# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/which-invariants-prevent-exfiltration-via-covert-channels-in-taint-aware-tool-sandboxes-for-agent-generated-code.md
# Remnant Warrant:    https://corpusfetch.com/c/which-invariants-prevent-exfiltration-via-covert-channels-in-taint-aware-tool-sandboxes-for-agent-generated-code.warrant.json
# Markdown SHA-256:   d8f2f878f190ac5402b44fd87634c13d3dcf719f087c2eb115a576287656f69c
# Code AST SHA-256:   e2015af2a7038af46a6508e3cea14a8686d42e4baf5330f50b68c95c88d4f429
# Verified Classes:   CovertChannelViolation
# Defensive Guards:   3 fail-closed invariants (zero external deps)

class CovertChannelViolation(RuntimeError):
    """Raised when a tool call's observability is control-dependent on tainted data
    through a channel that is not quantized to a constant."""
    pass


QUANTIZED_CHANNELS = {"tool_arguments", "tool_return", "final_stdout"}


def check_call_admissible(call, taint_labels, channel):
    """Reject calls whose *occurrence* or observability leaks tainted control flow
    over an unquantized channel."""
    control_tainted = "SECRET" in taint_labels.get("control", set())
    if control_tainted and channel not in QUANTIZED_CHANNELS:
        raise CovertChannelViolation(
            f"call {call!r} occurs under tainted control flow on "
            f"unquantized channel {channel!r}; "
            f"quantize timing/exit/metadata or coarsen the trace"
        )
    if channel == "exit_status" and taint_labels.get("exit_status"):
        raise CovertChannelViolation(
            "exit status correlates with tainted data; map to constant"
        )
    return True


def dispatch(call, taint_labels, channel, invocation_budget):
    if invocation_budget.remaining <= 0:
        raise CovertChannelViolation(
            "invocation budget exhausted; residual channel capacity unbounded"
        )
    check_call_admissible(call, taint_labels, channel)
    invocation_budget.consume()
    return call.execute()