Per-path panels

Payment code and a documentation site do not deserve the same burden of proof. Panel settings can be scoped to path globs.

Overrides

Each entry in panel.overrides matches path globs and replaces the keys it sets. The first matching entry wins, so order from most specific to least.

panel:
  threshold: 2
  block_at: 3
  overrides:
    - paths: ["src/billing/**", "src/payments/**"]
      threshold: 1        # hear everything here
      block_at: 2         # two votes are enough to block

    - paths: ["infra/**"]
      threshold: 1
      block_at: 2

    - paths: ["docs/**", "examples/**"]
      block_at: off    # advisory only

How a finding is matched

Matching is by the file the finding is anchored to, not by the files in the pull request. A change touching both src/billing and docs is heard under both sets of settings — the billing finding at threshold 1, the docs finding at the default.

scan.paths exclusions are applied first. A path excluded from scanning is never heard, regardless of overrides.

Monorepos

Overrides are the monorepo mechanism. A package that owns money movement can demand unanimity while an internal tool stays quiet, without splitting the repository or running two installations.