# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/what-structural-signals-indicate-prompt-injection-taint-has-silently-laundered-through-a-summarization-tool-boundary.md
# Remnant Warrant:    https://corpusfetch.com/c/what-structural-signals-indicate-prompt-injection-taint-has-silently-laundered-through-a-summarization-tool-boundary.warrant.json
# Markdown SHA-256:   3e6d81faafa97984bfe8e07587b4f9b7552412b4a1651619587c2a2a4c44d340
# Code AST SHA-256:   a485e74237f066dfd8cbb5210456080fbb3ffc7769c45497aa7fe39cbd315dd6
# Verified Classes:   Trust, TaintLaunderingError, Labeled
# Defensive Guards:   5 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import IntEnum


class Trust(IntEnum):
    UNTRUSTED_LOW = 0
    UNTRUSTED_HIGH = 1
    TRUSTED = 2


class TaintLaunderingError(RuntimeError):
    """Raised when a tool boundary would lower a taint label without a witness."""
    pass


@dataclass(frozen=True)
class Labeled:
    value: str
    label: Trust


def join(labels: list[Trust]) -> Trust:
    if not labels:
        return Trust.UNTRUSTED_LOW
    return Trust(max(int(x) for x in labels))


def apply_tool(
    tool_name: str,
    inputs: list[Labeled],
    output_value: str,
    declared_output: Trust,
    witness: str | None,
) -> Labeled:
    joined = join([i.label for i in inputs])

    # Declared trust higher than inputs: privilege escalation declaration.
    if declared_output > joined:
        raise TaintLaunderingError(
            f"tool {tool_name!r} declares output {declared_output.name} "
            f"but inputs join to {joined.name}; refusing privilege escalation"
        )

    # Declared trust lower than inputs requires a verifiable transform witness.
    if declared_output < joined and witness is None:
        raise TaintLaunderingError(
            f"tool {tool_name!r} would lower taint {joined.name} -> "
            f"{declared_output.name} with no transform witness; "
            f"assuming laundering channel"
        )

    # Witness present: verify substring preservation for extractors.
    if witness == "substring":
        for i in inputs:
            if i.label >= joined and output_value and output_value not in i.value:
                raise TaintLaunderingError(
                    f"tool {tool_name!r} claims substring witness but output "
                    f"is not contained in a source at label {i.label.name}"
                )

    return Labeled(output_value, declared_output)


def write_memory(slot: str, value: Labeled, store: dict[str, Labeled]) -> None:
    if value.label < Trust.TRUSTED:
        raise TaintLaunderingError(
            f"refusing to write {value.label.name} value to memory slot {slot!r}"
        )
    store[slot] = value


def read_memory(slot: str, store: dict[str, Labeled]) -> Labeled:
    if slot not in store:
        raise TaintLaunderingError(f"memory slot {slot!r} unset")
    return store[slot]