Backlog: guard reads only a turn's opening message for authorization (#290) - #291
Backlog: guard reads only a turn's opening message for authorization (#290)#291CryptoJones wants to merge 1 commit into
Conversation
…290) Observed 2026-08-28. A turn opened with "Can you also make it save its rules somewhere...", which correctly armed the capability-question rule. The user then sent "Fix it all please" mid-turn — Claude Code delivers those alongside a tool result rather than as a new turn — and the guard, which classifies from the opening message only, kept blocking. `guard explain` returned ALLOW for the same command, and `guard pause` could not help because the rule is enforced as a hard block. Net effect is the failure mode the guard otherwise prevents: the agent has to hand the user homework, asking them to re-issue an instruction already given. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VmauK5UCYGRYyXoQ36FQ3S
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Closing as superseded — the entry this PR adds is already on #290 (mid-turn user messages invisible to the authorization classifier) is in the This branch also predates the 2026-09-08 reconcile (#320), which removed the No content lost. Branch deleted. |
1 participant
Adds the BACKLOG.md entry for #290, keeping the backlog and the Issues tab in sync.
No code change — this is the backlog half of the pair.
The bug, briefly:
omind guardclassifies authorization from the OPENING message of a turn. Claude Code delivers messages the user sends mid-turn alongside a tool result rather than as a new turn, so the guard never sees them. A turn that opens withCan you ...?arms the capability-question rule, and a subsequent explicitFix it all pleasecannot lift it.omind guard explainreturns ALLOW for the same command, confirming the block is turn-level classification rather than command shape, andomind guard pausedoes not help because the rule is enforced as a hard block.The user-visible result is the failure mode the guard is otherwise good at preventing: the agent stops and asks the user to re-issue an instruction they already gave.
Observed on macOS 25.5.0, harness=claude, semantic relevance off (keyword path).
Proudly Made in Nebraska. Go Big Red! 🌽 https://xkcd.com/2347/