feat(contributor-scan): retain first-party JavaScript tests in graphs

.kiro/specs/contributor-scan/frontend-retention-prerequisite.md

@@ -1,6 +1,6 @@
 # Frontend input retention prerequisite
 
-Date: 2026-09-13. Status: proposed prerequisite, awaiting maintainer review.
+Date: 2026-09-13. Status: approved by the maintainer ("approved"); task 2.18 verified complete after independent review.
 Owner: contributor-scan. Blocks pre-push-safety-net task 3.4.
 
 ## Confirmed problem
@@ -26,7 +26,7 @@ Failure evidence is retained in
 An independent Kiro debug investigation returned `STOP_FOR_HUMAN`: a foundation
 prerequisite is missing from the approved downstream implementation sequence.
 
-## Proposed prerequisite for approval
+## Approved prerequisite
 
 Establish a reproducible frontend input policy that retains explicitly supplied
 first-party JavaScript source, including test directories and filename patterns.
@@ -52,5 +52,6 @@ ranker candidates. Report actual frontend omissions as incomplete coverage.
 4. Rebuild the image and rerun `ops/smoke_partitions.py`, then independently review
    and verify pre-push task 3.4 before checking it off or starting dependent work.
 
-This proposal changes the dependency work required before task 3.4 can complete.
-It does not approve a new engine version, a dependency patch or capability admission.
+The maintainer approved this prerequisite and its dependency adaptation on 2026-09-13.
+Task 2.18 owns reproducible implementation and verification; downstream task 3.4
+remains incomplete until its own review passes. Capability admission remains later work.

.kiro/specs/contributor-scan/frontend-retention-verification.md

@@ -0,0 +1,45 @@
+# Frontend retention verification
+
+Date: 2026-09-13. Task: contributor-scan 2.18. Status: VERIFIED (TASK), independent review APPROVED.
+
+The maintainer approved the frontend-retention prerequisite after real graph
+inspection showed that supplied JavaScript tests were missing. Verification must
+establish retained source paths and method nodes, vendor exclusion, unchanged
+ordinary engine behavior and explicit adaptation identity.
+
+The approved implementation adapts the two pinned upstream filters, preserving
+original source bytes and paths. The existing ranker still marks tests unshipped;
+the frontend inclusion policy does not select or admit findings. The installed
+manifest distinguishes this adaptation from stock Joern 4.0.625 for future graph
+compatibility checks.
+
+Completion requires independent review and a passing packaged census, including
+the test-directory fixture and four filename suffixes. A test-disabled control
+must reproduce the former omission. Native PHP/JavaScript graph and change-context
+regressions must pass before downstream task 3.4 resumes.
+
+## Evidence
+
+`benchmarks/measurements/2026-09-13-frontend-retention-smoke.json` retains the
+installed manifest, source/output integrity checks and complete runtime results.
+The graph includes all six JavaScript files (255 source bytes) and two PHP files
+(97 bytes), with exact test method witnesses and no vendor nodes. Disabling the
+policy reproduces the original test omission with exit 1. The mixed scan uses
+one selected question across both supported frontends and names unsupported Go.
+
+The PHP and JavaScript cross-file change-context regressions both complete with
+one finding at the unchanged helper. The shared lab allowance is 900 seconds;
+the mixed runtime took 260.93 seconds while concurrent checks were running. These
+are controlled runtime checks, not hook latency measurements.
+
+The independent full suite passed 1,141 tests with nine skipped in 125.68 seconds.
+Ruff, formatting (229 files), mypy (109 files) and diff checks passed. Independent
+installer checks verified an offline idempotent skip and corruption rejection.
+The original-backend RED reproduction is retained and explicitly distinguished
+from the implementer's initial reported failing run.
+
+One backend comment changed after packaging; same-parser Python AST equality
+proves no executable difference. Remaining listed modules match byte-for-byte;
+installed dependency hashes match the manifest.
+
+Task 2.18 is complete. Pre-push task 3.4 requires its own final review and verification.

