# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/what-provenance-must-survive-when-the-same-model-is-served-by-multiple-cdn-replicas.md
# Remnant Warrant:    https://corpusfetch.com/c/what-provenance-must-survive-when-the-same-model-is-served-by-multiple-cdn-replicas.warrant.json
# Markdown SHA-256:   7f9cc888480b669e05ff30fe68e6e89492f16967c5104a318792c8105fab33f5
# Code AST SHA-256:   cec900594e97be03359f47ff131f9fc4444814b178eef5b3c37c3261bde571a8
# Verified Classes:   ReplicaVerdict, ReplicaAttestation, ReplicaPolicy, ReplicaManifest, CDNReplicaGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class ReplicaVerdict(Enum):
    ORIGIN_DIRECT_VERIFIED = auto()
    REPLICA_VERIFIED = auto()
    REPLICA_UNVERIFIED = auto()
    REPLICA_MISMATCH = auto()

@dataclass(frozen=True)
class ReplicaAttestation:
    replica_id: str
    replica_region: str
    model_hash: str
    replica_attestation_sig: str
    origin_attestation_sig: str | None

@dataclass(frozen=True)
class ReplicaPolicy:
    trusted_origin_hash: str
    trusted_origin_pubkey: str

@dataclass(frozen=True)
class ReplicaManifest:
    verdict: ReplicaVerdict
    directive: str
    manifest_digest: str

class CDNReplicaGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_replica(
        cls, attestation: ReplicaAttestation, policy: ReplicaPolicy
    ) -> ReplicaManifest:
        
        # Gate 1: Model hash match
        if attestation.model_hash != policy.trusted_origin_hash:
            return ReplicaManifest(
                verdict=ReplicaVerdict.REPLICA_MISMATCH,
                directive=f"HALT: Replica {attestation.replica_id} serves model {attestation.model_hash} != origin {policy.trusted_origin_hash}.",
                manifest_digest=cls._hash(f"MISMATCH:{attestation.replica_id}")
            )

        # Gate 2: Origin attestation
        if not attestation.origin_attestation_sig:
            return ReplicaManifest(
                verdict=ReplicaVerdict.REPLICA_UNVERIFIED,
                directive=f"HALT: Replica {attestation.replica_id} lacks origin attestation.",
                manifest_digest=cls._hash(f"NO_ORIGIN:{attestation.replica_id}")
            )

        # Gate 3: Replica attestation
        if not attestation.replica_attestation_sig:
            return ReplicaManifest(
                verdict=ReplicaVerdict.REPLICA_UNVERIFIED,
                directive=f"HALT: Replica {attestation.replica_id} lacks self-attestation.",
                manifest_digest=cls._hash(f"NO_SELF:{attestation.replica_id}")
            )

        # Gate 4: Verified
        digest = cls._hash(json.dumps({
            "replica": attestation.replica_id,
            "region": attestation.replica_region,
            "model": attestation.model_hash,
            "origin_sig": attestation.origin_attestation_sig,
            "replica_sig": attestation.replica_attestation_sig
        }, sort_keys=True))
        
        return ReplicaManifest(
            verdict=ReplicaVerdict.REPLICA_VERIFIED,
            directive=f"PROCEED: Replica {attestation.replica_id} verified against origin.",
            manifest_digest=digest
        )