test(snapshots): make byte/snapshot tests hermetic + re-seed baseline

The COL collision-scanner and the CLAUDE.md cascade resolve ~/.claude from
process.env.HOME (active-config-reader). Snapshot/byte CLIs were spawned with
the developer's real HOME, so they picked up installed plugins/skills and the
user CLAUDE.md — making the v5.0.0 + default-output snapshots machine- and
time-dependent. They were seeded 2026-05-01 with COL=1 (a real ~/.claude skill
collision) and drifted to COL=0 after the polyrepo split: 26 pre-existing
failures unrelated to Batch 1.

Fix (test-only, no production change):
- tests/helpers/hermetic-home.mjs — empty temp HOME, mirroring the pattern
  collision.test.mjs already uses for the COL unit test.
- 7 harnesses spawn CLIs (or call lint()) under the hermetic HOME, so output
  depends only on committed fixtures. Determinism verified across runs.
- Re-seeded all snapshots under hermetic HOME via SEED_SNAPSHOT/UPDATE_SNAPSHOT
  (added a SEED guard to the frozen v5.0.0 byte tests). Snapshots now reflect
  the fixture alone (COL=0, fixture-only activeConfig counts).
- Also re-seeded the unused env-aware snapshots (manifest/whats-active/
  plugin-health), which had baked dozens of real ~/.claude skill/plugin names
  into the committed repo — privacy cleanup.

Full suite: 812/812 green, stable across 3 runs.

tests/helpers/hermetic-home.mjs

@@ -0,0 +1,40 @@
+/**
+ * Hermetic HOME for snapshot / byte-stability tests.
+ *
+ * The COL collision-scanner and the CLAUDE.md cascade resolve ~/.claude from
+ * process.env.HOME (see scanners/lib/active-config-reader.mjs — enumeratePlugins,
+ * enumerateSkills, walkClaudeMdCascade). A CLI spawned with the developer's real
+ * HOME picks up their installed plugins/skills and user CLAUDE.md, which makes
+ * byte-snapshots machine- and time-dependent: the snapshots seeded on one machine
+ * drift the moment another machine (or the same machine, later) has a different
+ * ~/.claude. Pointing HOME at an empty temp dir isolates every snapshot/byte test
+ * from user state, exactly as tests/scanners/collision.test.mjs already does for
+ * the COL unit test.
+ *
+ * Writes any CLI may make under HOME (sessions, baselines) land in the temp dir,
+ * never in the repo.
+ */
+import { mkdtempSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+export const HERMETIC_HOME = mkdtempSync(join(tmpdir(), 'config-audit-hermetic-home-'));
+
+/** Subprocess env with HOME/USERPROFILE redirected to the empty hermetic dir. */
+export function hermeticEnv(extra = {}) {
+  return { ...process.env, HOME: HERMETIC_HOME, USERPROFILE: HERMETIC_HOME, ...extra };
+}
+
+/** Run an in-process callback with process.env.HOME pointed at the hermetic dir. */
+export async function withHermeticHome(fn) {
+  const originalHome = process.env.HOME;
+  const originalProfile = process.env.USERPROFILE;
+  process.env.HOME = HERMETIC_HOME;
+  process.env.USERPROFILE = HERMETIC_HOME;
+  try {
+    return await fn();
+  } finally {
+    if (originalHome === undefined) delete process.env.HOME; else process.env.HOME = originalHome;
+    if (originalProfile === undefined) delete process.env.USERPROFILE; else process.env.USERPROFILE = originalProfile;
+  }
+}

tests/json-backcompat.test.mjs

@@ -26,16 +26,20 @@ import { resolve, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
-import { readFile, access, mkdir } from 'node:fs/promises';
+import { readFile, writeFile, access, mkdir } from 'node:fs/promises';
 import { homedir } from 'node:os';
+import { hermeticEnv, HERMETIC_HOME } from './helpers/hermetic-home.mjs';
 
 const exec = promisify(execFile);
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const REPO = resolve(__dirname, '..');
 const FIXTURE = resolve(REPO, 'tests/fixtures/marketplace-medium');
 const SNAPSHOT_DIR = resolve(REPO, 'tests/snapshots/v5.0.0');
-const BASELINE_DIR = resolve(homedir(), '.config-audit/baselines');
+// Baseline lives under the hermetic HOME so drift output is isolated from
+// the developer's ~/.config-audit state, matching the scan env below.
+const BASELINE_DIR = resolve(HERMETIC_HOME, '.config-audit/baselines');
 const DEFAULT_BASELINE = resolve(BASELINE_DIR, 'default.json');
+const SEED = process.env.SEED_SNAPSHOT === '1';
 
 async function runCli(scriptPath, args) {
   try {
@@ -43,6 +47,7 @@ async function runCli(scriptPath, args) {
       timeout: 60000,
       cwd: REPO,
       maxBuffer: 10 * 1024 * 1024,
+      env: hermeticEnv(),
     });
     return { stdout: stdout || '', stderr: stderr || '' };
   } catch (err) {
@@ -198,7 +203,12 @@ describe('SC-6 JSON backwards-compatibility — fixture-deterministic CLIs', ()
       const script = resolve(REPO, cli.script);
       const { stdout } = await runCli(script, [FIXTURE, '--json']);
       const actual = JSON.parse(stdout);
-      const expected = JSON.parse(await readFile(resolve(SNAPSHOT_DIR, cli.snapshot), 'utf8'));
+      const snapshotPath = resolve(SNAPSHOT_DIR, cli.snapshot);
+      if (SEED) {
+        await writeFile(snapshotPath, JSON.stringify(actual, null, 2) + '\n', 'utf8');
+        return;
+      }
+      const expected = JSON.parse(await readFile(snapshotPath, 'utf8'));
       assert.deepStrictEqual(cli.normalize(actual), cli.normalize(expected));
     });
   }
@@ -219,7 +229,12 @@ describe('SC-6 JSON backwards-compatibility — drift-cli', () => {
     const script = resolve(REPO, 'scanners/drift-cli.mjs');
     const { stdout } = await runCli(script, [FIXTURE, '--json']);
     const actual = JSON.parse(stdout);
-    const expected = JSON.parse(await readFile(resolve(SNAPSHOT_DIR, 'drift.json'), 'utf8'));
+    const snapshotPath = resolve(SNAPSHOT_DIR, 'drift.json');
+    if (SEED) {
+      await writeFile(snapshotPath, JSON.stringify(actual, null, 2) + '\n', 'utf8');
+      return;
+    }
+    const expected = JSON.parse(await readFile(snapshotPath, 'utf8'));
     assert.deepStrictEqual(normalizeDrift(actual), normalizeDrift(expected));
   });
 });

