diff --git a/.github/codeql/openclaw-boundary/queries/raw-socket-callsite-classification.ql b/.github/codeql/openclaw-boundary/queries/raw-socket-callsite-classification.ql
index 8c5e7176097b..58d6f17a0f8b 100644
--- a/.github/codeql/openclaw-boundary/queries/raw-socket-callsite-classification.ql
+++ b/.github/codeql/openclaw-boundary/queries/raw-socket-callsite-classification.ql
@@ -62,13 +62,10 @@ predicate allowedRawSocketClientCall(Expr call) {
   or
   allowedOwnerScope(call, "src/infra/ssh-tunnel.ts", "canConnectLocal")
   or
-  allowedOwnerScope(call, "src/infra/gateway-lock.ts", "checkPortFree")
-  or
   allowedOwnerScope(call, "src/infra/jsonl-socket.ts", "requestJsonlSocketWithMaxLineBytes")
   or
-  allowedOwnerScope(call, "src/infra/net/http-connect-tunnel.ts", "connectToProxy")
-  or
-  allowedOwnerScope(call, "src/infra/net/http-connect-tunnel.ts", "startTargetTls")
+  // This TLS layer wraps the managed CONNECT socket; it cannot open a direct route.
+  allowedOwnerScope(call, "src/infra/push-apns-http2.ts", "openApnsTlsTunnel")
   or
   allowedOwnerScope(call, "src/infra/push-apns-http2.ts", "openProxiedApnsHttp2Session")
   or
diff --git a/.github/workflows/codeql-critical-quality.yml b/.github/workflows/codeql-critical-quality.yml
index 2d84fef1877d..7d1efe0915c6 100644
--- a/.github/workflows/codeql-critical-quality.yml
+++ b/.github/workflows/codeql-critical-quality.yml
@@ -447,6 +447,7 @@ jobs:
           added_lines="$(mktemp)"
           raw_socket_scan_lines="$(mktemp)"
           codex_transport="extensions/codex/src/app-server/transport-websocket.ts"
+          network_codeql_contract_pattern='^\.github/codeql/(codeql-network-runtime-boundary-critical-quality\.yml|openclaw-boundary/queries/(raw-socket-callsite-classification|managed-proxy-runtime-mutation)\.ql)$'
 
           gh api --paginate "repos/${REPOSITORY}/pulls/${PR_NUMBER}/files" --jq '.[].filename' > "$changed_files"
           gh api --paginate "repos/${REPOSITORY}/pulls/${PR_NUMBER}/files" --jq '
@@ -472,10 +473,10 @@ jobs:
             | "\($file): \(.)"
           ' > "$raw_socket_scan_lines"
 
-          if grep -Fxq "$codex_transport" "$changed_files"; then
-            # This transport has an exact owner/function allowlist in the raw-socket
-            # CodeQL query, so its raw socket calls run there. Proxy policy tokens
-            # remain in the fast scan below.
+          # Query/config edits need semantic analysis; the fast diff scan cannot validate QL.
+          # The Codex transport also has an exact owner/function allowlist in the query.
+          if grep -Eq "$network_codeql_contract_pattern" "$changed_files" || \
+             grep -Fxq "$codex_transport" "$changed_files"; then
             echo "full_codeql=true" >> "$GITHUB_OUTPUT"
           else
             echo "full_codeql=false" >> "$GITHUB_OUTPUT"
diff --git a/test/scripts/ci-workflow-guards.test.ts b/test/scripts/ci-workflow-guards.test.ts
index 73d32bf1612b..8f2cf30dc74f 100644
--- a/test/scripts/ci-workflow-guards.test.ts
+++ b/test/scripts/ci-workflow-guards.test.ts
@@ -4998,6 +4998,12 @@ printf '%s\n' "\${CURL_SUCCESS_IP:-203.0.113.7}"
     expect(workflow).toContain(
       'codex_transport="extensions/codex/src/app-server/transport-websocket.ts"',
     );
+    expect(workflow).toContain(
+      "network_codeql_contract_pattern='^\\.github/codeql/(codeql-network-runtime-boundary-critical-quality\\.yml|openclaw-boundary/queries/(raw-socket-callsite-classification|managed-proxy-runtime-mutation)\\.ql)$'",
+    );
+    expect(workflow).toContain(
+      'if grep -Eq "$network_codeql_contract_pattern" "$changed_files" ||',
+    );
     expect(workflow).toContain(
       '| select(.filename != "extensions/codex/src/app-server/transport-websocket.ts")',
     );