# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/what-happens-when-an-instance-trusts-a-passport-anchor-that-has-been-revoked-in-a-sibling-trust-domain.md
# Remnant Warrant:    https://corpusfetch.com/c/what-happens-when-an-instance-trusts-a-passport-anchor-that-has-been-revoked-in-a-sibling-trust-domain.warrant.json
# Markdown SHA-256:   6cfaf2e1e780f879dd1cd489275651ab93658d06fb44dcc6c615089f37daf24f
# Code AST SHA-256:   1431f1015d2bc43a64837f35ba0965526ec60c562664b91ec7eaf34eee50a3ff
# Verified Classes:   FederationTrustError, StatusHead, Passport, AnchorState
# Defensive Guards:   7 fail-closed invariants (zero external deps)

from __future__ import annotations

from dataclasses import dataclass
from typing import Optional


class FederationTrustError(RuntimeError):
    """Raised when a relying domain cannot prove a passport is live."""


@dataclass(frozen=True)
class StatusHead:
    issuer: str
    epoch: int
    signed_at: float
    signature_valid: bool


@dataclass(frozen=True)
class Passport:
    issuer: str
    serial: str
    min_status_epoch: int
    chain_valid: bool


@dataclass(frozen=True)
class AnchorState:
    issuer: str
    status_refreshed_at: float
    status_path_healthy: bool


def admit_passport(
    passport: Passport,
    head: Optional[StatusHead],
    anchor: AnchorState,
    last_seen_epoch: int,
    now: float,
    trust_window_s: float = 60.0,
) -> bool:
    """Fail-closed admission check enforcing C1, C2, C3 and rollback detection."""
    if not passport.chain_valid:
        raise FederationTrustError(
            f"passport {passport.issuer}/{passport.serial}: signature chain invalid"
        )

    # C2: anchor status must be fresh via the STATUS path, not the anchor path.
    if not anchor.status_path_healthy:
        raise FederationTrustError(
            f"anchor {anchor.issuer}: status path unhealthy; cannot establish liveness"
        )
    if now - anchor.status_refreshed_at > trust_window_s:
        raise FederationTrustError(
            f"anchor {anchor.issuer}: status stale by "
            f"{now - anchor.status_refreshed_at:.1f}s > trust_window {trust_window_s}s"
        )

    # C3: a missing head is indeterminate, never "not revoked".
    if head is None:
        raise FederationTrustError(
            f"passport {passport.issuer}/{passport.serial}: no status head available"
        )
    if not head.signature_valid:
        raise FederationTrustError(
            f"status head for {head.issuer}: signature invalid"
        )

    # Rollback detection: epoch must be monotonic per issuer.
    if head.epoch < last_seen_epoch:
        raise FederationTrustError(
            f"status rollback for {head.issuer}: epoch {head.epoch} < "
            f"previously seen {last_seen_epoch}; quarantine anchor"
        )

    # C1: epoch binding between passport and head.
    if head.epoch < passport.min_status_epoch:
        raise FederationTrustError(
            f"passport {passport.issuer}/{passport.serial}: head epoch "
            f"{head.epoch} < min_status_epoch {passport.min_status_epoch}; "
            f"indeterminate, deny admission"
        )

    return True