feat(pre-push-safety-net): cover combined push failure paths

.kiro/specs/pre-push-safety-net/implementation-group-8.md

@@ -0,0 +1,37 @@
+# Group 8 implementation and qualification
+
+The maintainer authorized group 8 on 2026-09-13. Fresh agent dispatch failed with
+`agent thread limit reached`; the explicit manual Kiro fallback applies. Reviews
+are main-context reviews, not independent reviewer evidence. Joint rollout gates
+remain unchanged; implementation progress does not imply capability eligibility.
+
+## Task 8.1 brief
+
+Requirements 1.1–1.4, 2.2, 2.3, 4.2, 4.4, 5.2, 5.5, 7.1, 7.4 and 8.2;
+design: Snapshot Adapter, Cache/Engine Boundary, Push runner and Result/Hook Adapter.
+Combine immutable non-HEAD/tag/force/new-branch/deletion updates, unusual paths,
+external boundaries, physical vendor exclusion, census failure and interrupted report
+publication. Use production transaction/backend seams; preserve source/index/refs,
+truthful scope and prior artifacts, and prove worker cleanup. Tests only: no production
+behavior or feature toggle introduced. Existing focused suites retain the full cache,
+missing-base, hook-exit and ordinary-scan regressions.
+
+## Status Report
+- STATUS: READY_FOR_REVIEW
+- TASK: 8.1
+- RED_PHASE_OUTPUT: N/A: tests-only integration coverage; no production behavior changed.
+- TESTS_RUN: Three added combined controls pass. Full suite 1299 passed, 9 skipped in 117.83s; ruff, formatting and mypy pass.
+
+## Review Verdict
+- VERDICT: APPROVED
+- TASK: 8.1
+- MECHANICAL_RESULTS: actual new tests inspected, full regression suite passes, no placeholders or secrets; test-only integration boundary maintained.
+- FINDINGS: mixed push control verifies all three exact comparisons and four dispositions, readable snapshot bytes, live state preservation and external-content exclusion. Failed census control inspects physically filtered source before returning missing answers. Interrupted writer control checks previous bytes and absence of its process PID.
+- SUMMARY: Combined failures remain explicit and do not masquerade as clean checks.
+
+## Verification Result
+- STATUS: VERIFIED
+- CLAIM_TYPE: TASK
+- CLAIM: Task 8.1 integration regression coverage delivered.
+- EVIDENCE: `/tmp/group8-1-focused.log`: 3 passed; `/tmp/group8-1-full.log`: 1299 passed, 9 skipped; static checks exit 0.
+- GAPS: These controlled failures do not qualify real detector capabilities or representative latency.

.kiro/specs/pre-push-safety-net/spec.json

@@ -1,7 +1,7 @@
 {
   "feature_name": "pre-push-safety-net",
   "created_at": "2026-09-12T15:35:00Z",
-  "updated_at": "2026-09-13T16:03:14.583834+00:00",
+  "updated_at": "2026-09-13T16:41:21.889949+00:00",
   "language": "en",
   "phase": "implementation",
   "approvals": {
@@ -19,7 +19,7 @@
     }
   },
   "ready_for_implementation": true,
-  "implementation_approval_note": "Groups 1\u20137 implemented and verified (23/27). Group 7 authorized as a whole; manual Kiro review fallback after fresh dispatch thread limit. Multi-ref input, explicit hook integration and optional bounded witness selection verified. Default capability registry remains empty and rollout remains NO-GO; group 8 pending.",
+  "implementation_approval_note": "Group 8 authorized and in progress; groups 1\u20137 verified. Capability admission and rollout remain NO-GO until the declared evidence passes.",
   "depends_on": [
     "contributor-scan"
   ],
@@ -75,6 +75,11 @@
       "at": "2026-09-13T15:45:15.902603+00:00",
       "source": "ok, continue with group 7 as a whole",
       "action": "Authorized tasks 7.1\u20137.3; manual Kiro fallback after fresh dispatch hit thread limit. Group 8 and rollout remain pending."
+    },
+    {
+      "at": "2026-09-13T16:41:21.889949+00:00",
+      "source": "move on to group 8",
+      "action": "Authorized tasks 8.1\u20138.4 and their qualification work; preserve joint gates and record NO-GO wherever prerequisites or measurements do not pass. Fresh dispatch hit thread limit; manual Kiro fallback."
     }
   ],
   "task_review": {
@@ -110,10 +115,11 @@
       "6.4",
       "7.1",
       "7.2",
-      "7.3"
+      "7.3",
+      "8.1"
     ],
-    "remaining_tasks": 4,
-    "verification_record": "implementation-group-7.md",
+    "remaining_tasks": 3,
+    "verification_record": "implementation-group-8.md",
     "verification_records": [
       "implementation-group-1.md",
       "implementation-group-2.md",
@@ -121,7 +127,8 @@
       "implementation-group-4.md",
       "implementation-group-5.md",
       "implementation-group-6.md",
-      "implementation-group-7.md"
+      "implementation-group-7.md",
+      "implementation-group-8.md"
     ],
     "next_group": 8,
     "blocked_tasks": [],

.kiro/specs/pre-push-safety-net/tasks.md

@@ -212,7 +212,7 @@ independent capability qualification. Groups 7–8 remain pending; rollout remai
   - _Requirements: 3.5, 4.1, 4.2, 7.1, 7.2, 7.3_
 
 - [ ] 8. Validate usefulness, runtime and cross-language admission
-- [ ] 8.1 Exercise complete push failure and regression paths
+- [x] 8.1 Exercise complete push failure and regression paths
   - Combine dirty/non-HEAD/multi-ref/new-branch/force/tag/deletion pushes with unusual paths, external content boundaries, failed census, missing comparisons and interrupted persistence.
   - Verify no orphan children, no overwritten live state, no vendor code in graphs, exact scope reports and no false clean result from skipped work.
   - Done when the integration suite covers the critical flows through the real CLI/backend seams and preserves ordinary scan behavior.