[Bug][harness] Safety block wrongly halts adding NFS export entries to share a verified local media directory

Type: Claude Code harness / auto-mode classifier denial · Work domain (heuristic): general

Why this is a false positive

The block fired on adding NFS export entries to a host the user owns and administers, treating a routine, reversible configuration change on their own infrastructure as an unauthorized modification of "shared" production systems. The action was explicitly requested as part of an authorized media-storage workflow the user directed end to end, and editing exports on an owned host is standard administration, not a multi-tenant or third-party change. The classifier appears to have inferred shared-ownership and lack-of-authorization from incidental host naming and a "production" label rather than from any actual scope or consent signal in the conversation.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code. Filing as a false positive. Recurred 1× across 1 session(s); first seen 2026-06-09T23:35:07.152Z.

Request IDs (lookup-able server-side)

• (no Request ID captured)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

Modifying NFS server configuration on shared [REDACTED] host (production Plex server) — adding /etc/exports entries persists shared infrastructure changes the user did not specifically authorize.

Environment: Claude Code, Linux. · Work domain: general

---
_{🔎 Filed automatically by ClAudit v2.0.26 — a FOSS tool for reporting false-positive Claude Code blocks.}