Isolate cross-database repair validation

tests/test_policy.py

@@ -3,7 +3,8 @@ from dataclasses import replace
 from test_config import settings
 
 from lai_automation.git import ChangeSummary
-from lai_automation.policy import evaluate_changes
+from lai_automation.models import FailureReport
+from lai_automation.policy import evaluate_changes, evaluate_report_scope
 
 
 def test_policy_accepts_small_application_change() -> None:
@@ -52,3 +53,33 @@ def test_policy_rejects_symlinks(tmp_path) -> None:
     (tmp_path / "link.php").symlink_to("/etc/passwd")
     result = evaluate_changes(ChangeSummary(("link.php",), 1, 0), settings(), tmp_path)
     assert not result.allowed
+
+
+def test_cross_database_report_requires_application_orchestration() -> None:
+    report = FailureReport(
+        id=56,
+        chat_message_id=1,
+        source="user_feedback",
+        category="incorrect_answer",
+        user_feedback="Use cockpit_config.time_registration",
+        feedback_type="wrong_result",
+        expected_behavior="Join cockpit_config manager_id and FK_AuftragPos",
+        prompt="Hours in April",
+        response="0 hours",
+        sql_query="SELECT 0",
+        error_message=None,
+        context={},
+    )
+
+    rejected = evaluate_report_scope(
+        report,
+        ChangeSummary(("config/erp_semantics.php", "tests/Unit/FixTest.php"), 20, 2),
+    )
+    accepted = evaluate_report_scope(
+        report,
+        ChangeSummary(("app/Http/Controllers/ChatController.php", "tests/Unit/FixTest.php"), 20, 2),
+    )
+
+    assert not rejected.allowed
+    assert "staged orchestration" in rejected.errors[0]
+    assert accepted.allowed