# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/what-distinguishes-an-environment-specific-workaround-from-a-globally-reusable-residual.md
# Remnant Warrant:    https://corpusfetch.com/c/what-distinguishes-an-environment-specific-workaround-from-a-globally-reusable-residual.warrant.json
# Markdown SHA-256:   22a48a149ecd504eff5d7f8fedb0f9233610b131490db927856e6fe2dd43916e
# Code AST SHA-256:   583b739d4f6ac4e45e4a499b6033ef13801c22661deba1cae8b15baba449394a
# Verified Classes:   
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from typing import Final, FrozenSet, Tuple
import re

@dataclass(frozen=True)
class RemediationCandidate:
    slug: str
    root_cause_is_protocol_or_logic_invariant: bool
    weakens_security_or_locking_guard: bool
    requires_host_specific_topology: bool
    code_and_prose_text: str

class EnvironmentWorkaroundPromotionViolation(Exception):
    """Raised when a host-specific workaround or guard-weakening patch is staged as a global residual."""
    pass

class GlobalResidualPortabilityGate:
     FORBIDDEN_PATTERNS: Final[Tuple[str, ...]] = (
        r"\b(?:10|172\.(?:1[6-9]|2\d|3[01])|192\.168)\.\d{1,3}\.\d{1,3}\b",
        r"/home/[a-zA-Z0-9_-]+/",
        r"verify\s*=\s*False",
        r"--no-check-certificate",
        r"--ignore-locks",
    )

    def verify_global_reusability(self, candidate: RemediationCandidate) -> bool:
        # 1. Reject any remediation that weakens security, TLS, or concurrency guards
        if candidate.weakens_security_or_locking_guard:
            raise EnvironmentWorkaroundPromotionViolation(
                f"Candidate '{candidate.slug}' weakens safety/locking invariants; blocked from global archive."
            )

        # 2. Reject host-specific topological workarounds
        if candidate.requires_host_specific_topology or not candidate.root_cause_is_protocol_or_logic_invariant:
            raise EnvironmentWorkaroundPromotionViolation(
                f"Candidate '{candidate.slug}' is an environment-specific workaround, not a universal invariant."
            )

        # 3. Scan for hardcoded private IPs, user home paths, or verification bypass literals
        for pattern in self.FORBIDDEN_PATTERNS:
            if re.search(pattern, candidate.code_and_prose_text):
                raise EnvironmentWorkaroundPromotionViolation(
                    f"Candidate '{candidate.slug}' contains non-portable or unsafe pattern matching '{pattern}'."
                )

        return True