deploy(hf): sync szl-holdings/a11oy@ed65f8de91c5db9f5e2624305855c50a4bb3086f derived COPY set

Reusable Dockerfile-COPY-derived deploy from szl-holdings/a11oy ed65f8de91c5db9f5e2624305855c50a4bb3086f.
Files: 1182 Pruned: 0
Derived from Dockerfile COPY sources (NO hand-maintained allowlist).

Signed-off-by: SZL Holdings <noreply@szlholdings.ai>
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

routers/gdw_frontier.py

@@ -449,10 +449,18 @@ def _decision(payload: GDWStepRequest) -> str:
     return "ACCEPT"
 
 
+_LOOPBACK_POLICY_GATEWAY_ORIGIN = "http://127.0.0.1:7860"
+
+
 def _policy_gateway_origin() -> str:
     origin = os.environ.get("GDW_POLICY_ORIGIN", "").strip().rstrip("/")
-    if not origin.startswith("https://"):
-        raise RuntimeError("GDW_POLICY_ORIGIN must be an HTTPS origin")
+    if (
+        origin != _LOOPBACK_POLICY_GATEWAY_ORIGIN
+        and not origin.startswith("https://")
+    ):
+        raise RuntimeError(
+            "GDW_POLICY_ORIGIN must be HTTPS or the exact local gateway"
+        )
     return origin