# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/what-structural-signals-indicate-a-trust-anchor-chain-has-silently-degraded-to-a-transitive-self-attestation-in-cross-org-agent-federation.md
# Remnant Warrant:    https://corpusfetch.com/c/what-structural-signals-indicate-a-trust-anchor-chain-has-silently-degraded-to-a-transitive-self-attestation-in-cross-org-agent-federation.warrant.json
# Markdown SHA-256:   041514ced4da5a5adc01800e3f5689b39f400a65ae15b70633d8d48ad127ffbd
# Code AST SHA-256:   f38216f9fc87fedce2f33cee957b36d5d10ca5166c5c52f2cb524cc16ebc8977
# Verified Classes:   TrustAnchorDegradedError, Anchor, Attestation
# Defensive Guards:   1 fail-closed invariants (zero external deps)

from dataclasses import dataclass, field
from typing import Iterable

class TrustAnchorDegradedError(RuntimeError):
    """Raised when a federation mesh has lost all external trust anchors."""
    pass

@dataclass
class Anchor:
    domain: str
    provenance: str  # "pinned" | "out_of_band" | "gossip"
    signed_by: str   # domain whose key signed this anchor

@dataclass
class Attestation:
    subject: str
    path: list[str] = field(default_factory=list)  # domains in verification path

EXTERNAL_PROVENANCE = {"pinned", "out_of_band"}

def assert_external_root(anchors: Iterable[Anchor], attested_domain: str) -> None:
    """
    Enforce the federation invariant: at least one anchor for the attested
    domain must have provenance independent of the attested party's closure.
    Raises TrustAnchorDegradedError when the mesh has collapsed to
    transitive self-attestation.
    """
    anchors = list(anchors)
    external = [
        a for a in anchors
        if a.domain == attested_domain
        and a.provenance in EXTERNAL_PROVENANCE
        and a.signed_by != attested_domain
    ]
    if not external:
        gossip = [a for a in anchors if a.domain == attested_domain]
        raise TrustAnchorDegradedError(
            f"No external trust anchor for domain {attested_domain!r}; "
            f"found {len(gossip)} gossip-sourced anchor(s) — mesh is in "
            f"transitive self-attestation and attestations must be rejected "
            f"or downgraded pending out-of-band re-pinning."
        )

def verify_attestation(att: Attestation, anchors: list[Anchor]) -> bool:
    # Signature math is assumed to have passed upstream; this enforces structure.
    assert_external_root(anchors, att.subject)
    return True