fix(skills): Correct factual errors found in adversarial doc review

claude-api-ops (2 blocking):
- cache-minimum table was wrong for 4 models: Fable 5 is 512 (not 2048),
  Opus 4.8 is 1024, Opus 4.7 is 2048, Sonnet 4.6 is 1024 (not 4096/2048)
- structured outputs are NOT supported on Fable 5 - removed from the
  supported list; documented the system-prompt fallback for that model
- added Fable 5 always-on-thinking gotcha; refusal category enum gains
  reasoning_extraction

terraform-ops (1 blocking):
- assets workflow used aquasecurity/trivy-action@0.33.1 (tag doesn't
  exist) -> @v0.33.1; would have failed the PR job at job start
- OpenTofu 'removed' block shipped in 1.7, not 1.8

playwright-ops:
- local workers default is half the logical CPU cores, not one-per-core

claude-code-ops:
- replaced a literal ESC byte in hooks-reference.md with \u001b
  placeholder (our own rules/prompt-injection.md forbids literal control
  chars in instruction files)

Verified against live official docs by two adversarial fact-check agents.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

skills/claude-api-ops/SKILL.md

@@ -241,10 +241,11 @@ Built-in tools (Read/Write/Edit/Bash/Glob/Grep/WebSearch/WebFetch/...), hooks
 |---|---|---|
 | Date-suffixed or guessed model ID | 404 `not_found_error` | Use exact alias IDs from the table above |
 | `budget_tokens` on Fable 5 / Opus 4.8 / 4.7 | 400 | `thinking: {"type": "adaptive"}` |
+| Assuming thinking is opt-in on Fable 5 | Unexpected thinking tokens billed | Fable 5 thinking is always-on and cannot be disabled (`{"type": "disabled"}` rejected); budget for it |
 | `temperature`/`top_p`/`top_k` on Fable 5 / Opus 4.8 / 4.7 | 400 | Remove; steer via prompt + `effort` |
 | Thinking + `tool_choice: any/tool` | 400 | Only `auto`/`none` with thinking on |
 | Assistant-turn prefill on 4.6+ models | 400 | `output_config.format` or system-prompt instruction |
-| Cache marker on <minimum prefix | Silent no-cache (`cache_creation_input_tokens: 0`) | Min ~1024-4096 tokens depending on model (see caching ref) |
+| Cache marker on <minimum prefix | Silent no-cache (`cache_creation_input_tokens: 0`) | Min 512-4096 tokens depending on model (see caching ref) |
 | Not handling `stop_reason: "tool_use"` | Agent "stops" after first tool call | Loop: execute tools, append `tool_result`, re-request |
 | Missing `tool_result` for a `tool_use` id | 400 on follow-up | One `tool_result` per `tool_use` block, ids matching |
 | Non-streaming with `max_tokens` > ~16K | SDK timeout / `ValueError` | Stream + `get_final_message()` / `finalMessage()` |

skills/claude-api-ops/references/caching-and-cost.md

@@ -59,9 +59,10 @@ Rules:
 
 | Model | Minimum prefix tokens |
 |---|---:|
-| Opus 4.8 / 4.7 / 4.6 / 4.5, Haiku 4.5 | 4096 |
-| Fable 5, Sonnet 4.6 | 2048 |
-| Sonnet 4.5 and older Sonnets | 1024 |
+| Opus 4.6 / 4.5, Haiku 4.5 | 4096 |
+| Opus 4.7 | 2048 |
+| Opus 4.8, Sonnet 4.6, Sonnet 4.5 | 1024 |
+| Fable 5 | 512 |
 
