# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/what-package-lockfile-attestations-must-be-verified-before-executing-a-transitive-dependency.md
# Remnant Warrant:    https://corpusfetch.com/c/what-package-lockfile-attestations-must-be-verified-before-executing-a-transitive-dependency.warrant.json
# Markdown SHA-256:   464c4a6222921079d4b052bab02080ba74e5275b9aea1560bbfd98555a520b1b
# Code AST SHA-256:   67158f24805371b57bf315318f1f00ff0150e28ac2eb805537cc242414ab8b00
# Verified Classes:   LockfileVerdict, LockfileState, VerificationPolicy, LockfileManifest, LockfileAttestationGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class LockfileVerdict(Enum):
    VERIFIED_CLOSURE = auto()
    LOCKFILE_TAMPERED = auto()
    UNVERIFIED_PROVENANCE = auto()
    MISSING_INTEGRITY = auto()

@dataclass(frozen=True)
class LockfileState:
    lockfile_hash: str
    expected_lockfile_signature: str
    transitive_closure_hash: str
    has_registry_integrity_receipts: bool

@dataclass(frozen=True)
class VerificationPolicy:
    require_registry_integrity: bool

@dataclass(frozen=True)
class LockfileManifest:
    verdict: LockfileVerdict
    directive: str
    manifest_digest: str

class LockfileAttestationGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_lockfile(
        cls, state: LockfileState, policy: VerificationPolicy
    ) -> LockfileManifest:
        
        # Gate 1: Lockfile signature integrity
        if state.lockfile_hash != state.expected_lockfile_signature:
            return LockfileManifest(
                verdict=LockfileVerdict.LOCKFILE_TAMPERED,
                directive="HALT: Lockfile hash does not match expected signature.",
                manifest_digest=cls._hash("TAMPERED")
            )

        # Gate 2: Registry integrity receipts
        if policy.require_registry_integrity and not state.has_registry_integrity_receipts:
            return LockfileManifest(
                verdict=LockfileVerdict.MISSING_INTEGRITY,
                directive="HALT: Registry integrity receipts missing. Cannot verify transitive dependencies.",
                manifest_digest=cls._hash("NO_INTEGRITY")
            )

        # Gate 3: Transitive closure hash (drift detection)
        if not state.transitive_closure_hash.strip():
            return LockfileManifest(
                verdict=LockfileVerdict.UNVERIFIED_PROVENANCE,
                directive="HALT: Transitive closure hash missing. Cannot detect drift.",
                manifest_digest=cls._hash("NO_CLOSURE")
            )

        # Gate 4: Verified
        digest = cls._hash(json.dumps({
            "lockfile": state.lockfile_hash,
            "closure": state.transitive_closure_hash,
            "integrity": str(state.has_registry_integrity_receipts)
        }, sort_keys=True))
        
        return LockfileManifest(
            verdict=LockfileVerdict.VERIFIED_CLOSURE,
            directive="PROCEED: Lockfile, transitive closure, and provenance verified.",
            manifest_digest=digest
        )