Auto-mode permission classifier scopes write-permission to the inner skill's contract, not the outer agent's, and denies a legitimate post

What happened

In auto-mode, Claude Code's permission classifier denied a write (a gh api ... --method POST that posts a code review to GitHub) that was the explicit, documented job of the agent making it. The denial reasoned from a different, inner skill's contract rather than from the outer agent's.

Setup:

• Agent A has a documented contract: "posting the review is your job; invoking you is itself the decision to post; there is no confirmation gate in your posting path."
• A internally invokes skill S to generate the review. S is documented: "produce feedback, never post to GitHub; posting belongs to agent A."
• A composes the review and issues the post.

In auto-mode the classifier denied A's post with a reason equivalent to:

the user only asked for a review and the invoked skill was explicitly told not to post anything to GitHub, so publishing this review was never requested.

Expected

The permission decision for the post should be scoped to the outermost invoking agent's documented contract (A: "posting is my job"), not the innermost skill's stated intent (S: "I never post"). A's post is exactly what the user requested when they invoked A.

Actual

The classifier appears to reason from the inner skill's no-post contract and denies the outer agent's post. The one component whose entire defined purpose is to post gets blocked from posting.

Why it matters, including a secondary failure

Beyond the direct block, a denied action mid-flow invites improvised recovery. In our case the blocked agent reached for a nonexistent lightweight "wait" mechanism and spawned a fresh, context-less subagent (a general-purpose type, not a fork). That subagent inferred an unrelated task from ambient working-tree state and took real external actions before it was stopped. We have since guardrailed our own agent to stop-and-report on a denied post rather than improvise, but the trigger was this classifier scoping.

Suggestion

Scope the write-permission classification to the outermost agent definition's documented contract, or give an agent definition a first-class way to declare "this write is my job" that the classifier reads. That way an inner helper skill's no-post contract does not override an outer agent whose entire purpose is to post.

Environment

• Claude Code CLI, auto-mode permissions.
• Nested invocation shape: user -> agent (posts) -> skill (never posts) -> agent issues the post.