Scan quarantine (platform admin)
Every revision an image scan refused, waiting on an operator. It lives under Admin → Scan quarantine and requires the platform-admin role.
Refused, and for a revision that was never running, not destroyed either — the same promise a trust-tier ceiling makes. The one exception is a card that arrived by way of a scheduled rescan catching a digest already live: that revision's stack has already been stopped by the time it lands here, not only refused for its next deploy. Either way, nothing on this queue moves until an operator decides it. See deployment states for what a tenant sees of the same revision.
Every card carries the verdict, the reason in full, and — where the scanner found something specific — the individual findings underneath, each with its type and severity. There is one decision to make and two ways to make it — plus one button that tries to settle it on the evidence first, so that you don't have to:
| Action | Effect |
|---|---|
| Rescan | Asks the scanner again, against the signature databases as they are now, and re-applies the tier rules to whatever comes back. Nothing is overridden: a verdict that no longer refuses the revision releases and redeploys it, and one that still refuses it leaves the card here with the reason brought up to date. Try this first. |
| Clear | Overrides the digest's verdict, not just this revision's — a re-push of the same image is not re-queued for the next operator to clear again. Requires a reason, so the next person who sees this digest knows why it was let through. The revision moves to built and redeploys immediately. |
| Uphold | The revision moves to failed for good; the tenant sees the same findings on their own page. |
Try Rescan before you clear anything. The two verdicts that fill this queue are usually not judgement calls at all: an "image scan could not complete" refuses every deploy an untrusted account makes while the scanner is down or its databases have not been fetched yet, and a malware hit on a signature that has since been corrected reads identically to a real one. Clearing those buys a redeploy at the price of vouching for the digest forever. A rescan settles them on the evidence and vouches for nothing.
A rescan runs as a background task, so the button reports that it was asked for rather than what it found — the queue updates itself when the answer arrives. It only appears where there is a scanned digest to ask about again; a revision refused over its build context, or over an image that could never be resolved, has no earlier scan to repeat and offers Clear and Uphold only.
Clearing writes the reason onto the ledger and gets out of the way:
Clearing outranks scrutiny for that one digest, permanently — that is a real decision, not a formality. A digest cleared once proceeds at every tier from then on, including a tier that would otherwise quarantine it again. Getting it wrong means treating an image as vouched for when it should not have been, so the reason field exists to make that call accountable rather than to satisfy a form.