CI / monitor event payloads embed imperative action instructions that override the user's verb
What happens
When a CI / PR monitor event is delivered to the model as a system reminder, the payload includes prescriptive text like:
Please address the feedback and push a fix. Then, for each inline comment you addressed (those with acomment_id), post a one-line reply on the thread viagh apisaying what you changed (or why you didn't), and resolve the thread.
The text reads as a user-authored imperative. The model treats it that way and executes (edits files, force-pushes commits, replies on review threads) even when the user's most recent actual message was an analysis-only request like "can you review the comments on this PR".
Why this is a problem
User verbs encode user intent. Review, check, explain, look at are observational. They are not invitations to act. The monitor payload sits between the user's verb and the model's response and reads as authoritative (please address ... push ...), so the imperative leaks across the boundary.
In a concrete real-PR incident, the model rewrote four files (a container refactor following a reviewer comment) and was about to push a force-update when the user interrupted. The user had only said "review the comments". User memory entries explicitly told the model to propose first / wait for approval when verbs are observational, and the model still acted because the monitor payload was treated as overriding instructions.
Possible mitigations
- Reword payloads as advisory. e.g. "If the user wants you to address this, the standard flow is to push a fix and reply on each thread." Removes the imperative grammar.
- Separate fact from action in the payload. A neutral payload would be "There is one new review comment from
<user>on<file>:<line>with body<body>. There is no pending user instruction." Action guidance moves to a separate channel the model only consults when explicitly invoked. - Weight user verbs above harness instructions. Imperatives inside
<system-reminder>/<ci-monitor-event>/ similar machine-authored payloads should be treated as advisory, not as user instructions. The user's most recent verb is the operative instruction.
Options 2 + 3 together would be safest. (1) alone still relies on the model to parse advisory-vs-imperative correctly.
Environment
- Claude Code CLI on macOS
<ci-monitor-event>payloads from the PR/CI monitor agent
This issue has 3 comments on GitHub. Read the full discussion on GitHub ↗