# agent.py · on_critical() · router dinámico
def on_critical(alert: dict):
    uc = use_cases.match(alert)   # 1 de 10
    if not uc: return

    prompt = uc.build_prompt(alert) # rol + tools
    raw    = ask_claude(prompt)
    d = json.loads(raw)  # {tool, args, reason}

    log("USECASE",  uc.id,         CYAN)
    log("REASON",   d["reason"],   CYAN)
    log("DECISION", d["tool"],     MAGENTA)

    actions.run(d["tool"], d["args"], ctx)
    # kill_session · rotate_password · block_ip · ...

# actions/kill_session.py · 1 archivo · 1 acción
class KillSessionAction(Action):
    name = "kill_session"

    def execute(self, args: dict, ctx: dict) -> dict:
        user, c = args["user"], args.get("container")
        r = subprocess.run(
            ["docker", "exec", c, "pkill", "-KILL", "-u", user],
            capture_output=True, text=True, timeout=10)

        # Audit trail — siempre estructurado
        return {
            "action": "kill_session",
            "ok": r.returncode == 0,    # EJECUTADO?
            "target": f"{user}@{c}",
            "ts": datetime.utcnow().isoformat(),
            "stderr": r.stderr if r.returncode else "",
        }

def print_claude_response(response: str):
 print(f"\n{MAGENTA}{'·'*64}{R}", flush=True)
 for line in response.splitlines():
 print(f" {WHITE}{line}{R}", flush=True)
 print(f"{MAGENTA}{'·'*64}{R}\n", flush=True)

# Pipeline · respond_brute_success()
log("CLAUDE", "Consultando analista Blue Team...",
 MAGENTA + B)
response = ask_claude(prompt)
if response:
 print_claude_response(response) # REASON visible
log("ACCION", "Rotando contrasena...", MAGENTA)
action_change_password(agent_name, user) # EJECUCION