test(snapshots): make byte/snapshot tests hermetic + re-seed baseline

The COL collision-scanner and the CLAUDE.md cascade resolve ~/.claude from process.env.HOME (active-config-reader). Snapshot/byte CLIs were spawned with the developer's real HOME, so they picked up installed plugins/skills and the user CLAUDE.md — making the v5.0.0 + default-output snapshots machine- and time-dependent. They were seeded 2026-05-01 with COL=1 (a real ~/.claude skill collision) and drifted to COL=0 after the polyrepo split: 26 pre-existing failures unrelated to Batch 1. Fix (test-only, no production change): - tests/helpers/hermetic-home.mjs — empty temp HOME, mirroring the pattern collision.test.mjs already uses for the COL unit test. - 7 harnesses spawn CLIs (or call lint()) under the hermetic HOME, so output depends only on committed fixtures. Determinism verified across runs. - Re-seeded all snapshots under hermetic HOME via SEED_SNAPSHOT/UPDATE_SNAPSHOT (added a SEED guard to the frozen v5.0.0 byte tests). Snapshots now reflect the fixture alone (COL=0, fixture-only activeConfig counts). - Also re-seeded the unused env-aware snapshots (manifest/whats-active/ plugin-health), which had baked dozens of real ~/.claude skill/plugin names into the committed repo — privacy cleanup. Full suite: 812/812 green, stable across 3 runs.
2026-06-18 12:26:00 +02:00 · 2026-06-18 12:26:00 +02:00 · 8216fb4175
commit 8216fb4175
parent 4b94da0f11
20 changed files with 326 additions and 3386 deletions
--- a/tests/helpers/hermetic-home.mjs
+++ b/tests/helpers/hermetic-home.mjs
@ -0,0 +1,40 @@
+/**
+ * Hermetic HOME for snapshot / byte-stability tests.
+ *
+ * The COL collision-scanner and the CLAUDE.md cascade resolve ~/.claude from
+ * process.env.HOME (see scanners/lib/active-config-reader.mjs — enumeratePlugins,
+ * enumerateSkills, walkClaudeMdCascade). A CLI spawned with the developer's real
+ * HOME picks up their installed plugins/skills and user CLAUDE.md, which makes
+ * byte-snapshots machine- and time-dependent: the snapshots seeded on one machine
+ * drift the moment another machine (or the same machine, later) has a different
+ * ~/.claude. Pointing HOME at an empty temp dir isolates every snapshot/byte test
+ * from user state, exactly as tests/scanners/collision.test.mjs already does for
+ * the COL unit test.
+ *
+ * Writes any CLI may make under HOME (sessions, baselines) land in the temp dir,
+ * never in the repo.
+ */
+import { mkdtempSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+export const HERMETIC_HOME = mkdtempSync(join(tmpdir(), 'config-audit-hermetic-home-'));
+
+/** Subprocess env with HOME/USERPROFILE redirected to the empty hermetic dir. */
+export function hermeticEnv(extra = {}) {
+  return { ...process.env, HOME: HERMETIC_HOME, USERPROFILE: HERMETIC_HOME, ...extra };
+}
+
+/** Run an in-process callback with process.env.HOME pointed at the hermetic dir. */
+export async function withHermeticHome(fn) {
+  const originalHome = process.env.HOME;
+  const originalProfile = process.env.USERPROFILE;
+  process.env.HOME = HERMETIC_HOME;
+  process.env.USERPROFILE = HERMETIC_HOME;
+  try {
+    return await fn();
+  } finally {
+    if (originalHome === undefined) delete process.env.HOME; else process.env.HOME = originalHome;
+    if (originalProfile === undefined) delete process.env.USERPROFILE; else process.env.USERPROFILE = originalProfile;
+  }
+}
--- a/tests/json-backcompat.test.mjs
+++ b/tests/json-backcompat.test.mjs
@ -26,16 +26,20 @@ import { resolve, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
-import { readFile, access, mkdir } from 'node:fs/promises';
+import { readFile, writeFile, access, mkdir } from 'node:fs/promises';
 import { homedir } from 'node:os';
+import { hermeticEnv, HERMETIC_HOME } from './helpers/hermetic-home.mjs';

 const exec = promisify(execFile);
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const REPO = resolve(__dirname, '..');
 const FIXTURE = resolve(REPO, 'tests/fixtures/marketplace-medium');
 const SNAPSHOT_DIR = resolve(REPO, 'tests/snapshots/v5.0.0');
-const BASELINE_DIR = resolve(homedir(), '.config-audit/baselines');
+// Baseline lives under the hermetic HOME so drift output is isolated from
+// the developer's ~/.config-audit state, matching the scan env below.
+const BASELINE_DIR = resolve(HERMETIC_HOME, '.config-audit/baselines');
 const DEFAULT_BASELINE = resolve(BASELINE_DIR, 'default.json');
+const SEED = process.env.SEED_SNAPSHOT === '1';

 async function runCli(scriptPath, args) {
  try {
@ -43,6 +47,7 @@ async function runCli(scriptPath, args) {
      timeout: 60000,
      cwd: REPO,
      maxBuffer: 10 * 1024 * 1024,
+      env: hermeticEnv(),
    });
    return { stdout: stdout || '', stderr: stderr || '' };
  } catch (err) {
@ -198,7 +203,12 @@ describe('SC-6 JSON backwards-compatibility — fixture-deterministic CLIs', ()
      const script = resolve(REPO, cli.script);
      const { stdout } = await runCli(script, [FIXTURE, '--json']);
      const actual = JSON.parse(stdout);
-      const expected = JSON.parse(await readFile(resolve(SNAPSHOT_DIR, cli.snapshot), 'utf8'));
+      const snapshotPath = resolve(SNAPSHOT_DIR, cli.snapshot);
+      if (SEED) {
+        await writeFile(snapshotPath, JSON.stringify(actual, null, 2) + '\n', 'utf8');
+        return;
+      }
+      const expected = JSON.parse(await readFile(snapshotPath, 'utf8'));
      assert.deepStrictEqual(cli.normalize(actual), cli.normalize(expected));
    });
  }
@ -219,7 +229,12 @@ describe('SC-6 JSON backwards-compatibility — drift-cli', () => {
    const script = resolve(REPO, 'scanners/drift-cli.mjs');
    const { stdout } = await runCli(script, [FIXTURE, '--json']);
    const actual = JSON.parse(stdout);
-    const expected = JSON.parse(await readFile(resolve(SNAPSHOT_DIR, 'drift.json'), 'utf8'));
+    const snapshotPath = resolve(SNAPSHOT_DIR, 'drift.json');
+    if (SEED) {
+      await writeFile(snapshotPath, JSON.stringify(actual, null, 2) + '\n', 'utf8');
+      return;
+    }
+    const expected = JSON.parse(await readFile(snapshotPath, 'utf8'));
    assert.deepStrictEqual(normalizeDrift(actual), normalizeDrift(expected));
  });
 });
--- a/tests/raw-backcompat.test.mjs
+++ b/tests/raw-backcompat.test.mjs
@ -23,8 +23,9 @@ import { resolve, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
-import { readFile, access, mkdir } from 'node:fs/promises';
+import { readFile, writeFile, access, mkdir } from 'node:fs/promises';
 import { homedir } from 'node:os';
+import { hermeticEnv, HERMETIC_HOME } from './helpers/hermetic-home.mjs';

