feat(pre-push-safety-net): bound backend execution by one deadline

.kiro/specs/pre-push-safety-net/implementation-group-3.md

@@ -0,0 +1,63 @@
+# Group 3 implementation verification
+
+Date: 2026-09-13. Scope: tasks 3.1–3.4. The maintainer authorized continuing this
+group after the group 2 completion and next-step summary. Tasks remain unchecked
+until independent review and fresh verification establish their completion.
+
+## Boundary
+
+This group integrates the existing backend and ranker with generic execution,
+change-context and scope contracts. It does not implement new detector semantics,
+alert admission, persistent caching, or hook installation. Equivalent normalized
+PHP and JavaScript evidence must retain equivalent core decisions. Vendor sources
+must remain outside both graph inputs and targets; missing external semantics are
+coverage limits.
+
+## Verification state
+
+Implementation is in progress. No group-level completion claim is made yet.
+
+## Baseline
+
+Groups 1 and 2 completed at commit `948ee02`; the working tree was clean before
+this group began. The prior final suite recorded 1,069 passing and nine skipped
+tests. Three pre-existing mypy diagnostics concerned reuse of `candidates` in
+`model/scan.py`; fresh checks will report whether they remain.
+
+Historical Joern query failures cannot be declared resolved merely because a
+bounded failure returns promptly. Runtime smoke establishes readable source,
+nonempty graph census and query payloads for its declared small fixtures. It does
+not establish full-workload detection, actionable precision or hook latency.
+
+## Task 3.1 evidence
+
+The backend accepts an optional generic `ExecutionBudget`. Each build binds an
+independent session to its graph callbacks; probes, builds, overlays, census,
+queries and retries consume the same remaining time. Process startup also counts.
+A timed-out stage prevents further retries. The budgeted process path kills the
+original process group even after its launcher exits, bounds reaping and owned
+scratch cleanup, and exposes incomplete cleanup explicitly. The driver releases
+graph ownership on exceptions as well as normal return. Legacy backends cannot
+silently discard a supplied deadline; optional unbounded judge calls are withheld
+with an explicit reason. Ordinary scans retain their existing budget behavior.
+
+`benchmarks/measurements/2026-09-13-engine-budget-smoke.json` records the locally
+rebuilt non-root image and exact packaged backend/driver hashes. Under one
+900-second lab budget, native PHP read 45 source bytes and JavaScript read 48;
+both produced populated graphs, dataflow overlays and exact source-node witnesses.
+Unreadable PHP source was explicitly refused. PHP took 73.620 seconds and JavaScript
+34.756 seconds in this small smoke; these are runtime checks, not hook latency.
+
+An independent controlled process probe read its 241-byte input script, launched
+a parent and child ignoring SIGTERM, and observed termination in 0.804 seconds
+under a 0.8-second deadline plus 0.8-second cancellation allowance. Signal delivery
+may briefly leave a child visible immediately after return; the probe polls only
+within the original allowance. Zombies count as terminated, not running descendants.
+Concrete reusable graph leases and persisted completion records remain later tasks.
+
+The three former mypy errors were resolved by renaming the evidence-region list
+inside the driver; this does not change the ranker. Global mypy now checks all
+108 source files successfully. Independent review APPROVED task 3.1. Its fresh final suite passed: 1,089 tests,
+nine skipped, 96.85 seconds; global Ruff, formatting (219 files), mypy and diff
+checks passed. Verification status: VERIFIED, claim type TASK. This completes
+8/27 tasks; tasks 3.2–3.4 remain in progress for this group.

