docs(pre-push-safety-net): record frontend retention prerequisite

.kiro/specs/contributor-scan/frontend-retention-prerequisite.md

@@ -0,0 +1,56 @@
+# Frontend input retention prerequisite
+
+Date: 2026-09-13. Status: proposed prerequisite, awaiting maintainer review.
+Owner: contributor-scan. Blocks pre-push-safety-net task 3.4.
+
+## Confirmed problem
+
+The partition adapter supplies readable, original first-party JavaScript files,
+including tests, but Joern 4.0.625 silently removes tests during graph generation.
+The packaged probe read `server/api.js` (51 bytes) and `tests/probe.js` (41 bytes)
+from the physical frontend input. The resulting graph contained only the server
+file and its handler. Both autodetection and direct `jssrc2cpg` invocation failed
+the same assertion. This is separate from the earlier PHP closure/query failure.
+
+Two upstream layers filter tests:
+
+- Pinned ASTGen 3.50.1 excludes test directories independently of user exclusions:
+  [defaults](https://raw.githubusercontent.com/joernio/astgen-monorepo/javascript-astgen/v3.50.1/javascript-astgen/src/Defaults.ts)
+  and [application](https://raw.githubusercontent.com/joernio/astgen-monorepo/javascript-astgen/v3.50.1/javascript-astgen/src/FileUtils.ts).
+- Joern also unconditionally filters `.test.js`, `.spec.js`, `.mock.js` and `.e2e.js`:
+  [pinned frontend implementation](https://raw.githubusercontent.com/joernio/joern/v4.0.625/joern-cli/frontends/jssrc2cpg/src/main/scala/io/joern/jssrc2cpg/utils/AstGenRunner.scala).
+
+Installed help and versioned configuration provide no supported inclusion override.
+Failure evidence is retained in
+`benchmarks/measurements/2026-09-13-partition-retention-blocker.json`.
+An independent Kiro debug investigation returned `STOP_FOR_HUMAN`: a foundation
+prerequisite is missing from the approved downstream implementation sequence.
+
+## Proposed prerequisite for approval
+
+Establish a reproducible frontend input policy that retains explicitly supplied
+first-party JavaScript source, including test directories and filename patterns.
+The foundation owns any versioned dependency adaptation required in both ASTGen
+and jssrc2cpg. Record the exact sources, checksums, build recipe and invocation
+policy; a frontend upgrade or patch must preserve the existing native PHP and
+JavaScript engine regressions. Prefer a supported upstream inclusion mechanism if
+one becomes available; the pinned version currently has none.
+
+Keep source paths, bytes, imports and graph semantics intact. Do not rename test
+files, split them into disconnected graphs, restore vendor code, or weaken the
+retention criterion to make a smoke pass. Continue treating tests as unshipped
+ranker candidates. Report actual frontend omissions as incomplete coverage.
+
+## Acceptance and handoff
+
+1. A packaged census proves exact file and method nodes for ordinary first-party
+   source, `tests/` contents and `.test.js`, `.spec.js`, `.mock.js`, `.e2e.js` files.
+   The fixture must read and print the original input byte counts first.
+2. Declared vendor and node_modules paths and their unique methods remain absent.
+3. Existing native PHP/JavaScript graph, query, context and deadline regressions
+   pass; unsupported constructs still produce explicit coverage limits.
+4. Rebuild the image and rerun `ops/smoke_partitions.py`, then independently review
+   and verify pre-push task 3.4 before checking it off or starting dependent work.
+
+This proposal changes the dependency work required before task 3.4 can complete.
+It does not approve a new engine version, a dependency patch or capability admission.

.kiro/specs/contributor-scan/spec.json

@@ -1,7 +1,7 @@
 {
   "feature_name": "contributor-scan",
   "created_at": "2026-09-08T20:00:00Z",
-  "updated_at": "2026-09-12T15:35:00Z",
+  "updated_at": "2026-09-13T09:04:09.994054+00:00",
   "language": "en",
   "phase": "implementation",
   "approvals": {
@@ -30,6 +30,13 @@
       "topic": "Pre-push integration: shared deadline, reusable graph lease, exact ranker scope and provenance; preserve vendor exclusion.",
       "approved": false,
       "ready_for_implementation": false
+    },
+    {
+      "date": "2026-09-13",
+      "document": "frontend-retention-prerequisite.md",
+      "topic": "Retain declared first-party JavaScript tests through ASTGen and jssrc2cpg; prerequisite for pre-push-safety-net 3.4.",
+      "approved": false,
+      "ready_for_implementation": false
     }
   ]
 }

