docs(pre-push-safety-net): record frontend retention prerequisite

.kiro/specs/pre-push-safety-net/brief.md

@@ -1,6 +1,6 @@
 # Brief: pre-push-safety-net
 
-Status: requirements, design and tasks approved on 2026-09-12; groups 1 and 2 verified complete (7/27 subtasks); groups 3–8 pending. Language: English.
+Status: requirements, design and tasks approved on 2026-09-12; groups 1 and 2 plus tasks 3.1–3.3 verified complete (10/27 subtasks); task 3.4 blocked on frontend test retention; groups 4–8 pending. Language: English.
 
 ## Problem
 

.kiro/specs/pre-push-safety-net/design.md

@@ -241,6 +241,18 @@ modeled graph/facts/scope; unanswered evidence is never tier 0.
 
 ### Cache and Engine Boundary
 
+The initial driver uses a generic `model/partitions.py` graph handle to route existing
+question requests to physically filtered frontend inputs. It does not select questions:
+one existing ranker order, region budget and `ScopeDecision` cover all partitions.
+`PartitionCoverage` records language, frontend, input paths and byte count, excluded
+paths, unshipped test paths, build status and capability boundaries. Query locations
+return to repository-relative paths before change-context matching. Projection and
+cleanup consume the same execution deadline and cancellation allowance as the backend.
+Runtime origin is `unspecified` when no declaration establishes browser/server scope;
+JavaScript presence alone does not admit an Express capability. TypeScript and C/C++
+retain explicit capability limits. These records prepare later artifact manifests;
+they do not implement persistent graph storage.
+
 Graph key: digest of every included blob/path and applicable declarations, frontend/engine version,
 overlay semantics/options, language, and exclusions. Query key additionally includes graph key,
 question/context/depth, facts/sanitizers, query code and relevant analysis configuration. Result key

.kiro/specs/pre-push-safety-net/implementation-group-3.md

@@ -15,7 +15,10 @@ coverage limits.
 
 ## Verification state
 
-Implementation is in progress. No group-level completion claim is made yet.
+Tasks 3.1–3.3 are independently approved and verified (10/27 tasks overall).
+Task 3.4 is blocked on a confirmed frontend retention prerequisite; group 3 is
+not complete. The proposed foundation repair is in
+`../contributor-scan/frontend-retention-prerequisite.md`.
 
 ## Baseline
 
@@ -126,3 +129,43 @@ These are controlled change-to-question/witness checks, not proof that the remov
 line enforced security, that the defect is new, or that a hook meets its latency bar.
 
 Ten of 27 tasks are now complete; task 3.4 remains for this group.
+
+## Task 3.4 blocked verification
+
+Claim type TASK; status NOT_VERIFIED. The implementer returned BLOCKED, and an
+independent fresh-context Kiro debug investigation returned STOP_FOR_HUMAN with
+high confidence: the approved sequence lacks a contributor-scan frontend input
+retention prerequisite. There is no task completion or reviewer approval claim.
+
+The work in progress physically filters declared vendor inputs, routes explicit
+language partitions through one existing ranker and deadline, and reports input,
+excluded/test paths and unsupported coverage. Tests cover stale region paths,
+symlink substitution, shared limits, partial census, normalized witness paths and
+CLI propagation. Direct JavaScript frontend invocation establishes which engine
+is called, but does not override its built-in input filters.
+
+The fresh full suite passed 1,138 tests with nine skipped in 106.05 seconds. Global
+Ruff, formatting (227 files), mypy (109 source files), compileall and diff checks
+passed. Detection (44/47, zero false positives in 44 controls), split-sink map and
+local pair gates passed. The final direct frontend change required adapting one
+budget-test runner to recognize its `-o` output argument; the test still verifies
+deadline retention. Unit success does not override the failing real graph check.
+
+`benchmarks/measurements/2026-09-13-partition-retention-blocker.json` records exact
+packaged source hashes, readable input witnesses, frontend help and failures. The
+direct frontend input contained `server/api.js` (51 bytes) and `tests/probe.js`
+(41 bytes), with original hashes verified. The graph contained only the server
+file and handler. Both autodetection and direct `jssrc2cpg` probes exited 1 on the
+retention assertion. The instrument correctly refused to report a passing smoke.
+PHP and remaining end-of-scan assertions were not reached in this failing run.
+
+Pinned ASTGen 3.50.1 unconditionally excludes test directories; Joern 4.0.625 also
+filters test filename suffixes. Installed/versioned options provide no supported
+inclusion override. The upstream sources and concrete repair acceptance checks
+are linked in the proposed prerequisite. Do not mark task 3.4 complete by moving
+test files or declaring frontend omission acceptable. Its implementation remains
+uncommitted pending the foundation repair, review and fresh runtime verification.
+
+The packaged failure preceded a comment-only clarification in `cpg/backend.py`
+removing the disproven attribution to legacy frontend autodetection. No executable
+backend behavior changed after that measurement.

