Pipeline gates

These are knowledge of required checks, not the scanners themselves. CI is the evidence system.

Gate	When	Fail on	Waiver
Secret scan	every commit	any secret	exception only
SCA	every merge	critical, high	exception only
SAST	every merge	critical, high	exception only
Unit tests	every merge	failing tests	none
Independent review	protected default branch	missing approval	none
DAST or equivalent	pre-release	critical, high	exception only
Deploy evidence log	every production change	missing record	none

must

A coding agent may propose a patch. It may not merge, waive a gate, or mark a finding as accepted risk.