 const exec = promisify(execFile);
 const __dirname = dirname(fileURLToPath(import.meta.url));
@ -32,8 +33,10 @@ const REPO = resolve(__dirname, '..');
 const FIXTURE = resolve(REPO, 'tests/fixtures/marketplace-medium');
 const SNAPSHOT_DIR = resolve(REPO, 'tests/snapshots/v5.0.0');
 const STDERR_SNAPSHOT_DIR = resolve(REPO, 'tests/snapshots/v5.0.0-stderr');
-const BASELINE_DIR = resolve(homedir(), '.config-audit/baselines');
+// Baseline under the hermetic HOME so drift is isolated from ~/.config-audit.
+const BASELINE_DIR = resolve(HERMETIC_HOME, '.config-audit/baselines');
 const DEFAULT_BASELINE = resolve(BASELINE_DIR, 'default.json');
+const SEED = process.env.SEED_SNAPSHOT === '1';

 async function runCli(scriptPath, args) {
  try {
@ -41,6 +44,7 @@ async function runCli(scriptPath, args) {
      timeout: 60000,
      cwd: REPO,
      maxBuffer: 10 * 1024 * 1024,
+      env: hermeticEnv(),
    });
    return { stdout: stdout || '', stderr: stderr || '' };
  } catch (err) {
@ -263,7 +267,12 @@ describe('SC-7 --raw posture stderr scorecard verbatim', () => {
  it('posture --raw stderr matches tests/snapshots/v5.0.0-stderr/posture.txt (modulo Xms)', async () => {
    const script = resolve(REPO, 'scanners/posture.mjs');
    const { stderr } = await runCli(script, [FIXTURE, '--raw']);
-    const expected = await readFile(resolve(STDERR_SNAPSHOT_DIR, 'posture.txt'), 'utf8');
+    const stderrSnapshotPath = resolve(STDERR_SNAPSHOT_DIR, 'posture.txt');
+    if (SEED) {
+      await writeFile(stderrSnapshotPath, stderr, 'utf8');
+      return;
+    }
+    const expected = await readFile(stderrSnapshotPath, 'utf8');
    assert.equal(
      normalizeStderrDurations(stderr.trim()),
      normalizeStderrDurations(expected.trim()),
--- a/tests/scanners/cli-humanizer.test.mjs
+++ b/tests/scanners/cli-humanizer.test.mjs
@ -5,7 +5,7 @@ import { fileURLToPath } from 'node:url';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { readFile, writeFile, unlink, mkdir, access } from 'node:fs/promises';
-import { homedir } from 'node:os';
+import { hermeticEnv, HERMETIC_HOME } from '../helpers/hermetic-home.mjs';

 const exec = promisify(execFile);
 const __dirname = dirname(fileURLToPath(import.meta.url));
@ -13,7 +13,7 @@ const REPO = resolve(__dirname, '../..');
 const FIXTURE = resolve(REPO, 'tests/fixtures/marketplace-medium');
 const BROKEN_PLUGIN = resolve(REPO, 'tests/fixtures/broken-plugin');

-const BASELINE_DIR = resolve(homedir(), '.config-audit/baselines');
+const BASELINE_DIR = resolve(HERMETIC_HOME, '.config-audit/baselines');
 const DEFAULT_BASELINE = resolve(BASELINE_DIR, 'default.json');

 /**
@ -25,7 +25,7 @@ async function runCli(cliPath, args, env = {}) {
    const { stdout, stderr } = await exec('node', [cliPath, ...args], {
      timeout: 60000,
      cwd: REPO,
-      env: { ...process.env, ...env },
+      env: hermeticEnv(env),
      maxBuffer: 10 * 1024 * 1024,
    });
    return { stdout: stdout || '', stderr: stderr || '', code: 0 };
--- a/tests/scanners/lint-default-output.test.mjs
+++ b/tests/scanners/lint-default-output.test.mjs
@ -3,6 +3,7 @@ import assert from 'node:assert/strict';
 import { resolve, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { lint } from '../lint-default-output.mjs';
+import { withHermeticHome } from '../helpers/hermetic-home.mjs';

 const __dirname = dirname(fileURLToPath(import.meta.url));
 const REPO = resolve(__dirname, '../..');
@ -10,7 +11,9 @@ const FIXTURE = resolve(REPO, 'tests/fixtures/marketplace-medium');

 describe('SC-3 forbidden-words lint (default-output)', () => {
  it('produces no tier1 or tier3 violations across the 6 prose CLIs', async () => {
-    const { failures, warnings } = await lint(FIXTURE);
+    // lint() spawns the prose CLIs inheriting process.env; HOME isolation keeps
+    // the COL collision scanner off the developer's real ~/.claude.
+    const { failures, warnings } = await withHermeticHome(() => lint(FIXTURE));
    const failureSummary = failures
      .map((f) => `[${f.cli}] tier${f.tier} "${f.word}" × ${f.count}`)
      .join('\n  ');
--- a/tests/scanners/posture-humanizer.test.mjs
+++ b/tests/scanners/posture-humanizer.test.mjs
@ -5,6 +5,7 @@ import { fileURLToPath } from 'node:url';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { readFile, unlink } from 'node:fs/promises';
+import { hermeticEnv } from '../helpers/hermetic-home.mjs';

 const exec = promisify(execFile);
 const __dirname = dirname(fileURLToPath(import.meta.url));
@ -49,6 +50,7 @@ async function runPosture(flags) {
  const proc = await exec('node', [CLI, FIXTURE, ...flags], {
    timeout: 60000,
    cwd: REPO,
+    env: hermeticEnv(),
  }).catch(err => err); // posture exits non-zero on findings — capture either way
  return {
    stdout: proc.stdout || '',
--- a/tests/scanners/scan-orchestrator-humanizer.test.mjs
+++ b/tests/scanners/scan-orchestrator-humanizer.test.mjs
@ -5,6 +5,7 @@ import { fileURLToPath } from 'node:url';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { readFile, unlink } from 'node:fs/promises';
+import { hermeticEnv } from '../helpers/hermetic-home.mjs';

