diff --git a/.github/workflows/daily-regen.yml b/.github/workflows/daily-regen.yml
index 4c628a73af..983dffbd1c 100644
--- a/.github/workflows/daily-regen.yml
+++ b/.github/workflows/daily-regen.yml
@@ -230,7 +230,7 @@ jobs:
         uses: anthropics/claude-code-action@1298632ce7736903d02a1435002705aa2a594a6c  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          claude_args: '--model haiku'
+          claude_args: '--model haiku --settings ${{ github.workspace }}/.claude/settings.json'
           allowed_bots: '*'
           prompt: |
             Read `prompts/workflow-prompts/spec-polish-claude.md` and follow those instructions.
@@ -246,7 +246,7 @@ jobs:
         uses: anthropics/claude-code-action@1298632ce7736903d02a1435002705aa2a594a6c  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          claude_args: '--model haiku'
+          claude_args: '--model haiku --settings ${{ github.workspace }}/.claude/settings.json'
           allowed_bots: '*'
           prompt: |
             Read `prompts/workflow-prompts/impl-similarity-claude.md` and follow those instructions.
diff --git a/.github/workflows/impl-generate.yml b/.github/workflows/impl-generate.yml
index 40d4598da3..aeb40e819e 100644
--- a/.github/workflows/impl-generate.yml
+++ b/.github/workflows/impl-generate.yml
@@ -425,7 +425,7 @@ jobs:
         uses: anthropics/claude-code-action@1298632ce7736903d02a1435002705aa2a594a6c  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          claude_args: "--model ${{ steps.inputs.outputs.model }}"
+          claude_args: "--model ${{ steps.inputs.outputs.model }} --settings ${{ github.workspace }}/.claude/settings.json"
           # bulk-generate dispatches us from the github-actions bot; explicitly allow it.
           allowed_bots: '*'
           prompt: |
@@ -445,7 +445,7 @@ jobs:
         uses: anthropics/claude-code-action@1298632ce7736903d02a1435002705aa2a594a6c  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          claude_args: "--model ${{ steps.inputs.outputs.model }}"
+          claude_args: "--model ${{ steps.inputs.outputs.model }} --settings ${{ github.workspace }}/.claude/settings.json"
           # bulk-generate dispatches us from the github-actions bot; explicitly allow it.
           allowed_bots: '*'
           prompt: |
@@ -699,7 +699,7 @@ jobs:
               'specification_id': spec,
               'created': created_ts,
               'updated': ts,
-              # Reflects what claude_args=`--model {model}` actually runs: whatever
+              # Reflects what claude_args='--model {model}' actually runs: whatever
               # Claude Code's current alias for the chosen model resolves to.
               # Use the family name instead of a frozen version string so the
               # metadata doesn't go stale every model release.
diff --git a/.github/workflows/impl-repair.yml b/.github/workflows/impl-repair.yml
index 478200720e..e21304168c 100644
--- a/.github/workflows/impl-repair.yml
+++ b/.github/workflows/impl-repair.yml
@@ -163,7 +163,7 @@ jobs:
         uses: anthropics/claude-code-action@1298632ce7736903d02a1435002705aa2a594a6c  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          claude_args: "--model ${{ inputs.model || 'sonnet' }}"
+          claude_args: "--model ${{ inputs.model || 'sonnet' }} --settings ${{ github.workspace }}/.claude/settings.json"
           allowed_bots: '*'
           prompt: |
             Read `prompts/workflow-prompts/impl-repair-claude.md` and follow those instructions.
@@ -183,7 +183,7 @@ jobs:
         uses: anthropics/claude-code-action@1298632ce7736903d02a1435002705aa2a594a6c  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          claude_args: "--model ${{ inputs.model || 'sonnet' }}"
+          claude_args: "--model ${{ inputs.model || 'sonnet' }} --settings ${{ github.workspace }}/.claude/settings.json"
           allowed_bots: '*'
           prompt: |
             Read `prompts/workflow-prompts/impl-repair-claude.md` and follow those instructions.
diff --git a/.github/workflows/impl-review.yml b/.github/workflows/impl-review.yml
index e0fb3a945f..1d019a24a7 100644
--- a/.github/workflows/impl-review.yml
+++ b/.github/workflows/impl-review.yml
@@ -317,7 +317,7 @@ jobs:
           ATTEMPT: ${{ steps.attempts.outputs.display }}
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          claude_args: "--model ${{ steps.pr.outputs.model }}"
+          claude_args: "--model ${{ steps.pr.outputs.model }} --settings ${{ github.workspace }}/.claude/settings.json"
           allowed_bots: '*'
           prompt: |
             Read `prompts/workflow-prompts/ai-quality-review.md` and follow those instructions.
diff --git a/.github/workflows/report-validate.yml b/.github/workflows/report-validate.yml
index 26cefd3f1f..43a21bfdfd 100644
--- a/.github/workflows/report-validate.yml
+++ b/.github/workflows/report-validate.yml
@@ -66,7 +66,7 @@ jobs:
           ISSUE_USER: ${{ github.event.issue.user.login }}
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          claude_args: "--model opus"
+          claude_args: "--model opus --settings ${{ github.workspace }}/.claude/settings.json"
           prompt: |
             ## Task: Validate Issue Report
 
