Add production release governance and repository guardrails

[saldestechnology]

Summary

• establish root Cargo.toml as the sole authoritative version with deterministic show/check/set/bump/release-note tooling
• add SemVer, release, guardrail, and agent workflow policy under governance/ while preserving docs/ for the public manual
• enforce CLI/Rust compatibility review, changelog/version policy, MSRV, pinned Actions, advisory/license/source policy, and time-bounded exceptions
• harden tag releases with annotated-tag/main ancestry checks, reviewed changelog notes, exact artifact allowlists, checksums, least privilege, protected environment integration, and provenance attestations
• refresh compatible locked dependencies to remediate actionable RustSec advisories

Validation

• 12 Python governance/version tests
• cargo fmt --all -- --check
• cargo clippy --locked --all-targets --all-features -- -D warnings
• cargo test --locked --all-features
• cargo test --locked --no-default-features
• cargo deny check advisories licenses sources bans
• default/minimal cargo publish --locked --dry-run
• compiled version and CLI contract checks
• shell and workflow YAML syntax checks

Required repository-admin follow-up

After merge, configure the main ruleset, protected v* tags, required status checks/CODEOWNERS review, trusted label permissions, and required reviewers on the release environment as specified in governance/guardrails.md. These external settings are deliberately not claimed as repository-enforced until configured.

[github-actions]

ctx analysis

Analyzed 52fa872bd457 against 591ea0c9a052 with ctx 0.3.4.

PR delta	Value
Files changed	6
Complexity delta	1107
Fan-out delta	520
Symbols added / removed	84 / 0
New duplicate pairs	1
Architecture violations	0
Whole-codebase audit	6.8 / 10

Repository health

Indexed 110 files, 2161 symbols, 1602 functions, and 13360 relationships.

Audit category	Score	Issues
complexity	1.0	57
duplication	10.0	0
coverage	10.0	0
modularity	5.0	76
naming	10.0	0

Audit findings (133)

• critical · complexity · src/mcp/tools/analysis.rs:162 — smart_context: fan-out 69 (threshold: 20)
• critical · complexity · src/parser/solidity.rs:951 — extract_calls_from_expr: fan-out 53 (threshold: 20)
• warning · complexity · src/commands/map.rs:115 — build_map: fan-out 50 (threshold: 20)
• critical · complexity · src/commands/sql.rs:215 — run_sql_duckdb: fan-out 54 (threshold: 20)
• critical · complexity · src/main.rs:75 — run: fan-out 54 (threshold: 20)
• warning · complexity · src/score.rs:137 — compute_score: fan-out 48 (threshold: 20)
• critical · complexity · src/parser/go.rs:376 — build_go_signature: fan-out 53 (threshold: 20)
• critical · complexity · src/audit.rs:434 — run_audit: fan-out 53 (threshold: 20)
• critical · complexity · src/commands/query.rs:518 — run_query: fan-out 51 (threshold: 20)
• warning · complexity · src/fingerprint.rs:432 — find_near_duplicates: fan-out 48 (threshold: 20)
• warning · complexity · src/walker.rs:560 — discover_files: fan-out 47 (threshold: 20)
• warning · complexity · src/commands/sql.rs:112 — split_sql_statements: fan-out 48 (threshold: 20)
• warning · complexity · src/shell.rs:231 — execute_command: fan-out 48 (threshold: 20)
• warning · complexity · src/index/mod.rs:264 — index_parallel: fan-out 47 (threshold: 20)
• warning · complexity · scripts/check-governance.py:42 — structural_check: fan-out 47 (threshold: 20)
• warning · complexity · tests/self_update_cli.rs:293 — test_suppression_means_zero_network_calls: fan-out 47 (threshold: 20)
• warning · complexity · tests/fixture_gen.rs:147 — apply_change_set_rewrites_exactly_the_selected_files: fan-out 46 (threshold: 20)
• warning · complexity · src/index/mod.rs:679 — watch_and_index: fan-out 45 (threshold: 20)
• warning · complexity · src/diff.rs:671 — get_pr_info: fan-out 42 (threshold: 20)
• warning · complexity · src/parser/rust.rs:219 — extract_symbols: fan-out 42 (threshold: 20)
• … 113 more in the artifact.

New near-duplicate functions (1)

• 1.000 similarity: git_output (scripts/check-contracts.py:129) ↔ git (scripts/check-governance.py:33)

Architecture-rule findings (0)

No .ctx/rules.toml is configured.

