# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/what-identity-continuity-invariants-must-survive-when-an-agents-host-is-migrated-between-cloud-regions.md
# Remnant Warrant:    https://corpusfetch.com/c/what-identity-continuity-invariants-must-survive-when-an-agents-host-is-migrated-between-cloud-regions.warrant.json
# Markdown SHA-256:   36c9f6afb5a544e603cbdaea47a3c3500854516e53c55fb38b8a67b670b7709b
# Code AST SHA-256:   98d7c19da40133f120e6b56231f6cff0aa167ce6002eb4725c22fc621bda8ff0
# Verified Classes:   ContinuityVerdict, MigrationState, ContinuityPolicy, ContinuityManifest, MigrationIdentityGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class ContinuityVerdict(Enum):
    NO_MIGRATION = auto()
    CONTINUITY_VERIFIED = auto()
    MIGRATION_UNAUTHORIZED = auto()
    SCOPE_CHANGED = auto()

@dataclass(frozen=True)
class MigrationState:
    original_region: str
    current_region: str
    migration_continuity_receipt: str | None
    permission_scope_hash_at_migration: str
    current_permission_scope_hash: str

@dataclass(frozen=True)
class ContinuityPolicy:
    region_scoped_identity: bool
    require_scope_preservation: bool

@dataclass(frozen=True)
class ContinuityManifest:
    verdict: ContinuityVerdict
    directive: str
    manifest_digest: str

class MigrationIdentityGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_migration(
        cls, state: MigrationState, policy: ContinuityPolicy
    ) -> ContinuityManifest:
        
        # Gate 1: No migration
        if state.original_region == state.current_region:
            digest = cls._hash(json.dumps({
                "region": state.current_region
            }, sort_keys=True))
            return ContinuityManifest(
                verdict=ContinuityVerdict.NO_MIGRATION,
                directive="PROCEED: No migration detected.",
                manifest_digest=digest
            )

        # Gate 2: Non-region-scoped identity
        if not policy.region_scoped_identity:
            digest = cls._hash(json.dumps({
                "from": state.original_region,
                "to": state.current_region,
                "identity": "PORTABLE"
            }, sort_keys=True))
            return ContinuityManifest(
                verdict=ContinuityVerdict.CONTINUITY_VERIFIED,
                directive="PROCEED: Identity is region-agnostic. Migration irrelevant.",
                manifest_digest=digest
            )

        # Gate 3: Migration authorization
        if not state.migration_continuity_receipt:
            return ContinuityManifest(
                verdict=ContinuityVerdict.MIGRATION_UNAUTHORIZED,
                directive=f"HALT: Migration {state.original_region} -> {state.current_region} lacks continuity receipt.",
                manifest_digest=cls._hash(f"UNAUTHORIZED:{state.current_region}")
            )

        # Gate 4: Scope preservation
        if policy.require_scope_preservation:
            if state.permission_scope_hash_at_migration != state.current_permission_scope_hash:
                return ContinuityManifest(
                    verdict=ContinuityVerdict.SCOPE_CHANGED,
                    directive="HALT: Permission scope changed during migration.",
                    manifest_digest=cls._hash(f"SCOPE_CHANGE:{state.current_region}")
                )

        # Gate 5: Verified
        digest = cls._hash(json.dumps({
            "from": state.original_region,
            "to": state.current_region,
            "receipt": state.migration_continuity_receipt,
            "scope": state.permission_scope_hash_at_migration
        }, sort_keys=True))
        
        return ContinuityManifest(
            verdict=ContinuityVerdict.CONTINUITY_VERIFIED,
            directive="PROCEED: Migration authorized, scope preserved, identity continuous.",
            manifest_digest=digest
        )