tests/raw-backcompat.test.mjs

@@ -23,8 +23,9 @@ import { resolve, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
-import { readFile, access, mkdir } from 'node:fs/promises';
+import { readFile, writeFile, access, mkdir } from 'node:fs/promises';
 import { homedir } from 'node:os';
+import { hermeticEnv, HERMETIC_HOME } from './helpers/hermetic-home.mjs';
 
 const exec = promisify(execFile);
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -32,8 +33,10 @@ const REPO = resolve(__dirname, '..');
 const FIXTURE = resolve(REPO, 'tests/fixtures/marketplace-medium');
 const SNAPSHOT_DIR = resolve(REPO, 'tests/snapshots/v5.0.0');
 const STDERR_SNAPSHOT_DIR = resolve(REPO, 'tests/snapshots/v5.0.0-stderr');
-const BASELINE_DIR = resolve(homedir(), '.config-audit/baselines');
+// Baseline under the hermetic HOME so drift is isolated from ~/.config-audit.
+const BASELINE_DIR = resolve(HERMETIC_HOME, '.config-audit/baselines');
 const DEFAULT_BASELINE = resolve(BASELINE_DIR, 'default.json');
+const SEED = process.env.SEED_SNAPSHOT === '1';
 
 async function runCli(scriptPath, args) {
   try {
@@ -41,6 +44,7 @@ async function runCli(scriptPath, args) {
       timeout: 60000,
       cwd: REPO,
       maxBuffer: 10 * 1024 * 1024,
+      env: hermeticEnv(),
     });
     return { stdout: stdout || '', stderr: stderr || '' };
   } catch (err) {
@@ -263,7 +267,12 @@ describe('SC-7 --raw posture stderr scorecard verbatim', () => {
   it('posture --raw stderr matches tests/snapshots/v5.0.0-stderr/posture.txt (modulo Xms)', async () => {
     const script = resolve(REPO, 'scanners/posture.mjs');
     const { stderr } = await runCli(script, [FIXTURE, '--raw']);
-    const expected = await readFile(resolve(STDERR_SNAPSHOT_DIR, 'posture.txt'), 'utf8');
+    const stderrSnapshotPath = resolve(STDERR_SNAPSHOT_DIR, 'posture.txt');
+    if (SEED) {
+      await writeFile(stderrSnapshotPath, stderr, 'utf8');
+      return;
+    }
+    const expected = await readFile(stderrSnapshotPath, 'utf8');
     assert.equal(
       normalizeStderrDurations(stderr.trim()),
       normalizeStderrDurations(expected.trim()),

tests/scanners/cli-humanizer.test.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'node:url';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { readFile, writeFile, unlink, mkdir, access } from 'node:fs/promises';
-import { homedir } from 'node:os';
+import { hermeticEnv, HERMETIC_HOME } from '../helpers/hermetic-home.mjs';
 
 const exec = promisify(execFile);
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -13,7 +13,7 @@ const REPO = resolve(__dirname, '../..');
 const FIXTURE = resolve(REPO, 'tests/fixtures/marketplace-medium');
 const BROKEN_PLUGIN = resolve(REPO, 'tests/fixtures/broken-plugin');
 
-const BASELINE_DIR = resolve(homedir(), '.config-audit/baselines');
+const BASELINE_DIR = resolve(HERMETIC_HOME, '.config-audit/baselines');
 const DEFAULT_BASELINE = resolve(BASELINE_DIR, 'default.json');
 
 /**
@@ -25,7 +25,7 @@ async function runCli(cliPath, args, env = {}) {
     const { stdout, stderr } = await exec('node', [cliPath, ...args], {
       timeout: 60000,
       cwd: REPO,
-      env: { ...process.env, ...env },
+      env: hermeticEnv(env),
       maxBuffer: 10 * 1024 * 1024,
     });
     return { stdout: stdout || '', stderr: stderr || '', code: 0 };

tests/scanners/lint-default-output.test.mjs

@@ -3,6 +3,7 @@ import assert from 'node:assert/strict';
 import { resolve, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { lint } from '../lint-default-output.mjs';
+import { withHermeticHome } from '../helpers/hermetic-home.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const REPO = resolve(__dirname, '../..');
@@ -10,7 +11,9 @@ const FIXTURE = resolve(REPO, 'tests/fixtures/marketplace-medium');
 
 describe('SC-3 forbidden-words lint (default-output)', () => {
   it('produces no tier1 or tier3 violations across the 6 prose CLIs', async () => {
-    const { failures, warnings } = await lint(FIXTURE);
+    // lint() spawns the prose CLIs inheriting process.env; HOME isolation keeps
+    // the COL collision scanner off the developer's real ~/.claude.
+    const { failures, warnings } = await withHermeticHome(() => lint(FIXTURE));
     const failureSummary = failures
       .map((f) => `[${f.cli}] tier${f.tier} "${f.word}" × ${f.count}`)
       .join('\n  ');

tests/scanners/posture-humanizer.test.mjs

@@ -5,6 +5,7 @@ import { fileURLToPath } from 'node:url';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { readFile, unlink } from 'node:fs/promises';
+import { hermeticEnv } from '../helpers/hermetic-home.mjs';
 
 const exec = promisify(execFile);
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -49,6 +50,7 @@ async function runPosture(flags) {
   const proc = await exec('node', [CLI, FIXTURE, ...flags], {
     timeout: 60000,
     cwd: REPO,
+    env: hermeticEnv(),
   }).catch(err => err); // posture exits non-zero on findings — capture either way
   return {
     stdout: proc.stdout || '',

tests/scanners/scan-orchestrator-humanizer.test.mjs

@@ -5,6 +5,7 @@ import { fileURLToPath } from 'node:url';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { readFile, unlink } from 'node:fs/promises';
+import { hermeticEnv } from '../helpers/hermetic-home.mjs';
 
 const exec = promisify(execFile);
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -44,6 +45,7 @@ async function runOrchestrator(flags) {
     await exec('node', [CLI, FIXTURE, '--output-file', out, ...flags], {
       timeout: 60000,
       cwd: REPO,
+      env: hermeticEnv(),
     });
     const written = await readFile(out, 'utf-8');
     return JSON.parse(written);

