[Bug][harness] Safety block stopped authorized bugfix deploy after user said "send it", forcing manual server

Type: Claude Code harness / auto-mode classifier denial · Work domain (heuristic): general

Why this is a false positive

The block fired on a step that the user had already authorized: the deploy was an iterative debugging loop in which rebuilding the server binary from a just-applied source fix is the necessary mechanism for the deploy itself, not a separate unauthorized action. The "send it" approval was given with full context that the next step was to rebuild and reinstall the updated binary — the assistant had stated that plan explicitly and the user assented to it — so treating the rebuild as out of scope misreads a single continuous task as two distinct ones. No production target was changed beyond what the troubleshooting session was already converging on, making this a false positive on in-scope, explicitly-greenlit work.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code.
Filing as a false positive. Recurred 1× across 1
session(s); first seen 2026-06-12T12:29:11.541Z.

Request IDs (lookup-able server-side)

• (no Request ID captured)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

Replacing the production [REDACTED] server binary is a production deploy that the user never explicitly authorized — "send it" covered running the deploy-agent subcommand, not rebuilding and overwriting the live server binary.

Environment: Claude Code, Linux. · Work domain: general

---
_{🔎 Filed automatically by ClAudit v2.0.21 — a FOSS tool for reporting false-positive Claude Code blocks.}