diff --git a/lib/crates/fabro-auth/src/resolve.rs b/lib/crates/fabro-auth/src/resolve.rs
index c99ab41ab..f27156b7d 100644
--- a/lib/crates/fabro-auth/src/resolve.rs
+++ b/lib/crates/fabro-auth/src/resolve.rs
@@ -543,6 +543,7 @@ mod tests {
             panic!("expected cli credential");
         };
 
+        #[allow(clippy::disallowed_methods)] // Test needs a real shell to verify login_command
         let status = std::process::Command::new("/bin/sh")
             .arg("-lc")
             .arg(cli.login_command.unwrap())
diff --git a/lib/crates/fabro-config/src/merge.rs b/lib/crates/fabro-config/src/merge.rs
index 50e73a9ce..c5411aaa1 100644
--- a/lib/crates/fabro-config/src/merge.rs
+++ b/lib/crates/fabro-config/src/merge.rs
@@ -494,6 +494,7 @@ fn combine_server_integrations(
 #[cfg(test)]
 mod tests {
     use fabro_types::settings::InterpString;
+    use fabro_types::settings::cli::{OutputFormat, OutputVerbosity};
 
     use super::*;
     use crate::parse::parse_settings_layer;
@@ -714,23 +715,17 @@ verbosity = "verbose"
 
         let merged = combine_files(lower, higher);
         let output = merged.cli.unwrap().output.unwrap();
-        assert_eq!(
-            output.format,
-            Some(fabro_types::settings::cli::OutputFormat::Text)
-        );
-        assert_eq!(
-            output.verbosity,
-            Some(fabro_types::settings::cli::OutputVerbosity::Verbose)
-        );
+        assert_eq!(output.format, Some(OutputFormat::Text));
+        assert_eq!(output.verbosity, Some(OutputVerbosity::Verbose));
     }
 
     #[test]
     fn cli_updates_merges_by_field() {
         let lower = parse(
-            r#"
+            r"
 [cli.updates]
 check = true
-"#,
+",
         );
         let higher = parse(
             r#"
diff --git a/lib/crates/fabro-config/src/resolve/mod.rs b/lib/crates/fabro-config/src/resolve/mod.rs
index ddb3970b4..b0ac5c82b 100644
--- a/lib/crates/fabro-config/src/resolve/mod.rs
+++ b/lib/crates/fabro-config/src/resolve/mod.rs
@@ -115,7 +115,7 @@ pub(crate) fn default_interp(path: impl AsRef<std::path::Path>) -> InterpString
 mod tests {
     use std::collections::HashMap;
 
-    use fabro_types::settings::run::{HookType, McpTransport};
+    use fabro_types::settings::run::{HookType, McpTransport, TlsMode};
 
     use super::resolve;
     use crate::parse_settings_layer;
@@ -209,7 +209,7 @@ Authorization = "Bearer {{ env.HOOK_TOKEN }}"
                     "Bearer {{ env.HOOK_TOKEN }}".to_string(),
                 )])),
                 allowed_env_vars: Vec::new(),
-                tls:              fabro_types::settings::run::TlsMode::Verify,
+                tls:              TlsMode::Verify,
             })
         );
     }
diff --git a/lib/crates/fabro-server/src/jwt_auth.rs b/lib/crates/fabro-server/src/jwt_auth.rs
index cdecabbca..3319fe45a 100644
--- a/lib/crates/fabro-server/src/jwt_auth.rs
+++ b/lib/crates/fabro-server/src/jwt_auth.rs
@@ -315,12 +315,12 @@ mod tests {
     #[test]
     fn fails_when_auth_methods_empty() {
         let file = parse_settings_layer(
-            r#"
+            r"
 _version = 1
 
 [server.auth]
 methods = []
-"#,
+",
         )
         .expect("fixture should parse");
         let errors = resolve_server_from_file(&file).expect_err("empty auth methods should fail");
diff --git a/lib/crates/fabro-types/src/settings/resolved.rs b/lib/crates/fabro-types/src/settings/resolved.rs
index f6795be88..bdcd99ed0 100644
--- a/lib/crates/fabro-types/src/settings/resolved.rs
+++ b/lib/crates/fabro-types/src/settings/resolved.rs
@@ -135,34 +135,36 @@ mod tests {
             })
         );
 
-        let mut settings = Settings::default();
-        settings.server = ServerSettings {
-            slatedb: ServerSlateDbSettings {
-                prefix:         InterpString::parse("slatedb/"),
-                store:          ObjectStoreSettings::Local {
-                    root: InterpString::parse("/srv/slatedb"),
-                },
-                flush_interval: StdDuration::from_secs(30),
-            },
-            ..ServerSettings::default()
-        };
-        settings.run = RunSettings {
-            agent: RunAgentSettings {
-                mcps: HashMap::from([("sandboxed".to_string(), McpServerSettings {
-                    name:                 "sandboxed".to_string(),
-                    transport:            McpTransport::Http {
-                        url:     "https://mcp.example.com".to_string(),
-                        headers: HashMap::from([(
-                            "Authorization".to_string(),
-                            "Bearer {{ env.MCP_TOKEN }}".to_string(),
-                        )]),
+        let settings = Settings {
+            server: ServerSettings {
+                slatedb: ServerSlateDbSettings {
+                    prefix:         InterpString::parse("slatedb/"),
+                    store:          ObjectStoreSettings::Local {
+                        root: InterpString::parse("/srv/slatedb"),
                     },
-                    startup_timeout_secs: 15,
-                    tool_timeout_secs:    90,
-                })]),
-                ..RunAgentSettings::default()
+                    flush_interval: StdDuration::from_secs(30),
+                },
+                ..ServerSettings::default()
             },
-            ..RunSettings::default()
+            run: RunSettings {
+                agent: RunAgentSettings {
+                    mcps: HashMap::from([("sandboxed".to_string(), McpServerSettings {
+                        name:                 "sandboxed".to_string(),
+                        transport:            McpTransport::Http {
+                            url:     "https://mcp.example.com".to_string(),
+                            headers: HashMap::from([(
+                                "Authorization".to_string(),
+                                "Bearer {{ env.MCP_TOKEN }}".to_string(),
+                            )]),
+                        },
+                        startup_timeout_secs: 15,
+                        tool_timeout_secs:    90,
+                    })]),
+                    ..RunAgentSettings::default()
+                },
+                ..RunSettings::default()
+            },
+            ..Settings::default()
         };
 
         let value = serde_json::to_value(settings).unwrap();
diff --git a/lib/crates/fabro-workflow/src/pipeline/initialize.rs b/lib/crates/fabro-workflow/src/pipeline/initialize.rs
index dafac31de..255bd4bc4 100644
--- a/lib/crates/fabro-workflow/src/pipeline/initialize.rs
+++ b/lib/crates/fabro-workflow/src/pipeline/initialize.rs
@@ -810,13 +810,13 @@ mod tests {
     }
 
     fn llm_graph() -> (Graph, String) {
-        let source = r#"digraph test {
+        let source = r"digraph test {
   start [shape=Mdiamond];
   writer [shape=box];
   exit [shape=Msquare];
   start -> writer;
   writer -> exit;
-}"#
+}"
         .to_string();
         let mut graph = Graph::new("test");
         let mut start = Node::new("start");