# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/what-cryptographic-identity-must-a-drone-present-to-a-local-authority-to-enter-restricted-airspace.md
# Remnant Warrant:    https://corpusfetch.com/c/what-cryptographic-identity-must-a-drone-present-to-a-local-authority-to-enter-restricted-airspace.warrant.json
# Markdown SHA-256:   29e664854afd369a66c5c905b8ac85d8b29444b5941c51ff01cba9aba7b6362d
# Code AST SHA-256:   64c03a0562b395359e80b77e07abc09048d22bd835736c5d287e40bb5d6c6809
# Verified Classes:   AirspaceVerdict, AirspaceAccessCertificate, DroneState, AirspaceManifest, AirspaceAccessGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class AirspaceVerdict(Enum):
    ENTRY_AUTHORIZED = auto()
    ENTRY_DENIED_INVALID_CERT = auto()
    ENTRY_DENIED_REVOKED = auto()
    ENTRY_DENIED_SPOOF = auto()

@dataclass(frozen=True)
class AirspaceAccessCertificate:
    drone_pubkey: str
    airspace_corridor: str
    max_altitude_m: float
    valid_until: float
    authority_signature: str

@dataclass(frozen=True)
class DroneState:
    certificate: AirspaceAccessCertificate
    current_epoch: float
    revocation_status_verified: bool
    challenge_response_valid: bool
    mission_purpose_commitment: str

@dataclass(frozen=True)
class AirspaceManifest:
    verdict: AirspaceVerdict
    directive: str
    manifest_digest: str

class AirspaceAccessGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_entry(
        cls, state: DroneState
    ) -> AirspaceManifest:
        
        # Gate 1: Certificate validity
        if state.certificate.valid_until < state.current_epoch:
            return AirspaceManifest(
                verdict=AirspaceVerdict.ENTRY_DENIED_INVALID_CERT,
                directive=f"HALT: Certificate expired at {state.certificate.valid_until:.0f}.",
                manifest_digest=cls._hash("EXPIRED")
            )

        # Gate 2: Revocation check
        if not state.revocation_status_verified:
            return AirspaceManifest(
                verdict=AirspaceVerdict.ENTRY_DENIED_REVOKED,
                directive="HALT: Revocation status unverified. Cannot proceed.",
                manifest_digest=cls._hash("NO_REVOCATION_CHECK")
            )

        # Gate 3: Challenge response
        if not state.challenge_response_valid:
            return AirspaceManifest(
                verdict=AirspaceVerdict.ENTRY_DENIED_SPOOF,
                directive="HALT: Challenge response invalid. Possible spoofing.",
                manifest_digest=cls._hash("CHALLENGE_FAIL")
            )

        # Gate 4: Authorized
        digest = cls._hash(json.dumps({
            "drone": state.certificate.drone_pubkey,
            "corridor": state.certificate.airspace_corridor,
            "altitude": f"{state.certificate.max_altitude_m:.1f}",
            "purpose": state.mission_purpose_commitment,
            "valid_until": f"{state.certificate.valid_until:.0f}"
        }, sort_keys=True))
        
        return AirspaceManifest(
            verdict=AirspaceVerdict.ENTRY_AUTHORIZED,
            directive=f"PROCEED: Entry authorized for corridor {state.certificate.airspace_corridor}.",
            manifest_digest=digest
        )