tests/snapshot-default-output.test.mjs

@@ -23,6 +23,7 @@ import { fileURLToPath } from 'node:url';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { readFile, writeFile } from 'node:fs/promises';
+import { hermeticEnv } from './helpers/hermetic-home.mjs';
 
 const exec = promisify(execFile);
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -38,6 +39,7 @@ async function runCli(scriptPath, args) {
       timeout: 60000,
       cwd: REPO,
       maxBuffer: 10 * 1024 * 1024,
+      env: hermeticEnv(),
     });
     return { stdout: stdout || '', stderr: stderr || '' };
   } catch (err) {

tests/snapshots/default-output/posture.json

@@ -1,4 +1,4 @@
 {
   "kind": "text",
-  "payload": "`[CML] CLAUDE.md Linter`: 0 finding(s) (0ms)\n  `[SET] Settings Validator`: 0 finding(s) (0ms)\n  `[HKV] Hook Validator`: 0 finding(s) (0ms)\n  `[RUL] Rules Validator`: 0 finding(s) (0ms)\n  `[MCP] MCP Config Validator`: 0 finding(s) (0ms)\n  `[IMP] Import Resolver`: 0 finding(s) (0ms)\n  `[CNF] Conflict Detector`: 0 finding(s) (0ms)\n  `[GAP] Feature Gap Scanner`: 17 finding(s) (0ms)\n  `[TOK] Token Hotspots`: 1 finding(s) (0ms)\n  `[CPS] Cache-Prefix Stability`: 0 finding(s) (0ms)\n  `[DIS] Disabled-In-Schema`: 1 finding(s) (0ms)\n  `[COL] Plugin Skill Collision`: 1 finding(s) (0ms)\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n Configuration health\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n Health: A (97/100) — Healthy setup, only minor polish needed\n 9 areas reviewed\n\n Area scores\n ───────────\n `CLAUDE.md` ........... A (100)     `Settings` ............ A (90)\n `Hooks` ............... A (100)     `Rules` ............... A (100)\n `MCP` ................. A (100)     `Imports` ............. A (100)\n `Conflicts` ........... A (100)     `Token Efficiency` .... A (90)\n `Plugin Hygiene` ...... A (90)\n\n 17 ways you could get more out of Claude Code — see /config-audit feature-gap\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+  "payload": "`[CML] CLAUDE.md Linter`: 1 finding(s) (0ms)\n  `[SET] Settings Validator`: 0 finding(s) (0ms)\n  `[HKV] Hook Validator`: 0 finding(s) (0ms)\n  `[RUL] Rules Validator`: 0 finding(s) (0ms)\n  `[MCP] MCP Config Validator`: 0 finding(s) (0ms)\n  `[IMP] Import Resolver`: 0 finding(s) (0ms)\n  `[CNF] Conflict Detector`: 0 finding(s) (0ms)\n  `[GAP] Feature Gap Scanner`: 17 finding(s) (0ms)\n  `[TOK] Token Hotspots`: 1 finding(s) (0ms)\n  `[CPS] Cache-Prefix Stability`: 0 finding(s) (0ms)\n  `[DIS] Disabled-In-Schema`: 1 finding(s) (0ms)\n  `[COL] Plugin Skill Collision`: 0 finding(s) (0ms)\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n Configuration health\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n Health: A (97/100) — Healthy setup, only minor polish needed\n 9 areas reviewed\n\n Area scores\n ───────────\n `CLAUDE.md` ........... A (90)      `Settings` ............ A (90)\n `Hooks` ............... A (100)     `Rules` ............... A (100)\n `MCP` ................. A (100)     `Imports` ............. A (100)\n `Conflicts` ........... A (100)     `Token Efficiency` .... A (90)\n `Plugin Hygiene` ...... A (100)\n\n 17 ways you could get more out of Claude Code — see /config-audit feature-gap\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
 }

