release: prepare v1.2.0-alpha.1 and record rollout blockers

.github/workflows/release.yml

@@ -30,4 +30,7 @@ jobs:
           files: |
             dist/*.whl
             dist/*.tar.gz
+          body_path: RELEASE_NOTES.md
           generate_release_notes: true
+          prerelease: ${{ contains(github.ref_name, '-') }}
+          make_latest: ${{ !contains(github.ref_name, '-') }}

.kiro/specs/contributor-scan/spec.json

@@ -1,7 +1,7 @@
 {
   "feature_name": "contributor-scan",
   "created_at": "2026-09-08T20:00:00Z",
-  "updated_at": "2026-09-14T06:06:32.633059+00:00",
+  "updated_at": "2026-09-14T06:10:56.975614+00:00",
   "language": "en",
   "phase": "implementation",
   "approvals": {
@@ -65,5 +65,12 @@
       "independent": false,
       "record": "census-repair-verification.md"
     }
+  },
+  "release": {
+    "tag": "v1.2.0-alpha.1",
+    "package_version": "1.2.0a1",
+    "channel": "alpha",
+    "rollout_decision": "NO-GO",
+    "status_record": "census-repair-verification.md"
   }
 }

.kiro/specs/pre-push-safety-net/spec.json

@@ -1,7 +1,7 @@
 {
   "feature_name": "pre-push-safety-net",
   "created_at": "2026-09-12T15:35:00Z",
-  "updated_at": "2026-09-14T06:06:32.633405+00:00",
+  "updated_at": "2026-09-14T06:10:56.975614+00:00",
   "language": "en",
   "phase": "implementation",
   "approvals": {
@@ -150,5 +150,12 @@
       "record": "../contributor-scan/census-repair-verification.md",
       "effect": "Node 44/44 input census restored; partial/missing census remains explicitly unresolved. Existing eligibility stale; runtime/context/independent qualification remain NO-GO."
     }
+  },
+  "release": {
+    "tag": "v1.2.0-alpha.1",
+    "package_version": "1.2.0a1",
+    "channel": "alpha",
+    "rollout_decision": "NO-GO",
+    "status_record": "status.md"
   }
 }

.kiro/specs/pre-push-safety-net/status.md

@@ -0,0 +1,64 @@
+# Pre-push safety net status — v1.2.0-alpha.1
+
+Updated 2026-09-14. Phase: **implementation**. Requirements, design and tasks are
+approved. **26/27 executable tasks complete; task 8.3 remains blocked.**
+Rollout: **NO-GO**. The alpha tag publishes experimental implementation and evidence;
+it does not approve normal hook capabilities or production enforcement.
+
+## Verified
+
+Immutable pushed snapshots, shared multi-ref deadlines, ranker-owned scope, physical
+vendor exclusion, compatible immutable graph/result reuse, actionability admission,
+compact truthful reporting and non-destructive hook integration are implemented.
+Advisory and blocking share the same evidence bar; optional model output cannot bypass it.
+
+Contributor-scan task 2.19 is verified: the pinned frontend now retains the original
+Gruntfile, bringing the real NodeGoat census from 43/44 to 44/44 files. Partial, absent
+and malformed census no longer masquerade as a complete result or a falsely empty graph.
+The final code verification recorded 1321 passed tests, nine skipped, passing canonical
+gates and a packaged native PHP/JavaScript partition smoke. See
+[owner verification](../contributor-scan/census-repair-verification.md).
+
+## Rollout blockers
+
+1. **Useful checks within the deadline are unproven.** The last full representative
+   runtime profile timed out on all 21 Node transactions, completing 0/24 declared target
+   checks. Cancellation/reporting stayed below the two-second allowance. The subsequent
+   census repair is verified, but the full changed-code runtime/coverage profile has not
+   passed under its new identities. Amortize engine startup/loading work and rerun the
+   frozen seven-class profile; require warm p95 <=30s and >=95% completed supported checks.
+2. **Target and change-context evidence remains incomplete.** VAmPI preserves raw findings
+   at all three known sites, but the exact SQLI function question/transitive witness and
+   supported authorization context are unresolved. Raw findings or rank positions cannot
+   establish an actionable new regression. Repair this in the shared scan boundary and
+   verify the actual associated query/path evidence.
+3. **Independent quality qualification is missing.** Freeze and review untouched Node API
+   vulnerable/fixed/benign cases, including middleware/module/async context. Ghost remains
+   reserved with missing reviewed inputs. PHP and Python need their own independent
+   language/framework/family populations; Node results cannot qualify them. Require >=95%
+   observed actionable precision with counts/intervals, >=90% supported recall, nonzero
+   reviewed emitted alerts/positive controls and zero known fixed/benign false alerts.
+4. **No current capability is eligible.** The earlier registry is NO-GO and becomes stale
+   under the repaired runtime/core identities. Loading it enables zero capabilities.
+   After the preceding evidence passes together, regenerate exact-semantic eligibility
+   and rerun packaged acceptance validation. Do not relabel old measurements as current.
+
+C/libpng arithmetic and bounds remain explicitly unsupported; this is not a C/C++
+detection qualification. Advisory rollout cannot be justified by silence from an
+unqualified registry.
+
+## Ownership and revalidation
+
+Engine lifecycle, source/census and context/witness normalization belong to
+`contributor-scan`. The hook consumes those contracts; no second engine, source IR,
+ranker priority exceptions or differential graph mutation is introduced here. Graph
+mutation would need a separate cold-equivalence experiment.
+
+After owner fixes, refreeze identities and rerun ordinary scan gates, Python regressions,
+PHP-to-Node transfer, the representative cache/deadline profile, independent per-capability
+quality evaluation and packaged hook validation. Keep task 8.3 unchecked and the feature
+in implementation until those mandatory results are established.
+
+Evidence: [group 8 validation](validation-group-8.md),
+[runtime scorecard](../../../benchmarks/measurements/2026-09-13-nodegoat-feasibility.json),
+[census repair](../../../benchmarks/measurements/2026-09-14-node-census-repair.json).

