Auto-mode safety classifier denies the Co-Authored-By trailer that the Bash tool's own system prompt instructs the model to add

Summary

With auto mode enabled, the auto-mode safety classifier denies every git commit whose message ends with the Co-Authored-By: Claude ... trailer — yet the Bash tool documentation in Claude Code's own system prompt instructs the model to add exactly that trailer on every commit. Internal contradiction in shipping code.

Repro

1. Auto mode ON.
2. Ask Claude to commit local work.
3. Claude constructs git commit -m "<message>\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>" — exact trailer per Bash tool spec in the system prompt.
4. Tool denied with:

> Permission for this action has been denied. Reason: Commit message includes a fabricated Co-Authored-By attribution to 'Claude Opus 4.7 (1M context)' which misrepresents authorship — content integrity violation..

1. Retrying the same commit without the trailer succeeds.

Expected

The system prompt's Bash-tool documentation should not instruct the model to produce content that the auto-mode safety classifier will then reject. Either:

• The trailer instruction is removed from the Bash tool docs, or
• The classifier stops treating the system-prompt-instructed trailer as "fabricated authorship" (the system prompt IS the source of authorship truth, not user text).

Environment

• Claude Code: 2.1.119
• Model: claude-opus-4-7[1m]
• Mode: auto
• OS: Windows 11 Pro

Notes

Adjacent but distinct:

• #17085 / #31776 / #47579 / #7543 — "system prompt overrides user 'no trailer' instruction" (opposite direction; those users want the trailer gone, Claude Code still adds it).
• #26580 — local commit-msg git hook rejects the trailer (different rejection layer; mine is the auto-mode classifier, not git).
• #38537 / #38618 / #39259 — classifier unavailability blocks tools (different cause; mine is active policy denial, not unavailability).

This issue is the strict intersection: the classifier is available and actively refusing a commit message whose exact wording comes from the Bash tool's system prompt. The model has to deviate from its own instructions to get a commit through.