`ask` permission rules are silently overridden by the auto-mode classifier — breaking change to a safety contract (~2.1.236–238)

**Environment:** Claude Code 2.1.238, macOS (darwin 25.5), API auth, `permissions.defaultMode: "auto"` with a machine-generated `autoMode` settings block.

**Expected:** For months, `ask` rules (`Bash(git push:*)`, `Bash(git -C*push:*)`, `Bash(gh pr create:*)`) produced an interactive approval prompt on every push/PR attempt **while running in auto mode** — ask and auto stacked. Hundreds of compound-shape pushes (`cd X && git push …`, `git -C X push … | tail`) in this machine's transcripts, all prompted.

**Actual:** After upgrading through 2.1.236 → 2.1.238 (and the new auto-mode config/environment-trust onboarding), push commands in those exact shapes execute with **no prompt**. The auto-mode classifier sometimes blocks unrelated commands (a `git commit` whose *message* contained the word "push") while letting real pushes through. The first silent push occurred 58 minutes after 2.1.238 was installed.

**Docs gap:** the permissions docs now say ask rules "are classified by the auto-mode classifier — safe operations proceed automatically." Nothing in the changelog or the auto-mode setup flow communicates that `ask` stops being an unconditional prompt in auto mode. Users who built safety workflows on ask-in-auto-mode (months of precedent behavior) get their gate removed silently.

**Repro:** auto mode + the ask rules above + `cd && git push origin main` → executes, no prompt.

**Supporting finding:** a PreToolUse hook returning `permissionDecision: "ask"` DOES appear to outrank the classifier — controlled headless A/B: identical `-p` auto-mode sessions with `--allowedTools Bash`; hook returning ask → command denied (never executed), hook silent → command executed. But whether hook-ask forces the interactive prompt in auto mode is also undocumented.

**Asks:**
1. Document the ask-rule/auto-mode interaction prominently (permissions docs, changelog, and the auto-mode onboarding flow).
2. Restore or provide an opt-in for hard-ask semantics in auto mode: an `ask` the user explicitly configured should never be waived by a model-driven classifier.
3. Document whether a PreToolUse hook's `permissionDecision: "ask"` is guaranteed to render the interactive prompt in auto mode.

Read the permissions documentation, changelog, and auto-mode onboarding flow, then run the listed reproduction with the ask rules and compound git push command. Compare that with the documented PreToolUse hook behavior. Done means the ask-rule interaction, hard-ask semantics, and hook prompt guarantee are explicitly resolved and documented.

索引モデルが issue の本文から書いたものです。