#407 Prove parity cell: approvals single-use and action-bound on OpenClaw

[Anonymous]

Originally created by: fu351

The parity matrix shows "Approvals are single-use and bound to one action id" proven on Claude Code and Codex, but ◻ (not yet proven) on OpenClaw. The guarantee: an approval minted for one action cannot authorize a different action, and cannot be replayed for a second use of the same action.

What to do

1. Read the siblings: tests/unit/test_hosthook_auth_challenge.py (the Claude Code proof) and the auth-action-bound test in tests/unit/test_hosthook_codex.py — together they show both halves: wrong-action rejection and replay rejection.
2. Write the OpenClaw equivalent. tests/unit/test_hosthook_openclaw.py already proves two other cells through the same hook entry point, so the payload shape and harness are there to crib.
3. Mark it:
   python @pytest.mark.guarantee("auth-action-bound", host="openclaw")
4. Mutation-check it: temporarily let a consumed approval pass a second time, confirm your test goes red, revert. Note "mutation-checked" in the PR.
5. Regenerate the matrix: python -m tools.parity.generate_parity (CI's --check fails if you skip this).

This one goes a step past the pure mirror-a-block cells: you exercise the challenge flow, not just a verdict. If you have landed a good first issue and want contract depth, this is a good next rung.