={asserted_taint!r} producer={label_producer_taint!r}"
            )
    return inherited


def promote_to_trusted_band(chunk, label_producer_taint, has_runtime_provenance):
    taint = effective_taint(
        asserted_taint=chunk.label.trust,
        label_producer_taint=label_producer_taint,
        has_runtime_provenance=has_runtime_provenance,
    )
    if taint != "trusted":
        # Fail closed: do not place in trusted band.
        raise TaintAssertionError(
            f"refusing trusted promotion, effective taint={taint!r}"
        )
    return chunk