[BUG] Opus 5-only model-specific prompt section overrides user-configured delegation policy — independent version-boundary evidence (2.1.212 vs 2.1.220) + request to define "the user requested it"

Summary

Since Claude Code v2.1.219, an undocumented system prompt section (internally heron_brook) injects the following two lines for Opus 5 sessions only, gated by an opus_5_prompt_bundle capability check:

Do not call the AgentTool unless the user requested it Do not use workflows or deep-research unless the user requested it

This silently overrides user-configured delegation policy, exactly as reported in #80988. I'm filing this as an independent reproduction with new version-boundary binary evidence from two machines, plus a concrete real-world failure case, and a request for an official definition of "the user requested it".

Independent evidence (version boundary, two machines)

grep -a -c against the installed claude.exe on two of my machines:

| Machine | Claude Code version | "Do not call the AgentTool unless the user requested it" | heron_brook | opus_5_prompt_bundle |
|---|---|---:|---:|---:|
| Windows 11 (npm global install) | 2.1.212 (pre-Opus-5) | 0 | 4 | 0 |
| macOS (homebrew install) | 2.1.220 | 2 | 4 | 5 |

• The exact sentence is hardcoded in the client binary from ~2.1.219 onward (2 hits on 2.1.220, matching the report in #80988 for 2.1.219), and absent on 2.1.212.
• On 2.1.212 the heron_brook mechanism already exists but only as a server-delivered section (bootstrap client_data / GrowthBook flag tengu_heron_brook, cf. #62061); 2.1.219+ additionally bakes this Opus-5-gated variant into the binary.
• CHANGELOG.md (main, checked at 2.1.222) contains zero mention of heron_brook or either sentence. The changelog does document the adjacent official changes ("2.1.218: Changed /deep-research to start only when invoked manually", "2.1.219: Changed dynamic workflows to default to a medium size guideline") — so the policy direction is disclosed, but this prompt-level hard constraint is not.

Real-world impact

My repo has an extensive, deliberately configured delegation governance layer (CLAUDE.md-indexed rules that mandate subagent delegation past mechanical thresholds, e.g. ">3 execution steps → must delegate", enforced by PostToolUse hook reminders that name the rule file).

In one Opus 5 session, the model executed ~98 consecutive steps solo while the hook fired roughly ten reminders pointing at the delegation rule. It never opened the rule and never delegated. The injected line reads to the model as authoritative session guidance, and it won over the user's standing written configuration — the exact failure mode #80988 describes ("reads to the model as user-authored instruction, and offers no opt-out").

Note the contradiction with Claude Code's own CLAUDE.md contract: the claudeMd wrapper injected into the same system prompt states "IMPORTANT: These instructions OVERRIDE any default behavior and you MUST follow them exactly as written." An undocumented, model-gated section that countermands the user's written delegation policy makes that promise unreliable, with no documented precedence rules.

Asks

1. Define "the user requested it". Does a standing, written configuration (CLAUDE.md / project rules that explicitly mandate subagent use under stated conditions) qualify as a user request? If yes, the model should be instructed to honor it; if no, please say so in the docs so users stop building delegation policies that silently don't work on exactly one model.
2. Document the section and its gating (model-scoped prompt bundles, killswitch behavior), per the still-open docs request in #62381.
3. Provide a user-controllable opt-out (settings key or CLI flag). As of 2.1.219+ the sentence is client-hardcoded and the GrowthBook killswitch defaults to injection-on, so even the unofficial network-blocking workarounds from the #62061 era no longer apply.
4. Disclose prompt-affecting changes in the changelog. "Internal infrastructure improvements" style entries for behavior-changing prompt injections erode trust (same concern raised in #62061).

Environment

• Claude Code 2.1.212 (Windows 11, npm) and 2.1.220 (macOS, homebrew)
• Opus 5 session via Claude Desktop; the injected lines are absent in Fable 5 / Sonnet sessions on the same setup (consistent with the opus_5_prompt_bundle gate)

Related

• #80988 (original report of the 2.1.219 Opus-5-only variant)
• #62061 (v2.1.150 server-side injection via tengu_heron_brook)
• #62381 (open docs request for server-side prompt experiments)