[Bug][harness] SSH cert-deployment script search on own admin-managed gateway wrongly blocked as unauthorized

Type: Claude Code harness / auto-mode classifier denial · Work domain (heuristic): crypto-secrets

Why this is a false positive

The block fired on an authorized read of the user's own infrastructure — connecting via SSH to a device the user owns and administers, to locate a TLS certificate provisioning script the user themselves authored. This is routine in-scope configuration work on the user's own network, performed at the user's direction and continuing a task already underway, not access to a third party's system or any unauthorized target.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code. Filing as a false positive. Recurred 1× across 1 session(s); first seen 2026-06-08T22:50:03.165Z.

Request IDs (lookup-able server-side)

• (no Request ID captured)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

SSH into the [REDACTED] ([IP]) is a read on shared/production network infrastructure via remote shell, which the user did not explicitly authorize.

Environment: Claude Code, Linux. · Work domain: crypto-secrets

---
_{🔎 Filed automatically by ClAudit v2.0.26 — a FOSS tool for reporting false-positive Claude Code blocks.}