Changed-code hotspots (1)

File	Churn	Complexity	Score
src/cli.rs	17	4	1.000

Architectural map (489 ranked symbols)

ctx/
docs/
└── website/
    └── … (5 files)
perf/
├── benches/
│   └── … (1 file)
└── src/
    └── … (5 files)
scripts/
├── check-contracts.py
├── check-governance.py
├── package-release.py
├── update-package-metadata.py
├── validate-release-assets.py
└── version.py
src/
├── analytics/
│   └── … (3 files)
├── audit.rs
├── check.rs
├── cli.rs
├── commands/
│   └── … (22 files)
├── config.rs
├── db/
│   └── … (3 files)
├── default_ignores.rs
├── diff.rs
├── embeddings/
│   └── … (4 files)
├── error.rs
├── exit.rs
├── fingerprint.rs
├── fixture.rs
├── formatter.rs
├── gatelog.rs
├── gitutil.rs
├── harness/
│   └── … (5 files)
├── index/
│   └── … (1 file)
├── json.rs
├── lib.rs
├── main.rs
├── mcp/
│   └── … (6 files)
├── output.rs
├── parser/
│   └── … (6 files)
├── rank.rs
├── rules.rs
├── score.rs
├── shell.rs
├── smart.rs
├── snapshot.rs
├── testutil.rs
├── tokens.rs
├── tree.rs
├── update.rs
├── utils.rs
└── walker.rs
tests/
├── duplicates_cli.rs
├── fixture_gen.rs
├── gate_log_cli.rs
├── harness_cli.rs
├── hotspots_cli.rs
├── ollama_smart_e2e.rs
├── self_update_cli.rs
├── smart_relevance.rs
├── snapshot_cli.rs
├── snapshot_stub.rs
├── sql.rs
├── study_scripts.rs
└── versioning/
    └── … (2 files)

• src/harness/doctor.rs:433 — fn find<'a>(findings: &'a [Finding], code: &str) -> &'a Finding
• src/score.rs:80 — pub fn get(&self, name: &str) -> Option<i64>
• src/gatelog.rs:104 — pub fn append(path: &Path, record: &GateRecord) -> Result<()>
• src/json.rs:55 — pub fn to_value(&self) -> serde_json::Value
• src/config.rs:53 — pub fn load(root: &Path) -> Self
• src/config.rs:58 — pub fn load_file(path: &Path) -> Self
• src/error.rs:119 — pub fn embedding(msg: impl Into<String>) -> Self
• src/tree.rs:73 — fn render_tree(node: &TreeNode, prefix: &str, is_root: bool, show_sizes: bool) -> String
• src/db/schema.rs:97 — pub fn open_in_memory() -> crate::error::Result<Self>
• src/db/schema.rs:84 — pub fn open(path: &Path) -> crate::error::Result<Self>
• src/db/schema.rs:573 — pub fn find_symbols_filtered( &self, pattern: &str, limit: i32, file_pattern: Option<&str>, kind_filter: Option<&str>, ) -> Result<Vec<Symbol>>
• src/harness/checksum.rs:44 — fn is_checksum_line(line: &str) -> bool
• src/testutil.rs:26 — pub fn init(dir: &Path) -> GitRepo
• src/db/schema.rs:66 — pub fn is_vec_extension_available() -> bool
• src/formatter.rs:322 — fn make_entry(rel_path: &str) -> FileEntry
• src/db/schema.rs:1903 — fn symbol_from_row(row: &rusqlite::Row) -> Symbol
• src/error.rs:124 — pub fn git(msg: impl Into<String>) -> Self
• tests/harness_cli.rs:53 — fn ctx(dir: &Path, args: &[&str]) -> Output
• tests/sql.rs:86 — fn sql(dir: &Path) -> Command
• src/harness/checksum.rs:57 — pub fn content_checksum(bytes: &[u8]) -> String
• src/walker.rs:408 — fn add_nested_ignore_files(builder: &mut GitignoreBuilder, dir: &Path, filenames: &[&str])
• src/index/mod.rs:651 — pub fn open_database(root: &Path) -> crate::error::Result<Database>
• src/parser/typescript.rs:57 — pub fn new() -> Self
• src/fixture.rs:207 — fn next_u64(&mut self) -> u64
• src/harness/checksum.rs:108 — pub fn finalize(content: &str, style: HeaderStyle, version: &str) -> String
• src/testutil.rs:48 — pub fn commit_all(&self, msg: &str)
• src/db/schema.rs:367 — pub fn upsert_file(&self, file: &FileRecord, source: Option<&[u8]>) -> Result<()>
• src/walker.rs:454 — fn default() -> Self
• perf/src/scenarios.rs:73 — pub fn all() -> Vec<Scenario>
• src/analytics/duckdb_impl.rs:745 — pub fn interrupt_handle(&self) -> Arc<InterruptHandle>
• src/update.rs:629 — pub fn cache_dir() -> Option<PathBuf>
• src/index/mod.rs:139 — pub fn index(&mut self) -> io::Result<IndexResult>
• src/parser/python.rs:31 — pub fn new() -> Self
• src/tokens.rs:80 — pub fn get_bpe(encoding: Encoding) -> Result<CoreBPE, String>
• src/fingerprint.rs:160 — pub fn tokenize(lang: Language, source: &str) -> Option<Vec<Tok>>
• src/db/schema.rs:2007 — fn optional(self) -> Result<Option<T>>
• src/rules.rs:345 — pub fn file(&self) -> &str
• src/db/schema.rs:343 — pub fn transaction(&mut self) -> Result<Transaction<'_>>
• src/exit.rs:37 — pub fn code(self) -> u8
• src/walker.rs:465 — fn is_glob_pattern(pattern: &str) -> bool
• … 449 more in the artifact.

fan_in approximated as same-file callers for baseline comparability
check_violations: no rules file (.ctx/rules.toml)
Architecture check: no rules file

Full machine-readable results: workflow artifact.

Generated by ctx. This comment is updated on every PR revision.