feat(pre-push-safety-net): validate graph identity and isolated leases

.kiro/specs/pre-push-safety-net/design.md

@@ -265,6 +265,21 @@ results. A query/fact change invalidates its answers without automatically rebui
 input/frontend/overlay semantics are unchanged. This supports iteration on the core as well as
 repeated push checks; it does not authorize reusing stale evidence after a source change.
 
+Preparation is also a reusable artifact boundary. Task 5.2 measured PMPro exhausting
+30 seconds after materialization and before graph construction. Cache complete discovery
+by immutable source tree identity plus discovery code, shipping/layout facts and configuration;
+retain snapshot readability proofs and declaration/boundary records. Reuse must preserve
+repository-relative locations and must never deserialize repository-controlled executable objects.
+Measure preparation, graph and query hits separately. An identical-tip hit demonstrates reuse,
+not representative changed-code latency. Dependency/configuration changes invalidate affected
+preparation and graph/query context even when an individual source file is unchanged.
+
+Rollout approval remains an evidence decision under Requirement 6.5 and evaluation.md.
+Group 6 establishes correctness and bounded reuse; group 8 must still demonstrate the joint
+changed-code latency, completion, precision and recall gates on declared populations. Missing
+independent positive/fixed/benign populations or an empty capability registry cannot yield GO.
+No threshold, population denominator or alert eligibility rule is relaxed by this amendment.
+
 Only validated, complete artifacts can satisfy complete-result lookups. Partial artifacts may be
 retained for diagnostics but never promoted by cache presence. Publish atomically from private
 temporary paths under a per-key lock; another push may wait only within its deadline. Apply a

.kiro/specs/pre-push-safety-net/implementation-group-6.md

@@ -0,0 +1,39 @@
+# Group 6 implementation and verification
+
+The maintainer authorized 6.1–6.4 together on 2026-09-13. A fresh implementer dispatch
+failed with `agent thread limit reached`; the explicit kiro-impl manual fallback applies.
+Reviews below are main-context adversarial reviews, not independent reviewer evidence.
+The design amendment makes measured preparation/discovery costs explicit. Rollout gates
+and the empty default capability registry are unchanged.
+
+## Task 6.1 brief
+
+Requirements 4.2, 4.3, 4.4 and 7.3; design: Cache and Engine Boundary.
+Backend-owned identities bind readable source paths/bytes, declarations, exclusions,
+frontend/engine versions, overlay implementation and options. Complete graphs require a
+named source census, methods, calls and the dataflow overlay. Loading checks identity and
+streamed graph digest, then issues a disposable copy through the existing CpgResult driver
+contract. Old structural manifests without source paths cannot qualify. Sharded or partial
+graphs cannot qualify. Query locations normalize to repository-relative paths.
+
+## Status Report
+- STATUS: READY_FOR_REVIEW
+- TASK: 6.1
+- RED_PHASE_OUTPUT: `/tmp/group6-1-red.log` and `/tmp/group6-1-flag-off.log`: four failures before implementation/with the temporary switch OFF. ON passed; switch removed and five final tests passed.
+- TESTS_RUN: 105 focused tests passed; full suite 1246 passed, 9 skipped (105.31s), followed by the final additional driver integration test and focused rerun. Ruff and mypy passed.
+- EVIDENCE: source-mounted nonroot Docker Joern 4.0.625, network disabled, 3 GiB limit: read 45 JavaScript bytes, census 1 file/4 methods/3 calls, sealed graph loaded through a disposable lease, original digest unchanged after query and cleanup. This is a correctness control, not a latency benchmark.
+- CONCERNS: persistent publication and runner selection belong to 6.2–6.4; this task provides the validated backend lease contract. Main-context review fallback.
+
+## Review Verdict
+- VERDICT: APPROVED
+- TASK: 6.1
+- MECHANICAL_RESULTS: focused tests, full regression suite, ruff, mypy and diff whitespace checks passed; no introduced placeholders or secrets.
+- FINDINGS: review repaired unbounded full-graph buffering to streamed hashing/copy; unreadable source walks fail explicitly; single PHP graph census passes through unchanged while sharded graphs cannot seal. Existing driver accepts and releases the leased CpgResult.
+- SUMMARY: Backend identity and isolated leases satisfy task 6.1 within the approved boundary.
+
+## Verification Result
+- STATUS: VERIFIED
+- CLAIM_TYPE: TASK
+- CLAIM: Task 6.1 identity and lease behavior, not persistent runner reuse or rollout readiness.
+- EVIDENCE: tests/test_graph_reuse.py, 105 focused passing tests, full suite and real Joern control above; measurement JSON retained in benchmarks/measurements/2026-09-13-graph-lease-control.json.
+- GAPS: Warm push feasibility and independent capability eligibility remain unproven.

.kiro/specs/pre-push-safety-net/spec.json

@@ -65,6 +65,11 @@
       "at": "2026-09-13T12:40:57.961577+00:00",
       "source": "approved",
       "action": "Authorized group 5 after the group 4 completion summary: explicit transaction replay, then the first PMPro/frozen-core Node experiment. Review and fresh evidence remain required."
+    },
+    {
+      "at": "2026-09-13T13:58:52.336506+00:00",
+      "source": "continue with group 6 as a whole. do we need to amend the spec to get a go for the rollout",
+      "action": "Authorized group 6 (6.1\u20136.4). Clarified complete preparation/discovery reuse after measured group 5 bottleneck; rollout gates remain unchanged. Manual Kiro review fallback remains necessary after a fresh agent dispatch hit the thread limit."
     }
   ],
   "task_review": {

.kiro/specs/pre-push-safety-net/tasks.md

@@ -161,7 +161,7 @@ hook latency is admitted.
   - _Requirements: 6.2, 6.3, 6.4, 6.5, 8.1, 8.2, 8.3, 8.4_
 
 - [ ] 6. Reuse valid graphs and results without stale conclusions
-- [ ] 6.1 Validate graph artifact identity and leases
+- [x] 6.1 Validate graph artifact identity and leases
   - Have the backend own source/declaration/exclusion digests, frontend/engine/overlay options, graph census and complete/partial identity.
   - Permit validated graph leases in the generic driver while preserving the fresh-build path; isolate potentially mutating loads and retain bounded cleanup.
   - Done when identical valid inputs can reuse a graph while any changed graph input or failed census rejects the lease; original cached artifacts survive query loading unchanged.
@@ -181,6 +181,7 @@ hook latency is admitted.
   - _Boundary: Push cache, policy integration_
   - _Requirements: 3.4, 4.3, 4.4, 6.4, 7.2, 7.3_
 - [ ] 6.4 Integrate cache reuse into the shared push deadline
+  - Reuse complete preparation/discovery by immutable tree and discovery/fact/configuration identity, retaining readable snapshot and declaration/boundary records; measure its costs and hits separately from graph/query reuse.
   - Reuse identical snapshots/unchanged declared units across refs without merging different comparisons; changed units rebuild and stale graph relationships remain hints only.
   - Account for lookup, lock wait, lease, build/query and result persistence in the same deadline; preserve completed outcomes on cancellation.
   - Done when cached and uncached replay produce equal evidence/admission for the same completed questions under compatible semantics, with full equivalence under a sufficiently large controlled budget. Under the hook deadline, verify truthful extra completion/deferred scope from cache reuse rather than requiring identical scope; no stale answer survives a dependency/configuration edit.