# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/where-must-an-instance-boundary-be-drawn-when-aaif-tokens-cross-a-federated-trust-domain-that-re-issues-rather-than-forwards.md
# Remnant Warrant:    https://corpusfetch.com/c/where-must-an-instance-boundary-be-drawn-when-aaif-tokens-cross-a-federated-trust-domain-that-re-issues-rather-than-forwards.warrant.json
# Markdown SHA-256:   e83f1e20092b47e548d0cf9c0e6fa9358156e83552361a103d2a362e3f61f6db
# Code AST SHA-256:   1705926b0d70cab71fe5277bbb4eee004874c07c8d01db9887c2e344194a4b5b
# Verified Classes:   FederatedAttestationError
# Defensive Guards:   7 fail-closed invariants (zero external deps)

class FederatedAttestationError(RuntimeError):
    """Raised when a re-issued AAIF token cannot be resolved to a live originator instance."""
    pass


def validate_federated_aaif(token: dict, verifier_trust: dict, resolve_instance) -> dict:
    iss = token.get("iss")
    sub = token.get("sub")
    sub_domain = sub.split("@")[-1] if sub else None
    iss_domain = iss.split("//")[-1].split("/")[0] if iss else None

    if not iss or not sub or not sub_domain:
        raise FederatedAttestationError("token missing iss/sub; cannot establish instance boundary")

    # Self-claim path: issuer owns the subject domain.
    if iss_domain == sub_domain:
        instance_id = token.get("instance_id")
        if not instance_id:
            raise FederatedAttestationError(
                f"self-claim token for {sub} lacks instance_id; cannot bind to live instance"
            )
        if not resolve_instance(sub_domain, instance_id):
            raise FederatedAttestationError(
                f"instance {instance_id} for {sub} is not live in {sub_domain}"
            )
        return {"mode": "self", "assurance": token.get("attestation_level")}

    # Third-party claim path: issuer does not own the subject domain.
    delegation = token.get("delegated_attestation")
    if not delegation or delegation.get("delegate") != iss:
        raise FederatedAttestationError(
            f"issuer {iss} makes identity claim about {sub} without delegated_attestation"
        )

    trust_key = (iss_domain, sub_domain)
    if trust_key not in verifier_trust:
        raise FederatedAttestationError(
            f"no trust entry for {iss_domain} asserting identity of {sub_domain}; "
            "trusting an issuer to authenticate its own agents is not the same as "
            "trusting it to assert another domain's agents"
        )

    issuer_level = token.get("attestation_level", "none")
    subject_level = verifier_trust[trust_key].get("max_assurance", "none")
    effective = min(issuer_level, subject_level, key=_assurance_rank)

    instance_id = token.get("instance_id")
    if not instance_id:
        raise FederatedAttestationError(
            f"re-issued token for {sub} lacks originator instance_id; "
            "cannot verify instance liveness across re-issuance"
        )
    if not resolve_instance(sub_domain, instance_id):
        raise FederatedAttestationError(
            f"originator instance {instance_id} of {sub} is not live; "
            "re-issuer cannot keep a decommissioned instance attested"
        )

    return {"mode": "delegated", "assurance": effective, "delegated_by": iss}


def _assurance_rank(level: str) -> int:
    return {"none": 0, "software-key": 1, "hardware-bound": 2}.get(level, 0)