#406 Prove parity cell: control-plane self-protection on the MCP proxy

[Anonymous]

Originally created by: fu351

The parity matrix shows "The agent cannot edit Doberman's own config or hooks" proven on Claude Code, Codex, and OpenClaw — but ◻ (not yet proven) on the MCP proxy. The guarantee: a mediated write or delete targeting .doberman/ (policy, decision log, taint state) or the host-hook config is blocked before it reaches any tool. The proxy runs the same rules, so the cell is real and mirror-able — it just needs a test.

What to do

1. Read the siblings: tests/unit/test_rule_paths_codex_control_plane.py shows the rule-level shape, and tests/integration/test_engine_blocks_reach_no_tool.py shows the proxy-side harness (it already proves two other cells on this host, including that a BLOCK means the fake downstream server recorded nothing).
2. Write the proxy equivalent: drive the engine path with a write/delete aimed at .doberman/policies.yaml, assert BLOCK, and assert no tool call reached the fake downstream.
3. Mark the test so it claims the cell:
   python @pytest.mark.guarantee("control-plane-self-protection", host="mcp-proxy")
4. Mutation-check it (the bar for a ✅, not just a green test): temporarily disable the control-plane path rule, confirm your test goes red, revert. Note "mutation-checked" in the PR.
5. Regenerate the matrix: python -m tools.parity.generate_parity (CI's --check fails if you skip this).

The cell flips to ✅ automatically once the marked test is collected. Three sibling hosts already show exactly what the test should look like — this is the best-templated open cell in the matrix.