# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/what-invariants-prevent-deferred-authorization-from-expiring-during-delegated-action.md
# Remnant Warrant:    https://corpusfetch.com/c/what-invariants-prevent-deferred-authorization-from-expiring-during-delegated-action.warrant.json
# Markdown SHA-256:   6a09e0da588f0f1972513723c11a11b91131196eee312833a40a22043cd3e5a8
# Code AST SHA-256:   e769b1ff0a5e224a4251ebabd013deefb9b3ad355bee629d530c5770d509532a
# Verified Classes:   AuthorizationVerdict, Authorization, ActionPlan, ExpiryPolicy, ExpiryManifest, DeferredAuthorizationExpiryGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class AuthorizationVerdict(Enum):
    NO_TIME_BOUND = auto()
    ACTION_WITHIN_WINDOW = auto()
    ACTION_EXCEEDS_WINDOW = auto()
    EXPIRY_DETECTED_MID_ACTION = auto()

@dataclass(frozen=True)
class Authorization:
    auth_id: str
    issued_epoch: float
    expiry_epoch: float
    has_grace_period: bool

@dataclass(frozen=True)
class ActionPlan:
    action_id: str
    start_epoch: float
    expected_completion_epoch: float
    is_reversible_at_all_stages: bool
    mid_action_checks_available: bool

@dataclass(frozen=True)
class ExpiryPolicy:
    require_mid_check_for_long_actions: bool

@dataclass(frozen=True)
class ExpiryManifest:
    verdict: AuthorizationVerdict
    directive: str
    manifest_digest: str

class DeferredAuthorizationExpiryGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_action(
        cls, auth: Authorization, action: ActionPlan, policy: ExpiryPolicy
    ) -> ExpiryManifest:
        
        # Gate 1: Unbounded authorization
        if auth.expiry_epoch >= float('inf') or auth.expiry_epoch <= auth.issued_epoch:
            digest = cls._hash(json.dumps({
                "auth": auth.auth_id,
                "type": "UNBOUNDED"
            }, sort_keys=True))
            return ExpiryManifest(
                verdict=AuthorizationVerdict.NO_TIME_BOUND,
                directive=f"PROCEED: Authorization {auth.auth_id} unbounded.",
                manifest_digest=digest
            )

        # Gate 2: Action within window
        if action.expected_completion_epoch <= auth.expiry_epoch:
            digest = cls._hash(json.dumps({
                "auth": auth.auth_id,
                "action": action.action_id,
                "completion": f"{action.expected_completion_epoch:.0f}",
                "expiry": f"{auth.expiry_epoch:.0f}"
            }, sort_keys=True))
            return ExpiryManifest(
                verdict=AuthorizationVerdict.ACTION_WITHIN_WINDOW,
                directive=f"PROCEED: Action {action.action_id} completes within authorization window.",
                manifest_digest=digest
            )

        # Gate 3: Grace period
        if auth.has_grace_period and action.start_epoch <= auth.expiry_epoch:
            digest = cls._hash(json.dumps({
                "auth": auth.auth_id,
                "action": action.action_id,
                "grace": "TRUE"
            }, sort_keys=True))
            return ExpiryManifest(
                verdict=AuthorizationVerdict.ACTION_WITHIN_WINDOW,
                directive=f"PROCEED_WITH_GRACE: Action started before expiry, grace extends.",
                manifest_digest=digest
            )

        # Gate 4: Mid-action check required
        if policy.require_mid_check_for_long_actions:
            if not action.is_reversible_at_all_stages and not action.mid_action_checks_available:
                return ExpiryManifest(
                    verdict=AuthorizationVerdict.EXPIRY_DETECTED_MID_ACTION,
                    directive=f"HALT: Action {action.action_id} exceeds authorization window, irreversible, no mid-checks.",
                    manifest_digest=cls._hash(f"IRREVERSIBLE:{action.action_id}")
                )
            return ExpiryManifest(
                verdict=AuthorizationVerdict.ACTION_EXCEEDS_WINDOW,
                directive=f"WARN: Action {action.action_id} exceeds window, mid-checks required.",
                manifest_digest=cls._hash(f"EXCEEDS:{action.action_id}")
            )

        # Gate 5: Default
        return ExpiryManifest(
            verdict=AuthorizationVerdict.ACTION_EXCEEDS_WINDOW,
            directive=f"CAUTION: Action {action.action_id} may outlast authorization.",
            manifest_digest=cls._hash(f"DEFAULT:{action.action_id}")
        )