Scan quarantine (platform admin)
Every revision an image scan refused, waiting on an operator. It lives under Admin → Scan quarantine and requires the platform-admin role.
Refused, and for a revision that was never running, not destroyed either—the same promise a trust-tier ceiling makes. The one exception is a card that arrived by way of a scheduled rescan catching a digest already live: that revision's stack has already been stopped by the time it lands here, not only refused for its next deploy. Either way, nothing on this queue moves until an operator decides it. See deployment states for what a tenant sees of the same revision.
Every card carries the verdict, the reason in full, and—where the scanner found something specific—the individual findings underneath, each with its type and severity. There is one decision to make and two ways to make it. There's also one button that tries to settle it on the evidence first, so that you don't have to:
| Action | Effect |
|---|---|
| Rescan | Asks the scanner again, using the signature databases in their current state, and re-applies the tier rules to whatever comes back. It overrides nothing. A verdict that no longer refuses the revision releases and redeploys it. One that still refuses it leaves the card here, with the reason brought up to date. Try this first. |
| Clear | Overrides the digest's verdict, not just this revision's—a re-push of the same image isn't re-queued for the next operator to clear again. It requires a reason, so the next person who sees this digest knows why the operator let it through. The revision moves to built and redeploys immediately. |
| Uphold | The revision moves to failed for good; the tenant sees the same findings on their own page. |
Try Rescan before you clear anything. The two verdicts that fill this queue are usually not judgement calls at all: an "image scan could not complete" refuses every deploy an untrusted account makes while the scanner is down or before it fetches its databases, and a malware hit on a signature that has since been corrected reads identically to a real one. Clearing those buys a redeploy at the price of vouching for the digest forever. A rescan settles them on the evidence and vouches for nothing.
A rescan runs as a background task, so the button reports that it was asked for rather than what it found—the queue updates itself when the answer arrives. It only appears where there is a scanned digest to ask about again; a revision refused over its build context, or over an image that could never be resolved, has no earlier scan to repeat and offers Clear and Uphold only.
Clearing writes the reason onto the ledger and gets out of the way:
Clearing outranks scrutiny for that one digest, permanently—that's a real decision, not a formality. A digest cleared once proceeds at every tier from then on, including a tier that would otherwise quarantine it again. Getting it wrong means treating an image as vouched for when it shouldn't have been, so the reason field exists to make that call accountable rather than to satisfy a form.
Advisory or compulsory
One switch, over the queue, isn't about a single revision: whether a quarantine compels anything at all, for the whole platform.
| Compulsory | The default, and where the switch sits until somebody moves it. A quarantine refuses the revision, and a rescan that flags an image already serving traffic stops its stack. |
| Advisory | Scans still run and the platform still records every verdict per digest—but it refuses nothing, stops nothing, and no new card joins the queue below. |
Reach for advisory when the scanner is the thing that's broken. The signal is this queue filling up with revisions that plainly shouldn't be in it. An "image scan could not complete" on every deploy an untrusted account makes, what a scanner that's down or unfetched looks like from here. Clearing each of those one at a time vouches for a digest forever on the strength of a broken scanner; switching to advisory stops the bleeding estate-wide without vouching for anything, and switching back costs nothing because the digests have all still been scanned in the meantime.
Three things it doesn't do, on purpose:
- It changes nothing already on the queue. Every card stays, waiting for the same Rescan, Clear or Uphold. Advisory is about what happens next.
- It's not silent. The platform writes every suppressed quarantine to its log. The switch itself records who moved it and when—shown right under it. The next operator to look at this page can see the estate is running unenforced, and who decided that.
- A flagged image already serving traffic still pages you. That one notification survives the switch, because the thing not being done there is stopping a live miner rather than refusing a deploy nobody depends on yet.
Switching back to compulsory needs no ceremony and takes effect on the next scan—a revision built while the platform was advisory isn't retroactively refused, so anything already running keeps running until its next rescan reaches it.