.kiro/specs/contributor-scan/spec.json

@@ -1,7 +1,7 @@
 {
   "feature_name": "contributor-scan",
   "created_at": "2026-09-08T20:00:00Z",
-  "updated_at": "2026-09-13T09:04:09.994054+00:00",
+  "updated_at": "2026-09-13T09:29:15.806475+00:00",
   "language": "en",
   "phase": "implementation",
   "approvals": {
@@ -35,8 +35,24 @@
       "date": "2026-09-13",
       "document": "frontend-retention-prerequisite.md",
       "topic": "Retain declared first-party JavaScript tests through ASTGen and jssrc2cpg; prerequisite for pre-push-safety-net 3.4.",
-      "approved": false,
-      "ready_for_implementation": false
+      "approved": true,
+      "ready_for_implementation": true,
+      "approval_source": "approved",
+      "task": "2.18"
     }
-  ]
+  ],
+  "approval_history": [
+    {
+      "at": "2026-09-13T09:17:01.788332+00:00",
+      "source": "approved",
+      "action": "Approved frontend-retention prerequisite, task 2.18, including reproducible dependency adaptation; resume pre-push-safety-net 3.4 after verification."
+    }
+  ],
+  "implementation_verification": {
+    "2.18": {
+      "status": "VERIFIED",
+      "review": "APPROVED",
+      "record": "frontend-retention-verification.md"
+    }
+  }
 }

.kiro/specs/contributor-scan/tasks.md

@@ -333,6 +333,15 @@
   - _Requirements: 5.1, 5.2, 5.5_
   - _Depends: 2.11_
 
+- [x] 2.18 Retain declared first-party JavaScript source through the frontend
+  - Implement the approved `frontend-retention-prerequisite.md` with versioned source/checksum pins and a reproducible dependency adaptation across ASTGen and jssrc2cpg.
+  - Preserve source paths, bytes and imports; keep declared vendor sources excluded and tests unshipped. Report frontend omissions explicitly.
+  - Done when packaged file/method census retains test directories and filename suffixes, vendor witnesses remain absent, and existing native PHP/JavaScript/context/deadline regressions pass.
+  - _Boundary:_ contributor-scan engine integration and packaging; no new ranker, source IR or detector semantics.
+  - _Acceptance:_ approved frontend-retention-prerequisite.md acceptance 1–4; supports pre-push-safety-net requirements 2.2, 2.3, 7.3, 8.2, 8.4.
+  - _Approval:_ maintainer "approved", 2026-09-13; prerequisite for pre-push-safety-net task 3.4.
+  - _Verified:_ independent review APPROVED; 1,141 tests passed, nine skipped, static checks clean; real PHP/JavaScript test nodes retained and disabled-policy control reproduces omission. See `frontend-retention-verification.md`.
+
 ## Group 3 — Ship it
 
 - [ ] 3.1 Contributor output
@@ -1186,10 +1195,9 @@ Three requirements amendments this group argues for are drafted at the end of `r
 unapproved: what a report may repeat, a family stating a class it cannot decide, and Req 4.1 requiring a
 checkout that can actually demonstrate detection.
 
-## Proposed prerequisite awaiting review — 2026-09-13
+## Approved frontend prerequisite — 2026-09-13
 
 `frontend-retention-prerequisite.md` records a confirmed dependency gap blocking
 pre-push-safety-net task 3.4: pinned JavaScript frontend filters remove declared
-first-party tests. Its dependency adaptation and acceptance checks are proposed,
-not added to the approved executable task list. Review this prerequisite before
-resuming downstream partition completion.
+first-party tests. The maintainer approved its dependency adaptation and acceptance checks;
+task 2.18 now implements it before downstream partition completion.

.kiro/specs/pre-push-safety-net/spec.json

@@ -1,7 +1,7 @@
 {
   "feature_name": "pre-push-safety-net",
   "created_at": "2026-09-12T15:35:00Z",
-  "updated_at": "2026-09-13T09:04:09.984662+00:00",
+  "updated_at": "2026-09-13T09:17:01.788332+00:00",
   "language": "en",
   "phase": "implementation",
   "approvals": {
@@ -50,6 +50,11 @@
       "at": "2026-09-13T07:48:02.155687Z",
       "source": "continue with the task",
       "action": "Authorized continuing group 3 (3.1\u20133.4) after the group 3 next-step summary. Independent task review and fresh verification remain required."
+    },
+    {
+      "at": "2026-09-13T09:17:01.788332+00:00",
+      "source": "approved",
+      "action": "Approved contributor-scan frontend retention prerequisite; implement it and resume task 3.4 review and verification."
     }
   ],
   "task_review": {
@@ -87,7 +92,7 @@
         "task": "3.4",
         "reason": "Pinned JavaScript frontend silently excludes first-party tests; missing contributor-scan prerequisite.",
         "record": "../contributor-scan/frontend-retention-prerequisite.md",
-        "next_action": "review_prerequisite"
+        "next_action": "implement_approved_contributor_scan_2.18"
       }
     ]
   }