fix(ci): archive historical Python helpers and enforce repository gate

.github/workflows/ci.yml

@@ -75,6 +75,8 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Check repository release policy
+        run: cargo run -p xtask --locked -- release-gate
       - name: Verify crates.io package
         run: cargo publish --dry-run --locked
       - name: Enforce crates.io package size limit

crates/xtask/src/main.rs

@@ -1173,6 +1173,12 @@ fn check_workflow_policy(
         );
     }
     let ci_publish = yaml_path(ci, &["jobs", "publish-dry-run"]).unwrap_or(&YamlValue::Null);
+    if !yaml_contains_string(ci_publish, "cargo run -p xtask --locked -- release-gate") {
+        issues.push(
+            "FAIL: repository-release-gate-missing: CI must check repository release policy."
+                .to_string(),
+        );
+    }
     if !yaml_contains_string(ci_publish, "cargo package --locked --no-verify")
         || !yaml_contains_string(ci_publish, "verify-crate-size")
     {
@@ -2837,6 +2843,31 @@ mod tests {
         );
     }
 
+    #[test]
+    fn workflow_policy_rejects_missing_repository_release_gate() {
+        let mut ci = valid_ci_workflow();
+        let steps = ci["jobs"]["publish-dry-run"]["steps"]
+            .as_sequence_mut()
+            .unwrap();
+        steps.retain(|step| {
+            step.get("run").and_then(YamlValue::as_str)
+                != Some("cargo run -p xtask --locked -- release-gate")
+        });
+        let mut issues = Vec::new();
+        check_workflow_policy(
+            &ci,
+            &valid_native_workflow(),
+            &yaml_serde::from_str(&valid_release_workflow_text()).unwrap(),
+            &mut issues,
+        );
+        assert!(
+            issues
+                .iter()
+                .any(|issue| issue.contains("repository-release-gate-missing")),
+            "{issues:?}"
+        );
+    }
+
     #[test]
     fn workflow_policy_rejects_missing_crate_size_gates() {
         let broken_release = valid_release_workflow_text()

docs/release.md

@@ -37,6 +37,7 @@ Pull requests targeting `main` and pushes to `main` run:
 - platform-aligned workspace tests on macOS ARM64 and Windows x86_64
 - `cargo clippy --workspace --all-targets --all-features --locked -- -D warnings`
 - Rust advisory scanning with `cargo audit`
+- `cargo run -p xtask --locked -- release-gate`, before the package dry-run, to reject repository-policy violations before release.
 - `cargo publish --dry-run --locked`
 - An exact-byte check that the generated `.crate` does not exceed crates.io's 10 MiB upload limit.
 - `cargo package -p k-wiki --locked --no-verify` and the isolated Knowledge Wiki smoke. The

docs/testing/graph-disk-cleanup-evidence/README.md

@@ -0,0 +1,58 @@
+# Historical Python evidence helpers
+
+[COD-99](https://linear.app/codebasegraph/issue/COD-99) archives the four Python
+helpers from commit `7038e66ff8271ffddc511f879cf8d28353a09b2d`. The user approved
+archiving them on 2026-10-27. They are retained historical evidence, not maintained
+implementation or supported verification tooling. The Rust-only repository policy
+is unchanged.
+
+`historical-python-helpers.tar.gz` preserves each file's original bytes and repository-relative
+path. [The manifest](./historical-python-helpers.json) records the source commit,
+Git blob IDs, byte lengths, SHA-256 digests and exact archive creation command.
+The archive SHA-256 is `032ac4ef9cfddf40dc0540a913f71c34de4901a4a7d61d035141cb96832e7519`. Two independent `git archive`
+invocations produced identical bytes; each regular member matched its original
+file byte-for-byte before removal.
+
+Historical reports, source manifests, test outputs and their hashes are unchanged.
+Their `.py` paths still identify their original inputs, now stored in this archive.
+The archive does not turn earlier partial evidence into current qualification.
+The canonical DC-S1–DC-S5 contract remains
+`knowledge:architecture/graph-disk-cleanup-contract`.
+
+## Reconstruct historical inputs
+
+Use a separate temporary checkout of the revision named by the report you are
+reproducing. Do not extract into the current checkout: loose Python source would
+correctly fail the repository gate again. The archive contains only the four
+helpers, not their historical environment or every report prerequisite.
+
+From this checkout, inspect and verify the archive before extracting:
+
+```bash
+shasum -a 256 docs/testing/graph-disk-cleanup-evidence/historical-python-helpers.tar.gz
+tar -tzf docs/testing/graph-disk-cleanup-evidence/historical-python-helpers.tar.gz
+```
+
+For an unused temporary directory, reconstruct the archive's source revision:
+
+```bash
+git worktree add --detach /private/tmp/codebasegraph-historical-7038e66 \
+  7038e66ff8271ffddc511f879cf8d28353a09b2d
+tar -xzf docs/testing/graph-disk-cleanup-evidence/historical-python-helpers.tar.gz \
+  -C /private/tmp/codebasegraph-historical-7038e66
+```
+
+All file members are under `docs/testing/graph-disk-cleanup-evidence/`, so sibling
+imports and original relative paths are preserved. Verify their hashes against
+the manifest. Follow the selected historical report's commands and prerequisites;
+this archival change does not claim that historical helper tests were rerun or
+that all inputs can be reproduced from the archive alone.
+
+## Release limitation
+
+The original [failed job](https://github.com/rabii-chaarani/codebaseGraph/actions/runs/40453997235/job/122023180345)
+checks immutable source `7038e66`. A fix on a later commit cannot make that source
+pass by rerunning it. Corrected publication needs a trusted replacement release
+PR and its own successful exact-SHA CI under [the release process](../../release.md).
+Version selection, replacement of PR #156, tag/label changes and publication are
+not approved by the archival decision.

