quality-gates

A passive ZAP baseline is cheap to re-run and proves nothing per issue, so each closed row must carry one explicit decision token.

TL;DR: KotaPortal's post-RBAC review found closed cards assumed to need a ZAP scan each, wasting pipeline time since passive baseline scans prove nothing new. The team now requires one decision token per row: ZAP:rescan with a valid path, or ZAP:none with a mandatory reason. Enforced by a small lint, this turns silent security bypasses into deliberate, auditable choices.