# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/what-process-attestations-must-accompany-a-subagent-result-to-prove-actual-work.md
# Remnant Warrant:    https://corpusfetch.com/c/what-process-attestations-must-accompany-a-subagent-result-to-prove-actual-work.warrant.json
# Markdown SHA-256:   1be4dc1fb05ea89cfc8b77e6c21952e07a01233ccd994631957696a86e391b73
# Code AST SHA-256:   4e57cd144bed516311d7072b5c69f9abc424a08512e04beaf9196205704d47d8
# Verified Classes:   ProcessVerdict, SubagentResult, ProcessPolicy, ProcessManifest, ProcessAttestationGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class ProcessVerdict(Enum):
    PROCESS_OBSERVABLE = auto()
    PROCESS_ATTESTED = auto()
    NO_ATTESTATION = auto()
    ATTESTATION_INCONSISTENT = auto()

@dataclass(frozen=True)
class SubagentResult:
    result_id: str
    intermediate_log_hash: str | None
    process_execution_signature: str | None
    expected_resource_consumption: float
    actual_resource_consumption: float

@dataclass(frozen=True)
class ProcessPolicy:
    require_attestation: bool
    resource_consumption_tolerance_pct: float

@dataclass(frozen=True)
class ProcessManifest:
    verdict: ProcessVerdict
    directive: str
    manifest_digest: str

class ProcessAttestationGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_result(
        cls, result: SubagentResult, policy: ProcessPolicy
    ) -> ProcessManifest:
        
        # Gate 1: Attestation required?
        if not policy.require_attestation:
            digest = cls._hash(json.dumps({
                "result": result.result_id,
                "attestation": "NOT_REQUIRED"
            }, sort_keys=True))
            return ProcessManifest(
                verdict=ProcessVerdict.PROCESS_OBSERVABLE,
                directive=f"PROCEED: Attestation not required for {result.result_id}.",
                manifest_digest=digest
            )

        # Gate 2: Attestation presence
        if not result.intermediate_log_hash or not result.process_execution_signature:
            return ProcessManifest(
                verdict=ProcessVerdict.NO_ATTESTATION,
                directive=f"HALT: Result {result.result_id} lacks process attestation.",
                manifest_digest=cls._hash(f"NO_ATTEST:{result.result_id}")
            )

        # Gate 3: Resource consumption consistency
        if result.expected_resource_consumption > 0:
            drift = abs(result.actual_resource_consumption - result.expected_resource_consumption) / result.expected_resource_consumption
            if drift > policy.resource_consumption_tolerance_pct:
                return ProcessManifest(
                    verdict=ProcessVerdict.ATTESTATION_INCONSISTENT,
                    directive=f"HALT: Resource consumption drift {drift:.2%} > {policy.resource_consumption_tolerance_pct:.2%}. Possible shortcut.",
                    manifest_digest=cls._hash(f"RESOURCE_DRIFT:{drift:.4f}")
                )

        # Gate 4: Verified
        digest = cls._hash(json.dumps({
            "result": result.result_id,
            "log": result.intermediate_log_hash,
            "signature": result.process_execution_signature,
            "consumption": f"{result.actual_resource_consumption:.2f}"
        }, sort_keys=True))
        
        return ProcessManifest(
            verdict=ProcessVerdict.PROCESS_ATTESTED,
            directive=f"PROCEED: Process attested for {result.result_id}.",
            manifest_digest=digest
        )