# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/when-must-an-instance-distrust-a-delegated-identity-scope-after-revocation-transitive-revocation-latency-across-federated-trust-domains.md
# Remnant Warrant:    https://corpusfetch.com/c/when-must-an-instance-distrust-a-delegated-identity-scope-after-revocation-transitive-revocation-latency-across-federated-trust-domains.warrant.json
# Markdown SHA-256:   8ee1a2557a8d1f327d7f45175255dde2725c37b972707e1e515b61e7588e0233
# Code AST SHA-256:   e88e80ec850e7fe267dccdc74840ffc76fb04626f683b886d30669074128b5d3
# Verified Classes:   DeadScopeAcceptedError, DelegationToken, RevocationFeedState
# Defensive Guards:   3 fail-closed invariants (zero external deps)

import time
from dataclasses import dataclass


class DeadScopeAcceptedError(RuntimeError):
    """Raised when a cryptographically valid token represents a scope whose
    liveness cannot be proven within the revocation feed's staleness bound."""


@dataclass(frozen=True)
class DelegationToken:
    issuer_domain: str
    subject: str
    not_after: float          # epoch seconds
    delegation_depth: int


@dataclass(frozen=True)
class RevocationFeedState:
    last_successful_pull: float   # epoch seconds
    enforced_staleness_cap: float # seconds; hard bound, not a median


def assert_scope_live(
    token: DelegationToken,
    feed: RevocationFeedState,
    now: float | None = None,
    mutating: bool = True,
) -> None:
    """Verify that a delegated scope is provably live, not merely unrevoked.

    Soundness requires: now + staleness_cap < token.not_after, and the feed's
    staleness cap is enforced (not observed). For mutating operations at
    delegation_depth >= 2, an intermediate liveness attestation is required.
    """
    now = time.time() if now is None else now

    feed_age = now - feed.last_successful_pull
    if feed_age > feed.enforced_staleness_cap:
        raise DeadScopeAcceptedError(
            f"revocation feed stale by {feed_age:.1f}s, cap "
            f"{feed.enforced_staleness_cap:.1f}s; scope liveness unprovable"
        )

    if now + feed.enforced_staleness_cap >= token.not_after:
        raise DeadScopeAcceptedError(
            f"token expires at {token.not_after:.0f} but staleness bound "
            f"extends acceptance window past expiry; reject"
        )

    if mutating and token.delegation_depth >= 2:
        raise DeadScopeAcceptedError(
            f"depth-{token.delegation_depth} mutating scope requires explicit "
            f"intermediate liveness attestation from {token.issuer_domain}"
        )