Isolate cross-database repair validation

src/lai_automation/policy.py

@@ -5,6 +5,7 @@ from pathlib import Path, PurePosixPath
 
 from .config import Settings
 from .git import ChangeSummary
+from .models import FailureReport
 
 _ALWAYS_DENIED = (
     ".env",
@@ -66,3 +67,16 @@ def evaluate_changes(
             errors.append(f"Direct-main denied path changed: {filename}")
 
     return PolicyResult(not errors, tuple(errors))
+
+
+def evaluate_report_scope(report: FailureReport, summary: ChangeSummary) -> PolicyResult:
+    expected = f"{report.user_feedback or ''}\n{report.expected_behavior or ''}".lower()
+    requires_cross_database_orchestration = "cockpit_config" in expected and "fk_" in expected
+    has_application_change = any(filename.startswith("app/") for filename in summary.files)
+    errors = []
+    if requires_cross_database_orchestration and not has_application_change:
+        errors.append(
+            "Cross-database report changed no application code; inspect routing and implement staged orchestration"
+        )
+
+    return PolicyResult(not errors, tuple(errors))