feat(pre-push-safety-net): execute full Git push transactions

.kiro/specs/pre-push-safety-net/implementation-group-7.md

@@ -0,0 +1,37 @@
+# Group 7 implementation and verification
+
+The maintainer authorized all of group 7 on 2026-09-13. Fresh agent dispatch failed
+with `agent thread limit reached`; kiro-impl's explicit manual fallback applies.
+Reviews here are main-context reviews, not independent reviewer evidence.
+Rollout remains NO-GO and the default capability registry remains empty.
+
+## Task 7.1 brief
+
+Requirements 1.1, 1.3, 1.4, 4.1, 5.1–5.5 and 7.1; design: Snapshot Adapter,
+Push runner, Result and Hook Adapter. Consume every Git update and remote identity,
+resolve exact comparisons using the existing adapter, share one absolute budget,
+retain independent finding/coverage/enforcement statuses and all comparison evidence.
+Verify real stdin delivery, immutable readable snapshots, deduplication, missing bases,
+deletions, no work, policy combinations and deadline ownership.
+
+## Status Report
+- STATUS: READY_FOR_REVIEW
+- TASK: 7.1
+- RED_PHASE_OUTPUT: `/tmp/group7-1-red.log`: four failures with the interface switch OFF. ON: 37 focused tests passed; switch removed, final focused run: 29 passed (including 11 transaction controls).
+- TESTS_RUN: full suite 1274 passed, 9 skipped in 109.09s; final targeted tests cover the subsequently added five policy combinations and retained resolved identity on preparation failure. Ruff and mypy pass.
+- CONCERNS: synthetic admission controls prove enforcement, not detector eligibility. No capability enabled.
+
+## Review Verdict
+- VERDICT: APPROVED
+- TASK: 7.1
+- MECHANICAL_RESULTS: actual diff reviewed; full suite and final targeted checks pass; no new placeholders or credentials; boundary restricted to CLI, push runner and report.
+- FINDINGS: fixed child stdin closure by duplicating Git's descriptor before forking; remote URL is hashed rather than storing possible credentials; unresolved comparison identity survives preparation failure.
+- RED phase: VERIFIED.
+- SUMMARY: One transaction retains every resolved ref and completed scan without resetting the analysis deadline.
+
+## Verification Result
+- STATUS: VERIFIED
+- CLAIM_TYPE: TASK
+- CLAIM: Task 7.1 interface and policy integration implemented.
+- EVIDENCE: `/tmp/group7-1-full.log`, `/tmp/group7-1-final-focused.log`; ruff, mypy and diff checks exit 0.
+- GAPS: Representative multi-ref performance and real capability admission remain group 8 work.