tests/snapshots/default-output/scan-orchestrator.json

@@ -13,12 +13,29 @@
         "status": "ok",
         "files_scanned": 1,
         "duration_ms": 0,
-        "findings": [],
+        "findings": [
+          {
+            "id": "CA-CML-001",
+            "scanner": "CML",
+            "severity": "low",
+            "title": "Your instructions file is missing common sections",
+            "description": "Sections like Project Overview, Commands, and Conventions help Claude apply your guidance consistently across tasks.",
+            "file": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md",
+            "line": null,
+            "evidence": "Present sections: Marketplace Medium, Plugins, Commands, Conventions",
+            "category": null,
+            "recommendation": "Add the missing sections noted in the details.",
+            "autoFixable": false,
+            "userImpactCategory": "Configuration mistake",
+            "userActionLanguage": "Optional cleanup",
+            "relevanceContext": "test-fixture-no-impact"
+          }
+        ],
         "counts": {
           "critical": 0,
           "high": 0,
           "medium": 0,
-          "low": 0,
+          "low": 1,
           "info": 0
         }
       },
@@ -432,69 +449,53 @@
               "Review whether this source needs to load on every turn."
             ]
           },
-          {
-            "source": "mcp:sadhguru-wisdom (plugin:sadhguru-wisdom)",
-            "estimated_tokens": 500,
-            "rank": 2,
-            "recommendations": [
-              "Review whether this source needs to load on every turn."
-            ]
-          },
-          {
-            "source": "mcp:vegnorm-rag (plugin:vegnormalene)",
-            "estimated_tokens": 500,
-            "rank": 3,
-            "recommendations": [
-              "Review whether this source needs to load on every turn."
-            ]
-          },
           {
             "source": "CLAUDE.md",
             "estimated_tokens": 116,
-            "rank": 4,
+            "rank": 2,
             "recommendations": [
               "Move volatile top-of-file content to the bottom or extract to an @import-ed file.",
               "Split overlong CLAUDE.md into focused @imports (≤200 lines each)."
             ],
-            "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md"
+            "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md"
           },
           {
             "source": "hooks/hooks.json",
             "estimated_tokens": 81,
+            "rank": 3,
+            "recommendations": [
+              "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
+              "Move rarely-used permissions to a project-local override."
+            ],
+            "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/hooks/hooks.json"
+          },
+          {
+            "source": ".claude/settings.json",
+            "estimated_tokens": 59,
+            "rank": 4,
+            "recommendations": [
+              "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
+              "Move rarely-used permissions to a project-local override."
+            ],
+            "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json"
+          },
+          {
+            "source": ".mcp.json",
+            "estimated_tokens": 53,
             "rank": 5,
             "recommendations": [
               "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
               "Move rarely-used permissions to a project-local override."
             ],
-            "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/hooks/hooks.json"
+            "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.mcp.json"
-          },
-          {
-            "source": ".claude/settings.json",
-            "estimated_tokens": 59,
-            "rank": 6,
-            "recommendations": [
-              "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
-              "Move rarely-used permissions to a project-local override."
-            ],
-            "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json"
-          },
-          {
-            "source": ".mcp.json",
-            "estimated_tokens": 53,
-            "rank": 7,
-            "recommendations": [
-              "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
-              "Move rarely-used permissions to a project-local override."
-            ],
-            "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.mcp.json"
           }
         ],
-        "total_estimated_tokens": 1809,
+        "total_estimated_tokens": 809,
         "activeConfig": {
           "claudeMdEstimatedTokens": "<ANCESTOR_DERIVED>",
-          "mcpServerCount": 3,
+          "mcpServerCount": 1,
-          "pluginCount": 41,
+          "pluginCount": 0,
-          "skillCount": 65
+          "skillCount": 0
         }
       },
       {
@@ -523,7 +524,7 @@
             "severity": "low",
             "title": "A tool is in both the let-in list and the shut-out list",
             "description": "When a tool is in both lists, the shut-out always wins, so the let-in entry does nothing. It looks like the tool is approved, but it isn't.",
-            "file": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json",
+            "file": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json",
             "line": null,
             "evidence": "Read: allow=\"Read(src/**)\" + deny=\"Read(./.env)\"",
             "category": "permissions-hygiene",
@@ -545,45 +546,14 @@
       {
         "scanner": "COL",
         "status": "ok",
-        "files_scanned": 65,
+        "files_scanned": 0,
         "duration_ms": 0,
-        "findings": [
+        "findings": [],
-          {
-            "id": "CA-COL-001",
-            "scanner": "COL",
-            "severity": "low",
-            "title": "Two plugins both define a skill with the same name",
-            "description": "When two plugins offer the same skill name, only one wins, and which one is hard to predict.",
-            "file": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/okr/skills/okr-offentlig-sektor/SKILL.md",
-            "line": null,
-            "evidence": "name=\"okr-offentlig-sektor\"; plugins=okr,okr",
-            "category": "plugin-hygiene",
-            "recommendation": "Rename the skill in one of the plugins, or disable the one you don't use.",
-            "autoFixable": false,
-            "userImpactCategory": "Conflict",
-            "userActionLanguage": "Optional cleanup",
-            "relevanceContext": "affects-everyone",
-            "details": {
-              "namespaces": [
-                {
-                  "source": "plugin:okr",
-                  "name": "okr-offentlig-sektor",
-                  "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/okr/skills/okr-offentlig-sektor/SKILL.md"
-                },
-                {
-                  "source": "plugin:okr",
-                  "name": "okr-offentlig-sektor",
-                  "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-privat/plugins/okr/skills/okr-offentlig-sektor/SKILL.md"
-                }
-              ]
-            }
-          }
-        ],
         "counts": {
           "critical": 0,
           "high": 0,
           "medium": 0,
-          "low": 1,
+          "low": 0,
           "info": 0
         }
       }

tests/snapshots/default-output/token-hotspots.json

@@ -5,7 +5,7 @@
     "status": "ok",
     "files_scanned": 2,
     "duration_ms": 0,
-    "total_estimated_tokens": 1809,
+    "total_estimated_tokens": 809,
     "hotspots": [
       {
         "source": "mcp:memory (.mcp.json)",
@@ -15,61 +15,45 @@
           "Review whether this source needs to load on every turn."
         ]
       },
-      {
-        "source": "mcp:sadhguru-wisdom (plugin:sadhguru-wisdom)",
-        "estimated_tokens": 500,
-        "rank": 2,
-        "recommendations": [
-          "Review whether this source needs to load on every turn."
-        ]
-      },
-      {
-        "source": "mcp:vegnorm-rag (plugin:vegnormalene)",
-        "estimated_tokens": 500,
-        "rank": 3,
-        "recommendations": [
-          "Review whether this source needs to load on every turn."
-        ]
-      },
       {
         "source": "CLAUDE.md",
         "estimated_tokens": 116,
-        "rank": 4,
+        "rank": 2,
         "recommendations": [
           "Move volatile top-of-file content to the bottom or extract to an @import-ed file.",
           "Split overlong CLAUDE.md into focused @imports (≤200 lines each)."
         ],
-        "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md"
+        "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md"
       },
       {
         "source": "hooks/hooks.json",
         "estimated_tokens": 81,
+        "rank": 3,
+        "recommendations": [
+          "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
+          "Move rarely-used permissions to a project-local override."
+        ],
+        "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/hooks/hooks.json"
+      },
+      {
+        "source": ".claude/settings.json",
+        "estimated_tokens": 59,
+        "rank": 4,
+        "recommendations": [
+          "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
+          "Move rarely-used permissions to a project-local override."
+        ],
+        "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json"
+      },
+      {
+        "source": ".mcp.json",
+        "estimated_tokens": 53,
         "rank": 5,
         "recommendations": [
           "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
           "Move rarely-used permissions to a project-local override."
         ],
-        "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/hooks/hooks.json"
+        "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.mcp.json"
-      },
-      {
-        "source": ".claude/settings.json",
-        "estimated_tokens": 59,
-        "rank": 6,
-        "recommendations": [
-          "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
-          "Move rarely-used permissions to a project-local override."
-        ],
-        "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json"
-      },
-      {
-        "source": ".mcp.json",
-        "estimated_tokens": 53,
-        "rank": 7,
-        "recommendations": [
-          "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
-          "Move rarely-used permissions to a project-local override."
-        ],
-        "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.mcp.json"
       }
     ],
     "findings": [

tests/snapshots/v5.0.0-stderr/posture.txt

@@ -1,15 +1,15 @@
-  [CML] CLAUDE.md Linter: 0 finding(s) (9ms)
+  [CML] CLAUDE.md Linter: 1 finding(s) (13ms)
-  [SET] Settings Validator: 0 finding(s) (0ms)
+  [SET] Settings Validator: 0 finding(s) (1ms)
-  [HKV] Hook Validator: 0 finding(s) (2ms)
+  [HKV] Hook Validator: 0 finding(s) (1ms)
-  [RUL] Rules Validator: 0 finding(s) (0ms)
+  [RUL] Rules Validator: 0 finding(s) (1ms)
-  [MCP] MCP Config Validator: 0 finding(s) (1ms)
+  [MCP] MCP Config Validator: 0 finding(s) (0ms)
   [IMP] Import Resolver: 0 finding(s) (1ms)
   [CNF] Conflict Detector: 0 finding(s) (1ms)
-  [GAP] Feature Gap Scanner: 17 finding(s) (3ms)
+  [GAP] Feature Gap Scanner: 17 finding(s) (2ms)
-  [TOK] Token Hotspots: 1 finding(s) (116ms)
+  [TOK] Token Hotspots: 1 finding(s) (8ms)
   [CPS] Cache-Prefix Stability: 0 finding(s) (1ms)
   [DIS] Disabled-In-Schema: 1 finding(s) (1ms)
-  [COL] Plugin Skill Collision: 1 finding(s) (77ms)
+  [COL] Plugin Skill Collision: 0 finding(s) (0ms)
 
