fix(pce): PCE lock, failed-onboarding quarantine, and clientId-only PCE

CONTEXT.md

@@ -138,3 +138,25 @@ description-only prohibition yields no durable DENY (see the PRB spec's _digeste
 input retires exclusivity handling and Door B_ decision). Enforcement is tracked
 in the neutrality-guard follow-up (`rossoctl/aiac`).
 _Avoid_: description-driven deny, effect-in-description.
+
+**Quarantine**:
+The policy teardown of a failed onboarding, done by the PCE after the UC1
+rollback disables the client. Keyed by the clientId, as every PCE operation
+is. It deletes the service's SPM, removes its roles
+from the other SPMs, replaces a failed agent's CR with a no-rules CR (which
+denies every request), and re-derives the affected agents. A disabled client
+_is_ a quarantined service: the routing guard drops every rule that touches it,
+and the focal resolver gives it no candidate role or scope. Only a successful
+re-onboarding lifts it. Distinct from **decommission** (the offboard teardown of
+a deleted client, keyed by clientId).
+_Avoid_: rollback (the IdP-side teardown that comes before it), block, ban.
+
+**Focus service**:
+The service that the current onboarding builds rules for — the `focus_service`
+the onboarding route and the NATS consumer pass to the PCE, as its clientId
+(never its Keycloak UUID). It is the one
+disabled service that the routing guard and the focal resolver do not skip,
+because a re-onboarding of a quarantined service builds and applies while its
+client is still disabled (`reenable_service` runs after the apply).
+_Avoid_: target service (a target is the service an agent calls), focal entity
+(the per-pass subject inside one build).

docs/specs/components/aiac-agent.md

@@ -124,7 +124,7 @@ The Controller is a FastAPI routes layer (`controller/routes.py`). Its responsib
 - Parse the trigger type and entity ID from the request path.
 - Dispatch to the Service Onboarding Orchestrator (UC1) or directly to the Policy Update / Role Update sub-agents (UC2, UC3).
 - Receive the `list[PolicyRule]` returned by the Orchestrator or sub-agent (already merged by the sub-agent).
-- Call `compute_and_apply(merged_rules)` from `aiac.policy.computation` (PCE) once.
+- Call `compute_and_apply(merged_rules)` from `aiac.policy.computation` (PCE) once. For UC1, the onboarding route and the NATS consumer also pass `override` and `focus_service` (the clientId of the service being onboarded, which `onboard_service` returns — not the UUID in the path), so the PCE routing guard keeps the rules of a disabled (quarantined) service that re-onboards.
 - Return a bare HTTP status code to the caller; write summary and debug info to the log.
 
 No per-use-case business logic, retry handling, or state assembly lives in the Controller. PRB calls are owned by the producing sub-agents; the Controller's shared step is the single PCE call.
@@ -165,7 +165,7 @@ Every sub-agent (UC1 Provision + Service Policy Builder, UC2 Build + Rebuild, UC
 
 A `/health` reply needs a **free event loop** — the process being "up" is not enough. The event path therefore offloads its slow synchronous handler to a threadpool so the loop stays answerable during onboarding (see [NATS Consumer → Failure isolation](#failure-isolation)). As a complementary defence, the k8s Deployment tunes the **liveness** probe tolerant — an explicit `timeoutSeconds` and a raised `failureThreshold` (so several consecutive slow probes, not one, must fail before a restart) — so a brief loop-busy window cannot kill the pod. The concrete probe values are authoritative in `k8s/agent-deployment.yaml`; this spec fixes only the intent.
 
-The `/apply/offboard/{service_id}` path uses the `{service_id:path}` converter (slash-bearing SPIFFE-URI clientIds) and is keyed on the **clientId (SPM key)**, not the Keycloak UUID that `/apply/service/{service_id}` carries — an offboarded client is gone from `get_services()`, so UUID→clientId resolution is impossible.
+The `/apply/offboard/{service_id}` path uses the `{service_id:path}` converter (slash-bearing SPIFFE-URI clientIds) and is keyed on the **clientId (SPM key)**, not the Keycloak UUID that `/apply/service/{service_id}` carries — an offboarded client is gone from `get_services()`, so UUID→clientId resolution is impossible. The PCE takes only the clientId; the onboarding resolves it from the UUID in the Orchestrator.
 
 The `/apply/*` endpoints return bare HTTP status codes: `200 OK` on success (no response body), and the status codes from the Error Handling table on upstream failure. Success responses carry no body; upstream failures and PRB exceptions are raised as FastAPI `HTTPException`s, so error responses carry a sanitized JSON error body (`{"detail": <safe summary>}`; see [Error Handling → Sanitized body vs. full log](#sanitized-body-vs-full-log)) alongside the status code. Summary, applied-rule details, and debug information are written to the service log. Validation failures surface as an error status and log entry; detailed reporting is specified in [policy-rules-builder.md](aiac-agent/policy-rules-builder.md). A genuine grant/prohibit conflict surfaces on `/apply` as a `422` with a `ConflictReport` body (verbatim policy quotes; see [Error Handling](#error-handling)). There is no separate pre-commit `/policy/check` route — it is retired (see [PRB design decision: identify conflicts, never reconcile](aiac-agent/policy-rules-builder.md#design-decision-identify-conflicts-never-reconcile) / #2503), and the conflict diagnostic is folded into `/apply`.
 
@@ -265,7 +265,7 @@ src/aiac/
 ├── shared/                             ← project-level shared: run_upstream (upstream.py) — transport retry primitive
 └── agent/
     ├── controller/
-    ├── shared/                         ← flatten_role (roles.py); focal_entities.py (resolve_focal_entities — D13, shared by live build() + diagnostic); error_logging.py (log_by_type — per-persona named-logger router)
+    ├── shared/                         ← flatten_role (roles.py); focal_entities.py (resolve_focal_entities — D13, shared by live build() + diagnostic; skips the roles and scopes of every disabled service, except the focus service); error_logging.py (log_by_type — per-persona named-logger router)
     ├── uc/
     │   ├── onboarding/
     │   │   ├── orchestrator.py         ← sequences provision → policy_builder, returns list[PolicyRule]

docs/specs/components/aiac-agent/policy-rules-builder.md

@@ -580,6 +580,12 @@ and is **not yet enforced** here.
 | UC3 — Role Update | Role sub-agent | `build_role_rules(role, all_scopes)` — one call |
 | Conflict diagnostic (folded into `/apply`, [identify conflicts, never reconcile](#design-decision-identify-conflicts-never-reconcile) / #2503) | Apply path | A parallel diagnostic assembly reusing propose / precheck / audit (record-not-raise + a terminal `explain` node); returns a `422` `ConflictReport` |
 
+> **Disabled services are not candidates.** The UC1 caller and the conflict diagnostic get their
+> candidates from one shared resolver, `resolve_focal_entities` (`agent/shared/focal_entities.py`).
+> It skips the roles and scopes of every disabled service (`Service.enabled == False`, a quarantined
+> failed onboarding), except the focus service. So the PRB never judges a pair with a quarantined
+> service. See [`uc1-service-onboarding.md` → Service Policy Builder](uc1-service-onboarding.md#sub-agent-service-policy-builder).
+
 > **Door B removed (#2540).** UC1 previously also ran a user-role-focal **deny-only** pass
 > (`build_role_denies` over each `RoleKind.USER` candidate role, alongside the scope-focal pass) to
 > derive user-role exclusivity denies. Under digested input that pass is redundant and has been