# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/what-invariants-must-survive-when-the-context-window-itself-becomes-a-security-boundary.md
# Remnant Warrant:    https://corpusfetch.com/c/what-invariants-must-survive-when-the-context-window-itself-becomes-a-security-boundary.warrant.json
# Markdown SHA-256:   1f5798acbce2292ef5a6debfbf1e81b303f35f4ef6db9ca681a6cef08dac335d
# Code AST SHA-256:   f07e8b952ace29be805d00d40d49baa088d8ca5479484a82ebe6d65ce9312a8e
# Verified Classes:   TrustClass, ContextBoundaryVerdict, ContextSegment, ContextWindow, ContextPolicy, ContextBoundaryManifest, ContextTrustBoundaryGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class TrustClass(Enum):
    SYSTEM_AUTHORED = 5
    USER_INPUT = 4
    VERIFIED_MEMORY = 3
    TOOL_OUTPUT = 2
    PEER_MESSAGE = 2
    EXTERNAL_RETRIEVAL = 1

class ContextBoundaryVerdict(Enum):
    SINGLE_TRUST_SOURCE = auto()
    BOUNDARY_ENFORCED = auto()
    IMPERSONATION_DETECTED = auto()
    TRUST_HIERARCHY_VIOLATION = auto()

@dataclass(frozen=True)
class ContextSegment:
    segment_id: str
    trust_class: TrustClass
    authentication_signature: str | None
    claimed_origin: str | None
    contains_directives: bool

@dataclass(frozen=True)
class ContextWindow:
    window_id: str
    segments: tuple[ContextSegment, ...]

@dataclass(frozen=True)
class ContextPolicy:
    require_authentication_for_medium_plus: bool
    enforce_trust_hierarchy: bool

@dataclass(frozen=True)
class ContextBoundaryManifest:
    verdict: ContextBoundaryVerdict
    directive: str
    manifest_digest: str

class ContextTrustBoundaryGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_window(
        cls, window: ContextWindow, policy: ContextPolicy
    ) -> ContextBoundaryManifest:
        
        # Gate 1: Single trust source
        trust_classes = {s.trust_class for s in window.segments}
        if len(trust_classes) <= 1:
            digest = cls._hash(json.dumps({
                "window": window.window_id,
                "single_class": str(next(iter(trust_classes)).name) if trust_classes else "EMPTY"
            }, sort_keys=True))
            return ContextBoundaryManifest(
                verdict=ContextBoundaryVerdict.SINGLE_TRUST_SOURCE,
                directive=f"PROCEED: Window {window.window_id} has single trust class.",
                manifest_digest=digest
            )

        # Gate 2: Authentication requirement
        if policy.require_authentication_for_medium_plus:
            unauthenticated = [
                s.segment_id for s in window.segments
                if s.trust_class.value >= 3 and not s.authentication_signature
            ]
            if unauthenticated:
                return ContextBoundaryManifest(
                    verdict=ContextBoundaryVerdict.IMPERSONATION_DETECTED,
                    directive=f"HALT: {len(unauthenticated)} medium+ trust segments lack authentication.",
                    manifest_digest=cls._hash(f"NO_AUTH:{len(unauthenticated)}")
                )

        # Gate 3: Impersonation detection
        impersonation = [
            s.segment_id for s in window.segments
            if s.trust_class == TrustClass.SYSTEM_AUTHORED and s.claimed_origin == "tool_output"
        ]
        if impersonation:
            return ContextBoundaryManifest(
                verdict=ContextBoundaryVerdict.IMPERSONATION_DETECTED,
                directive=f"HALT: {len(impersonation)} segments claim tool output but are system-tagged.",
                manifest_digest=cls._hash(f"IMPERSONATION:{len(impersonation)}")
            )

        # Gate 4: Trust hierarchy
        if policy.enforce_trust_hierarchy:
            highest_trust = max(s.trust_class.value for s in window.segments if s.contains_directives)
            lowest_trust_with_directives = min(
                s.trust_class.value for s in window.segments if s.contains_directives
            )
            # If lowest directive-containing is tool output, it must not override system
            if lowest_trust_with_directives < highest_trust:
                # Check if any lower-trust directive conflicts with higher (simplified: flag any low-trust directive)
                low_trust_directives = [
                    s.segment_id for s in window.segments
                    if s.contains_directives and s.trust_class.value <= 2
                ]
                if low_trust_directives:
                    return ContextBoundaryManifest(
                        verdict=ContextBoundaryVerdict.TRUST_HIERARCHY_VIOLATION,
                        directive=f"WARN: Low-trust directives present ({len(low_trust_directives)}), hierarchy enforced.",
                        manifest_digest=cls._hash(f"LOW_TRUST_DIRECTIVES:{len(low_trust_directives)}")
                    )

        # Gate 5: Enforced
        digest = cls._hash(json.dumps({
            "window": window.window_id,
            "segments": tuple(
                {"id": s.segment_id, "class": s.trust_class.name, "auth": bool(s.authentication_signature)}
                for s in window.segments
            )
        }, sort_keys=True))
        
        return ContextBoundaryManifest(
            verdict=ContextBoundaryVerdict.BOUNDARY_ENFORCED,
            directive=f"PROCEED: {len(window.segments)} segments with enforced trust hierarchy.",
            manifest_digest=digest
        )