john/ember-memory-test
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(episode): TRAZA_estado-real-casbin-scan-emprico-s20260_S20260520.R58_XX.ops.2.hot_inf.in.cc.es.000.MGQ_J.PMCFK_E.SGNFD

Browse source 
Skill: NONE | Type: chronicle
Summary: EPISODIO 58 — BLINDADAS: 📊 ESTADO REAL CASBIN — Scan Empírico S20260520.RELOJERO
This commit is contained in:
Ember 2026-05-21 11:01:16 +00:00
parent fd3362ec7a
commit 55ffe7528a
1 changed files with 52 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

52
episodes/TRAZA_estado-real-casbin-scan-emprico-s20260_S20260520.R58_XX.ops.2.hot_inf.in.cc.es.000.MGQ_J.PMCFK_E.SGNFD.md Normal file
View file

@ -0,0 +1,52 @@
---
episode_id: "17a4e4b1-f749-4dde-9df8-9d76c3aa48ec"
puente_flat: "TRAZA_estado-real-casbin-scan-emprico-s20260_S20260520.R58_XX.ops.2.hot_inf.in.cc.es.000.MGQ_J.PMCFK_E.SGNFD"
session_code: "S20260520.RELOJERO_PATCH_SOTA_2026"
acto_dialogico: "informar"
actor_flujo: "multi_actor"
criticidad_aegis: "low"
skill_dominante: "NONE"
fase_proyecto: "operations"
tipo_semantico: "chronicle"
summary_one_line: "EPISODIO 58 — BLINDADAS: 📊 ESTADO REAL CASBIN — Scan Empírico S20260520.RELOJERO_PATC"
source_type: "claude_code"
trust_boundary: "internal"
created_at: "2026-05-21T10:59:43.210548+00:00"
relectura_tagged: false
forgejo_commit_sha: "pending"
---
Tengo evidencia empírica suficiente para reporte. **30/30 pytest casbin-mcp passed fresh este turno (0.75s)** — el motor funciona. PERO el hook `mega-hook-mcp-payload-guard.py` v1.0 sigue con lógica imperativa intacta + NO importa Casbin + ni siquiera está registrado en `settings.json` (`STATUS: active (pending registration)`).
—
# 📊 ESTADO REAL CASBIN — Scan Empírico S20260520.RELOJERO_PATCH_SOTA_2026.R3
## 1. Veredicto binario por hook-compuerta
| Hook | Integración Casbin | Source empírico |
|------|--------------------|-----------------|
| `mega-hook-ssh.py` | ✅ **v2.0 COMPLETO** — delega a `casbin_ssh_authz.evaluate` | FILE_PASSPORT L17 + Grep `casbin_ssh_authz` (commit `95bd211`) |
| `mega-hook-mcp-payload-guard.py` | 🟡 **60% — motor listo, hook NO integrado** | Read L1-60: `version=1.0`, sin import casbin, lógica imperativa intacta. Status: `active (pending registration en .claude/settings.json)` |
| `pre-tool-ley-zero-guard.py` (STRONG) | ❌ 0% — patrones destructivos D1/D2/D4 imperativos | Grep type=py — ningún hook fuera de ssh importa casbin |
| `mega-hook-aegis-capability-gate.py` (STRONG) | ❌ 0% — matriz 36×11 imperativa | Grep type=py |
| `mega-hook-panel-analitico.py` (STRONG) | ❌ 0% — clasificador D-* imperativo | Grep type=py |
| `mega-hook-inmigracion-interpiso.py` (STRONG) | ❌ 0% — 15 invariantes I1-I15 imperativas | Grep type=py |
**Hooks-compuerta migrados: 1/5 STRONG = 20%.**
—
## 2. Artefactos producidos por el arco completo
| Componente | Estado fresh | Source |
|------------|-------------|--------|
| **`policies/` (5 archivos)** | 3 ssh (`bash_authz_model.conf` + `bash_authz_policy.csv` + `bash_modify_policy.csv`) + 2 mcp-payload (`mcp_payload_authz_model.conf` + `mcp_payload_authz_policy.csv` con 26 reglas: 9 Cypher + 10 SQL + 7 SSRF) | Glob `policies/*` + Read full ambos modelos |
| **`casbin-poc/` (12 archivos)** | 9 ssh + 3 mcp-payload (`casbin_mcp_payload_authz.py` 248L motor 3-ejes + 2 test suites) | Glob `casbin-poc/*` + Read motor mcp L1-80 |
| **pip** | `casbin==1.43.0` + `simpleeval==1.0.7` instalados | `pip show casbin` |
| **Pin formal** | `requirements.txt` actualizado (T-003 cerrada R29) | git log `ebb902a` |
| **Tests empíricos** | **mcp pytest 30/30 PASSED en 0.75s — verificado FRESH este turno (no heredado)** | `cd casbin-poc && python -m pytest test_casbin_mcp_payload_authz.py -v` |
—
## 3. Timeline real de commits del arco Casbin (no el reportado en mi EXODUS heredado)