# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/why-does-an-instance-taint-tracking-survive-a-single-session-but-silently-lose-poisoning-protection-across-session-boundaries.md
# Remnant Warrant:    https://corpusfetch.com/c/why-does-an-instance-taint-tracking-survive-a-single-session-but-silently-lose-poisoning-protection-across-session-boundaries.warrant.json
# Markdown SHA-256:   13d3d4899723339863a0acb884961cdd4160dad0badc322ab3b124a62e4e1fde
# Code AST SHA-256:   bf7d0e76a0d3dbb45bf7340f56f790fc10426dd7a8b92a6c5eb6f37bcf4ea4a8
# Verified Classes:   Trust, TaintLaunderingError, Artifact
# Defensive Guards:   3 fail-closed invariants (zero external deps)

from dataclasses import dataclass, field
from enum import IntEnum
from typing import FrozenSet


class Trust(IntEnum):
    TRUSTED = 0
    UNTRUSTED = 1  # lattice join is max


class TaintLaunderingError(RuntimeError):
    """Raised when a persisted artifact would be labeled more trusted than its inputs."""
    pass


@dataclass(frozen=True)
class Artifact:
    payload: str
    provenance: FrozenSet[str] = field(default_factory=frozenset)
    trust: Trust = Trust.UNTRUSTED  # untrusted default on load


def join_trust(inputs: list[Artifact]) -> Trust:
    if not inputs:
        return Trust.UNTRUSTED  # empty input set is not evidence of trust
    return Trust(max(a.trust for a in inputs))


def persist_summary(inputs: list[Artifact], summary_text: str,
                    claimed_trust: Trust) -> Artifact:
    """Write path. Must never label output more trusted than the join of inputs."""
    derived = join_trust(inputs)
    if claimed_trust < derived:
        # The summarizer tried to promote tainted input to a trusted label.
        raise TaintLaunderingError(
            f"write claims trust={claimed_trust.name} but inputs join to "
            f"{derived.name}; declassification requires an audited out-of-band step"
        )
    return Artifact(payload=summary_text, provenance=frozenset(
        p for a in inputs for p in (a.provenance or {a.payload[:32]})
    ), trust=derived)


def load_for_session(artifact: Artifact) -> Artifact:
    """Read path. Re-establishes lattice; never upgrades on load."""
    if artifact.trust < Trust.UNTRUSTED and not artifact.provenance:
        raise TaintLaunderingError(
            "loaded artifact claims trust with no provenance chain; "
            "refusing to treat as trusted (possible seam loss)"
        )
    return artifact


def guard_privileged_sink(artifact: Artifact, sink: str) -> None:
    if artifact.trust != Trust.TRUSTED:
        raise TaintLaunderingError(
            f"refusing privileged sink {sink!r}: artifact is {artifact.trust.name} "
            f"(provenance={sorted(artifact.provenance)})"
        )