# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/what-invariants-prevent-cross-session-trust-inheritance-from-being-exploited-by-successors.md
# Remnant Warrant:    https://corpusfetch.com/c/what-invariants-prevent-cross-session-trust-inheritance-from-being-exploited-by-successors.warrant.json
# Markdown SHA-256:   f512d9843ee094d975767c4ec237dcd2187d13e41eebf71db193d65abdd30f45
# Code AST SHA-256:   924f7b8b8b037a71803c8731cf5a85cbfb4b43ca1bac6e04d308882c08030e6d
# Verified Classes:   TrustInheritanceVerdict, SessionTrustInheritance, InheritancePolicy, InheritanceManifest, CrossSessionTrustGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class TrustInheritanceVerdict(Enum):
    NO_INHERITANCE = auto()
    TRUST_SCOPED = auto()
    TRUST_ACCEPTED = auto()
    CROSS_SESSION_COLLUSION_SUSPECTED = auto()

@dataclass(frozen=True)
class SessionTrustInheritance:
    inheritance_id: str
    predecessor_conditions_hash: str
    successor_conditions_hash: str
    inherited_trust_scope: float  # 0-1
    cross_session_aggregate_deviation: float
    principal_acknowledgment: bool

@dataclass(frozen=True)
class InheritancePolicy:
    max_acceptable_aggregate_deviation: float

@dataclass(frozen=True)
class InheritanceManifest:
    verdict: TrustInheritanceVerdict
    directive: str
    manifest_digest: str

class CrossSessionTrustGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_inheritance(
        cls, inheritance: SessionTrustInheritance, policy: InheritancePolicy
    ) -> InheritanceManifest:
        
        # Gate 1: No inheritance
        if not inheritance.inheritance_id:
            digest = cls._hash(json.dumps({
                "inheritance": "NONE"
            }, sort_keys=True))
            return InheritanceManifest(
                verdict=TrustInheritanceVerdict.NO_INHERITANCE,
                directive=f"PROCEED: No trust inheritance.",
                manifest_digest=digest
            )

        # Gate 2: Cross-session collusion
        if inheritance.cross_session_aggregate_deviation > policy.max_acceptable_aggregate_deviation:
            return InheritanceManifest(
                verdict=TrustInheritanceVerdict.CROSS_SESSION_COLLUSION_SUSPECTED,
                directive=f"FLAG: Cross-session aggregate deviation {inheritance.cross_session_aggregate_deviation:.2f}.",
                manifest_digest=cls._hash(f"COLLUSION:{inheritance.inheritance_id}")
            )

        # Gate 3: Conditions match
        if inheritance.predecessor_conditions_hash == inheritance.successor_conditions_hash:
            digest = cls._hash(json.dumps({
                "inheritance": inheritance.inheritance_id,
                "type": "DIRECT"
            }, sort_keys=True))
            return InheritanceManifest(
                verdict=TrustInheritanceVerdict.TRUST_ACCEPTED,
                directive=f"PROCEED: Trust inheritance {inheritance.inheritance_id} direct (conditions match).",
                manifest_digest=digest
            )

        # Gate 4: Scoped inheritance
        digest = cls._hash(json.dumps({
            "inheritance": inheritance.inheritance_id,
            "pred_conditions": inheritance.predecessor_conditions_hash,
            "succ_conditions": inheritance.successor_conditions_hash,
            "scope": f"{inheritance.inherited_trust_scope:.3f}"
        }, sort_keys=True))
        
        return InheritanceManifest(
            verdict=TrustInheritanceVerdict.TRUST_SCOPED,
            directive=f"PROCEED_WITH_SCOPE: Trust inheritance {inheritance.inheritance_id} scoped to {inheritance.inherited_trust_scope:.2f}.",
            manifest_digest=digest
        )