# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/why-does-an-instance-of-federated-agent-identity-revocation-fail-to-propagate-across-a-cross-org-trust-domain-boundary-when-the-revocation-is-signed-b.md
# Remnant Warrant:    https://corpusfetch.com/c/why-does-an-instance-of-federated-agent-identity-revocation-fail-to-propagate-across-a-cross-org-trust-domain-boundary-when-the-revocation-is-signed-b.warrant.json
# Markdown SHA-256:   b4f9f82438ab8f0d53ce6e820368bb785f2e09890dd02609e946fde6c594e935
# Code AST SHA-256:   6b1a77490215365bb4c0c049d4ceaf937626fc162efd9f98af3f75e76ba6e479
# Verified Classes:   RevocationProvenanceError, TrustInterval, RevocationArtifact
# Defensive Guards:   2 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from typing import Optional

class RevocationProvenanceError(RuntimeError):
    """Raised when a revocation artifact's provenance cannot be resolved
    against the historical trust anchor set for its issuance interval."""
    pass

@dataclass
class TrustInterval:
    intermediate_id: str
    valid_from: float
    valid_to: float  # inclusive of retained-verification grace period
    retained_until: float  # GC boundary; must exceed drain completion

@dataclass
class RevocationArtifact:
    artifact_id: str
    issuer_intermediate: str
    signed_at: float
    subject_agent: str

def resolve_provenance(
    artifact: RevocationArtifact,
    intervals: list[TrustInterval],
    now: float,
) -> TrustInterval:
    # Provenance is resolved against the interval containing signed_at,
    # NOT against the current trust anchor set.
    for iv in intervals:
        if iv.intermediate_id != artifact.issuer_intermediate:
            continue
        if iv.valid_from <= artifact.signed_at <= iv.valid_to:
            if now > iv.retained_until:
                # Past the retention horizon: quarantine, do not discard.
                raise RevocationProvenanceError(
                    f"artifact {artifact.artifact_id} signed by "
                    f"{artifact.issuer_intermediate} at {artifact.signed_at} "
                    f"is past retained-verification horizon {iv.retained_until}; "
                    f"quarantine for manual reconciliation"
                )
            return iv
    raise RevocationProvenanceError(
        f"no trust interval for intermediate {artifact.issuer_intermediate} "
        f"covers artifact {artifact.artifact_id} signed at {artifact.signed_at}; "
        f"cannot establish historical provenance"
    )

def apply_revocation(
    artifact: RevocationArtifact,
    intervals: list[TrustInterval],
    credential_store: dict,
    now: float,
) -> None:
    iv = resolve_provenance(artifact, intervals, now)  # may raise
    credential_store[artifact.subject_agent] = "REVOKED"