- non-structural exemptions need approved_by (windy-hub|windy-mind) and expire within 90 days;
a longer amnesty simply does not apply and is reported (OVER-CAP). compute-door/guard-self: yearly.
- .github/CODEOWNERS on the allow-lists + guard.
- engine-port rule skips contracts/schemas/specs/openapi dirs and *.json (53 baseline hits, was 57).
- tests: findings carry kind+name never the value; shipped allow file obeys its own rules.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
