The ponytail API example returned the raw ORM model, which exposes every column. Restore a response_model whitelist (the trust boundary) while still cutting the repository/service/exception ceremony. Matches the skill's own 'never cut security' rule. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>