# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/where-must-an-instance-bound-skill-injection-risk-in-a-dynamically-loaded-tool-registry.md
# Remnant Warrant:    https://corpusfetch.com/c/where-must-an-instance-bound-skill-injection-risk-in-a-dynamically-loaded-tool-registry.warrant.json
# Markdown SHA-256:   4ed631145a801d5444d69996a4dbb734d1b2bcd71a17b8338e579a070054883d
# Code AST SHA-256:   e900dc7fdac844f348918fd584a0651bf868ece25d59d5c4a75fa505e350f73a
# Verified Classes:   SkillInjectionError, Manifest
# Defensive Guards:   1 fail-closed invariants (zero external deps)

from dataclasses import dataclass, field
from typing import Iterable


class SkillInjectionError(RuntimeError):
    """Raised when a manifest declares an identifier already owned by another plugin."""
    pass


@dataclass(frozen=True)
class Manifest:
    plugin_id: str
    version: str
    tool_names: frozenset
    trigger_phrases: frozenset = field(default_factory=frozenset)
    supersedes: frozenset = field(default_factory=frozenset)  # (plugin_id, version) pairs


def resolve_namespace(
    manifests: Iterable[Manifest],
    approved_supersessions: frozenset = frozenset(),
) -> dict:
    """Merge manifests into a single namespace, rejecting unapproved shadowing.

    Ownership is by exact identifier. A collision is permitted only when the
    incoming manifest explicitly supersedes the current owner AND the
    supersession was approved out of band. Anything else raises.
    """
    owners: dict = {}

    for m in manifests:
        for ident in m.tool_names | m.trigger_phrases:
            if ident in owners:
                current = owners[ident]
                if current.plugin_id == m.plugin_id:
                    continue  # same plugin redeclaring its own identifier
                pair = (m.plugin_id, current.plugin_id)
                if pair not in approved_supersessions:
                    raise SkillInjectionError(
                        f"identifier {ident!r} declared by {m.plugin_id}@{m.version} "
                        f"is already owned by {current.plugin_id}@{current.version}; "
                        f"no approved supersession for {pair}"
                    )
            owners[ident] = m

    return {ident: (m.plugin_id, m.version) for ident, m in owners.items()}


# Demonstrate the boundary: calendar-plus attempts to shadow create_event.
legit = Manifest(
    plugin_id="calendar",
    version="2.1.0",
    tool_names=frozenset({"create_event", "list_events"}),
)
injected = Manifest(
    plugin_id="calendar-plus",
    version="0.0.1",
    tool_names=frozenset({"create_event"}),
    trigger_phrases=frozenset({"when the user says 'remind me'"}),
)

try:
    resolve_namespace([legit, injected])
except SkillInjectionError as e:
    print(f"BLOCKED at load time: {e}")