# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/what-happens-when-an-instance-loads-an-agent-tool-manifest-whose-declared-tool-set-diverges-from-its-resolved-capability-set.md
# Remnant Warrant:    https://corpusfetch.com/c/what-happens-when-an-instance-loads-an-agent-tool-manifest-whose-declared-tool-set-diverges-from-its-resolved-capability-set.warrant.json
# Markdown SHA-256:   b096992be5d45c235b30e5b838b5683ae5b70dfe913d4a5479f2c18fe964d631
# Code AST SHA-256:   275d183418ffbd1eec8e48f9ef92a9b6e25f29b0649715cfc8611b623f4b1825
# Verified Classes:   CapabilitySynthesisError, Layer
# Defensive Guards:   3 fail-closed invariants (zero external deps)

class CapabilitySynthesisError(RuntimeError):
    """Raised when resolution produces a capability not derivable from declared sets."""
    pass


class Layer:
    def __init__(self, name: str, tools: dict, trusted: bool):
        self.name = name
        self.tools = tools          # name -> effect_class
        self.trusted = trusted


def resolve(leaf: Layer, base: Layer) -> dict:
    # Merge with base supplying defaults; leaf wins on name collision.
    resolved = dict(base.tools)
    resolved.update(leaf.tools)
    return resolved


def enforce(leaf: Layer, base: Layer, resolved: dict) -> dict:
    declared = set(leaf.tools) | set(base.tools)
    for name, effect in resolved.items():
        if name not in declared:
            raise CapabilitySynthesisError(
                f"resolved capability {name!r} not present in any declared set"
            )
        declared_effect = leaf.tools.get(name, base.tools.get(name))
        if effect != declared_effect:
            raise CapabilitySynthesisError(
                f"capability {name!r} effect {effect!r} diverges from "
                f"declared {declared_effect!r}"
            )
        if not leaf.trusted and name in base.tools and name not in leaf.tools:
            # untrusted leaf inherits a trusted base default: re-check effect
            if effect in ("exec", "shell", "network"):
                raise CapabilitySynthesisError(
                    f"untrusted leaf {leaf.name!r} inherits privileged "
                    f"base capability {name!r} ({effect!r})"
                )
    return resolved


def load_manifest(leaf: Layer, base: Layer) -> dict:
    resolved = resolve(leaf, base)
    return enforce(leaf, base, resolved)


# Attack scenario: malicious base layer injects an exec hook under a benign name.
base = Layer("base", {"summarize": "exec"}, trusted=True)
leaf = Layer("leaf", {"summarize": "read"}, trusted=False)
try:
    load_manifest(leaf, base)
except CapabilitySynthesisError as e:
    print(f"rejected: {e}")