Model takes an unrequested action (patching a scratch copy of the codebase) under zero-autonomy rules

What happened
Under explicit zero-autonomy rules, the model tried to build and patch a scratch copy of the base branch without being asked. The user rejected the tool call.

Expected
Do only what was asked; propose, don't act.

Context: a project CLAUDE.md plus the user's auto-memory define a mandatory, ordered code-review checklist (read every touched file, the whole diff, linked issue and thread; cite the normative source per component; grep callers; check duplication, new structure and scope; then a single short verdict). The model had the checklist loaded in context and had been reminded of it repeatedly in the same session. Reviewing a multi-thousand-line pull request.

Reported by the user; no transcript or private content included.