diff --git a/config/quality/eslint-suppressions.json b/config/quality/eslint-suppressions.json
index 3dae8591dd..79875e3148 100644
--- a/config/quality/eslint-suppressions.json
+++ b/config/quality/eslint-suppressions.json
@@ -853,11 +853,6 @@
       "count": 1
     }
   },
-  "src/app/api/usage/call-logs/route.ts": {
-    "no-restricted-imports": {
-      "count": 1
-    }
-  },
   "src/app/api/usage/quota/route.ts": {
     "no-restricted-imports": {
       "count": 1
@@ -953,11 +948,6 @@
       "count": 1
     }
   },
-  "src/app/api/v1/rerank/route.ts": {
-    "no-restricted-imports": {
-      "count": 1
-    }
-  },
   "src/app/api/v1/vscode/[token]/models/route.ts": {
     "no-restricted-syntax": {
       "count": 1
@@ -3259,4 +3249,4 @@
       "count": 5
     }
   }
-}
+}
\ No newline at end of file
diff --git a/tests/unit/security-route-guard-tiers.test.ts b/tests/unit/security-route-guard-tiers.test.ts
new file mode 100644
index 0000000000..dfc1f3c026
--- /dev/null
+++ b/tests/unit/security-route-guard-tiers.test.ts
@@ -0,0 +1,10 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { isLocalOnlyPath } from "../../src/server/authz/routeGuard.ts";
+
+test("isLocalOnlyPath correctly classifies process-spawning endpoints under Tier 1 LOCAL_ONLY", () => {
+  assert.equal(isLocalOnlyPath("/api/services/dario/start"), true);
+  assert.equal(isLocalOnlyPath("/api/mcp/stream"), true);
+  assert.equal(isLocalOnlyPath("/api/cli-tools/runtime/status"), true);
+  assert.equal(isLocalOnlyPath("/api/v1/chat/completions"), false);
+});