 const exec = promisify(execFile);
 const __dirname = dirname(fileURLToPath(import.meta.url));
@ -44,6 +45,7 @@ async function runOrchestrator(flags) {
    await exec('node', [CLI, FIXTURE, '--output-file', out, ...flags], {
      timeout: 60000,
      cwd: REPO,
+      env: hermeticEnv(),
    });
    const written = await readFile(out, 'utf-8');
    return JSON.parse(written);
--- a/tests/snapshot-default-output.test.mjs
+++ b/tests/snapshot-default-output.test.mjs
@ -23,6 +23,7 @@ import { fileURLToPath } from 'node:url';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { readFile, writeFile } from 'node:fs/promises';
+import { hermeticEnv } from './helpers/hermetic-home.mjs';

 const exec = promisify(execFile);
 const __dirname = dirname(fileURLToPath(import.meta.url));
@ -38,6 +39,7 @@ async function runCli(scriptPath, args) {
      timeout: 60000,
      cwd: REPO,
      maxBuffer: 10 * 1024 * 1024,
+      env: hermeticEnv(),
    });
    return { stdout: stdout || '', stderr: stderr || '' };
  } catch (err) {
--- a/tests/snapshots/default-output/posture.json
+++ b/tests/snapshots/default-output/posture.json
@ -1,4 +1,4 @@
 {
  "kind": "text",
-  "payload": "`[CML] CLAUDE.md Linter`: 0 finding(s) (0ms)\n  `[SET] Settings Validator`: 0 finding(s) (0ms)\n  `[HKV] Hook Validator`: 0 finding(s) (0ms)\n  `[RUL] Rules Validator`: 0 finding(s) (0ms)\n  `[MCP] MCP Config Validator`: 0 finding(s) (0ms)\n  `[IMP] Import Resolver`: 0 finding(s) (0ms)\n  `[CNF] Conflict Detector`: 0 finding(s) (0ms)\n  `[GAP] Feature Gap Scanner`: 17 finding(s) (0ms)\n  `[TOK] Token Hotspots`: 1 finding(s) (0ms)\n  `[CPS] Cache-Prefix Stability`: 0 finding(s) (0ms)\n  `[DIS] Disabled-In-Schema`: 1 finding(s) (0ms)\n  `[COL] Plugin Skill Collision`: 1 finding(s) (0ms)\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n Configuration health\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n Health: A (97/100) — Healthy setup, only minor polish needed\n 9 areas reviewed\n\n Area scores\n ───────────\n `CLAUDE.md` ........... A (100)     `Settings` ............ A (90)\n `Hooks` ............... A (100)     `Rules` ............... A (100)\n `MCP` ................. A (100)     `Imports` ............. A (100)\n `Conflicts` ........... A (100)     `Token Efficiency` .... A (90)\n `Plugin Hygiene` ...... A (90)\n\n 17 ways you could get more out of Claude Code — see /config-audit feature-gap\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+  "payload": "`[CML] CLAUDE.md Linter`: 1 finding(s) (0ms)\n  `[SET] Settings Validator`: 0 finding(s) (0ms)\n  `[HKV] Hook Validator`: 0 finding(s) (0ms)\n  `[RUL] Rules Validator`: 0 finding(s) (0ms)\n  `[MCP] MCP Config Validator`: 0 finding(s) (0ms)\n  `[IMP] Import Resolver`: 0 finding(s) (0ms)\n  `[CNF] Conflict Detector`: 0 finding(s) (0ms)\n  `[GAP] Feature Gap Scanner`: 17 finding(s) (0ms)\n  `[TOK] Token Hotspots`: 1 finding(s) (0ms)\n  `[CPS] Cache-Prefix Stability`: 0 finding(s) (0ms)\n  `[DIS] Disabled-In-Schema`: 1 finding(s) (0ms)\n  `[COL] Plugin Skill Collision`: 0 finding(s) (0ms)\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n Configuration health\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n Health: A (97/100) — Healthy setup, only minor polish needed\n 9 areas reviewed\n\n Area scores\n ───────────\n `CLAUDE.md` ........... A (90)      `Settings` ............ A (90)\n `Hooks` ............... A (100)     `Rules` ............... A (100)\n `MCP` ................. A (100)     `Imports` ............. A (100)\n `Conflicts` ........... A (100)     `Token Efficiency` .... A (90)\n `Plugin Hygiene` ...... A (100)\n\n 17 ways you could get more out of Claude Code — see /config-audit feature-gap\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
 }
--- a/tests/snapshots/default-output/scan-orchestrator.json
+++ b/tests/snapshots/default-output/scan-orchestrator.json
@ -13,12 +13,29 @@
        "status": "ok",
        "files_scanned": 1,
        "duration_ms": 0,
-        "findings": [],
+        "findings": [
+          {
+            "id": "CA-CML-001",
+            "scanner": "CML",
+            "severity": "low",
+            "title": "Your instructions file is missing common sections",
+            "description": "Sections like Project Overview, Commands, and Conventions help Claude apply your guidance consistently across tasks.",
+            "file": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md",
+            "line": null,
+            "evidence": "Present sections: Marketplace Medium, Plugins, Commands, Conventions",
+            "category": null,
+            "recommendation": "Add the missing sections noted in the details.",
+            "autoFixable": false,
+            "userImpactCategory": "Configuration mistake",
+            "userActionLanguage": "Optional cleanup",
+            "relevanceContext": "test-fixture-no-impact"
+          }
+        ],
        "counts": {
          "critical": 0,
          "high": 0,
          "medium": 0,
-          "low": 0,
+          "low": 1,
          "info": 0
        }
      },
@ -432,69 +449,53 @@
              "Review whether this source needs to load on every turn."
            ]
          },
-          {
-            "source": "mcp:sadhguru-wisdom (plugin:sadhguru-wisdom)",
-            "estimated_tokens": 500,
-            "rank": 2,
-            "recommendations": [
-              "Review whether this source needs to load on every turn."
-            ]
-          },
-          {
-            "source": "mcp:vegnorm-rag (plugin:vegnormalene)",
-            "estimated_tokens": 500,
-            "rank": 3,
-            "recommendations": [
-              "Review whether this source needs to load on every turn."
-            ]
-          },
          {
            "source": "CLAUDE.md",
            "estimated_tokens": 116,
-            "rank": 4,
+            "rank": 2,
            "recommendations": [
              "Move volatile top-of-file content to the bottom or extract to an @import-ed file.",
              "Split overlong CLAUDE.md into focused @imports (≤200 lines each)."
            ],
-            "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md"
+            "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md"
          },
          {
            "source": "hooks/hooks.json",
            "estimated_tokens": 81,
+            "rank": 3,
+            "recommendations": [
+              "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
+              "Move rarely-used permissions to a project-local override."
+            ],
+            "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/hooks/hooks.json"
+          },
+          {
+            "source": ".claude/settings.json",
+            "estimated_tokens": 59,
+            "rank": 4,
+            "recommendations": [
+              "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
+              "Move rarely-used permissions to a project-local override."
+            ],
+            "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json"
+          },
+          {
+            "source": ".mcp.json",
+            "estimated_tokens": 53,
            "rank": 5,
            "recommendations": [
              "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
              "Move rarely-used permissions to a project-local override."
            ],
-            "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/hooks/hooks.json"
-          },
-          {
-            "source": ".claude/settings.json",
-            "estimated_tokens": 59,
-            "rank": 6,
-            "recommendations": [
-              "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
-              "Move rarely-used permissions to a project-local override."
-            ],
