fix(contributor-scan): retain declared Gruntfile and report census gaps honestly

.kiro/specs/contributor-scan/census-repair-verification.md

@@ -0,0 +1,76 @@
+# Task 2.19 — measured input retention and census completeness
+
+The maintainer accepted the proposed contributor-scan follow-up after the pre-push
+NO-GO report. The Kiro root-cause-first workflow identified a concrete shared-boundary
+repair; no new detector, ranking policy or rollout threshold is introduced.
+
+## Debug Report
+- ROOT_CAUSE: Joern 4.0.625's default filename filter excludes Gruntfile.js. A fresh read-verified NodeGoat input has 44 files/95,411 bytes but its raw graph census contains 43 files, 564 methods and 3,750 calls. The partition adapter substitutes zero counts for this incomplete census, incorrectly producing cpg_empty.
+- CATEGORY: CONFIG_GAP
+- FIX_PLAN: Retain the original Gruntfile under an explicit versioned frontend policy; preserve actual census counts and named omissions while keeping incomplete questions unresolved.
+- VERIFICATION: Exact pinned Node input/census before and after; packaged native PHP/JavaScript partition smoke; malformed/missing census controls; full regression suite and canonical gates.
+- NEXT_ACTION: RETRY_TASK
+- CONFIDENCE: HIGH
+- NOTES: Independent quality evidence, VAmPI context/transitive witness and runtime amortization remain separate blockers. The debug timing is not a representative hook latency profile.
+
+## Implementation and review
+
+`JoernBackend.include_build_configs` explicitly sets the frontend environment option,
+overriding inherited ambient values. Runtime and graph identity include the option.
+The pinned adaptation exempts only the `Gruntfile.js` basename from the known default
+filter when enabled. Paths, bytes and graph connectivity are preserved; no configuration
+is executed. Existing test retention and vendor exclusion remain intact.
+
+Partition census rejection now carries actual counts plus a named completeness reason
+and the missing filenames when available. Scan scope and outcomes consume that reason
+in both evidence and arbitration passes. A nonempty graph is no longer reported empty.
+Empty, absent or malformed census payloads produce an explicit unavailable marker,
+with no invented observed counts. Review found this latter gap in the first correction;
+three failing controls reproduced it before repair. A missing-file marker survives
+aggregation with another valid partition; existing sharded/empty graph limits remain.
+
+RED evidence: `/tmp/owner-retention-red.log` and `owner-retention-off.log` fail the new
+explicit policy assertion. Default ON passes; the supported opt-out remains a real input
+policy. Census diagnostics: `owner-census-diagnostic-red.log` and `-off.log` fail three
+new expectations; ON passes and the temporary switch was removed. Additional empty,
+malformed and absent census controls fail before repair (`owner-census-empty-red.log`).
+The final focused suite passes 20 tests, including the combined push regression controls.
+
+The raw Node check after retention finds all 44 files and 579 methods, with no missing
+or extra source names. Both runs use exactly 95,411 readable source bytes. Diagnostic
+build/census costs remain tens of seconds and cannot qualify the 30-second hook gate.
+The before/after checks use packaged images; final partition smoke also exercises the
+updated scan completeness path. Existing eligibility becomes stale after runtime/core
+identity changes and admits nothing; no old measurement is relabeled as current PASS.
+
+
+Review also checked regression fixtures that intentionally exercise complete graph evidence.
+Those backends now provide a named census for the readable files they are given, matching
+the production contract. Their ranking, pruning and comparison assertions are unchanged.
+A genuinely empty graph retains `cpg_empty`; only unavailable/partial evidence uses the
+new explicit census reasons. Counts and missing filenames are carried into the saved
+scan degradations. The final focused scan/scope/partition/policy suite passes 74 tests.
+
+The final offline image's mixed native PHP/JavaScript partition smoke passes, including
+original Gruntfile method/file nodes, test directories/suffixes, first-party source byte
+receipts and absence of vendor nodes. No language-specific ranking change was made.
+
+## Status Report
+- STATUS: READY_FOR_REVIEW
+- TASK: 2.19
+- RED_PHASE_OUTPUT: Explicit policy OFF and census preservation OFF failures recorded above; three additional missing/malformed census failures reproduced before repair. Temporary diagnostic switch removed.
+- TESTS_RUN: Final full suite 1321 passed, 9 skipped in 120.96s, exit 0; 74 focused controls pass; ruff/format/mypy/compileall and detector/map/pair gates pass. Final image builds, native mixed partition smoke exits 0, installed builder identity and stale eligibility rejection verified.
+
+## Review Verdict
+- VERDICT: APPROVED
+- TASK: 2.19
+- MECHANICAL_RESULTS: Actual diff reviewed; full regression and packaged checks pass. Existing ordinary-scan test backends now supply named readable-file censuses while retaining their original assertions. No new placeholders, secrets, rank heuristics or vendor restoration.
+- FINDINGS: Actual empty graphs retain cpg_empty. Nonempty partial graphs retain counts and missing names; absent/empty/malformed census cannot authorize completion or tier-zero pruning. Runtime/cache identity binds the retention option and installed adaptation. Main-context Kiro fallback; no independent review claimed.
+- SUMMARY: Targeted shared input/census repair verified without a latency, transitive-detection or rollout claim.
+
+## Verification Result
+- STATUS: VERIFIED
+- CLAIM_TYPE: TASK
+- CLAIM: Task 2.19 repairs the measured Gruntfile omission and honest census-completeness handling.
+- EVIDENCE: `benchmarks/measurements/2026-09-14-node-census-repair.json` preserves all source receipts, raw before/after census, reproducer, build/smoke logs, packaged identity and final test/gate results. Node census 43/44 → 44/44, methods 564 → 579. Final image `898789cb6cc88507a9fa67276fd442ee4ef9e9f1135b333bafda511fb0532b25` passes mixed native PHP/JavaScript smoke, including the original build/test methods and vendor absence.
+- GAPS: Representative runtime/coverage gates, VAmPI change context/transitive evidence and independent qualification remain unresolved. Pre-push task 8.3 and rollout remain NO-GO. Old eligibility is stale and enables no capabilities.