README.md

@@ -1,5 +1,10 @@
 # OpenUltraSAST
 
+**v1.2.0-alpha.1:** experimental pre-push safety net. Integration and census repairs are
+verified; useful hook coverage, latency and independent capability qualification remain
+**NO-GO**. No real hook capability is enabled. See [release notes](RELEASE_NOTES.md) and
+[spec status](.kiro/specs/pre-push-safety-net/status.md).
+
 OpenUltraSAST is a command-line security analysis harness built around one
 goal: eliminating false positives by turning a suspicion into an
 evidence-backed finding, and learning from the claims that were rejected. A

RELEASE_NOTES.md

@@ -0,0 +1,26 @@
+# v1.2.0-alpha.1
+
+Experimental pre-push security safety net for AI-accelerated development. Python package
+version: `1.2.0a1`. This alpha is **not a rollout GO**; no real hook capability is enabled.
+
+- Analyze immutable pushed commits across refs without changing the working tree or
+  replacing existing hooks. Share one deadline across preparation, analysis and reporting.
+- Keep the existing ranker responsible for scope and physically exclude vendor code from
+  graph inputs. Reuse only compatible, complete immutable graph and answer artifacts.
+- Gate advisory and blocking alerts on the same actionable change/witness/repair evidence.
+  Preserve explicit incomplete coverage; optional model assistance cannot create evidence.
+- Add frozen runtime and PHP/Node/Python evaluation records with honest populations,
+  missing-target accounting and versioned eligibility that rejects stale evidence.
+- Repair the pinned JavaScript frontend's Gruntfile omission and incomplete-census handling.
+  The real NodeGoat input now retains 44/44 files; native PHP/JavaScript smoke passes.
+
+Implementation verification: 1321 tests passed, nine skipped; detector/map/local-pair
+gates and packaged partition smoke passed. These checks verify implementation contracts,
+not useful hook precision, recall or latency.
+
+Rollout remains blocked by representative changed-code latency/completion, VAmPI
+query/context/transitive evidence and independent reviewed per-capability populations.
+The earlier eligibility artifact is stale under the repaired identities and enables
+nothing. See [current spec status](https://github.com/norandom/OpenUltraSAST/blob/v1.2.0-alpha.1/.kiro/specs/pre-push-safety-net/status.md) for the
+owners, unchanged thresholds and required revalidation. Pre-push implementation stands
+at 26/27 tasks; task 8.3 remains blocked. C arithmetic/bounds detection is unsupported.

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "openultrasast"
-version = "1.1.0"
+version = "1.2.0a1"
 description = "OpenCode-oriented SAST harness for evidence-gated security analysis"
 readme = "README.md"
 requires-python = ">=3.11"

src/openultrasast/__init__.py

@@ -2,4 +2,4 @@
 
 __all__ = ["__version__"]
 
-__version__ = "1.1.0"
+__version__ = "1.2.0a1"

uv.lock

@@ -2138,7 +2138,7 @@ wheels = [
 
 [[package]]
 name = "openultrasast"
-version = "1.1.0"
+version = "1.2.0a1"
 source = { editable = "." }
 
 [package.optional-dependencies]