-            "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json"
-          },
-          {
-            "source": ".mcp.json",
-            "estimated_tokens": 53,
-            "rank": 7,
-            "recommendations": [
-              "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
-              "Move rarely-used permissions to a project-local override."
-            ],
-            "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.mcp.json"
+            "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.mcp.json"
          }
        ],
-        "total_estimated_tokens": 1809,
+        "total_estimated_tokens": 809,
        "activeConfig": {
          "claudeMdEstimatedTokens": "<ANCESTOR_DERIVED>",
-          "mcpServerCount": 3,
-          "pluginCount": 41,
-          "skillCount": 65
+          "mcpServerCount": 1,
+          "pluginCount": 0,
+          "skillCount": 0
        }
      },
      {
@ -523,7 +524,7 @@
            "severity": "low",
            "title": "A tool is in both the let-in list and the shut-out list",
            "description": "When a tool is in both lists, the shut-out always wins, so the let-in entry does nothing. It looks like the tool is approved, but it isn't.",
-            "file": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json",
+            "file": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json",
            "line": null,
            "evidence": "Read: allow=\"Read(src/**)\" + deny=\"Read(./.env)\"",
            "category": "permissions-hygiene",
@ -545,45 +546,14 @@
      {
        "scanner": "COL",
        "status": "ok",
-        "files_scanned": 65,
+        "files_scanned": 0,
        "duration_ms": 0,
-        "findings": [
-          {
-            "id": "CA-COL-001",
-            "scanner": "COL",
-            "severity": "low",
-            "title": "Two plugins both define a skill with the same name",
-            "description": "When two plugins offer the same skill name, only one wins, and which one is hard to predict.",
-            "file": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/okr/skills/okr-offentlig-sektor/SKILL.md",
-            "line": null,
-            "evidence": "name=\"okr-offentlig-sektor\"; plugins=okr,okr",
-            "category": "plugin-hygiene",
-            "recommendation": "Rename the skill in one of the plugins, or disable the one you don't use.",
-            "autoFixable": false,
-            "userImpactCategory": "Conflict",
-            "userActionLanguage": "Optional cleanup",
-            "relevanceContext": "affects-everyone",
-            "details": {
-              "namespaces": [
-                {
-                  "source": "plugin:okr",
-                  "name": "okr-offentlig-sektor",
-                  "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/okr/skills/okr-offentlig-sektor/SKILL.md"
-                },
-                {
-                  "source": "plugin:okr",
-                  "name": "okr-offentlig-sektor",
-                  "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-privat/plugins/okr/skills/okr-offentlig-sektor/SKILL.md"
-                }
-              ]
-            }
-          }
-        ],
+        "findings": [],
        "counts": {
          "critical": 0,
          "high": 0,
          "medium": 0,
-          "low": 1,
+          "low": 0,
          "info": 0
        }
      }
--- a/tests/snapshots/default-output/token-hotspots.json
+++ b/tests/snapshots/default-output/token-hotspots.json
@ -5,7 +5,7 @@
    "status": "ok",
    "files_scanned": 2,
    "duration_ms": 0,
-    "total_estimated_tokens": 1809,
+    "total_estimated_tokens": 809,
    "hotspots": [
      {
        "source": "mcp:memory (.mcp.json)",
@ -15,61 +15,45 @@
          "Review whether this source needs to load on every turn."
        ]
      },
-      {
-        "source": "mcp:sadhguru-wisdom (plugin:sadhguru-wisdom)",
-        "estimated_tokens": 500,
-        "rank": 2,
-        "recommendations": [
-          "Review whether this source needs to load on every turn."
-        ]
-      },
-      {
-        "source": "mcp:vegnorm-rag (plugin:vegnormalene)",
-        "estimated_tokens": 500,
-        "rank": 3,
-        "recommendations": [
-          "Review whether this source needs to load on every turn."
-        ]
-      },
      {
        "source": "CLAUDE.md",
        "estimated_tokens": 116,
-        "rank": 4,
+        "rank": 2,
        "recommendations": [
          "Move volatile top-of-file content to the bottom or extract to an @import-ed file.",
          "Split overlong CLAUDE.md into focused @imports (≤200 lines each)."
        ],
-        "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md"
+        "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md"
      },
      {
        "source": "hooks/hooks.json",
        "estimated_tokens": 81,
+        "rank": 3,
+        "recommendations": [
+          "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
+          "Move rarely-used permissions to a project-local override."
+        ],
+        "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/hooks/hooks.json"
+      },
+      {
+        "source": ".claude/settings.json",
+        "estimated_tokens": 59,
+        "rank": 4,
+        "recommendations": [
+          "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
+          "Move rarely-used permissions to a project-local override."
+        ],
+        "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json"
+      },
+      {
+        "source": ".mcp.json",
+        "estimated_tokens": 53,
        "rank": 5,
        "recommendations": [
          "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
          "Move rarely-used permissions to a project-local override."
        ],
-        "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/hooks/hooks.json"
-      },
-      {
-        "source": ".claude/settings.json",
-        "estimated_tokens": 59,
-        "rank": 6,
-        "recommendations": [
-          "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
-          "Move rarely-used permissions to a project-local override."
-        ],
-        "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json"
-      },
-      {
-        "source": ".mcp.json",
-        "estimated_tokens": 53,
-        "rank": 7,
-        "recommendations": [
-          "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
-          "Move rarely-used permissions to a project-local override."
-        ],
-        "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.mcp.json"
+        "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.mcp.json"
      }
    ],
    "findings": [
--- a/tests/snapshots/v5.0.0-stderr/posture.txt
+++ b/tests/snapshots/v5.0.0-stderr/posture.txt
@ -1,15 +1,15 @@
-  [CML] CLAUDE.md Linter: 0 finding(s) (9ms)
-  [SET] Settings Validator: 0 finding(s) (0ms)
-  [HKV] Hook Validator: 0 finding(s) (2ms)
-  [RUL] Rules Validator: 0 finding(s) (0ms)
-  [MCP] MCP Config Validator: 0 finding(s) (1ms)
+  [CML] CLAUDE.md Linter: 1 finding(s) (13ms)
+  [SET] Settings Validator: 0 finding(s) (1ms)
+  [HKV] Hook Validator: 0 finding(s) (1ms)
+  [RUL] Rules Validator: 0 finding(s) (1ms)
+  [MCP] MCP Config Validator: 0 finding(s) (0ms)
  [IMP] Import Resolver: 0 finding(s) (1ms)
  [CNF] Conflict Detector: 0 finding(s) (1ms)
-  [GAP] Feature Gap Scanner: 17 finding(s) (3ms)
-  [TOK] Token Hotspots: 1 finding(s) (116ms)
+  [GAP] Feature Gap Scanner: 17 finding(s) (2ms)
+  [TOK] Token Hotspots: 1 finding(s) (8ms)
  [CPS] Cache-Prefix Stability: 0 finding(s) (1ms)
  [DIS] Disabled-In-Schema: 1 finding(s) (1ms)
-  [COL] Plugin Skill Collision: 1 finding(s) (77ms)
+  [COL] Plugin Skill Collision: 0 finding(s) (0ms)

