config-audit

Author SHA1 Message Date

Author	SHA1	Message	Date
Kjell Tore Guttormsen	b3c572ad46	fix(mcp-config-validator): remove invented `trust` field (verify-first) `.mcp.json` has no per-server `trust` key — verified 2026-06-18 against code.claude.com/docs/en/mcp + /settings. MCP server approval is dialog/settings-based (enableAllProjectMcpServers / enabledMcpjsonServers / disabledMcpjsonServers), never a JSON field. The scanner's "Missing trust level" (CA-MCP-001, medium) and "Invalid trust level" (high) were false positives flagging a field that does not exist. - scanner: delete both trust checks + VALID_TRUST_LEVELS; drop `trust` from VALID_SERVER_FIELDS so a stray `trust` is now flagged as an unknown field - humanizer: remove the two trust-level entries - knowledge (5 files): point to the real approval mechanism, not a trust field - fixtures: scrub `trust` (incl. the invalid "local" in optimal-setup) - tests: flip assertions (no trust-level finding; stray trust -> unknown field) + add knowledge-staleness re-freeze guards - snapshots: reseed (marketplace-medium .mcp.json -8 tokens, hermetic) - gap-matrix: mark the trust verify-first item DONE Suite: 853/853 green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8	2026-06-18 14:22:56 +02:00
Kjell Tore Guttormsen	315ea2259f	docs(config-audit): CC 2.1.114-181 coverage gap analysis (Fase 0-2) Systematic review of Claude Code config-surface changes from the plugin's last-verified baseline (v2.1.114) to installed v2.1.181, against current scanner coverage. 12/12 surfaces, 162 verified gap rows via two background gap-analysis workflows (search-first, per-surface changelog verification). Key finding: a cluster of ACTIVE FALSE POSITIVES - config-audit flags valid v2.1.181 config as wrong (effortLevel xhigh; ~12 settings keys incl. sandbox/fallbackModel/enforceAvailableModels/disableBundledSkills/agent; MCP ${CLAUDE_PROJECT_DIR} and POSIX expansions; param-qualified permission rules; MessageDisplay/post-session hooks). Recommended release v5.2.0 (byte-stable; fixes remove false findings). Voyage escalation: no. - docs/cc-2.1.x-gap-review-plan.md - ratified plan (method A, floor v2.1.114) - docs/cc-2.1.x-gap-matrix.md - full gap matrix + buckets + release call - docs/cc-2.1.x-changelog-delta.md - changelog corpus (superseded by matrix) STATE.md updated (gitignored) - next session resumes at Batch 1. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8	2026-06-18 11:31:48 +02:00

b3c572ad46

fix(mcp-config-validator): remove invented trust field (verify-first)

`.mcp.json` has no per-server `trust` key — verified 2026-06-18 against
code.claude.com/docs/en/mcp + /settings. MCP server approval is
dialog/settings-based (enableAllProjectMcpServers / enabledMcpjsonServers /
disabledMcpjsonServers), never a JSON field. The scanner's "Missing trust
level" (CA-MCP-001, medium) and "Invalid trust level" (high) were false
positives flagging a field that does not exist.

- scanner: delete both trust checks + VALID_TRUST_LEVELS; drop `trust` from
  VALID_SERVER_FIELDS so a stray `trust` is now flagged as an unknown field
- humanizer: remove the two trust-level entries
- knowledge (5 files): point to the real approval mechanism, not a trust field
- fixtures: scrub `trust` (incl. the invalid "local" in optimal-setup)
- tests: flip assertions (no trust-level finding; stray trust -> unknown
  field) + add knowledge-staleness re-freeze guards
- snapshots: reseed (marketplace-medium .mcp.json -8 tokens, hermetic)
- gap-matrix: mark the trust verify-first item DONE

Suite: 853/853 green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8

2026-06-18 14:22:56 +02:00

Kjell Tore Guttormsen

315ea2259f

docs(config-audit): CC 2.1.114-181 coverage gap analysis (Fase 0-2)

Systematic review of Claude Code config-surface changes from the plugin's last-verified baseline (v2.1.114) to installed v2.1.181, against current scanner coverage. 12/12 surfaces, 162 verified gap rows via two background gap-analysis workflows (search-first, per-surface changelog verification).

Key finding: a cluster of ACTIVE FALSE POSITIVES - config-audit flags valid v2.1.181 config as wrong (effortLevel xhigh; ~12 settings keys incl. sandbox/fallbackModel/enforceAvailableModels/disableBundledSkills/agent; MCP ${CLAUDE_PROJECT_DIR} and POSIX expansions; param-qualified permission rules; MessageDisplay/post-session hooks). Recommended release v5.2.0 (byte-stable; fixes remove false findings). Voyage escalation: no.

- docs/cc-2.1.x-gap-review-plan.md - ratified plan (method A, floor v2.1.114)
- docs/cc-2.1.x-gap-matrix.md      - full gap matrix + buckets + release call
- docs/cc-2.1.x-changelog-delta.md - changelog corpus (superseded by matrix)

STATE.md updated (gitignored) - next session resumes at Batch 1.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8

2026-06-18 11:31:48 +02:00

2 commits