feat(pre-push-safety-net): render bounded reports and preserve full evidence

.kiro/steering/roadmap.md

@@ -46,17 +46,19 @@ engine are out of scope.
 - [ ] pre-push-safety-net — Immutable pushed tips, existing-ranker integration, compatible artifact
   reuse, total deadline, change attribution, actionability admission and compact hook behavior.
   Dependencies: contributor-scan. Requirements/design approved 2026-09-12; tasks generated
-  (8 groups, 27 executable subtasks), independently reviewed and approved; groups 1–3 are complete (11/27 tasks), including the resolved frontend-retention prerequisite.
+  (8 groups, 27 executable subtasks), independently reviewed and approved; groups 1–4 are complete (14/27 tasks), including the resolved frontend-retention prerequisite.
 
 ### Next concrete step
 
-Groups 1–3 have passed independent review: runtime, inputs, scoring, snapshots,
-shared deadline, exact ranker scope, change-context evidence and vendor-free language
-partitions. The approved contributor-scan prerequisite 2.18 (`51fabef`) repairs both
-JavaScript test filters; real graphs retain first-party tests and exclude vendor code.
-Task 3.4 also repairs unreadable-input handling and preserves named PHP census evidence.
-Group 4 is next: novelty comparison, actionability admission and compact advisory output.
-See `pre-push-safety-net/implementation-group-3.md` for evidence and limits.
+Groups 1–4 are verified: runtime, inputs, scoring, snapshots, shared deadline,
+ranker scope, change context, vendor-free partitions, novelty comparison, actionability
+admission and compact reporting. Tasks 4.1/4.2 passed independent review; 4.3 used the
+Kiro manual review fallback after the agent service reached its thread limit.
+Group 5 is next: wire explicit full transaction replay, then run the first bounded
+experiment. Real capabilities remain disabled pending independent evaluation.
+Automatic dominance-only change-context projection remains an upstream limit to
+retain during replay integration. See `pre-push-safety-net/implementation-group-4.md`
+for verification and scope limits.
 The first complete experiment is 5.2, before persistent caching and hook
 installation work. Keep PMPro as the primary core-optimization example, then freeze the core and
 prove a changed security flow and its fixed twin on a JavaScript/Express Node API workload through

.kiro/steering/safety-net.md

@@ -79,10 +79,11 @@ updates as a shortcut to an unmeasured latency promise.
 The product direction above is user-requested. The amended requirements, design and initial
 evaluation profile in `pre-push-safety-net` were approved for task generation on 2026-09-12
 ("ok, next kiro phase"). The maintainer then approved the task plan and starting group 1
-("approve.") and then group 2 ("ok, next kiro phase, approved"). Groups 1–3 are now verified
-complete (11/27 total). The maintainer approved the frontend-retention prerequisite;
-contributor-scan 2.18 and pre-push task 3.4 have both passed independent review and
-fresh verification. Group 4 is next: novelty comparison, actionability admission and
-compact advisory output. Implementation is authorized under the approved plan;
-task completion still requires independent review and fresh evidence. Hook performance
-and capability admission remain unproven.
+("approve.") and then group 2 ("ok, next kiro phase, approved"). Groups 1–4 are now verified
+complete (14/27 total), including the approved frontend-retention prerequisite.
+Group 4 adds bound novelty, operation-specific admission and compact artifacts;
+4.1/4.2 passed independent review and 4.3 used the documented Kiro manual fallback
+after agent dispatch became unavailable. Group 5 is next for full replay and the
+first bounded experiment. Task completion still requires review and fresh evidence.
+Real capability eligibility, automatic dominance context projection and hook
+performance remain unproven; the default capability registry is empty.