.kiro/specs/contributor-scan/tasks.md

@@ -1185,3 +1185,11 @@ integration. They now live in `.kiro/specs/finding-feedback-loop/`, at brief, un
 Three requirements amendments this group argues for are drafted at the end of `requirements.md`, also
 unapproved: what a report may repeat, a family stating a class it cannot decide, and Req 4.1 requiring a
 checkout that can actually demonstrate detection.
+
+## Proposed prerequisite awaiting review — 2026-09-13
+
+`frontend-retention-prerequisite.md` records a confirmed dependency gap blocking
+pre-push-safety-net task 3.4: pinned JavaScript frontend filters remove declared
+first-party tests. Its dependency adaptation and acceptance checks are proposed,
+not added to the approved executable task list. Review this prerequisite before
+resuming downstream partition completion.

.kiro/specs/pre-push-safety-net/brief.md

@@ -1,6 +1,6 @@
 # Brief: pre-push-safety-net
 
-Status: requirements, design and tasks approved on 2026-09-12; groups 1 and 2 verified complete (7/27 subtasks); groups 3–8 pending. Language: English.
+Status: requirements, design and tasks approved on 2026-09-12; groups 1 and 2 plus tasks 3.1–3.3 verified complete (10/27 subtasks); task 3.4 blocked on frontend test retention; groups 4–8 pending. Language: English.
 
 ## Problem
 

.kiro/specs/pre-push-safety-net/design.md

@@ -241,6 +241,18 @@ modeled graph/facts/scope; unanswered evidence is never tier 0.
 
 ### Cache and Engine Boundary
 
+The initial driver uses a generic `model/partitions.py` graph handle to route existing
+question requests to physically filtered frontend inputs. It does not select questions:
+one existing ranker order, region budget and `ScopeDecision` cover all partitions.
+`PartitionCoverage` records language, frontend, input paths and byte count, excluded
+paths, unshipped test paths, build status and capability boundaries. Query locations
+return to repository-relative paths before change-context matching. Projection and
+cleanup consume the same execution deadline and cancellation allowance as the backend.
+Runtime origin is `unspecified` when no declaration establishes browser/server scope;
+JavaScript presence alone does not admit an Express capability. TypeScript and C/C++
+retain explicit capability limits. These records prepare later artifact manifests;
+they do not implement persistent graph storage.
+
 Graph key: digest of every included blob/path and applicable declarations, frontend/engine version,
 overlay semantics/options, language, and exclusions. Query key additionally includes graph key,
 question/context/depth, facts/sanitizers, query code and relevant analysis configuration. Result key

.kiro/specs/pre-push-safety-net/implementation-group-3.md

@@ -15,7 +15,10 @@ coverage limits.
 
 ## Verification state
 
-Implementation is in progress. No group-level completion claim is made yet.
+Tasks 3.1–3.3 are independently approved and verified (10/27 tasks overall).
+Task 3.4 is blocked on a confirmed frontend retention prerequisite; group 3 is
+not complete. The proposed foundation repair is in
+`../contributor-scan/frontend-retention-prerequisite.md`.
 
 ## Baseline
 
@@ -126,3 +129,43 @@ These are controlled change-to-question/witness checks, not proof that the remov
 line enforced security, that the defect is new, or that a hook meets its latency bar.
 
