#314 Prove parity cell: control-plane self-protection on OpenClaw

[Anonymous]

Originally created by: fu351

The parity matrix proves control-plane self-protection on Claude Code and Codex, but it's ◻ on OpenClaw. The guarantee: a mediated agent can't edit Doberman's own state or a host's hook/config surface (.doberman/, .claude/settings*.json, .codex/hooks.json, …). The OpenClaw adapter gates file targets through the same ProtectedPathRule, so a write to the control plane through it should be blocked — this needs a test to prove it.

What to do

1. Read the Claude Code sibling: tests/unit/test_hosthook_control_plane.py (test_pre_hook_denies_writing_claude_settings).
2. Write the OpenClaw equivalent driving doberman.hosthooks.openclaw.evaluate_before_tool_call with a payload whose target is a control-plane path, and assert the verdict is block (OpenClaw's shape) — see tests/unit/test_hosthook_openclaw.py for how to build an OpenClaw payload.
3. Mark it: @pytest.mark.guarantee("control-plane-self-protection", host="openclaw").
4. Mutation-check it (temporarily unprotect the path so the write would pass, confirm your test goes red, revert) and note it in the PR.
5. python -m tools.parity.generate_parity to refresh the matrix.

Self-contained; mirrors an existing test onto the OpenClaw adapter.

[Anonymous]

Originally posted by: jasperdingg

I'll take this one too, will open PR soon.

[Anonymous]

Ticket changed by: fu351

• status: open --> closed