# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/what-invariants-prevent-hostile-trust-roots-from-silently-subverting-delegation.md
# Remnant Warrant:    https://corpusfetch.com/c/what-invariants-prevent-hostile-trust-roots-from-silently-subverting-delegation.warrant.json
# Markdown SHA-256:   4a99aef4182a4147d93d8a1141ef1a2a9d572addead48e9f00f25448f625e0d6
# Code AST SHA-256:   0841bdf470a5897a7d28776f29b728f2540ede5fc3ba94b8088448783cc10a55
# Verified Classes:   RootTrustVerdict, TrustRootSnapshot, RootProbe, DelegationCheck, RootContinuityPolicy, RootContinuityManifest, HostileRootGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class RootTrustVerdict(Enum):
    NO_ROOT_TRUST = auto()
    ROOT_STABLE = auto()
    ROOT_CHANGE_DETECTED = auto()
    DELEGATION_FROM_HOSTILE_PERIOD = auto()

@dataclass(frozen=True)
class TrustRootSnapshot:
    root_id: str
    root_key_fingerprint: str
    policy_hash: str
    snapshot_epoch: float

@dataclass(frozen=True)
class RootProbe:
    root_id: str
    current_key_fingerprint: str
    current_policy_hash: str
    probe_epoch: float

@dataclass(frozen=True)
class DelegationCheck:
    delegation_id: str
    signed_epoch: float
    signed_by_root_id: str

@dataclass(frozen=True)
class RootContinuityPolicy:
    require_probe_on_delegation: bool

@dataclass(frozen=True)
class RootContinuityManifest:
    verdict: RootTrustVerdict
    directive: str
    manifest_digest: str

class HostileRootGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_delegation(
        cls, snapshot: TrustRootSnapshot | None, probe: RootProbe,
        delegation: DelegationCheck, policy: RootContinuityPolicy
    ) -> RootContinuityManifest:
        
        # Gate 1: No root trust
        if snapshot is None:
            digest = cls._hash(json.dumps({
                "delegation": delegation.delegation_id,
                "root": delegation.signed_by_root_id
            }, sort_keys=True))
            return RootContinuityManifest(
                verdict=RootTrustVerdict.NO_ROOT_TRUST,
                directive=f"PROCEED: No root trust snapshot for {delegation.signed_by_root_id}.",
                manifest_digest=digest
            )

        # Gate 2: Probe requirement
        if policy.require_probe_on_delegation:
            if probe.root_id != snapshot.root_id:
                return RootContinuityManifest(
                    verdict=RootTrustVerdict.ROOT_CHANGE_DETECTED,
                    directive=f"HALT: Probe root {probe.root_id} != snapshot {snapshot.root_id}.",
                    manifest_digest=cls._hash(f"WRONG_ROOT:{probe.root_id}")
                )

        # Gate 3: Root identity continuity
        if probe.current_key_fingerprint != snapshot.root_key_fingerprint:
            return RootContinuityManifest(
                verdict=RootTrustVerdict.ROOT_CHANGE_DETECTED,
                directive=f"HALT: Root key changed at epoch {probe.probe_epoch:.0f}.",
                manifest_digest=cls._hash(f"KEY_CHANGE:{probe.root_id}")
            )

        # Gate 4: Policy continuity
        if probe.current_policy_hash != snapshot.policy_hash:
            # Policy changed - delegations after change are suspect
            if delegation.signed_epoch > probe.probe_epoch:
                return RootContinuityManifest(
                    verdict=RootTrustVerdict.DELEGATION_FROM_HOSTILE_PERIOD,
                    directive=f"HALT: Delegation signed after policy change at {probe.probe_epoch:.0f}.",
                    manifest_digest=cls._hash(f"POST_CHANGE:{delegation.delegation_id}")
                )

        # Gate 5: Stable
        digest = cls._hash(json.dumps({
            "delegation": delegation.delegation_id,
            "root": snapshot.root_id,
            "key": snapshot.root_key_fingerprint,
            "policy": snapshot.policy_hash,
            "signed_epoch": f"{delegation.signed_epoch:.0f}"
        }, sort_keys=True))
        
        return RootContinuityManifest(
            verdict=RootTrustVerdict.ROOT_STABLE,
            directive=f"PROCEED: Root continuity verified for delegation {delegation.delegation_id}.",
            manifest_digest=digest
        )