"""Reviewed callback hosts. Changes require repository and platform review."""

# Exact DNS names only: no wildcards, subdomains, IP literals, or workflow overrides.
ALLOWED_CALLBACK_HOSTS = frozenset({"notify.bro3.net"})