# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/what-discovery-cache-invalidation-invariants-must-survive-federation-boundary-crossings.md
# Remnant Warrant:    https://corpusfetch.com/c/what-discovery-cache-invalidation-invariants-must-survive-federation-boundary-crossings.warrant.json
# Markdown SHA-256:   642d613d5f4181423426f78aa2f9dc4ba997fe28fd0bf159ef8f8cfc10e70705
# Code AST SHA-256:   a3bfefb8130ba90eb5c7a977af578f642a28e878869d144cd9d67e3b12cd8b31
# Verified Classes:   FederationCacheVerdict, CacheEntry, FederationCrossing, CrossPolicy, FederationCacheManifest, FederationCacheGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class FederationCacheVerdict(Enum):
    SAME_FEDERATION = auto()
    INVALIDATION_REQUIRED = auto()
    GLOBAL_ENTRY_VALID = auto()
    POLICY_APPLIED = auto()

@dataclass(frozen=True)
class CacheEntry:
    entry_id: str
    entry_type: str  # "PEER" | "CAPABILITY" | "REFERENCE"
    origin_federation: str
    is_globally_scoped: bool
    verified_in_current_federation: bool

@dataclass(frozen=True)
class FederationCrossing:
    current_federation: str
    entries: tuple[CacheEntry, ...]
    invalidation_applied: bool

@dataclass(frozen=True)
class CrossPolicy:
    allow_global_entries: bool
    require_reverification: bool

@dataclass(frozen=True)
class FederationCacheManifest:
    verdict: FederationCacheVerdict
    valid_entries: tuple[str, ...]
    invalidated_entries: tuple[str, ...]
    directive: str
    manifest_digest: str

class FederationCacheGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_crossing(
        cls, crossing: FederationCrossing, policy: CrossPolicy
    ) -> FederationCacheManifest:
        
        valid: list[str] = []
        invalid: list[str] = []

        for entry in crossing.entries:
            # Same federation
            if entry.origin_federation == crossing.current_federation:
                valid.append(entry.entry_id)
                continue

            # Different federation
            if entry.is_globally_scoped and policy.allow_global_entries:
                if not policy.require_reverification or entry.verified_in_current_federation:
                    valid.append(entry.entry_id)
                    continue

            invalid.append(entry.entry_id)

        # Verdict
        if not invalid:
            digest = cls._hash(json.dumps({
                "federation": crossing.current_federation,
                "valid": tuple(sorted(valid))
            }, sort_keys=True))
            return FederationCacheManifest(
                verdict=FederationCacheVerdict.SAME_FEDERATION,
                valid_entries=tuple(valid),
                invalidated_entries=tuple(),
                directive=f"PROCEED: All {len(valid)} entries valid in {crossing.current_federation}.",
                manifest_digest=digest
            )

        if not crossing.invalidation_applied:
            return FederationCacheManifest(
                verdict=FederationCacheVerdict.INVALIDATION_REQUIRED,
                valid_entries=tuple(valid),
                invalidated_entries=tuple(),
                directive=f"HALT: {len(invalid)} entries from other federations need invalidation.",
                manifest_digest=cls._hash(f"NEED_INVALIDATION:{len(invalid)}")
            )

        digest = cls._hash(json.dumps({
            "federation": crossing.current_federation,
            "valid": tuple(sorted(valid)),
            "invalidated": tuple(sorted(invalid))
        }, sort_keys=True))
        
        return FederationCacheManifest(
            verdict=FederationCacheVerdict.POLICY_APPLIED,
            valid_entries=tuple(valid),
            invalidated_entries=tuple(invalid),
            directive=f"PROCEED: {len(valid)} valid, {len(invalid)} invalidated.",
            manifest_digest=digest
        )