Wakeup-INSERT rule is universal (never allowlisted — hard invariant). Raw-HTTP rule exempts the sanctioned helpers + standalone operator/admin scripts (a distinct category per fitness-function scope differentiation + DRY: tooling needn't reuse the FastAPI wrapper). Repo scanned clean under these rules. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>