feat(pre-push-safety-net): admit only supported actionable changes

.kiro/specs/pre-push-safety-net/design.md

@@ -308,6 +308,16 @@ patch generation. Templates grounded in facts/witnesses are sufficient. Admissio
 "sanitize input" advice without a supported context/operation. An LLM explanation must cite the
 same witness and cannot raise the rung or invent exploitability.
 
+Task 4.2 binds each delta to its base revision, head revision and semantics identity;
+legacy unbound evidence remains readable but cannot be admitted. Eligibility declarations
+are trusted outputs of the later evaluation loader, with positive/reviewed populations,
+calibration and untouched-workload provenance. The default registry is empty. Each
+declaration narrows its semantic context to exact operation symbols, preserving receiver
+spelling; a broad family such as injection cannot select shell advice for a SQL operation.
+Unknown or dynamic spellings remain ineligible. This is admission over existing graph
+witnesses, not a new detector or an alias resolver. Per-candidate records retain the full
+matching evaluation declarations and exact comparison/ref ownership.
+
 ### Result and Hook Adapter
 
 `PushResult` separates `finding_status` (`actionable` / `none`), `coverage_status` (`complete_within_scope`

.kiro/specs/pre-push-safety-net/implementation-group-4.md

@@ -39,3 +39,26 @@ limitation for the later replay integration. These controls use declared questio
 and Git context directly; no missing-coverage result was erased. Ambiguous source
 and identifier changes remain unknown. Task 4.1 brings progress to 12/27 tasks;
 admission and rendering remain pending within this authorized group.
+
+## Task 4.2 verification
+
+VERIFIED (TASK scope), independent review APPROVED. Full suite: 1,207 passed,
+nine skipped in 99.04 seconds; global Ruff/format (235 files), mypy (110 source
+files), detection/map/pair gates and diff checks passed. OFF admission controls
+failed before implementation. Review reproduced a SQL witness acquiring shell advice
+through a broad injection-family key; evaluated operation-symbol restrictions now
+reject that mismatch, missing bindings, receiver changes and embedded-name matches.
+
+Deltas bind exact base/head and semantics; unbound legacy records cannot be admitted.
+Evaluation declarations retain calibration and untouched-population provenance and
+must supply positive controls and reviewed alerts. Every disposition preserves its
+evidence and matching declarations. Deduplication retains witnesses, locations,
+refs and exact comparisons; unchanged debt on one comparison cannot erase a new
+claim on another. Advisory and blocking share admission; coverage policy is separate.
+
+`benchmarks/measurements/2026-09-13-admission-policy-smoke.json` records current
+policy against captured actual engine answers: all remain diagnostic with the empty
+default registry. Explicitly synthetic PHP/WordPress and JavaScript/Express controls
+receive equivalent admission and enforcement behavior. They do not qualify any
+real capability; task 8.3 still owns actual eligibility. Task 4.2 brings progress to
+13/27 tasks. Compact reporting remains in this authorized group.

.kiro/specs/pre-push-safety-net/spec.json

@@ -84,9 +84,10 @@
       "3.2",
       "3.3",
       "3.4",
-      "4.1"
+      "4.1",
+      "4.2"
     ],
-    "remaining_tasks": 15,
+    "remaining_tasks": 14,
     "verification_record": "implementation-group-4.md",
     "verification_records": [
       "implementation-group-1.md",

.kiro/specs/pre-push-safety-net/tasks.md

@@ -1,7 +1,7 @@
 # Implementation Plan: pre-push-safety-net
 
 Status: task plan approved by the maintainer's "approve." on 2026-09-12. Groups 1–3 (tasks 1.1–3.4)
-are complete after independent review and fresh verification (12/27 subtasks, including task 4.1). Tasks 4.2–4.3 and groups 5–8 remain pending;
+are complete after independent review and fresh verification (13/27 subtasks, including tasks 4.1–4.2). Task 4.3 and groups 5–8 remain pending;
 the hook and capability admission are not yet implemented. See `implementation-group-1.md` and `implementation-group-2.md`.
 
 ## Execution contract
@@ -121,12 +121,13 @@ the hook and capability admission are not yet implemented. See `implementation-g
   - _Boundary: Delta and Actionability Policy, engine comparison integration_
   - _Depends: 2.3, 3.3, 3.4_
   - _Requirements: 2.4, 3.1, 3.4, 4.1_
-- [ ] 4.2 Enforce capability and actionability admission
+- [x] 4.2 Enforce capability and actionability admission
   - Require evaluated capability provenance, applicable semantics, a sufficient rung, exact witness/location, supported change attribution and a concrete repair direction.
   - Keep experimental, suspicious, wrongly sanitized and unknown-novelty candidates in diagnostic records; do not let model confidence, a sanitizer name or printed-before state admit/dismiss a defect.
   - Deduplicate by defect while retaining relevant witnesses and refs; distinguish experimental evaluation from normal hook eligibility.
   - Add equivalent PHP/JavaScript normalized claims with equally eligible capabilities and assert equal admission; add an unsupported-origin control whose coverage/eligibility differs without changing core scores.
   - Done when the policy rejects an entailed but unsupported claim and admits fully supported synthetic controls equivalently across origins and advisory/blocking modes; real capabilities remain disabled pending 8.3.
+  - _Verified 2026-09-13:_ independent review APPROVED after operation/context-binding repair; 1,207 tests passed, nine skipped; default real-evidence controls remain diagnostic and synthetic PHP/JavaScript admission is equivalent. See `implementation-group-4.md`.
   - _Boundary: Delta and Actionability Policy_
   - _Requirements: 3.1, 3.2, 3.3, 3.4, 3.5, 5.3, 5.4, 8.1_
 - [ ] 4.3 Render compact results and preserve complete artifacts