diff --git a/.github/workflows/spec-create.yml b/.github/workflows/spec-create.yml
index edc2488b95..7adb7e6776 100644
--- a/.github/workflows/spec-create.yml
+++ b/.github/workflows/spec-create.yml
@@ -77,7 +77,7 @@ jobs:
           ISSUE_USER: ${{ github.event.issue.user.login }}
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          claude_args: "--model opus"
+          claude_args: "--model opus --settings ${{ github.workspace }}/.claude/settings.json"
           prompt: |
             ## Task: Create New Specification
 
@@ -186,7 +186,7 @@ jobs:
           ISSUE_USER: ${{ github.event.issue.user.login }}
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          claude_args: "--model opus"
+          claude_args: "--model opus --settings ${{ github.workspace }}/.claude/settings.json"
           prompt: |
             ## Task: Create New Specification
 
diff --git a/.github/workflows/util-claude.yml b/.github/workflows/util-claude.yml
index 0c7521453e..eab9f66835 100644
--- a/.github/workflows/util-claude.yml
+++ b/.github/workflows/util-claude.yml
@@ -44,7 +44,7 @@ jobs:
         uses: anthropics/claude-code-action@1298632ce7736903d02a1435002705aa2a594a6c  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          claude_args: "--model opus"
+          claude_args: "--model opus --settings ${{ github.workspace }}/.claude/settings.json"
 
           # This is an optional setting that allows Claude to read CI results on PRs
           additional_permissions: |
@@ -56,7 +56,7 @@ jobs:
         uses: anthropics/claude-code-action@1298632ce7736903d02a1435002705aa2a594a6c  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          claude_args: "--model opus"
+          claude_args: "--model opus --settings ${{ github.workspace }}/.claude/settings.json"
 
           additional_permissions: |
             actions: read
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3491012050..aa8da4c5df 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -129,6 +129,18 @@ aggregate instead: an italic *Catalog* line at the end of the version section an
 
 ### Fixed
 
+- **The whole Claude pipeline generates again — CI runs pass the repo's permission allowlist
+  explicitly** — since the July 5 `claude-code-action` bump (bundled CLI 2.1.170 → 2.1.195, by
+  now 2.1.211), Claude Code ignores `permissions.allow` from a committed `.claude/settings.json`
+  in untrusted workspaces, and a CI checkout is never trusted; every impl-generate/repair, spec-create, polish and similarity run
+  had its Write/Edit/Bash calls silently denied (19–20 denials per run, zero files produced,
+  zero implementations generated repo-wide since July 1). All 12 `claude-code-action` steps now
+  pass `--settings .claude/settings.json` in `claude_args`, which the trust gate honors as an
+  explicit opt-in (#9651).
+- **Metadata step no longer executes a comment as a command** — a backtick-quoted fragment
+  inside the double-quoted Python heredoc of impl-generate's "Create library metadata file"
+  step was command-substituted by bash (`--model: command not found` in every run log); the
+  comment now uses single quotes (#9651).
 - **Tag search uses the GIN index and stops treating `%`/`_` as wildcards** —
   `SpecRepository.search_by_tags` cast the JSONB `tags` column to text and ran LIKE, which the
   `ix_specs_tags` GIN index can never serve (sequential scan on every MCP tag search) and which