 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  Config-Audit Health Score
@@ -19,11 +19,11 @@
 
  Area Scores
  ───────────
- CLAUDE.md ........... A (100)     Settings ............ A (90)
+ CLAUDE.md ........... A (90)      Settings ............ A (90)
  Hooks ............... A (100)     Rules ............... A (100)
  MCP ................. A (100)     Imports ............. A (100)
  Conflicts ........... A (100)     Token Efficiency .... A (90)
- Plugin Hygiene ...... A (90)
+ Plugin Hygiene ...... A (100)
 
  17 opportunities available — run /config-audit feature-gap for recommendations
 

tests/snapshots/v5.0.0/drift.json

@@ -2,6 +2,19 @@
   "newFindings": [],
   "resolvedFindings": [],
   "unchangedFindings": [
+    {
+      "id": "CA-CML-001",
+      "scanner": "CML",
+      "severity": "low",
+      "title": "Missing recommended sections",
+      "description": "CLAUDE.md is missing: Project overview, Architecture",
+      "file": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md",
+      "line": null,
+      "evidence": "Present sections: Marketplace Medium, Plugins, Commands, Conventions",
+      "category": null,
+      "recommendation": "Add sections for: Project overview, Architecture",
+      "autoFixable": false
+    },
     {
       "id": "CA-GAP-001",
       "scanner": "GAP",
@@ -242,39 +255,12 @@
       "severity": "low",
       "title": "Tool listed in both permissions.deny and permissions.allow",
       "description": ".claude/settings.json contains 1 tool present in both deny and allow lists. The deny list wins — the allow entries are dead config but still load on every turn and may confuse future readers about intent.",
-      "file": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json",
+      "file": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json",
       "line": null,
       "evidence": "Read: allow=\"Read(src/**)\" + deny=\"Read(./.env)\"",
       "category": "permissions-hygiene",
       "recommendation": "Remove the redundant allow entries. If you actually want this tool enabled, remove it from the deny list instead. Settings should express intent clearly.",
       "autoFixable": false
-    },
-    {
-      "id": "CA-COL-001",
-      "scanner": "COL",
-      "severity": "low",
-      "title": "Skill name \"okr-offentlig-sektor\" used by multiple plugins",
-      "description": "2 plugins (okr, okr) expose a skill named \"okr-offentlig-sektor\". Even when invocation is namespaced via /plugin:skill, shared names create ambiguity in error messages, search results, and the plugin-skills enumeration.",
-      "file": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/okr/skills/okr-offentlig-sektor/SKILL.md",
-      "line": null,
-      "evidence": "name=\"okr-offentlig-sektor\"; plugins=okr,okr",
-      "category": "plugin-hygiene",
-      "recommendation": "Coordinate naming across plugins, or rename one to clarify intent. The shared name forces every reader to disambiguate by source.",
-      "autoFixable": false,
-      "details": {
-        "namespaces": [
-          {
-            "source": "plugin:okr",
-            "name": "okr-offentlig-sektor",
-            "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/okr/skills/okr-offentlig-sektor/SKILL.md"
-          },
-          {
-            "source": "plugin:okr",
-            "name": "okr-offentlig-sektor",
-            "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-privat/plugins/okr/skills/okr-offentlig-sektor/SKILL.md"
-          }
-        ]
-      }
     }
   ],
   "movedFindings": [],
@@ -293,11 +279,11 @@
     {
       "name": "CLAUDE.md",
       "before": {
-        "score": 100,
+        "score": 90,
         "grade": "A"
       },
       "after": {
-        "score": 100,
+        "score": 90,
         "grade": "A"
       },
       "delta": 0
@@ -401,11 +387,11 @@
     {
       "name": "Plugin Hygiene",
       "before": {
-        "score": 90,
+        "score": 100,
         "grade": "A"
       },
       "after": {
-        "score": 90,
+        "score": 100,
         "grade": "A"
       },
       "delta": 0

tests/snapshots/v5.0.0/fix-cli.json

@@ -5,6 +5,12 @@
   "verified": [],
   "regressions": [],
   "manual": [
+    {
+      "findingId": "CA-CML-001",
+      "title": "Missing recommended sections",
+      "file": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md",
+      "recommendation": "Add sections for: Project overview, Architecture"
+    },
     {
       "findingId": "CA-GAP-001",
       "title": "No custom skills or commands",
@@ -116,14 +122,8 @@
     {
       "findingId": "CA-DIS-001",
       "title": "Tool listed in both permissions.deny and permissions.allow",
-      "file": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json",
+      "file": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json",
       "recommendation": "Remove the redundant allow entries. If you actually want this tool enabled, remove it from the deny list instead. Settings should express intent clearly."
-    },
-    {
-      "findingId": "CA-COL-001",
-      "title": "Skill name \"okr-offentlig-sektor\" used by multiple plugins",
-      "file": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/okr/skills/okr-offentlig-sektor/SKILL.md",
-      "recommendation": "Coordinate naming across plugins, or rename one to clarify intent. The shared name forces every reader to disambiguate by source."
     }
   ],
   "backupId": null

tests/snapshots/v5.0.0/plugin-health.json

@@ -1,14 +1,28 @@
 {
   "scanner": "PLH",
   "status": "ok",
-  "files_scanned": 1,
+  "files_scanned": 0,
-  "duration_ms": 17,
+  "duration_ms": 2,
-  "findings": [],
+  "findings": [
+    {
+      "id": "CA-PLH-001",
+      "scanner": "PLH",
+      "severity": "info",
+      "title": "No plugins found",
+      "description": "No Claude Code plugins found under tests/fixtures/marketplace-medium",
+      "file": null,
+      "line": null,
+      "evidence": null,
+      "category": null,
+      "recommendation": "Ensure plugins have .claude-plugin/plugin.json",
+      "autoFixable": false
+    }
+  ],
   "counts": {
     "critical": 0,
     "high": 0,
     "medium": 0,
     "low": 0,
-    "info": 0
+    "info": 1
   }
 }