docs/testing/graph-disk-cleanup-evidence/historical-python-helpers.json

@@ -0,0 +1,48 @@
+{
+  "schema_version": 1,
+  "work_item": "COD-99",
+  "classification": "historical evidence only; not maintained implementation or supported tooling",
+  "source_commit": "7038e66ff8271ffddc511f879cf8d28353a09b2d",
+  "approval": {
+    "date": "2026-10-27",
+    "user_decision": "i approve archiving the python helpers",
+    "scope": "Lossless historical archival of the four Python helpers; no policy exemption or release publication approval."
+  },
+  "archive": {
+    "path": "docs/testing/graph-disk-cleanup-evidence/historical-python-helpers.tar.gz",
+    "sha256": "032ac4ef9cfddf40dc0540a913f71c34de4901a4a7d61d035141cb96832e7519",
+    "size_bytes": 15810,
+    "member_paths_relative_to": "repository root"
+  },
+  "creation_command": "git archive --format=tar.gz --output=docs/testing/graph-disk-cleanup-evidence/historical-python-helpers.tar.gz 7038e66ff8271ffddc511f879cf8d28353a09b2d -- docs/testing/graph-disk-cleanup-evidence/audit.py docs/testing/graph-disk-cleanup-evidence/qualification.py docs/testing/graph-disk-cleanup-evidence/test_audit.py docs/testing/graph-disk-cleanup-evidence/test_qualification.py",
+  "files": [
+    {
+      "path": "docs/testing/graph-disk-cleanup-evidence/audit.py",
+      "git_blob_sha1": "18a90517c8f2954dea0d57df412faf119186f266",
+      "sha256": "316630c38e1638370b8c1873174d4311cc32ae4d0d9bcbbf0045e1083ccfb518",
+      "size_bytes": 6707,
+      "git_mode": "100644"
+    },
+    {
+      "path": "docs/testing/graph-disk-cleanup-evidence/qualification.py",
+      "git_blob_sha1": "1384a3298cedeb0f3d0022938e885b50875cce04",
+      "sha256": "264753ae10581691d0dc1c7591acab9601b29ff7c9f95df8d04ed56b56509e3b",
+      "size_bytes": 26627,
+      "git_mode": "100644"
+    },
+    {
+      "path": "docs/testing/graph-disk-cleanup-evidence/test_audit.py",
+      "git_blob_sha1": "f934f32d3a7f5d583c038bf4c431a48a674573e9",
+      "sha256": "b317ac2a5f4ab7ec3c52e98169e37090d65c9a7a92d397bd898962516f6f545c",
+      "size_bytes": 5632,
+      "git_mode": "100644"
+    },
+    {
+      "path": "docs/testing/graph-disk-cleanup-evidence/test_qualification.py",
+      "git_blob_sha1": "4e20628898f3e019e7e45bb956d1669b960a1e53",
+      "sha256": "4fa5adbdff51ec53085ae307444ca4800a557726b95e18cacfc42091c0c57ef3",
+      "size_bytes": 24274,
+      "git_mode": "100644"
+    }
+  ]
+}