diff --git a/tests/agent/test_anthropic_adapter.py b/tests/agent/test_anthropic_adapter.py
index 10f82ca95e08..df4d10aa95f0 100644
--- a/tests/agent/test_anthropic_adapter.py
+++ b/tests/agent/test_anthropic_adapter.py
@@ -28,6 +28,34 @@
 from agent.transports import get_transport
 
 
+# ---------------------------------------------------------------------------
+# Module-level isolation — KR-TEST-STABILITY-SWEEP
+# ---------------------------------------------------------------------------
+#
+# ``resolve_anthropic_token`` + ``read_claude_code_credentials`` read
+# from the OS keychain on macOS (via
+# ``_read_claude_code_credentials_from_keychain``) in addition to the
+# env vars + filesystem credential files individual tests
+# monkeypatch. Without an autouse keychain-stub a developer's real
+# OAuth token bleeds into TestResolveAnthropicToken assertions
+# (observed during pre-existing-failure sweep: keychain returned a
+# live ``sk-ant-oat01-...`` token regardless of the test's env setup).
+#
+# ``TestReadClaudeCodeCredentials`` already had its own per-class
+# autouse fixture stubbing the keychain reader. Promoted to module
+# scope so every Test* class in the file gets the same isolation by
+# default — same shape, broader reach. The per-class fixture in
+# TestReadClaudeCodeCredentials is now redundant but kept verbatim
+# for self-documentation; both fire on those tests with no side
+# effects (both patch to the same lambda value).
+@pytest.fixture(autouse=True)
+def _module_no_keychain(monkeypatch):
+    monkeypatch.setattr(
+        "agent.anthropic_adapter._read_claude_code_credentials_from_keychain",
+        lambda: None,
+    )
+
+
 # ---------------------------------------------------------------------------
 # Auth helpers
 # ---------------------------------------------------------------------------
diff --git a/tests/gateway/test_dingtalk.py b/tests/gateway/test_dingtalk.py
index 6b2db13299dd..91aeee909ac0 100644
--- a/tests/gateway/test_dingtalk.py
+++ b/tests/gateway/test_dingtalk.py
@@ -250,7 +250,9 @@ async def test_send_posts_to_webhook(self):
         assert call_args[0][0] == "https://dingtalk.example/webhook"
         payload = call_args[1]["json"]
         assert payload["msgtype"] == "markdown"
-        assert payload["markdown"]["title"] == "Hermes"
+        # Identity rebrand: PlatformConfig.display_name defaults to
+        # "Kora" since the Hermes→Kora fork (see gateway/config.py:304).
+        assert payload["markdown"]["title"] == "Kora"
         assert payload["markdown"]["text"] == "Hello!"
 
     @pytest.mark.asyncio
diff --git a/tests/plugins/memory/test_scratchpad.py b/tests/plugins/memory/test_scratchpad.py
index c2aac6a9c823..ae42c8372788 100644
--- a/tests/plugins/memory/test_scratchpad.py
+++ b/tests/plugins/memory/test_scratchpad.py
@@ -21,9 +21,17 @@
 import logging
 from typing import Any, List, Optional
 
-import blake3
 import pytest
 
+# blake3 is an optional plugin dep (declared in the ``isokron`` extra
+# in pyproject.toml + the plugin.yaml). The production module
+# ``plugins.memory.isokron.scratchpad`` already imports it inside a
+# try/except — test side mirrors that with importorskip so the suite
+# collects cleanly in environments where the isokron extra isn't
+# installed (e.g. the default ``--extra dev --extra all`` test
+# invocation). Collection-time skip > collection-time ImportError.
+blake3 = pytest.importorskip("blake3")
+
 from plugins.memory.isokron.scratchpad import (
     DEFAULT_SCRATCHPAD_READ_LIMIT,
     ScratchpadEntry,