tests/snapshots/v5.0.0/posture.json

@@ -17,8 +17,8 @@
       "id": "claude_md",
       "name": "CLAUDE.md",
       "grade": "A",
-      "score": 100,
+      "score": 90,
-      "findingCount": 0
+      "findingCount": 1
     },
     {
       "id": "settings",
@@ -80,8 +80,8 @@
       "id": "plugin_hygiene",
       "name": "Plugin Hygiene",
       "grade": "A",
-      "score": 90,
+      "score": 100,
-      "findingCount": 1
+      "findingCount": 0
     }
   ],
   "overallGrade": "A",
@@ -93,8 +93,8 @@
   "opportunityCount": 17,
   "scannerEnvelope": {
     "meta": {
-      "target": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium",
+      "target": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium",
-      "timestamp": "2026-05-01T14:44:22.725Z",
+      "timestamp": "2026-06-18T10:18:35.634Z",
       "version": "2.2.0",
       "tool": "config-audit"
     },
@@ -103,13 +103,27 @@
         "scanner": "CML",
         "status": "ok",
         "files_scanned": 1,
-        "duration_ms": 1,
+        "duration_ms": 3,
-        "findings": [],
+        "findings": [
+          {
+            "id": "CA-CML-001",
+            "scanner": "CML",
+            "severity": "low",
+            "title": "Missing recommended sections",
+            "description": "CLAUDE.md is missing: Project overview, Architecture",
+            "file": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md",
+            "line": null,
+            "evidence": "Present sections: Marketplace Medium, Plugins, Commands, Conventions",
+            "category": null,
+            "recommendation": "Add sections for: Project overview, Architecture",
+            "autoFixable": false
+          }
+        ],
         "counts": {
           "critical": 0,
           "high": 0,
           "medium": 0,
-          "low": 0,
+          "low": 1,
           "info": 0
         }
       },
@@ -117,7 +131,7 @@
         "scanner": "SET",
         "status": "ok",
         "files_scanned": 1,
-        "duration_ms": 0,
+        "duration_ms": 1,
         "findings": [],
         "counts": {
           "critical": 0,
@@ -145,7 +159,7 @@
         "scanner": "RUL",
         "status": "skipped",
         "files_scanned": 0,
-        "duration_ms": 1,
+        "duration_ms": 0,
         "findings": [],
         "counts": {
           "critical": 0,
@@ -173,7 +187,7 @@
         "scanner": "IMP",
         "status": "ok",
         "files_scanned": 1,
-        "duration_ms": 1,
+        "duration_ms": 2,
         "findings": [],
         "counts": {
           "critical": 0,
@@ -187,7 +201,7 @@
         "scanner": "CNF",
         "status": "ok",
         "files_scanned": 2,
-        "duration_ms": 1,
+        "duration_ms": 0,
         "findings": [],
         "counts": {
           "critical": 0,
@@ -201,7 +215,7 @@
         "scanner": "GAP",
         "status": "ok",
         "files_scanned": 4,
-        "duration_ms": 3,
+        "duration_ms": 2,
         "findings": [
           {
             "id": "CA-GAP-001",
@@ -437,7 +451,7 @@
         "scanner": "TOK",
         "status": "ok",
         "files_scanned": 2,
-        "duration_ms": 167,
+        "duration_ms": 8,
         "findings": [
           {
             "id": "CA-TOK-001",
@@ -469,69 +483,53 @@
               "Review whether this source needs to load on every turn."
             ]
           },
-          {
-            "source": "mcp:sadhguru-wisdom (plugin:sadhguru-wisdom)",
-            "estimated_tokens": 500,
-            "rank": 2,
-            "recommendations": [
-              "Review whether this source needs to load on every turn."
-            ]
-          },
-          {
-            "source": "mcp:vegnorm-rag (plugin:vegnormalene)",
-            "estimated_tokens": 500,
-            "rank": 3,
-            "recommendations": [
-              "Review whether this source needs to load on every turn."
-            ]
-          },
           {
             "source": "CLAUDE.md",
             "estimated_tokens": 116,
-            "rank": 4,
+            "rank": 2,
             "recommendations": [
               "Move volatile top-of-file content to the bottom or extract to an @import-ed file.",
               "Split overlong CLAUDE.md into focused @imports (≤200 lines each)."
             ],
-            "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md"
+            "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md"
           },
           {
             "source": "hooks/hooks.json",
             "estimated_tokens": 81,
+            "rank": 3,
+            "recommendations": [
+              "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
+              "Move rarely-used permissions to a project-local override."
+            ],
+            "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/hooks/hooks.json"
+          },
+          {
+            "source": ".claude/settings.json",
+            "estimated_tokens": 59,
+            "rank": 4,
+            "recommendations": [
+              "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
+              "Move rarely-used permissions to a project-local override."
+            ],
+            "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json"
+          },
+          {
+            "source": ".mcp.json",
+            "estimated_tokens": 53,
             "rank": 5,
             "recommendations": [
               "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
               "Move rarely-used permissions to a project-local override."
             ],
-            "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/hooks/hooks.json"
+            "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.mcp.json"
-          },
-          {
-            "source": ".claude/settings.json",
-            "estimated_tokens": 59,
-            "rank": 6,
-            "recommendations": [
-              "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
-              "Move rarely-used permissions to a project-local override."
-            ],
-            "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json"
-          },
-          {
-            "source": ".mcp.json",
-            "estimated_tokens": 53,
-            "rank": 7,
-            "recommendations": [
-              "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
-              "Move rarely-used permissions to a project-local override."
-            ],
-            "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.mcp.json"
           }
         ],
-        "total_estimated_tokens": 1809,
+        "total_estimated_tokens": 809,
         "activeConfig": {
-          "claudeMdEstimatedTokens": 5716,
+          "claudeMdEstimatedTokens": 1639,
-          "mcpServerCount": 3,
+          "mcpServerCount": 1,
-          "pluginCount": 41,
+          "pluginCount": 0,
-          "skillCount": 65
+          "skillCount": 0
         }
       },
       {
@@ -560,7 +558,7 @@
             "severity": "low",
             "title": "Tool listed in both permissions.deny and permissions.allow",
             "description": ".claude/settings.json contains 1 tool present in both deny and allow lists. The deny list wins — the allow entries are dead config but still load on every turn and may confuse future readers about intent.",
-            "file": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json",
+            "file": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json",
             "line": null,
             "evidence": "Read: allow=\"Read(src/**)\" + deny=\"Read(./.env)\"",
             "category": "permissions-hygiene",
@@ -579,42 +577,14 @@
       {
         "scanner": "COL",
         "status": "ok",
-        "files_scanned": 65,
+        "files_scanned": 0,
-        "duration_ms": 107,
+        "duration_ms": 0,
-        "findings": [
+        "findings": [],
-          {
-            "id": "CA-COL-001",
-            "scanner": "COL",
-            "severity": "low",
-            "title": "Skill name \"okr-offentlig-sektor\" used by multiple plugins",
-            "description": "2 plugins (okr, okr) expose a skill named \"okr-offentlig-sektor\". Even when invocation is namespaced via /plugin:skill, shared names create ambiguity in error messages, search results, and the plugin-skills enumeration.",
-            "file": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/okr/skills/okr-offentlig-sektor/SKILL.md",
-            "line": null,
-            "evidence": "name=\"okr-offentlig-sektor\"; plugins=okr,okr",
-            "category": "plugin-hygiene",
-            "recommendation": "Coordinate naming across plugins, or rename one to clarify intent. The shared name forces every reader to disambiguate by source.",
-            "autoFixable": false,
-            "details": {
-              "namespaces": [
-                {
-                  "source": "plugin:okr",
-                  "name": "okr-offentlig-sektor",
-                  "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/okr/skills/okr-offentlig-sektor/SKILL.md"
-                },
-                {
-                  "source": "plugin:okr",
-                  "name": "okr-offentlig-sektor",
-                  "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-privat/plugins/okr/skills/okr-offentlig-sektor/SKILL.md"
-                }
-              ]
-            }
-          }
-        ],
         "counts": {
           "critical": 0,
           "high": 0,
           "medium": 0,
-          "low": 1,
+          "low": 0,
           "info": 0
         }
       }
@@ -636,4 +606,4 @@
       "scanners_skipped": 1
     }
   }
-}
+}

