Publish curated Unraid-AppOps-Gateway source from c61e0e1e292914893b40354f904f23dd9fd4a958

backend/app/services/policy_engine.py

@@ -210,6 +210,16 @@ def evaluate_policy(
             "scope_decision": "allowed" if allowed else None,
         }
 
+    if action in {'runner.acceptance.preflight', 'runner.acceptance.quiesce'}:
+        # Dedicated finite maintenance authority; wildcard and database rows
+        # cannot redirect this source-qualified action to other containers.
+        eligible = target == 'tower/ci-acceptance-residue' and source in {'manual', 'chatgpt-mcp'}
+        return {
+            'decision': ('allowed' if action.endswith('.preflight') else 'approval_required') if eligible else 'blocked',
+            'reason': 'Fixed CI acceptance maintenance requires current native origin, dispatch and product-exclusion proofs.',
+            'risk': ACTION_RISK[action], 'policy_id': None, 'scope_decision': None,
+        }
+
     if action in _DEFAULT_DECISIONS:
         reason = _DEFAULT_REASONS.get(action, 'Action uses default governance policy.')
         return {