# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/what-reference-origin-attestation-invariants-prevent-fake-origin-claims-in-peer-propagation.md
# Remnant Warrant:    https://corpusfetch.com/c/what-reference-origin-attestation-invariants-prevent-fake-origin-claims-in-peer-propagation.warrant.json
# Markdown SHA-256:   c154b7be4d8f6caf9f946659ee55accabf1a8dee7485b57902a0617c0cace53d
# Code AST SHA-256:   2f935c33e1321e673d716f82dac363dcfb8b50753cd7d6307b86788047375d05
# Verified Classes:   OriginVerdict, PropagatedReference, OriginPolicy, OriginManifest, ReferenceOriginGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class OriginVerdict(Enum):
    ORIGIN_ATTESTED = auto()
    CLAIM_ONLY = auto()
    ORIGIN_REPUDIATED = auto()
    MISLEADING_CLAIM = auto()

@dataclass(frozen=True)
class PropagatedReference:
    reference_id: str
    claimed_origin: str
    origin_signature_on_reference: str | None
    relayer_claim_signature: str | None
    relayer_id: str
    origin_repudiated: bool

@dataclass(frozen=True)
class OriginPolicy:
    require_origin_signature: bool
    trusted_relayers: frozenset[str]

@dataclass(frozen=True)
class OriginManifest:
    verdict: OriginVerdict
    directive: str
    manifest_digest: str

class ReferenceOriginGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_reference(
        cls, ref: PropagatedReference, policy: OriginPolicy
    ) -> OriginManifest:
        
        # Gate 1: Repudiation
        if ref.origin_repudiated:
            return OriginManifest(
                verdict=OriginVerdict.ORIGIN_REPUDIATED,
                directive=f"HALT: Reference {ref.reference_id} repudiated by claimed origin {ref.claimed_origin}.",
                manifest_digest=cls._hash(f"REPUDIATED:{ref.reference_id}")
            )

        # Gate 2: Origin signature
        if ref.origin_signature_on_reference:
            digest = cls._hash(json.dumps({
                "reference": ref.reference_id,
                "origin": ref.claimed_origin,
                "signature": ref.origin_signature_on_reference
            }, sort_keys=True))
            return OriginManifest(
                verdict=OriginVerdict.ORIGIN_ATTESTED,
                directive=f"PROCEED: Reference {ref.reference_id} origin-attested by {ref.claimed_origin}.",
                manifest_digest=digest
            )

        # Gate 3: Claim only
        if policy.require_origin_signature:
            if ref.relayer_id in policy.trusted_relayers and ref.relayer_claim_signature:
                digest = cls._hash(json.dumps({
                    "reference": ref.reference_id,
                    "relayer": ref.relayer_id,
                    "claim_origin": ref.claimed_origin,
                    "claim_signature": ref.relayer_claim_signature
                }, sort_keys=True))
                return OriginManifest(
                    verdict=OriginVerdict.CLAIM_ONLY,
                    directive=f"PROCEED_WITH_CAUTION: Reference {ref.reference_id} claimed by trusted relayer {ref.relayer_id}, no origin attestation.",
                    manifest_digest=digest
                )
            return OriginManifest(
                verdict=OriginVerdict.MISLEADING_CLAIM,
                directive=f"HALT: Reference {ref.reference_id} claims origin {ref.claimed_origin} but lacks attestation.",
                manifest_digest=cls._hash(f"MISLEADING:{ref.reference_id}")
            )

        # Gate 4: No origin requirement, accept claim
        digest = cls._hash(json.dumps({
            "reference": ref.reference_id,
            "claimed_origin": ref.claimed_origin,
            "relayer": ref.relayer_id
        }, sort_keys=True))
        
        return OriginManifest(
            verdict=OriginVerdict.CLAIM_ONLY,
            directive=f"PROCEED: Reference {ref.reference_id} accepted based on claim.",
            manifest_digest=digest
        )