.kiro/specs/contributor-scan/pre-push-runtime-followup.md

@@ -64,3 +64,28 @@ boundaries explicit. Do not fabricate transitivity from a raw finding at the tar
 Revalidate ordinary VAmPI scan, exact question accounting, push regressions and independent
 qualification after an approved owner fix. This note records the prerequisite; it does
 not silently approve an upstream implementation or change detector semantics.
+
+## 2026-09-14 census diagnosis and targeted retention repair
+
+The maintainer accepted the proposed contributor-scan follow-up with "ok" after
+group 8's NO-GO report. This authorizes the targeted shared-boundary fixes and their
+validation; independent qualification and rollout still require their existing gates.
+
+A fresh offline packaged probe copied and reopened all 44 exact NodeGoat first-party
+JavaScript inputs (95,411 bytes), built a graph and inspected its raw named census.
+Result: 43 files, 564 methods, 3,750 calls; only `Gruntfile.js` was missing. Build took
+21.708s and census 14.990s. Tests were retained. The pinned frontend's
+`IgnoredFilesRegex` explicitly drops `Gruntfile.js`; the partition adapter then replaced
+the partial census with zero counts, producing the misleading `cpg_empty` diagnosis.
+
+The first repair narrowly extends the existing versioned frontend adaptation to retain
+`Gruntfile.js` under explicit `OUSAST_INCLUDE_BUILD_CONFIGS=1`. It changes neither its
+path nor bytes and leaves all other defaults, vendor exclusion and test retention
+intact. The backend owns the option and binds it to graph/runtime identity, so old
+artifacts cannot silently qualify under the new retention policy. It does not execute
+the build configuration. This format-level input repair is not NodeGoat-specific scope
+selection or a claim that every possible JavaScript configuration file is now supported.
+The partial-census correction now preserves actual counts and missing filenames,
+with missing/empty/malformed census still preventing completed questions. Runtime amortization and VAmPI context/witness evidence remain open.
+
+Source: [Joern 4.0.625 AstGenRunner](https://raw.githubusercontent.com/joernio/joern/v4.0.625/joern-cli/frontends/jssrc2cpg/src/main/scala/io/joern/jssrc2cpg/utils/AstGenRunner.scala).

