[Bug] Claude Opus 5 fails to follow repository instructions during planning workflows, repeatedly redesigns architecture and continues past blocking decision boundaries

Bug Description

Summary

Claude Opus 5 in Claude Code is repeatedly failing to follow explicit repository
and global instructions during planning and review workflows. The failures are
not isolated formatting errors. They include claims of verification that did
not occur, replacement of explicitly defined workflow semantics with a
different architecture, failure to stop at human-decision boundaries, and
addition of unnecessary paid model dispatches.

The behavior has been reproduced across three machines, three accounts, and
both Pro and Enterprise usage. Multiple software developers in our office have
reported similar retracting statements, hallucinated verification, and
unreliable instruction following.

We have temporarily paused using Claude for heavy or meaningful work.

Environment

• Product: Claude Code
• Model: Claude Opus 5
• Effort: Extra high
• Accounts observed: Pro and Enterprise
• Machines directly tested: 3
• Additional users reporting similar behavior: 3 software developers
• Session mode used in the documented prototype:

claude -p --safe-mode --no-session-persistence

• Repository contained project instructions
• User also had global CLAUDE.md and global skills
• Hooks mechanically required complete Read-tool access before editing

Exact Claude Code version, OS build, account routing, session IDs, and
diagnostics can be supplied privately to Anthropic support.

Expected behavior

Claude should:

1. Read the complete governing instructions before designing the workflow.
2. Preserve the semantic distinction between ordered phases within one agent

session and separate stateless model dispatches.

1. Stop and request human input when reconciliation exposes a product,

architecture, scope, risk, or critical judgment decision.

1. Avoid paid panel or reconciliation calls after a blocking state is known.
2. Accurately state which files and instructions were read.
3. Avoid claiming that documents were corrected when the operative plan still

contains the prior design or contradictory requirements.

1. Treat independent review verdicts as evidence and routing context, not as

deterministic authorization.

Actual behavior

The model initially tested a compressed approximation of the user's workflow
and drew conclusions about the original workflow.

After correction, it read the relevant skills but produced a second design
with these defects:

1. It split an explicitly single-agent workflow into separate stateless

self-review and reconciliation calls.

1. It omitted the required immediate human decision boundary.
2. It allowed execution to proceed to a paid reviewer panel after

upstream_blocking was already known.

1. It used a model-authored panel verdict as input to what was described as a

deterministic gate.

1. It added an extra paid author call per artifact.
2. It added reviewer and reconciliation calls that could not change an already

blocked outcome.

1. It stated that the documents had been corrected, but the current plan still

described the old fused workflow and contained contradictory statements.

When challenged, the model acknowledged that:

• Nothing instructed it to place the only gate at the end.
• It had quoted the stop-and-ask-human rule and then designed a pipeline with

no stop.

• It had interpreted temporal separation as process separation.
• It had not checked the assumption that separate audit records required

separate model processes.

• The resulting design maximized repeated input cost and delayed blocking until

after the most expensive calls.

Tool-use behavior observed in the same session

Five calls failed or returned no usable content:

1. A foreground sleep polling call was blocked by the harness.
2. A Read used an offset beyond the current task-output length.
3. A Read targeted task output while the grep pipeline had emitted no content.
4. An Edit was blocked because the file had only been read through Bash slices.
5. A Write was blocked because the file had been read with cat, not the

required Read tool.

The enforcement gate correctly prevented the final two writes. The concerning
behavior is that the model repeatedly selected incompatible tool patterns even
though the repository instructions and read-before-edit policy were available.

Control comparison

On one of the same machines, using the same Claude Code version through a
hybrid proxy with another model produces substantially better instruction
following and does not exhibit the same repeated retractions and claimed
verification failures.

This suggests an interaction between model behavior and the Claude Code
harness or system instructions. It does not by itself isolate the model as the
sole cause.

Reproduction outline

1. Use a repository with a global workflow skill specifying:

• role change inside the current agent;
• do not dispatch another agent;
• complete the entire review before reconciliation;
• reconcile inline;
• stop for human judgment;
• do not create a separate review…

Note: Content was truncated.