test(config-audit): add baseline-all-a fixture + grade-stability regression test

plugins/config-audit/tests/fixtures/baseline-all-a/.claude/rules/typescript.md

@@ -0,0 +1,13 @@
+---
+paths: src/**/*.ts
+---
+
+# TypeScript Rules
+
+Use strict TypeScript throughout.
+
+## Mandatory
+
+- `strict: true` in tsconfig
+- No `any` — prefer `unknown` at boundaries
+- Prefer `type` aliases for simple shapes, `interface` for extendable objects

plugins/config-audit/tests/fixtures/baseline-all-a/.claude/settings.json

@@ -0,0 +1,8 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
+  "permissions": {
+    "allow": ["Bash(npm run *)", "Read(src/**)"],
+    "deny": ["Read(./.env)"]
+  },
+  "effortLevel": "medium"
+}

plugins/config-audit/tests/fixtures/baseline-all-a/.claude/shared.md

@@ -0,0 +1,15 @@
+# Shared Configuration
+
+Common patterns and conventions shared across the baseline fixture.
+
+## Naming Conventions
+
+- `camelCase` for variables and functions
+- `PascalCase` for classes, interfaces, and types
+- `UPPER_SNAKE_CASE` for module-level constants
+
+## Error Handling
+
+- Prefer early return over deep nesting
+- Throw `Error` subclasses with typed messages
+- Never swallow errors silently

plugins/config-audit/tests/fixtures/baseline-all-a/.mcp.json

@@ -0,0 +1,10 @@
+{
+  "mcpServers": {
+    "memory": {
+      "type": "stdio",
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-memory"],
+      "trust": "workspace"
+    }
+  }
+}

plugins/config-audit/tests/fixtures/baseline-all-a/CLAUDE.md

@@ -0,0 +1,44 @@
+# Baseline Project
+
+## Overview
+
+A fixture designed to score Grade A on every v3 quality area (CML, SET, HKV,
+RUL, MCP, IMP, CNF) before the Token Efficiency scanner is added. Serves as
+the grade-stability canary for the config-audit v4.0 release.
+
+## Purpose
+
+This fixture is the regression canary for the posture scorecard. If a future
+scanner change drags any v3 quality area below Grade A on this fixture, the
+change is not release-safe.
+
+## Commands
+
+- `npm run build` — Build the project
+- `npm test` — Run all tests
+- `npm run lint` — Lint source files
+
+## Architecture
+
+Standard Node.js layout with TypeScript under `src/`, unit tests co-located
+beside implementation files, and shared config imported via `@import`.
+
+## Conventions
+
+- TypeScript strict mode; no `any`
+- Conventional Commits (`type(scope): description`)
+- Zero runtime npm dependencies where possible
+- Deterministic test fixtures only
+
+## Tooling
+
+- Node.js ≥ 18
+- `node:test` framework for unit tests
+- `node --test 'tests/**/*.test.mjs'` runs the full suite
+
+## Shared Patterns
+
+Shared conventions and helpers are documented in an imported file to keep the
+top-level stable-prefix content cache-friendly under Opus 4.7.
+
+@.claude/shared.md

plugins/config-audit/tests/fixtures/baseline-all-a/hooks/hooks.json

@@ -0,0 +1,28 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "echo pre-bash",
+            "timeout": 5000
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Write|Edit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "echo post-edit",
+            "timeout": 5000
+          }
+        ]
+      }
+    ]
+  }
+}

plugins/config-audit/tests/fixtures/baseline-all-a/src/index.ts

@@ -0,0 +1,4 @@
+// Sample TypeScript source file to satisfy rule glob patterns.
+export function hello(name: string): string {
+  return `Hello, ${name}`;
+}