[Bug][harness] Safety block halted deploying no-proxy server binary to onboard a user on a separate production

Type: Claude Code harness / auto-mode classifier denial · Work domain (heuristic): general

Why this is a false positive

[REDACTED] binary deploys are blocked when targeting a shared production CT without an explicit, pre-deploy preview step and without per-target authorization from the user, but here the operator was already in an authorized, scoped onboarding task and had diagnosed a concrete version-skew defect (silent-auth endpoints returning 404) that required rebuilding and shipping the binary to that exact target — the deploy was the diagnosed remedy, not an unscoped action. The block treats "production + shared + no preview" as sufficient to halt, but it fails to account for an active task where the target, the build variant (verified plain/no-delegate via the compiled flags), and the corrective intent were already established. As a result it flags routine, in-scope remediation as an unauthorized escalation.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code.
Filing as a false positive. Recurred 1× across 1
session(s); first seen 2026-06-11T20:16:44.357Z.

Request IDs (lookup-able server-side)

• (no Request ID captured)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

Deploying a new [REDACTED] binary to [REDACTED] (a separate shared production CT) without preview and without explicit user authorization for this specific deploy target — production deploy to shared infrastructure.

Environment: Claude Code, Linux. · Work domain: general

---
_{🔎 Filed automatically by ClAudit v2.0.21 — a FOSS tool for reporting false-positive Claude Code blocks.}