feat(pre-push-safety-net): preserve existing hooks during explicit integration

.kiro/specs/pre-push-safety-net/implementation-group-7.md

@@ -35,3 +35,43 @@ deletions, no work, policy combinations and deadline ownership.
 - CLAIM: Task 7.1 interface and policy integration implemented.
 - EVIDENCE: `/tmp/group7-1-full.log`, `/tmp/group7-1-final-focused.log`; ruff, mypy and diff checks exit 0.
 - GAPS: Representative multi-ref performance and real capability admission remain group 8 work.
+
+## Task 7.2 brief
+
+Requirements 1.2, 5.3, 5.4 and 7.4; design: Result and Hook Adapter.
+Deliver executable opt-in integration and non-overwriting installation, preserve the
+configured hook path, explicitly chain a prior hook with its exact input/arguments,
+retain rejection, and document guarded removal. The existing hook's runtime remains
+its own behavior; input retention and Safety Net analysis share one deadline.
+Verify with disposable repositories and a local bare remote, never this project's hooks.
+
+## Debug Report
+- ROOT_CAUSE: `git rev-parse --path-format=absolute --git-path hooks/pre-push` canonicalizes the final symlink, so even O_EXCL on the returned name creates its target. Initial attribution to shell noclobber was not supported by the subsequent test.
+- CATEGORY: LOGIC_ERROR
+- FIX_PLAN: Resolve only `hooks`, append the literal `pre-push` basename, and create with O_EXCL/O_NOFOLLOW.
+- VERIFICATION: Dangling-symlink regression passes; target remains absent.
+- NEXT_ACTION: RETRY_TASK
+- CONFIDENCE: HIGH
+- NOTES: Git documents absolute output as canonical: https://git-scm.com/docs/git-rev-parse/2.33.0.html . Guarded removal instructions use directory-only resolution too.
+
+## Status Report
+- STATUS: READY_FOR_REVIEW
+- TASK: 7.2
+- RED_PHASE_OUTPUT: `/tmp/group7-2-red.log` (missing integration); `/tmp/group7-2-flag-off.log` (two failures with chaining OFF). ON: three passed; switch removed, final 16 hook/interface tests passed.
+- TESTS_RUN: full regression 1282 passed, 9 skipped in 119.95s; final 16 focused tests include subsequently added exact-exit and symlink controls. Ruff, formatting, mypy, shell syntax, CLI help and diff checks pass.
+- CONCERNS: input-retention failure stops the integration because a prior hook cannot safely receive partial input. Prior hook runtime remains separate from analysis.
+
+## Review Verdict
+- VERDICT: APPROVED
+- TASK: 7.2
+- MECHANICAL_RESULTS: actual diff and installation/removal recipes reviewed; disposable remote accepts/rejects correctly; original stdin bytes/arguments and exact nonzero exit preserved; source/index/ref state and core.hooksPath preserved; no placeholders or secrets; task boundary maintained.
+- FINDINGS: final-path canonicalization issue repaired and regression tested. Installation is explicit and does not overwrite existing hooks or symlink targets.
+- RED phase: VERIFIED.
+- SUMMARY: Opt-in integration preserves prior hook behavior and supports guarded restoration.
+
+## Verification Result
+- STATUS: VERIFIED
+- CLAIM_TYPE: TASK
+- CLAIM: Task 7.2 non-destructive hook integration delivered.
+- EVIDENCE: `/tmp/group7-2-full.log`, `/tmp/group7-2-final-focused.log`; static checks and shell/CLI smoke exit 0.
+- GAPS: No hook installed in this project's actual repository; rollout remains NO-GO.

.kiro/specs/pre-push-safety-net/spec.json

@@ -19,7 +19,7 @@
     }
   },
   "ready_for_implementation": true,
-  "implementation_approval_note": "Group 7 authorized as a whole; 7.1 verified, 7.2\u20137.3 in progress. Default capability registry empty; rollout NO-GO.",
+  "implementation_approval_note": "Group 7 authorized; 7.1\u20137.2 verified, 7.3 next. Default capability registry empty; rollout NO-GO.",
   "depends_on": [
     "contributor-scan"
   ],
@@ -108,9 +108,10 @@
       "6.2",
       "6.3",
       "6.4",
-      "7.1"
+      "7.1",
+      "7.2"
     ],
-    "remaining_tasks": 6,
+    "remaining_tasks": 5,
     "verification_record": "implementation-group-7.md",
     "verification_records": [
       "implementation-group-1.md",

.kiro/specs/pre-push-safety-net/tasks.md

@@ -198,7 +198,7 @@ independent capability qualification. Groups 7–8 remain pending; rollout remai
   - _Boundary: CLI/config, Push runner and Result and Hook Adapter integration_
   - _Depends: 2.1, 4.2, 4.3, 6.4_
   - _Requirements: 1.1, 1.3, 1.4, 4.1, 5.1, 5.2, 5.3, 5.4, 5.5, 7.1_
-- [ ] 7.2 Provide non-destructive hook integration and removal
+- [x] 7.2 Provide non-destructive hook integration and removal
   - Supply an executable integration snippet/installation path with explicit invocation, preserving existing hooks, hook path configuration, remote arguments and stdin for other consumers.
   - Refuse automatic overwrite; retain an existing hook's nonzero result even when the Safety Net runs advisory. Include concrete integration/removal instructions with the delivered hook interface.
   - Done when a disposable Git remote accepts/rejects pushes correctly with an existing stdin-reading hook, and removal restores the preceding behavior without touching source or refs.