 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 Config-Audit Health Score
@ -19,11 +19,11 @@

 Area Scores
 ───────────
- CLAUDE.md ........... A (100)     Settings ............ A (90)
+ CLAUDE.md ........... A (90)      Settings ............ A (90)
 Hooks ............... A (100)     Rules ............... A (100)
 MCP ................. A (100)     Imports ............. A (100)
 Conflicts ........... A (100)     Token Efficiency .... A (90)
- Plugin Hygiene ...... A (90)
+ Plugin Hygiene ...... A (100)

 17 opportunities available — run /config-audit feature-gap for recommendations

--- a/tests/snapshots/v5.0.0/drift.json
+++ b/tests/snapshots/v5.0.0/drift.json
@ -2,6 +2,19 @@
  "newFindings": [],
  "resolvedFindings": [],
  "unchangedFindings": [
+    {
+      "id": "CA-CML-001",
+      "scanner": "CML",
+      "severity": "low",
+      "title": "Missing recommended sections",
+      "description": "CLAUDE.md is missing: Project overview, Architecture",
+      "file": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md",
+      "line": null,
+      "evidence": "Present sections: Marketplace Medium, Plugins, Commands, Conventions",
+      "category": null,
+      "recommendation": "Add sections for: Project overview, Architecture",
+      "autoFixable": false
+    },
    {
      "id": "CA-GAP-001",
      "scanner": "GAP",
@ -242,39 +255,12 @@
      "severity": "low",
      "title": "Tool listed in both permissions.deny and permissions.allow",
      "description": ".claude/settings.json contains 1 tool present in both deny and allow lists. The deny list wins — the allow entries are dead config but still load on every turn and may confuse future readers about intent.",
-      "file": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json",
+      "file": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json",
      "line": null,
      "evidence": "Read: allow=\"Read(src/**)\" + deny=\"Read(./.env)\"",
      "category": "permissions-hygiene",
      "recommendation": "Remove the redundant allow entries. If you actually want this tool enabled, remove it from the deny list instead. Settings should express intent clearly.",
      "autoFixable": false
-    },
-    {
-      "id": "CA-COL-001",
-      "scanner": "COL",
-      "severity": "low",
-      "title": "Skill name \"okr-offentlig-sektor\" used by multiple plugins",
-      "description": "2 plugins (okr, okr) expose a skill named \"okr-offentlig-sektor\". Even when invocation is namespaced via /plugin:skill, shared names create ambiguity in error messages, search results, and the plugin-skills enumeration.",
-      "file": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/okr/skills/okr-offentlig-sektor/SKILL.md",
-      "line": null,
-      "evidence": "name=\"okr-offentlig-sektor\"; plugins=okr,okr",
-      "category": "plugin-hygiene",
-      "recommendation": "Coordinate naming across plugins, or rename one to clarify intent. The shared name forces every reader to disambiguate by source.",
-      "autoFixable": false,
-      "details": {
-        "namespaces": [
-          {
-            "source": "plugin:okr",
-            "name": "okr-offentlig-sektor",
-            "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/okr/skills/okr-offentlig-sektor/SKILL.md"
-          },
-          {
-            "source": "plugin:okr",
-            "name": "okr-offentlig-sektor",
-            "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-privat/plugins/okr/skills/okr-offentlig-sektor/SKILL.md"
-          }
-        ]
-      }
    }
  ],
  "movedFindings": [],
@ -293,11 +279,11 @@
    {
      "name": "CLAUDE.md",
      "before": {
-        "score": 100,
+        "score": 90,
        "grade": "A"
      },
      "after": {
-        "score": 100,
+        "score": 90,
        "grade": "A"
      },
      "delta": 0
@ -401,11 +387,11 @@
    {
      "name": "Plugin Hygiene",
      "before": {
-        "score": 90,
+        "score": 100,
        "grade": "A"
      },
      "after": {
-        "score": 90,
+        "score": 100,
        "grade": "A"
      },
      "delta": 0
--- a/tests/snapshots/v5.0.0/fix-cli.json
+++ b/tests/snapshots/v5.0.0/fix-cli.json
@ -5,6 +5,12 @@
  "verified": [],
  "regressions": [],
  "manual": [
+    {
+      "findingId": "CA-CML-001",
+      "title": "Missing recommended sections",
+      "file": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md",
+      "recommendation": "Add sections for: Project overview, Architecture"
+    },
    {
      "findingId": "CA-GAP-001",
      "title": "No custom skills or commands",
@ -116,14 +122,8 @@
    {
      "findingId": "CA-DIS-001",
      "title": "Tool listed in both permissions.deny and permissions.allow",
-      "file": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json",
+      "file": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json",
      "recommendation": "Remove the redundant allow entries. If you actually want this tool enabled, remove it from the deny list instead. Settings should express intent clearly."
-    },
-    {
-      "findingId": "CA-COL-001",
-      "title": "Skill name \"okr-offentlig-sektor\" used by multiple plugins",
-      "file": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/okr/skills/okr-offentlig-sektor/SKILL.md",
-      "recommendation": "Coordinate naming across plugins, or rename one to clarify intent. The shared name forces every reader to disambiguate by source."
    }
  ],
  "backupId": null
--- a/tests/snapshots/v5.0.0/manifest.json
+++ b/tests/snapshots/v5.0.0/manifest.json
--- a/tests/snapshots/v5.0.0/plugin-health.json
+++ b/tests/snapshots/v5.0.0/plugin-health.json
@ -1,14 +1,28 @@
 {
  "scanner": "PLH",
  "status": "ok",
-  "files_scanned": 1,
-  "duration_ms": 17,
-  "findings": [],
+  "files_scanned": 0,
+  "duration_ms": 2,
+  "findings": [
+    {
+      "id": "CA-PLH-001",
+      "scanner": "PLH",
+      "severity": "info",
+      "title": "No plugins found",
+      "description": "No Claude Code plugins found under tests/fixtures/marketplace-medium",
+      "file": null,
+      "line": null,
+      "evidence": null,
+      "category": null,
+      "recommendation": "Ensure plugins have .claude-plugin/plugin.json",
+      "autoFixable": false
+    }
+  ],
  "counts": {
    "critical": 0,
    "high": 0,
    "medium": 0,
    "low": 0,
-    "info": 0
+    "info": 1
  }
 }
--- a/tests/snapshots/v5.0.0/posture.json
+++ b/tests/snapshots/v5.0.0/posture.json
@ -17,8 +17,8 @@
      "id": "claude_md",
      "name": "CLAUDE.md",
      "grade": "A",
-      "score": 100,
-      "findingCount": 0
+      "score": 90,
+      "findingCount": 1
    },
    {
      "id": "settings",
@ -80,8 +80,8 @@
      "id": "plugin_hygiene",
      "name": "Plugin Hygiene",
      "grade": "A",
-      "score": 90,
-      "findingCount": 1
+      "score": 100,
+      "findingCount": 0
    }
  ],
  "overallGrade": "A",
@ -93,8 +93,8 @@
