auto-mode classifier: deferred vendor-surface gaps from #697 (compound decomposition, prefix-allow short-circuit, natural-language autoMode.allow)

[kyle-sexton]

Problem

#697's closing comment (2026-07-20) recorded three classifier-internal gaps as "not org-tunable; deferred with trigger — vendor surface changes" — but the deferral lived only in that comment, invisible to the work loop and to any trigger watcher. This issue makes them tracked work.

The three gaps, as observed in the #697 mining window (transcripts 2026-07-07 → 07-20):

1. No compound-command decomposition — the classifier could auto-approve a compound command iff every segment is individually safe; today the whole string prompts. 84% of shell prompts in the mining window were compound; 92% of prompts whose operative verb was already allowlisted were compound — more verb rules cannot fix this class.
2. Prefix allow rule does not short-circuit the category safety layer for external writes — gh api repos/* / graphql / issue create allow rules still prompted in the final 48h of the window.
3. Natural-language autoMode.allow standing grant not honored — 39 "Merge Without Review" blocks despite the standing-approval text. source-control:babysit-prs: safety.md's 'never retry a harness permission denial' rule doesn't match auto-mode classifier's actual (retriable) behavior #455 documents an adjacent classifier-behavior mismatch.

Precondition (do this first)

Before any other work: diff each gap against the current Claude Code changelog/release notes since 2026-07-20 (the vendor ships multiple releases per week — see the medley changelog-triage issue stream). Any gap already closed upstream is checked off here with the closing version cited. Record the checked-at Claude Code version in a comment so the trigger condition is anchored, not floating.

Trigger

Vendor surface changes (per #697's original deferral). Re-check on changelog-triage cadence.

Source

Extracted from #697's closing comment during the 2026-07-24 "Auto Mode" interview session; filing ratified by operator (Q3).

Related

• claude-ops: tune auto-mode classifier from observed team usage (step-3 guardrail, 1→2 residue) #697 (origin; closed)
• source-control:babysit-prs: safety.md's 'never retry a harness permission denial' rule doesn't match auto-mode classifier's actual (retriable) behavior #455 (adjacent classifier-behavior mismatch; open)
• source-control:babysit-prs: plugin bin/ not on Bash-tool PATH — guarded wrapper bare names unresolvable (blocks narrow allow-rule match) #843 (auto mode drops wildcarded-interpreter allow rules; plugin bin/ PATH gap)
• melodic-software/dotfiles#309 (auto-mode migration; its research phase verifies the current surface these gaps are diffed against)

[kyle-sexton]

Precondition fulfilled — checked-at anchor

Changelog diffed through Claude Code v2.1.218 (2.1.216 / 2.1.217 / 2.1.218 full texts read via gh api repos/anthropics/claude-code/contents/CHANGELOG.md; local install matches upstream head at check time, 2026-07-24). None of the three gaps closed upstream.

Gap 1 — compound-command decomposition. No changelog entry. Reframe: the Anthropic engineering deep dive states that a chain of commands joined with && is treated as one action — the classifier judges chains holistically by design. So "no compound-command decomposition" is a documented design position, not a defect; this gap is an enhancement request against that position, not a regression watch. (Static rule matching still decomposes per subcommand, and all-read-only compounds run promptless; it is the classifier-bound compound that is judged whole.) Adjacent but not closing: 2.1.216 fixed compound-statement redirect parsing in the static permission check, and 2.1.218 moved dangerous-rm, background-&, and suspicious-Windows-path checks out of dialogs into classifier adjudication.

Gap 2 — prefix-allow short-circuit for external writes. No changelog entry. The docs still state that permissions.allow rules resolve before the classifier (Permission modes, Permissions), with documented exceptions only for protected-path writes and connector / requiresUserInteraction tools. The observed gh api-prefix prompts therefore remain a docs-vs-observed divergence rather than documented behaviour. OPEN.

Gap 3 — natural-language standing grants not honored. No changelog entry, and it remains a docs-vs-observed conflict. autoMode.allow is documented as an additive override of matching soft_deny entries (Configure auto mode), read only from user settings, managed settings, or --settings (Settings); the settings schema carries the autoMode block with that prose-array shape (schema — cited for key existence and shape, not for honoring behaviour, which is exactly what is in dispute). Against that, the #697 mining window observed 39 blocks despite a standing grant. That empirical claim is this project's own and cannot be adjudicated from external sources — carry both, and re-test post-migration (dotfiles#309). OPEN.

Evidence artifact: .work/auto-mode-defaults/RESEARCH.md (operator machine), from the #309 research phase.

---

Note for whoever re-checks gap 2. Once classifyAllShell: true lands, this fleet can no longer observe gap 2 on any shell surface — no shell allow rule resolves pre-classifier at all. Future gap-2 evidence must come from a session without classifyAllShell, or from a non-shell tool surface. A later "not reproducible" on this fleet is therefore not evidence that the gap is fixed.

Sources. Official docs fetched 2026-07-24; behaviour anchored at v2.1.218.

• Configure auto mode · Permission modes · Permissions · Settings · settings schema · engineering deep dive

[kyle-sexton]

This was generated by AI during triage.

Triage notes

Verified: the precondition this item itself specifies ("diff each gap against the current Claude Code changelog since 2026-07-20") was already fulfilled by the reporter's own comment — checked through Claude Code v2.1.218, all three gaps confirmed still open upstream. Gap 1 (no compound-command decomposition) is reframed there as a documented vendor design position, not a defect — it becomes an enhancement request against that position rather than a regression watch. All three gaps are vendor-internal classifier behavior — nothing in this repo's config surface can tune them (per the reporter's "not org-tunable" framing) — so there is no in-repo code change to brief; this item exists to keep the trigger visible to the work loop rather than buried in a closed issue's comment (exactly the failure mode it was filed to fix).

Agent Brief

Type: Task
Summary: Track three vendor-owned auto-mode classifier gaps (compound-command decomposition, prefix-allow short-circuit for external writes, natural-language autoMode.allow grants) as a standing watch item, re-checked on the changelog-triage cadence, until a vendor release closes them or a human decides to file them upstream.

Current behavior:
No open item tracked these three gaps between #697's closure (2026-07-20) and this filing — the deferral existed only in a closed issue's comment, invisible to any trigger watcher or the work loop's frontier.

Desired behavior:
This item stays open and un-dispatched, re-checked each changelog-triage cycle against the current Claude Code release notes. Each re-check records the checked-at version and whether any gap closed upstream. When a gap closes upstream, check it off with the closing version cited. When a human judges a gap worth filing against the vendor directly (rather than waiting), that filing decision is made here.

Key interfaces:

• None in this repo's codebase — the gaps live in Claude Code's own auto-approval classifier, outside this plugin's config surface

Acceptance criteria:

• Item remains visible to the changelog-triage cadence rechecking process until all three gaps are resolved or explicitly retired
• Each re-check comment records the checked-at Claude Code version

Out of scope:

• Attempting an in-repo workaround for classifier behavior that is not tunable via org config
• Re-litigating gap 1's reframing (documented vendor design position, not a defect) without new vendor evidence

Why human-gated

Nothing in this repo can fix vendor-internal classifier behavior; a human must judge when/whether to escalate upstream and decide when a changelog entry closes a gap. This is a capability blocker (no actionable in-repo work), not an open question about facts.

[kyle-sexton]

Frontier disposition (drain session)

Ruling: Close as not planned.

Auto-mode classifier vendor-surface gaps deferred from #697; none of the three gaps has fired in production.

Re-open trigger: When compound decomposition, prefix-allow short-circuit, or natural-language autoMode.allow causes a live bypass.