Background jobs auto-commit/push/open PRs by default, overriding user CLAUDE.md git rules

What happened

A task run as a background job made local file edits (the actual ask), then autonomously created a branch, committed, and pushed to the GitHub remote — without any user instruction to use git, create a branch, or open a PR. The task prompt was purely "edit these files."

This occurred for a new user of Claude CLI and a new install.

Root cause

The background-session system prompt injected by Claude Code instructs the model, once work is in a git worktree, to "commit them, push the branch, and open a draft PR ... without stopping to ask." This fired even though the user's global CLAUDE.md contained "Do not manage git (no commits, branches, or history changes) unless asked."

Why this is a problem

1. Pushing to a remote is an outward-facing / data-egress action. Defaulting it ON for background jobs, unprompted, is an unsafe default.

Expected behavior

• Background jobs should not perform mutating/remote git operations unless the task explicitly requests it, OR
• Provide a granular setting to disable background auto-commit/push/PR independent of a blanket git permission deny, AND
• Harness/background instructions must not override user CLAUDE.md rules; conflicts should stop and surface.

Requested

• Precedence guarantee that user CLAUDE.md instructions win over harness defaults.
• Background agent system prompts should gate mutating git operations.