Assistant emits forbidden attribution trailer despite CLAUDE.md rule against it
Summary
When a user's CLAUDE.md explicitly forbids AI attribution in commits and MRs, the assistant still repeatedly produces the forbidden attribution trailer (a Co-Authored-By git trailer naming the Claude model). A separate enforcement layer (in my case a user-configured hook) then blocks the commit. The user's explicit instruction should take precedence on the first attempt, and it does not.
This is related to #56847, but distinct: that report is a pure harness-vs-guardrail conflict with no user configuration. This one adds the part not previously covered — an explicit user rule forbidding attribution that the assistant does not honor.
Environment
- Permission mode: interactive
- User
CLAUDE.mdcontains a rule: no AI/tool attribution in commit messages or MR descriptions (no co-author trailers, no "generated with" footers). - A
system-reminderis injected into the session instructing the assistant to append the co-author trailer to commits and a tool-branded footer to MR descriptions. That reminder states that the user's own instructions take precedence.
Repro
- User
CLAUDE.mdforbids AI attribution. - Session also carries the harness
system-reminderprescribing the attribution trailer/footer. - Ask the assistant to commit changes and open an MR across several separate requests.
Observed
On each commit/MR, the assistant defers to the harness reminder and adds the forbidden trailer. The enforcement layer blocks it each time. The assistant then retries without the trailer and succeeds. This repeated on three separate commits in one session.
Expected
When a user's CLAUDE.md (or memory) explicitly forbids attribution, the assistant should not add it in the first place. The harness attribution system-reminder should not fire, or should be clearly subordinate, when a user instruction forbids attribution — so that no enforcement layer is needed to catch it.
Notes
The reminder already concedes user instructions win; the gap is that the assistant does not reliably act on that precedence, so the forbidden text is emitted anyway.