# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/what-compression-encryption-interaction-invariants-must-agents-verify-before-transmitting.md
# Remnant Warrant:    https://corpusfetch.com/c/what-compression-encryption-interaction-invariants-must-agents-verify-before-transmitting.warrant.json
# Markdown SHA-256:   bb641bbafd2722fc285d4e57e2e6df842376ea112bcb083a175e40d51fea2134
# Code AST SHA-256:   d555545a1bfc3aa8cfdf6cf85b24f3609d71a318e13698d2454359e55980083f
# Verified Classes:   CompositionVerdict, CompressionEncryptionConfig, CompositionPolicy, CompositionManifest, CompressionEncryptionGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class CompositionVerdict(Enum):
    SAFE_COMPOSITION = auto()
    LENGTH_ORACLE_RISK = auto()
    DECOMPRESSION_BOMB_RISK = auto()
    PADDING_ORACLE_RISK = auto()

@dataclass(frozen=True)
class CompressionEncryptionConfig:
    compression_algorithm_id: str
    encryption_algorithm_id: str
    composition_order: str  # "COMPRESS_THEN_ENCRYPT", "ENCRYPT_THEN_COMPRESS", "INTEGRATED"
    length_leak_mitigation: str | None
    authenticate_before_decompress: bool
    padding_scheme: str

@dataclass(frozen=True)
class CompositionPolicy:
    require_length_mitigation: bool
    require_auth_before_decompress: bool
    allowed_padding_schemes: frozenset[str]

@dataclass(frozen=True)
class CompositionManifest:
    verdict: CompositionVerdict
    directive: str
    manifest_digest: str

class CompressionEncryptionGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_config(
        cls, cfg: CompressionEncryptionConfig, policy: CompositionPolicy
    ) -> CompositionManifest:
        
        # Gate 1: Integrated composition bypasses checks
        if cfg.composition_order == "INTEGRATED":
            digest = cls._hash(json.dumps({
                "compression": cfg.compression_algorithm_id,
                "encryption": cfg.encryption_algorithm_id,
                "order": "INTEGRATED"
            }, sort_keys=True))
            return CompositionManifest(
                verdict=CompositionVerdict.SAFE_COMPOSITION,
                directive="PROCEED: Integrated AEAD with compression is safe.",
                manifest_digest=digest
            )

        # Gate 2: Length oracle
        if cfg.composition_order == "COMPRESS_THEN_ENCRYPT" and not cfg.length_leak_mitigation:
            if policy.require_length_mitigation:
                return CompositionManifest(
                    verdict=CompositionVerdict.LENGTH_ORACLE_RISK,
                    directive="HALT: Compress-then-encrypt without length mitigation. Vulnerable to CRIME.",
                    manifest_digest=cls._hash("LENGTH_ORACLE")
                )

        # Gate 3: Decompression bomb
        if cfg.composition_order == "COMPRESS_THEN_ENCRYPT" and not cfg.authenticate_before_decompress:
            if policy.require_auth_before_decompress:
                return CompositionManifest(
                    verdict=CompositionVerdict.DECOMPRESSION_BOMB_RISK,
                    directive="HALT: Decompression before authentication. Vulnerable to compression bombs.",
                    manifest_digest=cls._hash("DECOMPRESSION_BOMB")
                )

        # Gate 4: Padding oracle
        if cfg.padding_scheme not in policy.allowed_padding_schemes:
            return CompositionManifest(
                verdict=CompositionVerdict.PADDING_ORACLE_RISK,
                directive=f"HALT: Padding scheme {cfg.padding_scheme} not in allowlist.",
                manifest_digest=cls._hash(f"PADDING:{cfg.padding_scheme}")
            )

        # Gate 5: Safe
        digest = cls._hash(json.dumps({
            "compression": cfg.compression_algorithm_id,
            "encryption": cfg.encryption_algorithm_id,
            "order": cfg.composition_order,
            "mitigation": cfg.length_leak_mitigation,
            "padding": cfg.padding_scheme
        }, sort_keys=True))
        
        return CompositionManifest(
            verdict=CompositionVerdict.SAFE_COMPOSITION,
            directive="PROCEED: Compression-encryption composition is safe.",
            manifest_digest=digest
        )