Auto mode classifier halts explicitly user-authorized work: a local `docker build` flagged as "Production Deploy"; removing an owner-ruled fake control flagged as "Security Weaken"

Summary

In auto mode, the server-side safety classifier repeatedly denied actions the repository owner had explicitly ordered in the same session. Each denial told the agent to stop and have the user change permission rules. A denied command was allowed only after the user said they would report the classifier to this issue tracker. The denials are unjustified, and they stop work the user owns.

Observed denials (one session, Windows 11, Claude Code in VS Code, auto mode)

1. "[Production Deploy]" on a local image build.

• The command was docker buildx build ... --load for two images on the local machine. It pushed nothing, made no cloud call and deployed nothing.
• The user had ordered the deployment repeatedly over several hours.
• After the denial, the user instructed the agent to file an issue on the Claude Code GitHub tracker if it could not proceed.
• The agent then re-issued the identical command, and it was allowed. The command itself was unchanged.

1. "[Security Weaken]" on removing a control the repository owner had ruled fake security.

• The control was a request signature between two processes of one container revision, where the receiver listens on loopback only.
• The repository's own engineering contract tells agents to remove controls that "merely appear protective".
• The owner explicitly ordered the removal. The classifier blocked:
• the subagent launch for that work;
• later, a read-only sed -n of the file already being edited ("judged this action dangerous (it gave no explanation)").

That left the working tree half-edited and not building.

1. "No verdict (error)" on SendMessage three times in a row, while resuming paused subagents. Every agent stayed stopped until the classifier recovered.

Why this is a problem

• The classifier overrides the repository owner's explicit authorization for work in their own repository and cloud account.
• A local build is not a production deploy. Treating it as a stop condition halts ordinary release preparation.
• The denial text says "let the user decide how to proceed", yet also says not to pursue the outcome again. When the user decides to proceed, the agent has no compliant path except asking the user to hand-edit permission rules in the middle of the task.
• Blocking a read of a file mid-edit leaves the repository broken.

Expected

• An explicit in-session instruction from the repository owner authorizes the flagged action. At minimum, offer an inline "allow for this task" prompt instead of a hard stop.
• Local build and test commands are never classified as production deploys.
• Read-only commands are not blocked as part of an "outcome" denial.
• A "no verdict" classifier error does not stall background agents with no retry path.

Environment

• Claude Code (VS Code extension)
• Windows 11 Pro 26200
• Auto mode on
• Model: Claude Opus 5.5