# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/why-must-a-session-identity-be-cryptographically-bound-to-its-execution-environment.md
# Remnant Warrant:    https://corpusfetch.com/c/why-must-a-session-identity-be-cryptographically-bound-to-its-execution-environment.warrant.json
# Markdown SHA-256:   622d394377dd3b51f6b58e75091cec1bee6faefd66f763fd3c78e4d29c45e44b
# Code AST SHA-256:   0328df83b80bc18475f1c680c558697e5e4fcb644f4ee23f3aaa6111c47901fe
# Verified Classes:   BindingVerdict, SessionToken, ExecutionEnvironment, BindingPolicy, BindingManifest, SessionEnvironmentBindingGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class BindingVerdict(Enum):
    ENVIRONMENT_BOUND_VERIFIED = auto()
    ENVIRONMENT_MISMATCH = auto()
    NO_BINDING_PRESENT = auto()
    ENVIRONMENT_DRIFT_DETECTED = auto()

@dataclass(frozen=True)
class SessionToken:
    token_id: str
    issued_environment_fingerprint: str
    binding_signature: str | None
    token_expiry_epoch: float

@dataclass(frozen=True)
class ExecutionEnvironment:
    current_environment_fingerprint: str
    current_epoch: float

@dataclass(frozen=True)
class BindingPolicy:
    require_binding: bool
    allow_drift_reissue: bool

@dataclass(frozen=True)
class BindingManifest:
    verdict: BindingVerdict
    directive: str
    manifest_digest: str

class SessionEnvironmentBindingGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_token(
        cls, token: SessionToken, env: ExecutionEnvironment, policy: BindingPolicy
    ) -> BindingManifest:
        
        # Gate 1: Token expiry
        if token.token_expiry_epoch < env.current_epoch:
            return BindingManifest(
                verdict=BindingVerdict.ENVIRONMENT_DRIFT_DETECTED,
                directive=f"HALT: Token expired at {token.token_expiry_epoch:.0f}.",
                manifest_digest=cls._hash(f"EXPIRED:{token.token_id}")
            )

        # Gate 2: Binding requirement
        if not token.binding_signature:
            if policy.require_binding:
                return BindingManifest(
                    verdict=BindingVerdict.NO_BINDING_PRESENT,
                    directive=f"HALT: Token {token.token_id} has no environment binding. Replayable.",
                    manifest_digest=cls._hash(f"NO_BINDING:{token.token_id}")
                )
            digest = cls._hash(json.dumps({
                "token": token.token_id,
                "binding": "NONE",
                "policy": "LENIENT"
            }, sort_keys=True))
            return BindingManifest(
                verdict=BindingVerdict.NO_BINDING_PRESENT,
                directive="WARN: No binding, policy allows. Replay risk accepted.",
                manifest_digest=digest
            )

        # Gate 3: Environment match
        if token.issued_environment_fingerprint != env.current_environment_fingerprint:
            return BindingManifest(
                verdict=BindingVerdict.ENVIRONMENT_MISMATCH,
                directive=f"HALT: Token issued for env {token.issued_environment_fingerprint}, current {env.current_environment_fingerprint}.",
                manifest_digest=cls._hash(f"ENV_MISMATCH:{token.token_id}")
            )

        # Gate 4: Verified
        digest = cls._hash(json.dumps({
            "token": token.token_id,
            "environment": env.current_environment_fingerprint,
            "binding": token.binding_signature
        }, sort_keys=True))
        
        return BindingManifest(
            verdict=BindingVerdict.ENVIRONMENT_BOUND_VERIFIED,
            directive=f"PROCEED: Token {token.token_id} bound to current environment.",
            manifest_digest=digest
        )