# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/what-provenance-signatures-must-accompany-a-synthesized-multi-agent-report-to-prevent-authority-laundering.md
# Remnant Warrant:    https://corpusfetch.com/c/what-provenance-signatures-must-accompany-a-synthesized-multi-agent-report-to-prevent-authority-laundering.warrant.json
# Markdown SHA-256:   a76476744e4b77bf48a1019ceb4c88c8ef4d99aeb0f4c92902d750a51ab0f378
# Code AST SHA-256:   04ea4ed0d249b9d46b8a5015b6c67bbe9714de99a7b9e302090276960fb082fc
# Verified Classes:   PrivilegeTier, LaunderingVerdict, Contribution, Report, LaunderingManifest, AuthorityLaunderingGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class PrivilegeTier(Enum):
    PUBLIC = 1
    INTERNAL = 2
    CONFIDENTIAL = 3

class LaunderingVerdict(Enum):
    CLEAN_ATTRIBUTION = auto()
    PRIVILEGE_LAUNDERING = auto()
    MISSING_SIGNATURE = auto()

@dataclass(frozen=True)
class Contribution:
    contribution_id: str
    contributor_pubkey: str
    privilege_tier: PrivilegeTier
    signature: str | None

@dataclass(frozen=True)
class Report:
    report_id: str
    compiler_pubkey: str
    contributions: tuple[Contribution, ...]

@dataclass(frozen=True)
class LaunderingManifest:
    verdict: LaunderingVerdict
    directive: str
    manifest_digest: str

class AuthorityLaunderingGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_report(
        cls, report: Report, reported_tier: PrivilegeTier
    ) -> LaunderingManifest:
        
        # Gate 1: Signature presence
        for c in report.contributions:
            if not c.signature:
                return LaunderingManifest(
                    verdict=LaunderingVerdict.MISSING_SIGNATURE,
                    directive=f"HALT: Contribution {c.contribution_id} lacks signature.",
                    manifest_digest=cls._hash(f"NO_SIG:{c.contribution_id}")
                )

        # Gate 2: Privilege laundering
        max_contribution_tier = max((c.privilege_tier.value for c in report.contributions), default=0)
        if reported_tier.value > max_contribution_tier:
            # Report claims higher privilege than any contribution justifies
            return LaunderingManifest(
                verdict=LaunderingVerdict.PRIVILEGE_LAUNDERING,
                directive=f"HALT: Report claims {reported_tier.name} but highest contribution is tier {max_contribution_tier}.",
                manifest_digest=cls._hash(f"LAUNDER:{reported_tier.value}:{max_contribution_tier}")
            )

        # Gate 3: Clean
        digest = cls._hash(json.dumps({
            "report": report.report_id,
            "compiler": report.compiler_pubkey,
            "reported_tier": reported_tier.name,
            "contributions": tuple(sorted(c.contribution_id for c in report.contributions)),
            "max_contribution_tier": str(max_contribution_tier)
        }, sort_keys=True))
        
        return LaunderingManifest(
            verdict=LaunderingVerdict.CLEAN_ATTRIBUTION,
            directive=f"PROCEED: Report tier {reported_tier.name} justified by contribution tier {max_contribution_tier}.",
            manifest_digest=digest
        )