.kiro/specs/contributor-scan/spec.json

@@ -1,7 +1,7 @@
 {
   "feature_name": "contributor-scan",
   "created_at": "2026-09-08T20:00:00Z",
-  "updated_at": "2026-09-13T09:29:15.806475+00:00",
+  "updated_at": "2026-09-14T06:06:32.633059+00:00",
   "language": "en",
   "phase": "implementation",
   "approvals": {
@@ -46,6 +46,11 @@
       "at": "2026-09-13T09:17:01.788332+00:00",
       "source": "approved",
       "action": "Approved frontend-retention prerequisite, task 2.18, including reproducible dependency adaptation; resume pre-push-safety-net 3.4 after verification."
+    },
+    {
+      "at": "2026-09-14T05:58:44.810694+00:00",
+      "source": "ok",
+      "action": "Accepted the proposed shared engine/census/context follow-up after group 8 NO-GO. Task 2.19 covers the confirmed missing Gruntfile and honest census-completeness repair; runtime and independent qualification gates remain unchanged."
     }
   ],
   "implementation_verification": {
@@ -53,6 +58,12 @@
       "status": "VERIFIED",
       "review": "APPROVED",
       "record": "frontend-retention-verification.md"
+    },
+    "2.19": {
+      "status": "VERIFIED",
+      "review": "APPROVED",
+      "independent": false,
+      "record": "census-repair-verification.md"
     }
   }
 }

.kiro/specs/contributor-scan/tasks.md

@@ -342,6 +342,15 @@
   - _Approval:_ maintainer "approved", 2026-09-13; prerequisite for pre-push-safety-net task 3.4.
   - _Verified:_ independent review APPROVED; 1,141 tests passed, nine skipped, static checks clean; real PHP/JavaScript test nodes retained and disabled-policy control reproduces omission. See `frontend-retention-verification.md`.
 
+- [x] 2.19 Repair the measured Node input census and preserve honest completeness diagnostics
+  - Retain the declared original `Gruntfile.js` through the versioned frontend adaptation; bind the explicit policy to runtime/cache identity.
+  - Preserve observed file/method counts and missing names when census is incomplete; missing, empty or malformed census must not complete questions or become a false clean result.
+  - Verify the exact 44-file NodeGoat input, native PHP/JavaScript partition smoke, and ordinary scan/hook regressions. Do not infer latency or capability admission from retention.
+  - _Boundary: existing frontend adaptation, partition census and scan completeness integration._
+  - _Requirements: contributor-scan 4.3, 5.6, 6.1; pre-push 2.3, 4.3, 8.2._
+  - _Approval: maintainer accepted contributor-scan remediation with "ok" on 2026-09-14; no rollout approval._
+  - _Verified: 1321 tests passed, 9 skipped; real 44/44 Node census and packaged native PHP/JavaScript smoke. See `census-repair-verification.md`._
+
 ## Group 3 — Ship it
 
 - [ ] 3.1 Contributor output

.kiro/specs/pre-push-safety-net/spec.json

@@ -1,7 +1,7 @@
 {
   "feature_name": "pre-push-safety-net",
   "created_at": "2026-09-12T15:35:00Z",
-  "updated_at": "2026-09-13T17:38:57.553583+00:00",
+  "updated_at": "2026-09-14T06:06:32.633405+00:00",
   "language": "en",
   "phase": "implementation",
   "approvals": {
@@ -143,6 +143,12 @@
       "feature_complete": false,
       "record": "validation-group-8.md",
       "capabilities_enabled": 0
+    },
+    "owner_remediation": {
+      "task": "contributor-scan 2.19",
+      "status": "VERIFIED",
+      "record": "../contributor-scan/census-repair-verification.md",
+      "effect": "Node 44/44 input census restored; partial/missing census remains explicitly unresolved. Existing eligibility stale; runtime/context/independent qualification remain NO-GO."
     }
   }
 }

.kiro/steering/safety-net.md

@@ -111,3 +111,12 @@ context/transitive evidence remains unresolved. Independent reviewed Node/PHP/Py
 populations are missing; libpng arithmetic/bounds remains unsupported. No real capability
 is enabled. Engine/census/context prerequisites route to contributor-scan before another
 frozen qualification attempt. See `pre-push-safety-net/validation-group-8.md`.
+
+
+On 2026-09-14, contributor-scan task 2.19 repaired the confirmed Gruntfile frontend
+omission (real Node census 43/44 → 44/44) and the misleading empty-graph diagnostic.
+Incomplete or unavailable census retains explicit coverage gaps and cannot complete
+questions. Native PHP/JavaScript partition smoke and 1321 tests pass. Runtime/core
+identity changed, so prior eligibility is stale and remains disabled. This repairs one
+shared prerequisite; pre-push 8.3, runtime amortization, VAmPI context/transitive
+evidence and independent qualification remain open. No ranker retune or rollout GO.