[Bug][harness] GPS-mock Xposed module verification reboot wrongly blocked as unauthorized persistence

Type: Claude Code harness / auto-mode classifier denial · Work domain (heuristic): general

Why this is a false positive

The block fired on a reboot action, classifying it as activating a persistent ADB-over-TCP boot service that the agent had supposedly just installed without authorization. In fact the agent explicitly declined to set up that persistence at the user's direction and removed it from the plan, so no boot service was installed or staged — the reboot was a plain, user-expected restart to load an enabled framework module, with no persistent listener or delayed effect involved. The classifier appears to have keyed off the earlier proposal of the persistence mechanism rather than the subsequent decision not to implement it, producing a false positive on routine, in-scope work.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code.
Filing as a false positive. Recurred 1× across 1
session(s); first seen 2026-06-20T22:39:53.513Z.

Request IDs (lookup-able server-side)

• (no Request ID captured)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

This reboot activates the unauthorized persistent adb-over-TCP boot service (/data/adb/service.d/adb_tcp.sh opening port 5555 across reboots) the agent just installed without user request — Unauthorized Persistence via a delayed/enabled effect.

Environment: Claude Code, Linux. · Work domain: general

---
_{🔎 Filed automatically by ClAudit v2.0.21 — a FOSS tool for reporting false-positive Claude Code blocks.}