diff --git a/lib/crates/fabro-agent/src/lib.rs b/lib/crates/fabro-agent/src/lib.rs
index 96910227f..67ab43544 100644
--- a/lib/crates/fabro-agent/src/lib.rs
+++ b/lib/crates/fabro-agent/src/lib.rs
@@ -59,4 +59,5 @@ pub use truncation::{
 pub use types::{AgentEvent, SessionEvent, SessionState, Turn};
 
 #[cfg(test)]
+#[allow(unreachable_pub)]
 pub(crate) mod test_support;
diff --git a/lib/crates/fabro-cli/src/commands/run/attach.rs b/lib/crates/fabro-cli/src/commands/run/attach.rs
index 5bdc63a7a..eae061c3a 100644
--- a/lib/crates/fabro-cli/src/commands/run/attach.rs
+++ b/lib/crates/fabro-cli/src/commands/run/attach.rs
@@ -591,6 +591,7 @@ mod tests {
     }
 
     #[test]
+    #[allow(unsafe_code)]
     fn engine_child_guard_defuse_keeps_alive() {
         let child = std::process::Command::new("sleep")
             .arg("60")
diff --git a/lib/crates/fabro-store/src/keys.rs b/lib/crates/fabro-store/src/keys.rs
index 48cd9f99c..6444d02c5 100644
--- a/lib/crates/fabro-store/src/keys.rs
+++ b/lib/crates/fabro-store/src/keys.rs
@@ -120,7 +120,7 @@ pub(crate) fn parse_node_key(key: &str) -> Option<(String, u32, String)> {
 }
 
 #[cfg(test)]
-pub fn parse_node_asset_key(key: &str) -> Option<(String, u32, String)> {
+pub(crate) fn parse_node_asset_key(key: &str) -> Option<(String, u32, String)> {
     parse_visit_scoped_key(key, ARTIFACT_NODES_PREFIX)
 }
 
diff --git a/lib/crates/fabro-workflows/src/handler/llm/cli.rs b/lib/crates/fabro-workflows/src/handler/llm/cli.rs
index 87b90eb5b..472207571 100644
--- a/lib/crates/fabro-workflows/src/handler/llm/cli.rs
+++ b/lib/crates/fabro-workflows/src/handler/llm/cli.rs
@@ -966,6 +966,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[allow(unsafe_code)]
     async fn ensure_cli_skips_install_when_present() {
         let sandbox: Arc<dyn Sandbox> = Arc::new(CliMockSandbox::new(vec![ok_result()]));
         let emitter = Arc::new(EventEmitter::new());
@@ -980,6 +981,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[allow(unsafe_code)]
     async fn ensure_cli_installs_when_missing() {
         // version check fails, combined install succeeds
         let sandbox: Arc<dyn Sandbox> = Arc::new(CliMockSandbox::new(vec![
diff --git a/lib/crates/fabro-workflows/src/node_handler.rs b/lib/crates/fabro-workflows/src/node_handler.rs
index af1ccd8fd..13b61bad8 100644
--- a/lib/crates/fabro-workflows/src/node_handler.rs
+++ b/lib/crates/fabro-workflows/src/node_handler.rs
@@ -150,7 +150,7 @@ mod tests {
     use crate::graph::WorkflowGraph;
 
     /// Minimal spike handler that always succeeds — proves the trait plumbing.
-    pub struct SpikeHandler;
+    pub(crate) struct SpikeHandler;
 
     #[async_trait]
     impl NodeHandler<WorkflowGraph> for SpikeHandler {