"""Shared reason-code identifiers for AuditWalk risk signals.

These constants are the single source of truth for reason-code strings used by:
- detectors
- risk policy defaults
- assessment response payloads
"""

from __future__ import annotations


# IOC / intelligence hits
IOC_HASH_KNOWN_MALICIOUS = "IOC_HASH_KNOWN_MALICIOUS"
IOC_YARA_CONFIRMED_MALWARE_FAMILY = "IOC_YARA_CONFIRMED_MALWARE_FAMILY"
IOC_FEED_HIGH_CONFIDENCE_INDICATOR = "IOC_FEED_HIGH_CONFIDENCE_INDICATOR"

# Heuristic signals
HEUR_NEW_EXEC_IN_SENSITIVE_PATH = "HEUR_NEW_EXEC_IN_SENSITIVE_PATH"
HEUR_RECENT_SUSPICIOUS_EXTENSION = "HEUR_RECENT_SUSPICIOUS_EXTENSION"
HEUR_UNEXPECTED_MODIFICATION_NEAR_WALLET = "HEUR_UNEXPECTED_MODIFICATION_NEAR_WALLET"
HEUR_PERSISTENCE_ARTIFACT_DETECTED = "HEUR_PERSISTENCE_ARTIFACT_DETECTED"

# Environment/integrity signals
ENV_BASELINE_MISSING = "ENV_BASELINE_MISSING"
ENV_THREAT_DB_STALE = "ENV_THREAT_DB_STALE"
ENV_RULE_UPDATE_FAILED_RECENTLY = "ENV_RULE_UPDATE_FAILED_RECENTLY"
ENV_SCANNER_PARTIAL_RESULTS = "ENV_SCANNER_PARTIAL_RESULTS"

# Policy signals
POLICY_HIGH_RISK_BLOCK_ENFORCED = "POLICY_HIGH_RISK_BLOCK_ENFORCED"
POLICY_MEDIUM_RISK_WARNING_REQUIRED = "POLICY_MEDIUM_RISK_WARNING_REQUIRED"


MVP_REASON_CODES = (
    IOC_HASH_KNOWN_MALICIOUS,
    HEUR_NEW_EXEC_IN_SENSITIVE_PATH,
    HEUR_RECENT_SUSPICIOUS_EXTENSION,
    HEUR_UNEXPECTED_MODIFICATION_NEAR_WALLET,
    ENV_BASELINE_MISSING,
    ENV_THREAT_DB_STALE,
    ENV_SCANNER_PARTIAL_RESULTS,
    POLICY_HIGH_RISK_BLOCK_ENFORCED,
    POLICY_MEDIUM_RISK_WARNING_REQUIRED,
)
