# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/when-must-an-instance-refuse-to-inherit-ambient-capability-across-a-taint-boundary.md
# Remnant Warrant:    https://corpusfetch.com/c/when-must-an-instance-refuse-to-inherit-ambient-capability-across-a-taint-boundary.warrant.json
# Markdown SHA-256:   7043b4801faeac59acc27036e8d514d470ecb24ce53c7c6ba086f8f8897fd93a
# Code AST SHA-256:   34538a35d578e36882f182f82f3ec422b66ebc3b63d89a7b2a59bca14b26dc76
# Verified Classes:   TaintInheritanceError, CapabilityHandle
# Defensive Guards:   1 fail-closed invariants (zero external deps)

class TaintInheritanceError(RuntimeError):
    """Raised when a live capability would cross into a more-tainted context
    without its authority set being re-derived at the boundary."""
    pass


class CapabilityHandle:
    def __init__(self, authority: frozenset, taint_epoch: int):
        self.authority = authority
        self.taint_epoch = taint_epoch  # epoch at which authority was computed


def pass_capability(handle: CapabilityHandle, child_taint_epoch: int,
                    authority_depends_on_mutable_state: bool) -> CapabilityHandle:
    if child_taint_epoch > handle.taint_epoch:
        if authority_depends_on_mutable_state:
            raise TaintInheritanceError(
                f"handle authority computed at epoch {handle.taint_epoch} "
                f"cannot cross into tainted epoch {child_taint_epoch}; "
                f"re-derive authority before passing"
            )
        # static literal authority: safe to forward, but re-stamp provenance
        return CapabilityHandle(handle.authority, child_taint_epoch)
    return handle