.kiro/specs/pre-push-safety-net/research.md

@@ -6,7 +6,7 @@
 - User direction: a scalable pre-push safety net as AI accelerates development; WordPress is one case.
 - Clarifications: advisory must be actionable, not SAST noise; the ranker is the scope mechanism;
   third-party vendor code must remain outside targets and graphs.
-- Requirements, design and tasks are now approved, and groups 1 and 2 are verified complete; see
+- Requirements, design and tasks are now approved, and groups 1 and 2 plus tasks 3.1–3.3 are verified complete; task 3.4 is blocked on JavaScript frontend test retention; see
   `tasks.md` for verified completion. The discovery log below preserves the earlier drafting state
   and measurements. No hook latency claim is made.
 
@@ -157,3 +157,13 @@ setting environment variables alone is not evidence of either property.
 The snapshot adapter provides change evidence, not a second region selector. Source
 materialization, changed spans, and correspondence must remain language agnostic;
 unknown parser or correspondence boundaries cannot become a successful negative.
+
+### Group 3: frontend census invalidates completion
+
+Tasks 3.1–3.3 passed independent review and real engine checks. Task 3.4 passed
+projection/ranking unit checks but failed a packaged graph census: 92 readable
+JavaScript source bytes included a 41-byte test file that never reached the graph.
+Direct frontend invocation reproduced the omission. Two unconditional upstream
+test filters require an owning foundation repair; see
+`../contributor-scan/frontend-retention-prerequisite.md`. The runtime failure is
+not overridden by passing mocks, static checks or a populated server graph.

.kiro/specs/pre-push-safety-net/spec.json

@@ -1,7 +1,7 @@
 {
   "feature_name": "pre-push-safety-net",
   "created_at": "2026-09-12T15:35:00Z",
-  "updated_at": "2026-09-13T08:41:28.781759+00:00",
+  "updated_at": "2026-09-13T09:04:09.984662+00:00",
   "language": "en",
   "phase": "implementation",
   "approvals": {
@@ -81,6 +81,14 @@
       "implementation-group-2.md",
       "implementation-group-3.md"
     ],
-    "next_group": 3
+    "next_group": 3,
+    "blocked_tasks": [
+      {
+        "task": "3.4",
+        "reason": "Pinned JavaScript frontend silently excludes first-party tests; missing contributor-scan prerequisite.",
+        "record": "../contributor-scan/frontend-retention-prerequisite.md",
+        "next_action": "review_prerequisite"
+      }
+    ]
   }
 }

.kiro/specs/pre-push-safety-net/tasks.md

@@ -1,7 +1,7 @@
 # Implementation Plan: pre-push-safety-net
 
 Status: task plan approved by the maintainer's "approve." on 2026-09-12. Groups 1 and 2 (tasks 1.1–2.3)
-are complete after independent review and fresh verification. Group 3 is in progress (3.1–3.3 verified); groups 4–8 remain pending;
+are complete after independent review and fresh verification. Group 3 has 3.1–3.3 verified; 3.4 is blocked on frontend test retention. Groups 4–8 remain pending;
 the hook and capability admission are not yet implemented. See `implementation-group-1.md` and `implementation-group-2.md`.
 
 ## Execution contract
@@ -104,6 +104,7 @@ the hook and capability admission are not yet implemented. See `implementation-g
   - _Requirements: 2.1, 2.2, 2.4, 8.1, 8.2_
   - _Verified 2026-09-13:_ independent review APPROVED after an unknown-call boundary repair; fresh suite 1,128 passed, nine skipped; global Ruff/format/mypy passed. Real PHP/JavaScript Git guard-removal snapshots reached unchanged helper-file witnesses with local dirty state preserved. Production negative regression reproduced then fixed unknown(req.body) being pruned as tier zero: modeled arguments no longer summarize unknown consumers. Existing ranking and detector semantics unchanged; unsupported projections remain explicit. Evidence: `benchmarks/measurements/2026-09-13-change-context-smoke.json`. Lexical attribution is not semantic novelty or alert admission.
 - [ ] 3.4 Apply vendor exclusion and explicit language partitions
+  - _Blocked:_ Joern 4.0.625/ASTGen 3.50.1 omit first-party JavaScript tests despite readable filtered inputs. Independent debug returned STOP_FOR_HUMAN; review the owning `contributor-scan/frontend-retention-prerequisite.md` before resuming. Implementation remains uncommitted and unapproved; runtime evidence: `benchmarks/measurements/2026-09-13-partition-retention-blocker.json`.
   - Reuse declared layout exclusions before target enumeration and graph build; retain unshipped first-party tests and separate browser/server or language capability coverage.
   - Build supported frontend partitions explicitly; preserve unknown cross-language and vendor semantics without restoring excluded sources.
   - Done when PHP and Node graphs/targets contain no declared vendor code, first-party callers remain visible, and unsupported partitions appear as coverage limits rather than clean results.