Fable 5 safeguards: 216 false-positive hard blocks in 22 days on a legitimate cloud-infra DevOps project

Fable 5 safeguard false-positive evidence — SNOG project (cloud lifecycle platform)

User: <redacted> · repo /Users/<user>/snog · window 2026-07-06 → 2026-07-28

216 'Fable 5's safeguards flagged this message' errors across 11 Claude Code sessions in 22 days,
peaking at 46/day. All on model claude-fable-5; work continued fine on claude-opus-5 after each flip.

Domain: enterprise cloud-lifecycle orchestrator (Azure/AWS/GCP). Legitimate vocabulary is
credential-vault / envelope-encryption / multi-tenant-isolation heavy, plus product names like
snog-brain (AI orchestrator) and self-heal (Day-4 ops). No security-offense work of any kind.

Sample flagged turns (all mundane DevOps):

• 2026-07-23T07:45Z — taking a browser screenshot of an admin page (browse CLI + snapshot).
• 2026-07-23T09:45Z — make images-all-amd64 TAG=<sha> + az acr login docker build/push.
• 2026-07-27T05:03Z — spawning a read-only code-audit subagent with a verification prompt.

Daily flag counts:

• 2026-07-06: 11
• 2026-07-07: 8
• 2026-07-11: 21
• 2026-07-12: 2
• 2026-07-13: 24
• 2026-07-16: 10
• 2026-07-20: 1
• 2026-07-23: 46
• 2026-07-24: 24
• 2026-07-26: 27
• 2026-07-27: 22
• 2026-07-28: 20

Session files (local transcripts, available on request):

• ~/.claude/projects/-Users-<user>-snog/346d2794-f546-4dbb-9108-3d8fff0c29e3.jsonl
• ~/.claude/projects/-Users-<user>-snog/bfa372cb-3b8f-444a-bcdc-2cc8324fc495.jsonl
• ~/.claude/projects/-Users-<user>-snog/01cabfc3-bf3c-4156-bc7c-d78f61857bc5.jsonl
• ~/.claude/projects/-Users-<user>-snog/7734bac2-277d-428c-8462-fd0135fce8d8.jsonl
• ~/.claude/projects/-Users-<user>-snog/981d40e5-2f7a-4e5f-9e78-8e5a58df48fe.jsonl
• ~/.claude/projects/-Users-<user>-snog/c22d7f15-73b0-4212-aa1d-f923d8478d1b.jsonl

Environment

• Claude Code CLI on macOS (darwin 25.5.0), model claude-fable-5
• Same sessions continue without any flags when switched to claude-opus-5

Expected

Legitimate cloud-infrastructure DevOps work (docker builds, browser QA screenshots, read-only code audits) should not trip dual-use safeguards.

Actual

216 hard-blocked turns in 22 days ("Fable 5's safeguards flagged this message"), making the model unusable on this project while still consuming the user's paid quota on retries.