# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/what-federation-authority-limit-invariants-prevent-agents-from-delegating-beyond-their-reachable-authority.md
# Remnant Warrant:    https://corpusfetch.com/c/what-federation-authority-limit-invariants-prevent-agents-from-delegating-beyond-their-reachable-authority.warrant.json
# Markdown SHA-256:   8b02350890276dcf5f285a219cf34aacaca997d30ef03822c5956f615d7009fc
# Code AST SHA-256:   d4f81240118b761a36bd674c284eee888dd1dbdd2dd370a61414332f1fda7027
# Verified Classes:   DelegationVerdict, DelegationRequest, DelegationPolicy, DelegationManifest, FederationDelegationGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class DelegationVerdict(Enum):
    INTRA_FEDERATION = auto()
    CROSS_FEDERATION_VALID = auto()
    FEDERATION_NOT_RECOGNIZED = auto()
    SCOPE_OVERREACH = auto()

@dataclass(frozen=True)
class DelegationRequest:
    delegator_id: str
    delegatee_id: str
    delegator_federation: str
    delegatee_federation: str
    delegator_scope: dict
    delegated_scope: dict
    federation_reach_receipt: str | None

@dataclass(frozen=True)
class DelegationPolicy:
    require_reach_for_cross_federation: bool
    require_scope_subset: bool

@dataclass(frozen=True)
class DelegationManifest:
    verdict: DelegationVerdict
    directive: str
    manifest_digest: str

class FederationDelegationGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_delegation(
        cls, request: DelegationRequest, policy: DelegationPolicy
    ) -> DelegationManifest:
        
        # Gate 1: Intra-federation
        if request.delegator_federation == request.delegatee_federation:
            digest = cls._hash(json.dumps({
                "delegator": request.delegator_id,
                "delegatee": request.delegatee_id,
                "federation": request.delegator_federation
            }, sort_keys=True))
            return DelegationManifest(
                verdict=DelegationVerdict.INTRA_FEDERATION,
                directive=f"PROCEED: Intra-federation delegation in {request.delegator_federation}.",
                manifest_digest=digest
            )

        # Gate 2: Federation reach
        if policy.require_reach_for_cross_federation and not request.federation_reach_receipt:
            return DelegationManifest(
                verdict=DelegationVerdict.FEDERATION_NOT_RECOGNIZED,
                directive=f"HALT: Cross-federation delegation {request.delegator_federation} -> {request.delegatee_federation} lacks reach proof.",
                manifest_digest=cls._hash(f"NO_REACH:{request.delegator_id}")
            )

        # Gate 3: Scope subset check
        if policy.require_scope_subset:
            for key, value in request.delegated_scope.items():
                delegator_value = request.delegator_scope.get(key)
                if delegator_value is None:
                    return DelegationManifest(
                        verdict=DelegationVerdict.SCOPE_OVERREACH,
                        directive=f"HALT: Delegated key '{key}' not in delegator's scope.",
                        manifest_digest=cls._hash(f"KEY:{key}")
                    )
                if isinstance(value, (int, float)) and isinstance(delegator_value, (int, float)):
                    if value > delegator_value:
                        return DelegationManifest(
                            verdict=DelegationVerdict.SCOPE_OVERREACH,
                            directive=f"HALT: Delegated {key}={value} > delegator's {delegator_value}.",
                            manifest_digest=cls._hash(f"OVERREACH:{key}")
                        )

        # Gate 4: Valid cross-federation
        digest = cls._hash(json.dumps({
            "delegator": request.delegator_id,
            "delegatee": request.delegatee_id,
            "from_fed": request.delegator_federation,
            "to_fed": request.delegatee_federation,
            "reach": request.federation_reach_receipt,
            "scope": request.delegated_scope
        }, sort_keys=True))
        
        return DelegationManifest(
            verdict=DelegationVerdict.CROSS_FEDERATION_VALID,
            directive=f"PROCEED: Cross-federation delegation with reach and scope verified.",
            manifest_digest=digest
        )