diff --git a/src/application-core/src/main/java/dev/caskeleton/application/notification/platform/provider/ProviderSubmissionResult.java b/src/application-core/src/main/java/dev/caskeleton/application/notification/platform/provider/ProviderSubmissionResult.java
index f39dea88..c175b998 100644
--- a/src/application-core/src/main/java/dev/caskeleton/application/notification/platform/provider/ProviderSubmissionResult.java
+++ b/src/application-core/src/main/java/dev/caskeleton/application/notification/platform/provider/ProviderSubmissionResult.java
@@ -69,6 +69,7 @@ public record ProviderSubmissionResult(
               "an ambiguous attempt may not claim provider acceptance");
         }
       }
+      default -> throw new IllegalStateException("unhandled attempt confirmation " + confirmation);
     }
   }
 
diff --git a/src/config/spotbugs/exclude.xml b/src/config/spotbugs/exclude.xml
index 975d7893..a8fff6fa 100644
--- a/src/config/spotbugs/exclude.xml
+++ b/src/config/spotbugs/exclude.xml
@@ -35,6 +35,17 @@
         <Class name="dev.caskeleton.adapter.inbound.graphql.GraphqlHttpBoundaryQualificationTest$TestSecurityConfiguration"/>
     </Match>
 
+    <!-- Provider notification callbacks are inbound webhooks: an external provider POSTs to
+         /internal/notification/callbacks/**, so it can never carry a CSRF token, and the chain is
+         SESSION-STATELESS with no ambient cookie auth for CSRF to protect. Authenticity comes from
+         the provider signature the callback package verifies (a failure raises
+         CallbackValidationException -> 400), not from permitAll(). Scoped to this exact
+         configuration class; any other CSRF disable remains reportable. -->
+    <Match>
+        <Bug pattern="SPRING_CSRF_PROTECTION_DISABLED"/>
+        <Class name="dev.caskeleton.adapter.inbound.web.notification.platform.callback.CallbackMvcSecurityConfiguration"/>
+    </Match>
+
     <!-- Test-only violation fixture intentionally calls unsafe Jackson default typing so
          architecture tests can prove the boundary rule catches it. Production and non-fixture
          test classes remain covered by SECUJDES. -->