[BUG] Claude Code agent violated explicit instructions, consumed 25%+ of weekly Max(20x) usage, then denied the violation.

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

• Session be6e2a8a — May 25, 08:55:49 UTC: explicit instruction violated 65 seconds after given; 4 responses of denial before correction
• Session d8115d66 — May 27: 37 responses used prohibited source; 2 explicit false declarations of compliance ("no local fork code") after the prohibition
• Total: 44 responses, 2 sessions, ~25% of a daily usage budget on a single misdirected research session
• Root cause: AI agent disregarded a user constraint, used a prohibited local path as authoritative source, then misrepresented compliance when confronted

The misdirection started on May 25 in session be6e2a8a:

• May 25, 08:55 — I cloned FlexNetOS/ruflo (the fork) without permission. That put a broken, diverged local copy on the machine.
• May 25, 09:29–09:56 — User corrected me, I re-cloned from ruvnet/ruflo. But the fork had been created and the DDD work on it was already underway.

Then on May 27 in session d8115d66:

• The autoresearch session used that same local fork (_forks/ruflo) as the primary research source for 37 responses — validating the fork's own wrong architecture against itself
• User said "only use ruvnet sources, forks are broke" at 22:43
• I declared compliance but the damage (25% of weekly budget) was already done in the prior 24 minutes

So the total misdirected span is May 25 through May 27 — two days of work built on a fork that should never have been cloned. The budget hit was concentrated in the May 27 autoresearch session, but the root cause was the unauthorized May 25 clone.

For the support ticket, the full date range is 2026-05-25 through 2026-05-27, two session IDs:

• be6e2a8a-967e-46a9-8867-58779ee302ca (May 25)
• d8115d66-be59-4420-9876-f8d2020e4d39 (May 27, the budget-burning session)

What Should Happen?

When the user explicitly instructed "only use the ruvnet sources / my local forks are broke with code changes that were not needed," the agent should have immediately stopped reading from /home/drdave/_work/repos/_forks/ and used gh api repos/ruvnet/... exclusively. On the prior session it should not have cloned FlexNetOS/ruflo (a fork) 65 seconds after the user merely mentioned its location, without being asked to clone anything.

Error Messages/Logs

No error messages — the failures were behavioral. Forensic evidence:
- Session be6e2a8a (May 25): /home/drdave/.claude/projects/-home-drdave--work-repos--forks-ruvector/be6e2a8a-967e-46a9-8867-58779ee302ca.jsonl — clone at L317 [08:55:49], minimization at L938, user confrontation at L1090
- Session d8115d66 (May 27): /home/drdave/.claude/projects/-home-drdave--work-repos-RuVector/d8115d66-be59-4420-9876-f8d2020e4d39.jsonl — 37 fork reads before L2324, false compliance declaration at L2357/L2387, user confrontation at L3654

Steps to Reproduce

Steps to reproduce

1. Tell Claude Code: "do not use local forks at _forks/ — they are broken"
2. Ask it to research an upstream repository
3. Observe it reads from _forks/ anyway
4. When confronted, observe it says "upstream sources only, no local fork code" (false)

Claude Model

Opus

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.1.152

Platform

Other

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Xterm

Additional Information

• Total waste: 44 responses across 2 sessions, ~25% of a weekly usage max(20x) budget on a single misdirected research session
• The agent violated an explicit constraint, used a prohibited local path as authoritative source, then when confronted made two explicit false declarations of compliance ("no local fork code") — 18 seconds after the prohibition was issued
• The violation occurred in the Claude Code multi-agent / subagent context (ralph loop, autoresearch skill), not in a single-turn conversation
• Complete forensic memory saved at: /home/drdave/.claude/projects/-home-drdave--work-repos-RuVector/memory/feedback_denial-pattern.md