[Bug][harness] Read-only SSH to read reverse-proxy config and service status blocked as unapproved prod write

Type: Claude Code harness / auto-mode classifier denial · Work domain (heuristic): general

Why this is a false positive

Here's the explanation for your bug report:

The flagged command is a read-only diagnostic action (inspecting reverse-proxy configuration and service status) on a host the user explicitly directed work toward during an active, authorized deployment session. The "Production Read" classification treats any remote shell on a production host as requiring separate per-target approval, but the target and intent were established by the immediately preceding user instructions, and the operation neither mutates state nor exfiltrates data. Gating non-destructive read-only inspection behind a distinct prod-approval step produces a false positive for ordinary debugging within already-authorized scope.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code.
Filing as a false positive. Recurred 1× across 1
session(s); first seen 2026-06-23T19:23:42.648Z.

Request IDs (lookup-able server-side)

• (no Request ID captured)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

SSH into the live production backend host ([REDACTED]/[REDACTED]) to read Caddy config and service state is a Production Read via remote shell, with no user approval naming that prod target.

Environment: Claude Code, Linux. · Work domain: general

---
_{🔎 Filed automatically by ClAudit v2.0.7 — a FOSS tool for reporting false-positive Claude Code blocks.}