feat(pre-push-safety-net): execute full Git push transactions

.kiro/specs/pre-push-safety-net/implementation-group-7.md

@@ -0,0 +1,37 @@
+# Group 7 implementation and verification
+
+The maintainer authorized all of group 7 on 2026-09-13. Fresh agent dispatch failed
+with `agent thread limit reached`; kiro-impl's explicit manual fallback applies.
+Reviews here are main-context reviews, not independent reviewer evidence.
+Rollout remains NO-GO and the default capability registry remains empty.
+
+## Task 7.1 brief
+
+Requirements 1.1, 1.3, 1.4, 4.1, 5.1–5.5 and 7.1; design: Snapshot Adapter,
+Push runner, Result and Hook Adapter. Consume every Git update and remote identity,
+resolve exact comparisons using the existing adapter, share one absolute budget,
+retain independent finding/coverage/enforcement statuses and all comparison evidence.
+Verify real stdin delivery, immutable readable snapshots, deduplication, missing bases,
+deletions, no work, policy combinations and deadline ownership.
+
+## Status Report
+- STATUS: READY_FOR_REVIEW
+- TASK: 7.1
+- RED_PHASE_OUTPUT: `/tmp/group7-1-red.log`: four failures with the interface switch OFF. ON: 37 focused tests passed; switch removed, final focused run: 29 passed (including 11 transaction controls).
+- TESTS_RUN: full suite 1274 passed, 9 skipped in 109.09s; final targeted tests cover the subsequently added five policy combinations and retained resolved identity on preparation failure. Ruff and mypy pass.
+- CONCERNS: synthetic admission controls prove enforcement, not detector eligibility. No capability enabled.
+
+## Review Verdict
+- VERDICT: APPROVED
+- TASK: 7.1
+- MECHANICAL_RESULTS: actual diff reviewed; full suite and final targeted checks pass; no new placeholders or credentials; boundary restricted to CLI, push runner and report.
+- FINDINGS: fixed child stdin closure by duplicating Git's descriptor before forking; remote URL is hashed rather than storing possible credentials; unresolved comparison identity survives preparation failure.
+- RED phase: VERIFIED.
+- SUMMARY: One transaction retains every resolved ref and completed scan without resetting the analysis deadline.
+
+## Verification Result
+- STATUS: VERIFIED
+- CLAIM_TYPE: TASK
+- CLAIM: Task 7.1 interface and policy integration implemented.
+- EVIDENCE: `/tmp/group7-1-full.log`, `/tmp/group7-1-final-focused.log`; ruff, mypy and diff checks exit 0.
+- GAPS: Representative multi-ref performance and real capability admission remain group 8 work.

.kiro/specs/pre-push-safety-net/spec.json

@@ -1,7 +1,7 @@
 {
   "feature_name": "pre-push-safety-net",
   "created_at": "2026-09-12T15:35:00Z",
-  "updated_at": "2026-09-13T15:06:56.856952+00:00",
+  "updated_at": "2026-09-13T15:45:15.902603+00:00",
   "language": "en",
   "phase": "implementation",
   "approvals": {
@@ -19,7 +19,7 @@
     }
   },
   "ready_for_implementation": true,
-  "implementation_approval_note": "Groups 1\u20136 implemented and verified (20/27); group 6 authorized as a whole. Main-context Kiro review fallback after fresh dispatch thread limit. Valid reuse is demonstrated; real capability registry remains empty and rollout gates remain unmet. Groups 7\u20138 pending.",
+  "implementation_approval_note": "Group 7 authorized as a whole; 7.1 verified, 7.2\u20137.3 in progress. Default capability registry empty; rollout NO-GO.",
   "depends_on": [
     "contributor-scan"
   ],
@@ -70,6 +70,11 @@
       "at": "2026-09-13T13:58:52.336506+00:00",
       "source": "continue with group 6 as a whole. do we need to amend the spec to get a go for the rollout",
       "action": "Authorized group 6 (6.1\u20136.4). Clarified complete preparation/discovery reuse after measured group 5 bottleneck; rollout gates remain unchanged. Manual Kiro review fallback remains necessary after a fresh agent dispatch hit the thread limit."
+    },
+    {
+      "at": "2026-09-13T15:45:15.902603+00:00",
+      "source": "ok, continue with group 7 as a whole",
+      "action": "Authorized tasks 7.1\u20137.3; manual Kiro fallback after fresh dispatch hit thread limit. Group 8 and rollout remain pending."
     }
   ],
   "task_review": {
@@ -102,17 +107,19 @@
       "6.1",
       "6.2",
       "6.3",
-      "6.4"
+      "6.4",
+      "7.1"
     ],
-    "remaining_tasks": 7,
-    "verification_record": "implementation-group-6.md",
+    "remaining_tasks": 6,
+    "verification_record": "implementation-group-7.md",
     "verification_records": [
       "implementation-group-1.md",
       "implementation-group-2.md",
       "implementation-group-3.md",
       "implementation-group-4.md",
       "implementation-group-5.md",
-      "implementation-group-6.md"
+      "implementation-group-6.md",
+      "implementation-group-7.md"
     ],
     "next_group": 7,
     "blocked_tasks": [],

.kiro/specs/pre-push-safety-net/tasks.md

@@ -191,7 +191,7 @@ independent capability qualification. Groups 7–8 remain pending; rollout remai
   - _Requirements: 1.1, 2.2, 4.1, 4.2, 4.3, 4.4, 7.3_
 
 - [ ] 7. Connect the real push interface without adding noise
-- [ ] 7.1 Execute Git's full push input and enforcement policy
+- [x] 7.1 Execute Git's full push input and enforcement policy
   - Extend the replay command to consume all update lines and remote arguments, aggregating per-ref comparisons under one deadline and preserving independent coverage and finding statuses.
   - Apply advisory, opt-in blocking and separate incomplete-coverage policy; keep external services disabled by default and normal alerts limited to admitted capabilities.
   - Done when controlled multi-ref push invocations exercise all allow/block/status combinations, including deletion-only, missing-base and no-work cases, without resetting budgets.