  "opportunityCount": 17,
  "scannerEnvelope": {
    "meta": {
-      "target": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium",
-      "timestamp": "2026-05-01T14:44:22.725Z",
+      "target": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium",
+      "timestamp": "2026-06-18T10:18:35.634Z",
      "version": "2.2.0",
      "tool": "config-audit"
    },
@ -103,13 +103,27 @@
        "scanner": "CML",
        "status": "ok",
        "files_scanned": 1,
-        "duration_ms": 1,
-        "findings": [],
+        "duration_ms": 3,
+        "findings": [
+          {
+            "id": "CA-CML-001",
+            "scanner": "CML",
+            "severity": "low",
+            "title": "Missing recommended sections",
+            "description": "CLAUDE.md is missing: Project overview, Architecture",
+            "file": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md",
+            "line": null,
+            "evidence": "Present sections: Marketplace Medium, Plugins, Commands, Conventions",
+            "category": null,
+            "recommendation": "Add sections for: Project overview, Architecture",
+            "autoFixable": false
+          }
+        ],
        "counts": {
          "critical": 0,
          "high": 0,
          "medium": 0,
-          "low": 0,
+          "low": 1,
          "info": 0
        }
      },
@ -117,7 +131,7 @@
        "scanner": "SET",
        "status": "ok",
        "files_scanned": 1,
-        "duration_ms": 0,
+        "duration_ms": 1,
        "findings": [],
        "counts": {
          "critical": 0,
@ -145,7 +159,7 @@
        "scanner": "RUL",
        "status": "skipped",
        "files_scanned": 0,
-        "duration_ms": 1,
+        "duration_ms": 0,
        "findings": [],
        "counts": {
          "critical": 0,
@ -173,7 +187,7 @@
        "scanner": "IMP",
        "status": "ok",
        "files_scanned": 1,
-        "duration_ms": 1,
+        "duration_ms": 2,
        "findings": [],
        "counts": {
          "critical": 0,
@ -187,7 +201,7 @@
        "scanner": "CNF",
        "status": "ok",
        "files_scanned": 2,
-        "duration_ms": 1,
+        "duration_ms": 0,
        "findings": [],
        "counts": {
          "critical": 0,
@ -201,7 +215,7 @@
        "scanner": "GAP",
        "status": "ok",
        "files_scanned": 4,
-        "duration_ms": 3,
+        "duration_ms": 2,
        "findings": [
          {
            "id": "CA-GAP-001",
@ -437,7 +451,7 @@
        "scanner": "TOK",
        "status": "ok",
        "files_scanned": 2,
-        "duration_ms": 167,
+        "duration_ms": 8,
        "findings": [
          {
            "id": "CA-TOK-001",
@ -469,69 +483,53 @@
              "Review whether this source needs to load on every turn."
            ]
          },
-          {
-            "source": "mcp:sadhguru-wisdom (plugin:sadhguru-wisdom)",
-            "estimated_tokens": 500,
-            "rank": 2,
-            "recommendations": [
-              "Review whether this source needs to load on every turn."
-            ]
-          },
-          {
-            "source": "mcp:vegnorm-rag (plugin:vegnormalene)",
-            "estimated_tokens": 500,
-            "rank": 3,
-            "recommendations": [
-              "Review whether this source needs to load on every turn."
-            ]
-          },
          {
            "source": "CLAUDE.md",
            "estimated_tokens": 116,
-            "rank": 4,
+            "rank": 2,
            "recommendations": [
              "Move volatile top-of-file content to the bottom or extract to an @import-ed file.",
              "Split overlong CLAUDE.md into focused @imports (≤200 lines each)."
            ],
-            "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md"
+            "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md"
          },
          {
            "source": "hooks/hooks.json",
            "estimated_tokens": 81,
+            "rank": 3,
+            "recommendations": [
+              "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
+              "Move rarely-used permissions to a project-local override."
+            ],
+            "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/hooks/hooks.json"
+          },
+          {
+            "source": ".claude/settings.json",
+            "estimated_tokens": 59,
+            "rank": 4,
+            "recommendations": [
+              "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
+              "Move rarely-used permissions to a project-local override."
+            ],
+            "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json"
+          },
+          {
+            "source": ".mcp.json",
+            "estimated_tokens": 53,
            "rank": 5,
            "recommendations": [
              "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
              "Move rarely-used permissions to a project-local override."
            ],
-            "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/hooks/hooks.json"
-          },
-          {
-            "source": ".claude/settings.json",
-            "estimated_tokens": 59,
-            "rank": 6,
-            "recommendations": [
-              "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
-              "Move rarely-used permissions to a project-local override."
-            ],
-            "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json"
-          },
-          {
-            "source": ".mcp.json",
-            "estimated_tokens": 53,
-            "rank": 7,
-            "recommendations": [
-              "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
-              "Move rarely-used permissions to a project-local override."
-            ],
-            "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.mcp.json"
+            "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.mcp.json"
          }
        ],
-        "total_estimated_tokens": 1809,
+        "total_estimated_tokens": 809,
        "activeConfig": {
-          "claudeMdEstimatedTokens": 5716,
-          "mcpServerCount": 3,
-          "pluginCount": 41,
-          "skillCount": 65
+          "claudeMdEstimatedTokens": 1639,
+          "mcpServerCount": 1,
+          "pluginCount": 0,
+          "skillCount": 0
        }
      },
      {
@ -560,7 +558,7 @@
            "severity": "low",
            "title": "Tool listed in both permissions.deny and permissions.allow",
            "description": ".claude/settings.json contains 1 tool present in both deny and allow lists. The deny list wins — the allow entries are dead config but still load on every turn and may confuse future readers about intent.",
-            "file": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json",
+            "file": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json",
            "line": null,