tests/snapshots/v5.0.0/scan-orchestrator.json

@@ -1,7 +1,7 @@
 {
   "meta": {
-    "target": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium",
+    "target": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium",
-    "timestamp": "2026-05-01T14:44:16.877Z",
+    "timestamp": "2026-06-18T10:18:35.439Z",
     "version": "2.2.0",
     "tool": "config-audit"
   },
@@ -11,12 +11,26 @@
       "status": "ok",
       "files_scanned": 1,
       "duration_ms": 2,
-      "findings": [],
+      "findings": [
+        {
+          "id": "CA-CML-001",
+          "scanner": "CML",
+          "severity": "low",
+          "title": "Missing recommended sections",
+          "description": "CLAUDE.md is missing: Project overview, Architecture",
+          "file": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md",
+          "line": null,
+          "evidence": "Present sections: Marketplace Medium, Plugins, Commands, Conventions",
+          "category": null,
+          "recommendation": "Add sections for: Project overview, Architecture",
+          "autoFixable": false
+        }
+      ],
       "counts": {
         "critical": 0,
         "high": 0,
         "medium": 0,
-        "low": 0,
+        "low": 1,
         "info": 0
       }
     },
@@ -24,7 +38,7 @@
       "scanner": "SET",
       "status": "ok",
       "files_scanned": 1,
-      "duration_ms": 1,
+      "duration_ms": 0,
       "findings": [],
       "counts": {
         "critical": 0,
@@ -80,7 +94,7 @@
       "scanner": "IMP",
       "status": "ok",
       "files_scanned": 1,
-      "duration_ms": 0,
+      "duration_ms": 2,
       "findings": [],
       "counts": {
         "critical": 0,
@@ -344,7 +358,7 @@
       "scanner": "TOK",
       "status": "ok",
       "files_scanned": 2,
-      "duration_ms": 120,
+      "duration_ms": 8,
       "findings": [
         {
           "id": "CA-TOK-001",
@@ -376,76 +390,60 @@
             "Review whether this source needs to load on every turn."
           ]
         },
-        {
-          "source": "mcp:sadhguru-wisdom (plugin:sadhguru-wisdom)",
-          "estimated_tokens": 500,
-          "rank": 2,
-          "recommendations": [
-            "Review whether this source needs to load on every turn."
-          ]
-        },
-        {
-          "source": "mcp:vegnorm-rag (plugin:vegnormalene)",
-          "estimated_tokens": 500,
-          "rank": 3,
-          "recommendations": [
-            "Review whether this source needs to load on every turn."
-          ]
-        },
         {
           "source": "CLAUDE.md",
           "estimated_tokens": 116,
-          "rank": 4,
+          "rank": 2,
           "recommendations": [
             "Move volatile top-of-file content to the bottom or extract to an @import-ed file.",
             "Split overlong CLAUDE.md into focused @imports (≤200 lines each)."
           ],
-          "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md"
+          "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md"
         },
         {
           "source": "hooks/hooks.json",
           "estimated_tokens": 81,
+          "rank": 3,
+          "recommendations": [
+            "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
+            "Move rarely-used permissions to a project-local override."
+          ],
+          "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/hooks/hooks.json"
+        },
+        {
+          "source": ".claude/settings.json",
+          "estimated_tokens": 59,
+          "rank": 4,
+          "recommendations": [
+            "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
+            "Move rarely-used permissions to a project-local override."
+          ],
+          "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json"
+        },
+        {
+          "source": ".mcp.json",
+          "estimated_tokens": 53,
           "rank": 5,
           "recommendations": [
             "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
             "Move rarely-used permissions to a project-local override."
           ],
-          "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/hooks/hooks.json"
+          "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.mcp.json"
-        },
-        {
-          "source": ".claude/settings.json",
-          "estimated_tokens": 59,
-          "rank": 6,
-          "recommendations": [
-            "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
-            "Move rarely-used permissions to a project-local override."
-          ],
-          "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json"
-        },
-        {
-          "source": ".mcp.json",
-          "estimated_tokens": 53,
-          "rank": 7,
-          "recommendations": [
-            "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
-            "Move rarely-used permissions to a project-local override."
-          ],
-          "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.mcp.json"
         }
       ],
-      "total_estimated_tokens": 1809,
+      "total_estimated_tokens": 809,
       "activeConfig": {
-        "claudeMdEstimatedTokens": 5716,
+        "claudeMdEstimatedTokens": 1639,
-        "mcpServerCount": 3,
+        "mcpServerCount": 1,
-        "pluginCount": 41,
+        "pluginCount": 0,
-        "skillCount": 65
+        "skillCount": 0
       }
     },
     {
       "scanner": "CPS",
       "status": "ok",
       "files_scanned": 1,
-      "duration_ms": 0,
+      "duration_ms": 1,
       "findings": [],
       "counts": {
         "critical": 0,
@@ -459,7 +457,7 @@
       "scanner": "DIS",
       "status": "ok",
       "files_scanned": 1,
-      "duration_ms": 0,
+      "duration_ms": 1,
       "findings": [
         {
           "id": "CA-DIS-001",
@@ -467,7 +465,7 @@
           "severity": "low",
           "title": "Tool listed in both permissions.deny and permissions.allow",
           "description": ".claude/settings.json contains 1 tool present in both deny and allow lists. The deny list wins — the allow entries are dead config but still load on every turn and may confuse future readers about intent.",
-          "file": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json",
+          "file": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json",
           "line": null,
           "evidence": "Read: allow=\"Read(src/**)\" + deny=\"Read(./.env)\"",
           "category": "permissions-hygiene",
@@ -486,42 +484,14 @@
     {
       "scanner": "COL",
       "status": "ok",
-      "files_scanned": 65,
+      "files_scanned": 0,
-      "duration_ms": 91,
+      "duration_ms": 0,
-      "findings": [
+      "findings": [],
-        {
-          "id": "CA-COL-001",
-          "scanner": "COL",
-          "severity": "low",
-          "title": "Skill name \"okr-offentlig-sektor\" used by multiple plugins",
-          "description": "2 plugins (okr, okr) expose a skill named \"okr-offentlig-sektor\". Even when invocation is namespaced via /plugin:skill, shared names create ambiguity in error messages, search results, and the plugin-skills enumeration.",
-          "file": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/okr/skills/okr-offentlig-sektor/SKILL.md",
-          "line": null,
-          "evidence": "name=\"okr-offentlig-sektor\"; plugins=okr,okr",
-          "category": "plugin-hygiene",
-          "recommendation": "Coordinate naming across plugins, or rename one to clarify intent. The shared name forces every reader to disambiguate by source.",
-          "autoFixable": false,
-          "details": {
-            "namespaces": [
-              {
-                "source": "plugin:okr",
-                "name": "okr-offentlig-sektor",
-                "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/okr/skills/okr-offentlig-sektor/SKILL.md"
-              },
-              {
-                "source": "plugin:okr",
-                "name": "okr-offentlig-sektor",
-                "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-privat/plugins/okr/skills/okr-offentlig-sektor/SKILL.md"
-              }
-            ]
-          }
-        }
-      ],
       "counts": {
         "critical": 0,
         "high": 0,
         "medium": 0,
-        "low": 1,
+        "low": 0,
         "info": 0
       }
     }
@@ -542,4 +512,4 @@
     "scanners_error": 0,
     "scanners_skipped": 1
   }
-}
+}