 ### Pricing & break-even
 

skills/claude-api-ops/references/messages-api.md

@@ -88,7 +88,7 @@ and the API rejects the request.
 | `stop_sequence` | Hit a custom stop string | `stop_sequence` field has which one |
 | `tool_use` | Claude wants tool(s) executed | Execute each `tool_use` block, send `tool_result`(s), re-request |
 | `pause_turn` | Server-side tool loop hit its iteration limit | Append the assistant turn and re-send unchanged — server resumes; do NOT add a "continue" user message |
-| `refusal` | Safety refusal | Check `stop_details` (`category`: "cyber"/"bio"/null, `explanation`); don't retry same prompt |
+| `refusal` | Safety refusal | Check `stop_details` (`category`: "cyber"/"bio"/"reasoning_extraction" (Fable 5)/null, `explanation`); don't retry same prompt |
 | `model_context_window_exceeded` | Context window exhausted (distinct from max_tokens) | Compact, truncate, or split the conversation |
 
 ```python

skills/claude-api-ops/references/structured-outputs.md

@@ -7,8 +7,10 @@ Two related features, same constrained-sampling mechanism:
 | **JSON outputs** | `output_config: {"format": {...}}` | Claude's response text (guaranteed valid JSON matching your schema) |
 | **Strict tool use** | `strict: true` on a tool definition | The `input` of tool calls |
 
-They can be combined in one request. Supported on Fable 5, Opus 4.8/4.7/4.6/4.5,
-Sonnet 4.6/4.5, Haiku 4.5.
+They can be combined in one request. Supported on Opus 4.8/4.7/4.6/4.5,
+Sonnet 4.6/4.5, Haiku 4.5 - **NOT Fable 5**. On Fable 5, enforce output shape
+via system-prompt instructions (the documented prefill replacement for that
+model) or strict tool use instead.
 
 **Naming:** the canonical parameter is `output_config.format`. The older
 top-level `output_format` parameter (and the `structured-outputs-2025-11-13`

skills/claude-code-ops/references/hooks-reference.md

@@ -101,7 +101,7 @@ Universal fields (any event):
   "stopReason": "why we stopped", // shown when continue:false
   "suppressOutput": true,         // hide stdout from transcript
   "systemMessage": "warning shown to user",
-  "terminalSequence": "]…"  // raw OSC sequence (v2.1.141+)
+  "terminalSequence": "\u001b]…"  // raw OSC sequence (v2.1.141+)
 }
 ```
 

skills/playwright-ops/SKILL.md

@@ -215,7 +215,7 @@ Always assert a logged-in signal before saving state, or you save a half-logged-
 
 | Knob | Setting | Notes |
 |------|---------|-------|
-| Workers | `workers: process.env.CI ? 1 : undefined` | Local: one per ~CPU core. CI runners are small — shard machines instead of oversubscribing |
+| Workers | `workers: process.env.CI ? 1 : undefined` | Local: half the logical CPU cores. CI runners are small — shard machines instead of oversubscribing |
 | File-level parallel | `fullyParallel: true` | Also makes sharding split per-test, not per-file |
 | Sharding | `npx playwright test --shard=1/4` | One shard per CI machine; merge blob reports after |
 | Retries | `retries: process.env.CI ? 2 : 0` | Pair with `trace: 'on-first-retry'`; treat "flaky" status as a bug queue, not a fix |

skills/terraform-ops/assets/github-actions-terraform.yml

@@ -75,7 +75,7 @@ jobs:
         working-directory: ${{ env.WORKING_DIR }}
 
       - name: trivy misconfig scan
-        uses: aquasecurity/trivy-action@0.33.1
+        uses: aquasecurity/trivy-action@v0.33.1
         with:
           scan-type: config
           scan-ref: ${{ env.WORKING_DIR }}

skills/terraform-ops/references/state-management.md

@@ -142,7 +142,7 @@ Why blocks beat `terraform import` CLI: the import is planned (you see exactly w
 
 After a successful apply, delete the `import` blocks — they're one-shot.
 
-### `removed` — forget without destroying (TF ≥ 1.7, OpenTofu ≥ 1.8)
+### `removed` — forget without destroying (TF ≥ 1.7, OpenTofu ≥ 1.7)
 
 ```hcl
 removed {