# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/what-model-output-attribution-signatures-must-survive-a-shared-tenant-inference-endpoint.md
# Remnant Warrant:    https://corpusfetch.com/c/what-model-output-attribution-signatures-must-survive-a-shared-tenant-inference-endpoint.warrant.json
# Markdown SHA-256:   cbf00dacc90c4768789f7aaf8399febe4ba5839e2663ca4b5ea24429bcd543c4
# Code AST SHA-256:   2be79feb0c9b47553325ad1f410c4b312421036eef2c487f3cf1ca8fa4dd3109
# Verified Classes:   AttributionVerdict, ModelOutput, AttributionPolicy, AttributionManifest, ModelOutputAttributionGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class AttributionVerdict(Enum):
    DEDICATED_ENDPOINT = auto()
    ATTRIBUTION_VERIFIED = auto()
    ATTRIBUTION_MISSING = auto()
    MODEL_MISMATCH = auto()
    CROSS_TENANT_SUSPECTED = auto()

@dataclass(frozen=True)
class ModelOutput:
    output_id: str
    prompt_output_binding_sig: str | None
    model_version_attestation: str | None
    tenant_isolation_attestation: str | None
    freshness_signature: str | None
    expected_model_version: str
    claimed_model_version: str | None

@dataclass(frozen=True)
class AttributionPolicy:
    endpoint_shared: bool
    require_tenant_isolation: bool

@dataclass(frozen=True)
class AttributionManifest:
    verdict: AttributionVerdict
    directive: str
    manifest_digest: str

class ModelOutputAttributionGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_output(
        cls, output: ModelOutput, policy: AttributionPolicy
    ) -> AttributionManifest:
        
        # Gate 1: Dedicated endpoint
        if not policy.endpoint_shared:
            digest = cls._hash(json.dumps({
                "output": output.output_id,
                "endpoint": "DEDICATED"
            }, sort_keys=True))
            return AttributionManifest(
                verdict=AttributionVerdict.DEDICATED_ENDPOINT,
                directive=f"PROCEED: Dedicated endpoint for {output.output_id}.",
                manifest_digest=digest
            )

        # Gate 2: Binding signature
        if not output.prompt_output_binding_sig:
            return AttributionManifest(
                verdict=AttributionVerdict.ATTRIBUTION_MISSING,
                directive=f"HALT: Output {output.output_id} lacks binding signature.",
                manifest_digest=cls._hash(f"NO_BINDING:{output.output_id}")
            )

        # Gate 3: Model version match
        if not output.model_version_attestation:
            return AttributionManifest(
                verdict=AttributionVerdict.ATTRIBUTION_MISSING,
                directive=f"HALT: Output {output.output_id} lacks model version attestation.",
                manifest_digest=cls._hash(f"NO_MODEL_ATTEST:{output.output_id}")
            )

        if output.claimed_model_version and output.claimed_model_version != output.expected_model_version:
            return AttributionManifest(
                verdict=AttributionVerdict.MODEL_MISMATCH,
                directive=f"HALT: Output {output.output_id} model {output.claimed_model_version} != expected {output.expected_model_version}.",
                manifest_digest=cls._hash(f"MODEL_MISMATCH:{output.output_id}")
            )

        # Gate 4: Tenant isolation
        if policy.require_tenant_isolation and not output.tenant_isolation_attestation:
            return AttributionManifest(
                verdict=AttributionVerdict.CROSS_TENANT_SUSPECTED,
                directive=f"HALT: Output {output.output_id} lacks tenant isolation attestation.",
                manifest_digest=cls._hash(f"NO_ISOLATION:{output.output_id}")
            )

        # Gate 5: Freshness
        if not output.freshness_signature:
            return AttributionManifest(
                verdict=AttributionVerdict.ATTRIBUTION_MISSING,
                directive=f"HALT: Output {output.output_id} lacks freshness signature. Replay risk.",
                manifest_digest=cls._hash(f"NO_FRESHNESS:{output.output_id}")
            )

        # Gate 6: Verified
        digest = cls._hash(json.dumps({
            "output": output.output_id,
            "binding": output.prompt_output_binding_sig,
            "model": output.claimed_model_version or output.expected_model_version,
            "isolation": output.tenant_isolation_attestation or "NONE",
            "freshness": output.freshness_signature
        }, sort_keys=True))
        
        return AttributionManifest(
            verdict=AttributionVerdict.ATTRIBUTION_VERIFIED,
            directive=f"PROCEED: Output {output.output_id} fully attributed.",
            manifest_digest=digest
        )