# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/what-chain-of-custody-signatures-must-accompany-a-record-transferred-between-memory-layers.md
# Remnant Warrant:    https://corpusfetch.com/c/what-chain-of-custody-signatures-must-accompany-a-record-transferred-between-memory-layers.warrant.json
# Markdown SHA-256:   c66a28b065fcde9c64d2a79b487fbd63487d7206dbf386085bac03598396db4c
# Code AST SHA-256:   e08aa38aa24f2b9d70410a58993ca7feea95898a052c42ad860dde09ace80c97
# Verified Classes:   CustodyVerdict, CustodyLink, CustodyContext, CustodyManifest, ChainOfCustodyGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class CustodyVerdict(Enum):
    CUSTODY_VERIFIED = auto()
    MISSING_CHAIN = auto()
    UNAUTHORIZED_TRANSFER = auto()
    PAYLOAD_TAMPERED = auto()
    PRIVILEGE_LEAK_DETECTED = auto()

@dataclass(frozen=True)
class CustodyLink:
    layer_id: str
    privilege_tier: int
    payload_hash: str
    transfer_authorization_signature: str
    transfer_epoch: float

@dataclass(frozen=True)
class CustodyContext:
    trusted_layers: frozenset[str]
    receiving_layer_privilege_tier: int
    current_payload_hash: str

@dataclass(frozen=True)
class CustodyManifest:
    verdict: CustodyVerdict
    directive: str
    manifest_digest: str

class ChainOfCustodyGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_custody(
        cls, chain: tuple[CustodyLink, ...], ctx: CustodyContext
    ) -> CustodyManifest:
        
        # Gate 1: Chain presence
        if not chain:
            return CustodyManifest(
                verdict=CustodyVerdict.MISSING_CHAIN,
                directive="HALT: No custody chain provided. Cannot verify record history.",
                manifest_digest=cls._hash("NO_CHAIN")
            )

        # Gate 2: Payload hash consistency
        for link in chain:
            if link.payload_hash != ctx.current_payload_hash:
                return CustodyManifest(
                    verdict=CustodyVerdict.PAYLOAD_TAMPERED,
                    directive=f"HALT: Payload hash mismatch at layer {link.layer_id}. Record was modified during custody.",
                    manifest_digest=cls._hash(f"TAMPER:{link.layer_id}")
                )

        # Gate 3: Authorization verification
        for link in chain:
            if not link.transfer_authorization_signature.strip():
                return CustodyManifest(
                    verdict=CustodyVerdict.UNAUTHORIZED_TRANSFER,
                    directive=f"HALT: Layer {link.layer_id} transfer lacks authorization signature.",
                    manifest_digest=cls._hash(f"NO_AUTH:{link.layer_id}")
                )

        # Gate 4: Privilege tier check
        for link in chain:
            if link.privilege_tier < ctx.receiving_layer_privilege_tier and link.privilege_tier < 2:
                return CustodyManifest(
                    verdict=CustodyVerdict.PRIVILEGE_LEAK_DETECTED,
                    directive=f"HALT: Record passed through low-privilege layer {link.layer_id} en route to privileged layer.",
                    manifest_digest=cls._hash(f"LEAK:{link.layer_id}")
                )

        # Gate 5: Verified
        digest = cls._hash(json.dumps({
            "chain_length": str(len(chain)),
            "final_hash": ctx.current_payload_hash,
            "receiving_tier": str(ctx.receiving_layer_privilege_tier)
        }, sort_keys=True))
        
        return CustodyManifest(
            verdict=CustodyVerdict.CUSTODY_VERIFIED,
            directive="PROCEED: Full chain of custody verified.",
            manifest_digest=digest
        )