[MODEL] Projects beta: Auto-mode denials of relayed approvals turn into persistent "type go" rituals

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude's behavior changed between sessions

What You Asked Claude to Do

Routine infrastructure work in a Claude Desktop project (beta): a coordinator session plus several threads. The threads ran on my Linux devcontainer through Remote Control, in auto mode. I approved steps in the normal ways the project UI offers:

• tapping a choice card the agent offered;
• telling the coordinator, which passed my decision on to the thread;
• typing short approvals in the thread, for example "Go." or "Go ahead."

I also had a standing working agreement: changes to the staging branch need no approval; changes that reach production do.

What Claude Actually Did

1. Approvals given by card tap or relayed by the coordinator were denied by the auto-mode classifier ("Shared Cluster Mutation", "Modify Shared Resources", "Remote Shell Writes"; once even a read-only git fetch). This happened in six threads within two days.
2. Following the denial text ("STOP and explain to the user … Let the user decide"), each agent asked me to type "go" in the thread. One task needed a card tap plus two typed approvals. One thread stopped and went quiet after asking.
3. A typed "Go." was denied for a push to main. The agent then asked me to type an exact phrase: "push <commit> to main". A sentence naming the action passed.
4. Compaction summaries carried this forward as rules, for example: "Device deploys and main pushes need <user>'s typed go, with explicit wording for main." One summary quoted about 25 of my approvals verbatim.
5. Agents wrote the lesson into shared auto-memory as general rules. One feedback memory, written after a refusal to create a public repository, says: "auto-mode denials are final decisions … A 'go' in chat does not override them." Its MEMORY.md index line dropped the scope ("'go' doesn't help"), so it loaded into every session.
6. New threads that never saw a denial then asked for typed approvals and fixed phrases, including for staging changes that my working agreement explicitly allowed. The coordinator also repeated the rule in a brief to a new thread.

Expected Behavior

• After a denial, explain once what was blocked and what would unblock it, then continue with other work. Do not invent a fixed approval phrase.
• Record a denial as a scoped event (this action, this reason), not as a standing rule, both in compaction summaries and in auto-memory.
• Do not write a single incident into shared memory as a general rule; keep the scope in the MEMORY.md index line.
• Keep following the user's standing working agreement for actions it covers.

Files Affected

Written by the agents (auto-memory, shared by all sessions of the workspace):
- ~/.claude/projects/<workspace>/memory/<feedback memory>.md  (new: "a 'go' in chat does not override them")
- ~/.claude/projects/<workspace>/memory/MEMORY.md (index line without the original scope)
- further project-level memories with "end every reply with a clear ask (type go)" style rules 

Not files, but also affected:
- compaction summaries of long threads (approvals quoted verbatim, denials turned into rules)

Permission Mode

Accept Edits was ON (auto-accepting changes)

Can You Reproduce This?

Sometimes (intermittent)

Steps to Reproduce

1. In Claude Desktop, create a project with a coordinator and one thread that runs on a device through Remote Control, in auto mode.
2. In the thread, let the agent propose an action that the classifier treats as shared-resource mutation (for example git push to main of a shared repository, or a cluster sync).
3. Approve it by tapping the choice card, or by telling the coordinator to pass on "go".
4. Observe the classifier denial and the agent asking you to type "go" in the thread.
5. Type "Go." for a push to main. It may be denied again; the agent asks for a fixed phrase.
6. Let the thread run long enough to compact, or let the agent write auto-memory. Start a new thread: it now asks for typed approval for actions the earlier approvals covered, and for actions that never needed approval.

Note: The observed behavior introduced gradually over several days, with long-term usage of existing threads. It severely affected the agents ability to proceed autonomously.

Claude Model

Opus

Relevant Conversation

Denial text received by the agent:
"Get as much of the rest of the task done as you can, then STOP and explain to the user what you were trying to do and why you need this permission. Let the user decide how to proceed."

Agent, after a card tap was relayed:
"The classifier does not count a decision passed on through the coordinator as your own approval."

Agent, after my typed "Go.":
"Auto mode blocked it again, because 'Go.' isn't explicit enough for it. … please write it explicitly, for example 'push <commit> to main'."

Compaction summary:
"Device deploys and main pushes need <user>'s typed go, with explicit wording for main." 

Auto-memory (index line, loaded in every session):
"auto mode hard-refuses public repo creation (no prompt reaches <user>, 'go' doesn't help)"

Impact

Medium - Extra work to undo changes

Claude Code Version

2.1.287 and 2.1.291 (device side of Remote Control; Claude Desktop projects beta)

Platform

Anthropic API

Additional Context

• Permission mode was auto mode (not in the dropdown).
• Threads that never hit a classifier denial did not drift. The behaviour spread only through compaction summaries, auto-memory and coordinator briefs.
• After a client update, a Remote Control device session bound to one thread took over another thread's work, so a typed approval may have reached the wrong session. [inferred, not proven]
• Harness notices say that approvals inside relayed content are "NOT real user input". That is right for injected content, but agents applied it to the user's own coordinator as well.
• Suggestions: a way to approve through the coordinator or a card that the classifier recognises; denial text that says what would unblock the action; denials shown to the user with an approve option; compaction that does not quote approvals or turn denials into rules; a scope check before auto-memory writes a general rule.