feat(pre-push-safety-net): compare targeted base and head evidence

benchmarks/measurements/2026-09-08-module-audit.json

@@ -1,10 +1,10 @@
 {
   "counts": {
-    "load_bearing": 99,
+    "load_bearing": 100,
     "standalone_capability": 9
   },
-  "modules": 108,
-  "note": "Refreshed after pre-push-safety-net task 3.4: first-party frontend partitions share the authoritative ranker and execution budget.",
+  "modules": 109,
+  "note": "Refreshed after pre-push-safety-net task 4.1: targeted base comparison reuses existing arbiters and shared execution budget; replay integration remains task 5.1.",
   "orphaned": [],
   "rows": [
     {
@@ -116,7 +116,8 @@
         "config",
         "cpg.artifact",
         "model.contracts",
-        "push.contracts"
+        "push.contracts",
+        "push.policy"
       ],
       "module": "contracts",
       "reason": "pre-push-safety-net Req 7.3: strict shared manifest serialization, independent of push"
@@ -132,7 +133,8 @@
         "model.partitions",
         "model.pipeline",
         "model.scan",
-        "model.taint"
+        "model.taint",
+        "push.policy"
       ],
       "module": "cpg",
       "reason": "model-grounded-detection Req 4: the CPG seam package"
@@ -153,7 +155,8 @@
         "model.partitions",
         "model.pipeline",
         "model.scan",
-        "model.taint"
+        "model.taint",
+        "push.policy"
       ],
       "module": "cpg.backend",
       "reason": "model-grounded-detection Req 4.1/4.5: the single Joern subprocess boundary"
@@ -356,6 +359,7 @@
         "model.taint",
         "preprocess",
         "push.contracts",
+        "push.policy",
         "push.snapshot"
       ],
       "module": "model",
@@ -399,6 +403,7 @@
         "model.regions",
         "model.scan",
         "push.contracts",
+        "push.policy",
         "push.snapshot"
       ],
       "module": "model.contracts",
@@ -450,7 +455,8 @@
         "model.judge",
         "model.pipeline",
         "model.scan",
-        "model.taint"
+        "model.taint",
+        "push.policy"
       ],
       "module": "model.ladder",
       "reason": "model-grounded-detection Req 5: the evidence ladder every finding carries"
@@ -476,7 +482,8 @@
     {
       "classification": "load_bearing",
       "importers": [
-        "model.scan"
+        "model.scan",
+        "push.policy"
       ],
       "module": "model.pipeline",
       "reason": "model-grounded-detection Req 8: the enumerator proposes, the LLM answers, the model disposes"
@@ -486,7 +493,8 @@
       "importers": [
         "cli",
         "model.layout",
-        "model.scan"
+        "model.scan",
+        "push.policy"
       ],
       "module": "model.regions",
       "reason": "contributor-scan Req 2: regions from entry points, with the families each admits"
@@ -502,7 +510,8 @@
     {
       "classification": "load_bearing",
       "importers": [
-        "cli"
+        "cli",
+        "push.policy"
       ],
       "module": "model.scan",
       "reason": "contributor-scan Req 3: the repository driver -- one CPG, one budget, ranked spend"
@@ -667,6 +676,12 @@
       "module": "push.contracts",
       "reason": "pre-push-safety-net Req 5.5/7.3: immutable comparisons and independent result statuses; runner pending"
     },
+    {
+      "classification": "load_bearing",
+      "importers": [],
+      "module": "push.policy",
+      "reason": "pre-push-safety-net Req 2.4/3.1/3.4/4.1: targeted same-semantics base comparison; replay integration pending"
+    },
     {
       "classification": "load_bearing",
       "importers": [],