.kiro/specs/pre-push-safety-net/spec.json

@@ -1,7 +1,7 @@
 {
   "feature_name": "pre-push-safety-net",
   "created_at": "2026-09-12T15:35:00Z",
-  "updated_at": "2026-09-12T19:09:25.547910Z",
+  "updated_at": "2026-09-13T08:02:59.282414+00:00",
   "language": "en",
   "phase": "implementation",
   "approvals": {
@@ -19,7 +19,7 @@
     }
   },
   "ready_for_implementation": true,
-  "implementation_approval_note": "Groups 1 and 2 explicitly authorized by the maintainer and verified complete after independent review. Remaining task plan retains approval, with execution sequenced by the spec. Implementation of the complete hook is still pending.",
+  "implementation_approval_note": "Groups 1 and 2 verified complete. Maintainer authorized continuing group 3; remaining approved tasks execute in dependency order with independent review and fresh verification.",
   "depends_on": [
     "contributor-scan"
   ],
@@ -45,6 +45,11 @@
       "at": "2026-09-12T18:32:19.033933Z",
       "source": "ok, next kiro phase, approved; correct. we can continue with the spec",
       "action": "Authorized group 2 (2.1\u20132.3), resumed after local Claude Mem repair. Independent review and fresh verification remain required."
+    },
+    {
+      "at": "2026-09-13T07:48:02.155687Z",
+      "source": "continue with the task",
+      "action": "Authorized continuing group 3 (3.1\u20133.4) after the group 3 next-step summary. Independent task review and fresh verification remain required."
     }
   ],
   "task_review": {
@@ -64,13 +69,15 @@
       "1.4",
       "2.1",
       "2.2",
-      "2.3"
+      "2.3",
+      "3.1"
     ],
-    "remaining_tasks": 20,
-    "verification_record": "implementation-group-2.md",
+    "remaining_tasks": 19,
+    "verification_record": "implementation-group-3.md",
     "verification_records": [
       "implementation-group-1.md",
-      "implementation-group-2.md"
+      "implementation-group-2.md",
+      "implementation-group-3.md"
     ],
     "next_group": 3
   }

.kiro/specs/pre-push-safety-net/tasks.md

@@ -1,7 +1,7 @@
 # Implementation Plan: pre-push-safety-net
 
 Status: task plan approved by the maintainer's "approve." on 2026-09-12. Groups 1 and 2 (tasks 1.1–2.3)
-are complete after independent review and fresh verification. Groups 3–8 remain pending;
+are complete after independent review and fresh verification. Group 3 is in progress (3.1 verified); groups 4–8 remain pending;
 the hook and capability admission are not yet implemented. See `implementation-group-1.md` and `implementation-group-2.md`.
 
 ## Execution contract
@@ -79,13 +79,14 @@ the hook and capability admission are not yet implemented. See `implementation-g
   - _Verified 2026-09-12:_ independent review APPROVED; fresh final suite 1,069 passed, 9 skipped; focused 148 passed. Global Ruff/format, touched mypy and regression gates passed. PHP/JavaScript fixtures retain removed spans and unchanged-operation anchors across declaration renames; uncertain moves, repeated lines, binary and unavailable inputs remain unresolved. Forty independent real-Git comparisons checked exact spans/anchors. Network-disabled image smoke preserved committed PHP/JavaScript bytes and dirty non-HEAD state, with cleanup verified; see `implementation-group-2.md`. Lexical anchors do not establish semantic impact or novelty.
 
 - [ ] 3. Integrate bounded execution and ranker scope with the existing engine
-- [ ] 3.1 (P) Enforce one remaining-time budget in the backend
+- [x] 3.1 (P) Enforce one remaining-time budget in the backend
   - Thread the absolute deadline through readability probes, frontend builds, overlays, census, query batches, fallbacks and retries; no phase gets a fresh full budget.
   - Bound process-group termination and lease/scratch cleanup by the cancellation allowance, replacing any longer fixed cleanup waits on the push path.
   - Done when controlled hanging subprocesses at build/overlay/query stages terminate without orphan children inside the declared allowance, while ordinary scans preserve their prior behavior.
   - _Boundary: Cache and Engine Boundary, generic driver integration_
   - _Depends: 1.4_
   - _Requirements: 4.1, 4.2, 7.3_
+  - _Verified 2026-09-13:_ independent review APPROVED; fresh suite 1,089 passed, nine skipped; global Ruff/format and mypy (108 files) passed. Real hanging probe/frontend/overlay/census/query processes obey the shared deadline and cancellation allowance; retries do not reset it. Non-root packaged PHP/JavaScript graph/query smoke passed with matching source hashes under one 900-second lab budget. See `implementation-group-3.md` and `benchmarks/measurements/2026-09-13-engine-budget-smoke.json`. Runtime readiness only; no hook latency claim. Former three mypy errors resolved by a behavior-preserving variable rename.
 - [ ] 3.2 Return the ranker's exact selected and deferred work
   - Integrate the existing ranker through explicit mode selection and shared question identity; record selected/deferred IDs, evidence and reasons directly from the final order.
   - Preserve unanswered evidence as unknown rather than tier zero; report per-family coverage so taint ranking cannot masquerade as authorization/configuration coverage.