feat(gsbot)!: faithful Rust/SPARK port — eliminate Python from the fleet

[hyperpolymath]

Why

bots/gsbot (Garment Sustainability Bot) was the only Python in gitbot-fleet — 35 .py files, the source of the 35 cicd_rules/banned_language_file critical findings in the restored repo. Python is banned estate-wide with no exceptions; per the Rust/SPARK standard the sanctioned target is Rust/SPARK. This is a behaviour-preserving rewrite, not a rescaffold.

Stack

gsbot is the fleet's first Discord bot. Mappings, chosen to match fleet conventions:

Python	Rust/SPARK
discord.py cogs	poise/serenity prefix commands
SQLAlchemy + Alembic	sqlx + SQLite + embedded migrations/
colorlog	tracing
asyncio	tokio
pandas/numpy	not used by gsbot (no port needed)

Rust/SPARK seam

src/domain.rs is the correctness-critical scoring kernel: pure, total functions plus a #[no_mangle] extern "C" FFI surface so a verified SPARK/Ada module can be linked in later via the standard Idris2-ABI / Zig-FFI pattern ("designed to admit SPARK modules even if it contains none yet"). All callers use safe wrappers, so substitution is transparent.

Faithful behaviour

• Identical env vars / defaults / validation.
• Same schema incl. garment_materials M2M; identical scoring (material mean, grade ladder, garment lifespan multiplier + 100 cap, environmental-impact averaging, user points/level ratchet, ranks, brand summary).
• Every command preserved — names, aliases, argument shapes, point awards (+5/+5/+3/+2, +5/+7/0, +5, admin), embed fields, the exact on_command_error messages, presence string.
• !loaddata fixtures: same 10 materials / 7 garments / 6 brands.
• scripts/*.py → 3 bins (gsbot-load-fixtures, -export-data, -backup-db).
• Containerfile/docker-compose/Justfile rewritten for Rust (fleet convention: rust builder + debian-slim, non-root); Mustfile lint/test/fmt recipes preserved.

Verification (local)

• cargo build --all-targets — clean
• cargo clippy --all-targets -- -D warnings — clean
• cargo fmt --all -- --check — clean
• cargo test — 18/18 pass (domain 9, models 5, services 4)
• All Python removed (requirements.txt, setup.py, pytest.ini, alembic.ini, 35 .py) → banned_language_file clears for gsbot.

Scope / safety

• Surgical to bots/gsbot/ only. 38 tracked-file deletions — under the repo-integrity-guard's 50-file tripwire, so no [mass-delete-ok] marker needed; no critical paths touched.
• The original bots/gsbot/CLAUDE.md is a stale generic template proposing Python; superseded by the estate Rust/SPARK standard (left as-is, out of scope).

Refs hyperpolymath/hypatia#252

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 100 issues detected

Severity	Count
🔴 Critical	0
🟠 High	34
🟡 Medium	66

View findings

[
  {
    "reason": "Obj.magic bypassing type safety (2 occurrences, CWE-704)",
    "type": "obj_magic",
    "file": "/home/runner/work/gitbot-fleet/gitbot-fleet/bots/sustainabot/bot-integration/src/Analysis.res",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Obj.magic bypassing type safety (2 occurrences, CWE-704)",
    "type": "obj_magic",
    "file": "/home/runner/work/gitbot-fleet/gitbot-fleet/bots/sustainabot/bot-integration/lib/ocaml/Analysis.res",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "expect() in hot path (1 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/gitbot-fleet/gitbot-fleet/bots/gsbot/src/services.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (3 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/gitbot-fleet/gitbot-fleet/bots/glambot/src/analyzers/accessibility.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (3 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/gitbot-fleet/gitbot-fleet/bots/finishingbot/src/analyzers/claims.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (1 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/gitbot-fleet/gitbot-fleet/bots/finishingbot/src/analyzers/license.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (1 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/gitbot-fleet/gitbot-fleet/bots/accessibilitybot/src/analyzers/aria.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (5 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/gitbot-fleet/gitbot-fleet/bots/accessibilitybot/src/analyzers/forms.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (4 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/gitbot-fleet/gitbot-fleet/bots/accessibilitybot/src/analyzers/media.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (2 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/gitbot-fleet/gitbot-fleet/bots/accessibilitybot/src/analyzers/language.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence