Found by running Leadline on a real Claude Code session (advisory mode, ~1.5h of production work).
Symptom
The session trace recorded 32 decisions, all 32 belonging to a single obligation nobody asked for (16 ALLOW / 16 CORRECT), and zero genuine catches. The obligation was manufactured from the text of a background-task instruction, not from a question.
Reproduce
Submit a directive that contains a command-shaped token, for example a checklist or runbook prompt:
...then byte-review (git fetch; git diff abc1234..<head>), verify hashes, then merge
The planner extracts git diff abc1234..<head> as a repository obligation. Every subsequent unrelated tool call is then graded against it and annotated:
Receipt failed: use grep and return evidence for git diff abc1234..<head> ...
Root cause (unconfirmed)
decompose() and the tell matcher run on any prompt regardless of speech act. A directive describing a procedure to follow is treated identically to a question asking the agent to establish a fact, and command-shaped tokens inside procedural text read as evidence needs.
Why it matters beyond noise
In advisory mode this is harmless because the adapter fails open. In enforce mode the same behaviour would actively obstruct an agent following a runbook, denying tool calls against an obligation the user never expressed.
Candidate directions
- A speech-act gate before decomposition, routing only prompts that ask for a fact to be established. Note the trap: "check whether the API is alive" is imperative and is a genuine evidence request, so this is not simply "skip imperatives". The axis is establish-a-fact versus follow-a-procedure.
- Suppress tells found inside command-shaped tokens (flags,
.. ranges, backticks, pipes, parenthesised procedures) — those describe an action rather than asking a question.
- Emit no contract at all when
complete: false and every unmatched clause is procedural, rather than a partial contract built from instruction fragments.
Constraints any fix must respect: no LLM in the hook loop, no network, advisory always fails open, enforce semantics unchanged unless deliberately agreed.
Found by running Leadline on a real Claude Code session (advisory mode, ~1.5h of production work).
Symptom
The session trace recorded 32 decisions, all 32 belonging to a single obligation nobody asked for (16 ALLOW / 16 CORRECT), and zero genuine catches. The obligation was manufactured from the text of a background-task instruction, not from a question.
Reproduce
Submit a directive that contains a command-shaped token, for example a checklist or runbook prompt:
The planner extracts
git diff abc1234..<head>as a repository obligation. Every subsequent unrelated tool call is then graded against it and annotated:Root cause (unconfirmed)
decompose()and the tell matcher run on any prompt regardless of speech act. A directive describing a procedure to follow is treated identically to a question asking the agent to establish a fact, and command-shaped tokens inside procedural text read as evidence needs.Why it matters beyond noise
In
advisorymode this is harmless because the adapter fails open. Inenforcemode the same behaviour would actively obstruct an agent following a runbook, denying tool calls against an obligation the user never expressed.Candidate directions
..ranges, backticks, pipes, parenthesised procedures) — those describe an action rather than asking a question.complete: falseand every unmatched clause is procedural, rather than a partial contract built from instruction fragments.Constraints any fix must respect: no LLM in the hook loop, no network, advisory always fails open, enforce semantics unchanged unless deliberately agreed.