 Ten of 27 tasks are now complete; task 3.4 remains for this group.
+
+## Task 3.4 blocked verification
+
+Claim type TASK; status NOT_VERIFIED. The implementer returned BLOCKED, and an
+independent fresh-context Kiro debug investigation returned STOP_FOR_HUMAN with
+high confidence: the approved sequence lacks a contributor-scan frontend input
+retention prerequisite. There is no task completion or reviewer approval claim.
+
+The work in progress physically filters declared vendor inputs, routes explicit
+language partitions through one existing ranker and deadline, and reports input,
+excluded/test paths and unsupported coverage. Tests cover stale region paths,
+symlink substitution, shared limits, partial census, normalized witness paths and
+CLI propagation. Direct JavaScript frontend invocation establishes which engine
+is called, but does not override its built-in input filters.
+
+The fresh full suite passed 1,138 tests with nine skipped in 106.05 seconds. Global
+Ruff, formatting (227 files), mypy (109 source files), compileall and diff checks
+passed. Detection (44/47, zero false positives in 44 controls), split-sink map and
+local pair gates passed. The final direct frontend change required adapting one
+budget-test runner to recognize its `-o` output argument; the test still verifies
+deadline retention. Unit success does not override the failing real graph check.
+
+`benchmarks/measurements/2026-09-13-partition-retention-blocker.json` records exact
+packaged source hashes, readable input witnesses, frontend help and failures. The
+direct frontend input contained `server/api.js` (51 bytes) and `tests/probe.js`
+(41 bytes), with original hashes verified. The graph contained only the server
+file and handler. Both autodetection and direct `jssrc2cpg` probes exited 1 on the
+retention assertion. The instrument correctly refused to report a passing smoke.
+PHP and remaining end-of-scan assertions were not reached in this failing run.
+
+Pinned ASTGen 3.50.1 unconditionally excludes test directories; Joern 4.0.625 also
+filters test filename suffixes. Installed/versioned options provide no supported
+inclusion override. The upstream sources and concrete repair acceptance checks
+are linked in the proposed prerequisite. Do not mark task 3.4 complete by moving
+test files or declaring frontend omission acceptable. Its implementation remains
+uncommitted pending the foundation repair, review and fresh runtime verification.
+
+The packaged failure preceded a comment-only clarification in `cpg/backend.py`
+removing the disproven attribution to legacy frontend autodetection. No executable
+backend behavior changed after that measurement.

.kiro/specs/pre-push-safety-net/research.md

@@ -6,7 +6,7 @@
 - User direction: a scalable pre-push safety net as AI accelerates development; WordPress is one case.
 - Clarifications: advisory must be actionable, not SAST noise; the ranker is the scope mechanism;
   third-party vendor code must remain outside targets and graphs.
-- Requirements, design and tasks are now approved, and groups 1 and 2 are verified complete; see
+- Requirements, design and tasks are now approved, and groups 1 and 2 plus tasks 3.1–3.3 are verified complete; task 3.4 is blocked on JavaScript frontend test retention; see
   `tasks.md` for verified completion. The discovery log below preserves the earlier drafting state
   and measurements. No hook latency claim is made.
 
@@ -157,3 +157,13 @@ setting environment variables alone is not evidence of either property.
 The snapshot adapter provides change evidence, not a second region selector. Source
 materialization, changed spans, and correspondence must remain language agnostic;
 unknown parser or correspondence boundaries cannot become a successful negative.
+
+### Group 3: frontend census invalidates completion
+
+Tasks 3.1–3.3 passed independent review and real engine checks. Task 3.4 passed
+projection/ranking unit checks but failed a packaged graph census: 92 readable
+JavaScript source bytes included a 41-byte test file that never reached the graph.
+Direct frontend invocation reproduced the omission. Two unconditional upstream
+test filters require an owning foundation repair; see
+`../contributor-scan/frontend-retention-prerequisite.md`. The runtime failure is
+not overridden by passing mocks, static checks or a populated server graph.

.kiro/specs/pre-push-safety-net/spec.json

@@ -1,7 +1,7 @@
 {
   "feature_name": "pre-push-safety-net",
   "created_at": "2026-09-12T15:35:00Z",
-  "updated_at": "2026-09-13T08:41:28.781759+00:00",
+  "updated_at": "2026-09-13T09:04:09.984662+00:00",
   "language": "en",
   "phase": "implementation",
   "approvals": {
@@ -81,6 +81,14 @@
       "implementation-group-2.md",
       "implementation-group-3.md"
     ],
-    "next_group": 3
+    "next_group": 3,
+    "blocked_tasks": [
+      {
+        "task": "3.4",
+        "reason": "Pinned JavaScript frontend silently excludes first-party tests; missing contributor-scan prerequisite.",
+        "record": "../contributor-scan/frontend-retention-prerequisite.md",
+        "next_action": "review_prerequisite"
+      }
+    ]
   }
 }

.kiro/specs/pre-push-safety-net/tasks.md

@@ -1,7 +1,7 @@
 # Implementation Plan: pre-push-safety-net
 
 Status: task plan approved by the maintainer's "approve." on 2026-09-12. Groups 1 and 2 (tasks 1.1–2.3)
-are complete after independent review and fresh verification. Group 3 is in progress (3.1–3.3 verified); groups 4–8 remain pending;
+are complete after independent review and fresh verification. Group 3 has 3.1–3.3 verified; 3.4 is blocked on frontend test retention. Groups 4–8 remain pending;
 the hook and capability admission are not yet implemented. See `implementation-group-1.md` and `implementation-group-2.md`.
 
 ## Execution contract
@@ -104,6 +104,7 @@ the hook and capability admission are not yet implemented. See `implementation-g
   - _Requirements: 2.1, 2.2, 2.4, 8.1, 8.2_
   - _Verified 2026-09-13:_ independent review APPROVED after an unknown-call boundary repair; fresh suite 1,128 passed, nine skipped; global Ruff/format/mypy passed. Real PHP/JavaScript Git guard-removal snapshots reached unchanged helper-file witnesses with local dirty state preserved. Production negative regression reproduced then fixed unknown(req.body) being pruned as tier zero: modeled arguments no longer summarize unknown consumers. Existing ranking and detector semantics unchanged; unsupported projections remain explicit. Evidence: `benchmarks/measurements/2026-09-13-change-context-smoke.json`. Lexical attribution is not semantic novelty or alert admission.
 - [ ] 3.4 Apply vendor exclusion and explicit language partitions
+  - _Blocked:_ Joern 4.0.625/ASTGen 3.50.1 omit first-party JavaScript tests despite readable filtered inputs. Independent debug returned STOP_FOR_HUMAN; review the owning `contributor-scan/frontend-retention-prerequisite.md` before resuming. Implementation remains uncommitted and unapproved; runtime evidence: `benchmarks/measurements/2026-09-13-partition-retention-blocker.json`.
   - Reuse declared layout exclusions before target enumeration and graph build; retain unshipped first-party tests and separate browser/server or language capability coverage.
   - Build supported frontend partitions explicitly; preserve unknown cross-language and vendor semantics without restoring excluded sources.
   - Done when PHP and Node graphs/targets contain no declared vendor code, first-party callers remain visible, and unsupported partitions appear as coverage limits rather than clean results.

.kiro/steering/roadmap.md

@@ -46,14 +46,16 @@ engine are out of scope.
 - [ ] pre-push-safety-net — Immutable pushed tips, existing-ranker integration, compatible artifact
   reuse, total deadline, change attribution, actionability admission and compact hook behavior.
   Dependencies: contributor-scan. Requirements/design approved 2026-09-12; tasks generated
-  (8 groups, 27 executable subtasks), independently reviewed and approved; groups 1 and 2 are complete (7/27 tasks).
+  (8 groups, 27 executable subtasks), independently reviewed and approved; groups 1 and 2 and tasks 3.1–3.3 are complete (10/27 tasks); 3.4 is blocked.
 
 ### Next concrete step
 
-Groups 1 and 2 have passed independent review: reproducible runtime, pinned inputs, honest scoring,
-shared contracts, immutable push snapshots and lexical change context. Continue with group 3: one
-execution budget, exact ranker scope, affected relationships and vendor/language partitions. See
-`pre-push-safety-net/implementation-group-2.md` for evidence and limits.
+Groups 1 and 2 and tasks 3.1–3.3 have passed independent review: runtime, inputs,
+scoring, snapshots, shared deadline, exact ranker scope and change-context evidence.
+Task 3.4 is blocked: real Joern graphs omit first-party JavaScript tests even though
+filtered inputs contain them. Review `contributor-scan/frontend-retention-prerequisite.md`,
+repair that foundation contract, then rerun the partition census and independent review.
+See `pre-push-safety-net/implementation-group-3.md` for evidence and limits.
 The first complete experiment is 5.2, before persistent caching and hook
 installation work. Keep PMPro as the primary core-optimization example, then freeze the core and
 prove a changed security flow and its fixed twin on a JavaScript/Express Node API workload through

.kiro/steering/safety-net.md

@@ -80,5 +80,7 @@ The product direction above is user-requested. The amended requirements, design
 evaluation profile in `pre-push-safety-net` were approved for task generation on 2026-09-12
 ("ok, next kiro phase"). The maintainer then approved the task plan and starting group 1
 ("approve.") and then group 2 ("ok, next kiro phase, approved"). Groups 1 and 2 are now verified
-complete. Implementation is authorized under that plan; task completion still requires
+complete, as are group 3 tasks 3.1–3.3 (10/27 total). Task 3.4 is blocked on a
+confirmed frontend test-retention gap; review the proposed contributor-scan
+frontend-retention prerequisite before resuming it. Implementation is authorized under that plan; task completion still requires
 independent review and fresh evidence. Hook performance and capability admission remain unproven.