feat(pre-push-safety-net): bound optional assistance to admitted witnesses

.kiro/specs/pre-push-safety-net/spec.json

@@ -1,7 +1,7 @@
 {
   "feature_name": "pre-push-safety-net",
   "created_at": "2026-09-12T15:35:00Z",
-  "updated_at": "2026-09-13T15:45:15.902603+00:00",
+  "updated_at": "2026-09-13T16:03:14.583834+00:00",
   "language": "en",
   "phase": "implementation",
   "approvals": {
@@ -19,7 +19,7 @@
     }
   },
   "ready_for_implementation": true,
-  "implementation_approval_note": "Group 7 authorized; 7.1\u20137.2 verified, 7.3 next. Default capability registry empty; rollout NO-GO.",
+  "implementation_approval_note": "Groups 1\u20137 implemented and verified (23/27). Group 7 authorized as a whole; manual Kiro review fallback after fresh dispatch thread limit. Multi-ref input, explicit hook integration and optional bounded witness selection verified. Default capability registry remains empty and rollout remains NO-GO; group 8 pending.",
   "depends_on": [
     "contributor-scan"
   ],
@@ -109,9 +109,10 @@
       "6.3",
       "6.4",
       "7.1",
-      "7.2"
+      "7.2",
+      "7.3"
     ],
-    "remaining_tasks": 5,
+    "remaining_tasks": 4,
     "verification_record": "implementation-group-7.md",
     "verification_records": [
       "implementation-group-1.md",
@@ -122,7 +123,7 @@
       "implementation-group-6.md",
       "implementation-group-7.md"
     ],
-    "next_group": 7,
+    "next_group": 8,
     "blocked_tasks": [],
     "feasibility": "NO-GO for rollout: compatible identical-revision reuse verified; representative changed-code p95/completion and independent alert eligibility remain unmet."
   }