            "evidence": "Read: allow=\"Read(src/**)\" + deny=\"Read(./.env)\"",
            "category": "permissions-hygiene",
@ -579,42 +577,14 @@
      {
        "scanner": "COL",
        "status": "ok",
-        "files_scanned": 65,
-        "duration_ms": 107,
-        "findings": [
-          {
-            "id": "CA-COL-001",
-            "scanner": "COL",
-            "severity": "low",
-            "title": "Skill name \"okr-offentlig-sektor\" used by multiple plugins",
-            "description": "2 plugins (okr, okr) expose a skill named \"okr-offentlig-sektor\". Even when invocation is namespaced via /plugin:skill, shared names create ambiguity in error messages, search results, and the plugin-skills enumeration.",
-            "file": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/okr/skills/okr-offentlig-sektor/SKILL.md",
-            "line": null,
-            "evidence": "name=\"okr-offentlig-sektor\"; plugins=okr,okr",
-            "category": "plugin-hygiene",
-            "recommendation": "Coordinate naming across plugins, or rename one to clarify intent. The shared name forces every reader to disambiguate by source.",
-            "autoFixable": false,
-            "details": {
-              "namespaces": [
-                {
-                  "source": "plugin:okr",
-                  "name": "okr-offentlig-sektor",
-                  "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/okr/skills/okr-offentlig-sektor/SKILL.md"
-                },
-                {
-                  "source": "plugin:okr",
-                  "name": "okr-offentlig-sektor",
-                  "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-privat/plugins/okr/skills/okr-offentlig-sektor/SKILL.md"
-                }
-              ]
-            }
-          }
-        ],
+        "files_scanned": 0,
+        "duration_ms": 0,
+        "findings": [],
        "counts": {
          "critical": 0,
          "high": 0,
          "medium": 0,
-          "low": 1,
+          "low": 0,
          "info": 0
        }
      }
@ -636,4 +606,4 @@
      "scanners_skipped": 1
    }
  }
-}
+}
--- a/tests/snapshots/v5.0.0/scan-orchestrator.json
+++ b/tests/snapshots/v5.0.0/scan-orchestrator.json
@ -1,7 +1,7 @@
 {
  "meta": {
-    "target": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium",
-    "timestamp": "2026-05-01T14:44:16.877Z",
+    "target": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium",
+    "timestamp": "2026-06-18T10:18:35.439Z",
    "version": "2.2.0",
    "tool": "config-audit"
  },
@ -11,12 +11,26 @@
      "status": "ok",
      "files_scanned": 1,
      "duration_ms": 2,
-      "findings": [],
+      "findings": [
+        {
+          "id": "CA-CML-001",
+          "scanner": "CML",
+          "severity": "low",
+          "title": "Missing recommended sections",
+          "description": "CLAUDE.md is missing: Project overview, Architecture",
+          "file": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md",
+          "line": null,
+          "evidence": "Present sections: Marketplace Medium, Plugins, Commands, Conventions",
+          "category": null,
+          "recommendation": "Add sections for: Project overview, Architecture",
+          "autoFixable": false
+        }
+      ],
      "counts": {
        "critical": 0,
        "high": 0,
        "medium": 0,
-        "low": 0,
+        "low": 1,
        "info": 0
      }
    },
@ -24,7 +38,7 @@
      "scanner": "SET",
      "status": "ok",
      "files_scanned": 1,
-      "duration_ms": 1,
+      "duration_ms": 0,
      "findings": [],
      "counts": {
        "critical": 0,
@ -80,7 +94,7 @@
      "scanner": "IMP",
      "status": "ok",
      "files_scanned": 1,
-      "duration_ms": 0,
+      "duration_ms": 2,
      "findings": [],
      "counts": {
        "critical": 0,
@ -344,7 +358,7 @@
      "scanner": "TOK",
      "status": "ok",
      "files_scanned": 2,
-      "duration_ms": 120,
+      "duration_ms": 8,
      "findings": [
        {
          "id": "CA-TOK-001",
@ -376,76 +390,60 @@
            "Review whether this source needs to load on every turn."
          ]
        },
-        {
-          "source": "mcp:sadhguru-wisdom (plugin:sadhguru-wisdom)",
-          "estimated_tokens": 500,
-          "rank": 2,
-          "recommendations": [
-            "Review whether this source needs to load on every turn."
-          ]
-        },
-        {
-          "source": "mcp:vegnorm-rag (plugin:vegnormalene)",
-          "estimated_tokens": 500,
-          "rank": 3,
-          "recommendations": [
-            "Review whether this source needs to load on every turn."
-          ]
-        },
        {
          "source": "CLAUDE.md",
          "estimated_tokens": 116,
-          "rank": 4,
+          "rank": 2,
          "recommendations": [
            "Move volatile top-of-file content to the bottom or extract to an @import-ed file.",
            "Split overlong CLAUDE.md into focused @imports (≤200 lines each)."
          ],
-          "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md"
+          "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md"
        },
        {
          "source": "hooks/hooks.json",
          "estimated_tokens": 81,
+          "rank": 3,
+          "recommendations": [
+            "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
+            "Move rarely-used permissions to a project-local override."
+          ],
+          "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/hooks/hooks.json"
+        },
+        {
+          "source": ".claude/settings.json",
+          "estimated_tokens": 59,
+          "rank": 4,
+          "recommendations": [
+            "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
+            "Move rarely-used permissions to a project-local override."
+          ],
+          "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json"
+        },
+        {
+          "source": ".mcp.json",
+          "estimated_tokens": 53,
          "rank": 5,
          "recommendations": [
            "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
            "Move rarely-used permissions to a project-local override."
          ],
-          "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/hooks/hooks.json"
-        },
-        {
-          "source": ".claude/settings.json",
-          "estimated_tokens": 59,
-          "rank": 6,
-          "recommendations": [
-            "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
-            "Move rarely-used permissions to a project-local override."
-          ],
-          "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json"
-        },
-        {
-          "source": ".mcp.json",
-          "estimated_tokens": 53,
-          "rank": 7,
-          "recommendations": [
-            "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
-            "Move rarely-used permissions to a project-local override."
-          ],
-          "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.mcp.json"
+          "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.mcp.json"
        }
      ],
-      "total_estimated_tokens": 1809,
+      "total_estimated_tokens": 809,
      "activeConfig": {
-        "claudeMdEstimatedTokens": 5716,
-        "mcpServerCount": 3,
-        "pluginCount": 41,
-        "skillCount": 65
+        "claudeMdEstimatedTokens": 1639,
+        "mcpServerCount": 1,
+        "pluginCount": 0,
+        "skillCount": 0
      }
    },
    {
      "scanner": "CPS",
      "status": "ok",
      "files_scanned": 1,
-      "duration_ms": 0,
+      "duration_ms": 1,
      "findings": [],
      "counts": {
        "critical": 0,
@ -459,7 +457,7 @@
      "scanner": "DIS",
      "status": "ok",
      "files_scanned": 1,
-      "duration_ms": 0,
+      "duration_ms": 1,
      "findings": [
        {
          "id": "CA-DIS-001",
@ -467,7 +465,7 @@
          "severity": "low",
          "title": "Tool listed in both permissions.deny and permissions.allow",
          "description": ".claude/settings.json contains 1 tool present in both deny and allow lists. The deny list wins — the allow entries are dead config but still load on every turn and may confuse future readers about intent.",
-          "file": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json",
+          "file": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json",
          "line": null,
          "evidence": "Read: allow=\"Read(src/**)\" + deny=\"Read(./.env)\"",
          "category": "permissions-hygiene",
@ -486,42 +484,14 @@
    {
      "scanner": "COL",
      "status": "ok",
-      "files_scanned": 65,
-      "duration_ms": 91,
-      "findings": [
-        {
-          "id": "CA-COL-001",
-          "scanner": "COL",
-          "severity": "low",
-          "title": "Skill name \"okr-offentlig-sektor\" used by multiple plugins",
-          "description": "2 plugins (okr, okr) expose a skill named \"okr-offentlig-sektor\". Even when invocation is namespaced via /plugin:skill, shared names create ambiguity in error messages, search results, and the plugin-skills enumeration.",
-          "file": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/okr/skills/okr-offentlig-sektor/SKILL.md",
-          "line": null,
-          "evidence": "name=\"okr-offentlig-sektor\"; plugins=okr,okr",
-          "category": "plugin-hygiene",
-          "recommendation": "Coordinate naming across plugins, or rename one to clarify intent. The shared name forces every reader to disambiguate by source.",
-          "autoFixable": false,
-          "details": {
-            "namespaces": [
-              {
-                "source": "plugin:okr",
-                "name": "okr-offentlig-sektor",
-                "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/okr/skills/okr-offentlig-sektor/SKILL.md"
-              },
-              {
-                "source": "plugin:okr",
-                "name": "okr-offentlig-sektor",
-                "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-privat/plugins/okr/skills/okr-offentlig-sektor/SKILL.md"
-              }
-            ]
-          }
-        }
-      ],
+      "files_scanned": 0,
+      "duration_ms": 0,
+      "findings": [],
      "counts": {
        "critical": 0,
        "high": 0,
        "medium": 0,
-        "low": 1,
+        "low": 0,
        "info": 0
      }
    }
@ -542,4 +512,4 @@
    "scanners_error": 0,
    "scanners_skipped": 1
  }
-}
+}
--- a/tests/snapshots/v5.0.0/token-hotspots.json
+++ b/tests/snapshots/v5.0.0/token-hotspots.json
@ -2,8 +2,8 @@
  "scanner": "TOK",
  "status": "ok",
  "files_scanned": 2,
-  "duration_ms": 119,
-  "total_estimated_tokens": 1809,
+  "duration_ms": 9,
+  "total_estimated_tokens": 809,
  "hotspots": [
    {
      "source": "mcp:memory (.mcp.json)",
@ -13,61 +13,45 @@
        "Review whether this source needs to load on every turn."
      ]
    },
-    {
-      "source": "mcp:sadhguru-wisdom (plugin:sadhguru-wisdom)",
-      "estimated_tokens": 500,
-      "rank": 2,
-      "recommendations": [
-        "Review whether this source needs to load on every turn."
-      ]
-    },
-    {
-      "source": "mcp:vegnorm-rag (plugin:vegnormalene)",
-      "estimated_tokens": 500,
-      "rank": 3,
-      "recommendations": [
-        "Review whether this source needs to load on every turn."
-      ]
-    },
    {
      "source": "CLAUDE.md",
      "estimated_tokens": 116,
-      "rank": 4,
+      "rank": 2,
      "recommendations": [
        "Move volatile top-of-file content to the bottom or extract to an @import-ed file.",
        "Split overlong CLAUDE.md into focused @imports (≤200 lines each)."
      ],
-      "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md"
+      "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md"
    },
    {
      "source": "hooks/hooks.json",
      "estimated_tokens": 81,
+      "rank": 3,
+      "recommendations": [
+        "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
+        "Move rarely-used permissions to a project-local override."
+      ],
+      "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/hooks/hooks.json"
+    },
+    {
+      "source": ".claude/settings.json",
+      "estimated_tokens": 59,
+      "rank": 4,
+      "recommendations": [
+        "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
+        "Move rarely-used permissions to a project-local override."
+      ],
+      "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json"
+    },
+    {
+      "source": ".mcp.json",
+      "estimated_tokens": 53,
      "rank": 5,
      "recommendations": [
        "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
        "Move rarely-used permissions to a project-local override."
      ],
-      "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/hooks/hooks.json"
-    },
-    {
-      "source": ".claude/settings.json",
-      "estimated_tokens": 59,
-      "rank": 6,
-      "recommendations": [
-        "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
-        "Move rarely-used permissions to a project-local override."
-      ],
-      "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json"
-    },
-    {
-      "source": ".mcp.json",
-      "estimated_tokens": 53,
-      "rank": 7,
-      "recommendations": [
-        "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
-        "Move rarely-used permissions to a project-local override."
-      ],
-      "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.mcp.json"
+      "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.mcp.json"
    }
  ],
  "findings": [
@ -92,4 +76,4 @@
    "low": 1,
    "info": 0
  }
-}
+}
--- a/tests/snapshots/v5.0.0/whats-active.json
+++ b/tests/snapshots/v5.0.0/whats-active.json