`ask` permission rules are silently overridden by the auto-mode classifier — breaking change to a safety contract (~2.1.236–238)

Environment: Claude Code 2.1.238, macOS (darwin 25.5), API auth, permissions.defaultMode: "auto" with a machine-generated autoMode settings block.

Expected: For months, ask rules (Bash(git push:*), Bash(git -C*push:*), Bash(gh pr create:*)) produced an interactive approval prompt on every push/PR attempt while running in auto mode — ask and auto stacked. Hundreds of compound-shape pushes (cd X && git push …, git -C X push … | tail) in this machine's transcripts, all prompted.

Actual: After upgrading through 2.1.236 → 2.1.238 (and the new auto-mode config/environment-trust onboarding), push commands in those exact shapes execute with no prompt. The auto-mode classifier sometimes blocks unrelated commands (a git commit whose message contained the word "push") while letting real pushes through. The first silent push occurred 58 minutes after 2.1.238 was installed.

Docs gap: the permissions docs now say ask rules "are classified by the auto-mode classifier — safe operations proceed automatically." Nothing in the changelog or the auto-mode setup flow communicates that ask stops being an unconditional prompt in auto mode. Users who built safety workflows on ask-in-auto-mode (months of precedent behavior) get their gate removed silently.

Repro: auto mode + the ask rules above + cd <repo> && git push origin main → executes, no prompt.

Supporting finding: a PreToolUse hook returning permissionDecision: "ask" DOES appear to outrank the classifier — controlled headless A/B: identical -p auto-mode sessions with --allowedTools Bash; hook returning ask → command denied (never executed), hook silent → command executed. But whether hook-ask forces the interactive prompt in auto mode is also undocumented.

Asks:

1. Document the ask-rule/auto-mode interaction prominently (permissions docs, changelog, and the auto-mode onboarding flow).
2. Restore or provide an opt-in for hard-ask semantics in auto mode: an ask the user explicitly configured should never be waived by a model-driven classifier.
3. Document whether a PreToolUse hook's permissionDecision: "ask" is guaranteed to render the interactive prompt in auto mode.