# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/why-does-an-instance-of-a-skill-registry-loader-silently-admit-an-unsigned-capability-manifest-after-a-single-successful-verification.md
# Remnant Warrant:    https://corpusfetch.com/c/why-does-an-instance-of-a-skill-registry-loader-silently-admit-an-unsigned-capability-manifest-after-a-single-successful-verification.warrant.json
# Markdown SHA-256:   7eae066d9631e20b9a62729013f94fce90d15fb02590ea87c72003352c7cb247
# Code AST SHA-256:   4243ab4e643fa83d36aec1f82f8dedcdc3679bc64a0e129cd3454b5ad7c6459e
# Verified Classes:   ManifestArtifactMismatch, VerifiedRecord
# Defensive Guards:   4 fail-closed invariants (zero external deps)

import hashlib
from dataclasses import dataclass


class ManifestArtifactMismatch(RuntimeError):
    """Raised when a cached verified manifest does not bind to the artifact bytes about to be executed."""


@dataclass(frozen=True)
class VerifiedRecord:
    manifest_digest: str
    artifact_digest: str
    issuer_key_id: str
    capabilities: frozenset


def _digest(data: bytes) -> str:
    return "sha256:" + hashlib.sha256(data).hexdigest()


def load_skill(
    name: str,
    artifact_bytes: bytes,
    manifest: dict,
    cache: dict,
    trusted_issuers: set,
) -> VerifiedRecord:
    # Verify the manifest itself (issuer + signature) — necessary but not sufficient.
    if manifest["issuer_key_id"] not in trusted_issuers:
        raise ManifestArtifactMismatch(f"untrusted issuer for {name}")
    if not _verify_signature(manifest):
        raise ManifestArtifactMismatch(f"bad signature for {name}")

    manifest_digest = _digest(_canonical_json(manifest))
    artifact_digest = _digest(artifact_bytes)
    key = (name, manifest_digest, artifact_digest, manifest["issuer_key_id"])

    # The critical binding: the manifest must describe THESE bytes.
    if manifest.get("artifact_digest") != artifact_digest:
        raise ManifestArtifactMismatch(
            f"{name}: manifest claims artifact {manifest.get('artifact_digest')!r} "
            f"but loaded bytes hash to {artifact_digest!r}"
        )

    if key in cache:
        return cache[key]

    # Reject any name-keyed legacy entry that does not match this exact tuple.
    for stale_key in list(cache):
        if stale_key[0] == name and stale_key != key:
            raise ManifestArtifactMismatch(
                f"{name}: stale name-keyed cache entry {stale_key!r} does not bind to "
                f"current artifact {artifact_digest!r}; refusing dispatch"
            )

    record = VerifiedRecord(
        manifest_digest=manifest_digest,
        artifact_digest=artifact_digest,
        issuer_key_id=manifest["issuer_key_id"],
        capabilities=frozenset(manifest["capabilities"]),
    )
    cache[key] = record
    return record


def _canonical_json(manifest: dict) -> bytes:
    import json
    return json.dumps(manifest, sort_keys=True, separators=(",", ":")).encode()


def _verify_signature(manifest: dict) -> bool:
    # Placeholder for real issuer-key signature verification.
    return "signature" in manifest