tests/snapshots/v5.0.0/token-hotspots.json

@@ -2,8 +2,8 @@
   "scanner": "TOK",
   "status": "ok",
   "files_scanned": 2,
-  "duration_ms": 119,
+  "duration_ms": 9,
-  "total_estimated_tokens": 1809,
+  "total_estimated_tokens": 809,
   "hotspots": [
     {
       "source": "mcp:memory (.mcp.json)",
@@ -13,61 +13,45 @@
         "Review whether this source needs to load on every turn."
       ]
     },
-    {
-      "source": "mcp:sadhguru-wisdom (plugin:sadhguru-wisdom)",
-      "estimated_tokens": 500,
-      "rank": 2,
-      "recommendations": [
-        "Review whether this source needs to load on every turn."
-      ]
-    },
-    {
-      "source": "mcp:vegnorm-rag (plugin:vegnormalene)",
-      "estimated_tokens": 500,
-      "rank": 3,
-      "recommendations": [
-        "Review whether this source needs to load on every turn."
-      ]
-    },
     {
       "source": "CLAUDE.md",
       "estimated_tokens": 116,
-      "rank": 4,
+      "rank": 2,
       "recommendations": [
         "Move volatile top-of-file content to the bottom or extract to an @import-ed file.",
         "Split overlong CLAUDE.md into focused @imports (≤200 lines each)."
       ],
-      "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md"
+      "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/CLAUDE.md"
     },
     {
       "source": "hooks/hooks.json",
       "estimated_tokens": 81,
+      "rank": 3,
+      "recommendations": [
+        "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
+        "Move rarely-used permissions to a project-local override."
+      ],
+      "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/hooks/hooks.json"
+    },
+    {
+      "source": ".claude/settings.json",
+      "estimated_tokens": 59,
+      "rank": 4,
+      "recommendations": [
+        "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
+        "Move rarely-used permissions to a project-local override."
+      ],
+      "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json"
+    },
+    {
+      "source": ".mcp.json",
+      "estimated_tokens": 53,
       "rank": 5,
       "recommendations": [
         "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
         "Move rarely-used permissions to a project-local override."
       ],
-      "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/hooks/hooks.json"
+      "path": "/Users/ktg/repos/ktg-plugin-marketplace/config-audit/tests/fixtures/marketplace-medium/.mcp.json"
-    },
-    {
-      "source": ".claude/settings.json",
-      "estimated_tokens": 59,
-      "rank": 6,
-      "recommendations": [
-        "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
-        "Move rarely-used permissions to a project-local override."
-      ],
-      "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.claude/settings.json"
-    },
-    {
-      "source": ".mcp.json",
-      "estimated_tokens": 53,
-      "rank": 7,
-      "recommendations": [
-        "Deduplicate overlapping entries — each duplicate inflates the per-turn schema payload.",
-        "Move rarely-used permissions to a project-local override."
-      ],
-      "path": "/Users/ktg/.claude/plugins/marketplaces/ktg-plugin-marketplace/plugins/config-audit/tests/fixtures/marketplace-medium/.mcp.json"
     }
   ],
   "findings": [
@@ -92,4 +76,4 @@
     "low": 1,
     "info": 0
   }
-}
+}