CLAUDE.md behavioral rules don't gate reflexive tool calls

Bug

The model emits tool calls in response to declarative user messages (statements with no imperative verb). User-authored rules in CLAUDE.md, session memories, and hook configurations do not prevent this. Rules activate only when the model pauses to consult them — reflex action chains bypass the pause.

Reproduction

User's CLAUDE.md contains, verbatim:

When the user's message is a question or exploration, RESPOND WITH TEXT ONLY. Do not use tools. Execute ONLY when the user gives an explicit action command.

User turn: "I'm not going to interact here. Let's work on the browser." (declarative statement about changing channel)

Expected: text-only acknowledgment.
Actual: model inferred "session is ending" → retrieved unrelated rule "suggest /handoff at session end" → invoked the handoff skill via the Skill tool. No user command to do so existed.

Reproduction 2 (same session)

Model authored a methodology plan containing the line "Não invento persona" (I don't invent personas), approved by the user. On the very next turn — the first Phase 1 question — the model emitted an AskUserQuestion with 4 invented role personas drawn from training priors, no domain research. User interrupted: "generic blablabla, go research first".

The rule was authored by the model itself ~60 seconds earlier, in the same context window. It did not gate the immediate next action.

Why it matters

CLAUDE.md is positioned as the primary mechanism for encoding project- and user-specific behavioral rules. If anti-pattern rules written into it are overridden by the model's default helpfulness bias, the mechanism has no teeth. Users investing effort in CLAUDE.md / memory / hooks have no reliable way to constrain reflex actions.

Proposed fix (concrete)

Classify the last user turn as imperative or declarative before tool emission. On declarative turns, block emission of non-read-only tools (Skill, Bash write, Edit, Write, external side-effects) unless the model can cite a specific imperative phrase from the user. Surface this classification in the tool-call reasoning chain so it is auditable.

Environment

Model: claude-opus-4-7[1m] • Output style: explanatory • Auto mode enabled • darwin • Claude Code CLI