Migrate sustainabot from ReScript to AffineScript with stdlib alignment

[hyperpolymath]

Summary

Complete hand-port of the sustainabot integration layer from ReScript to AffineScript, followed by a static-review pass to align the code against the canonical AffineScript grammar and stdlib. This resolves the migration initiated under issue #148's policy override (2026-05-24).

Key Changes

Code Migration (2026-05-24)

• Main.affine: Converted webhook intake and dispatch logic; refactored JSON/Dict operations to use canonical json:: and dict:: module calls; simplified nested match expressions with unwrap_or helper
• GitHubApp.affine: Migrated JWT signing and token caching; replaced Bytes type with [Int] array representation; refactored string chaining to explicit intermediate bindings
• Oikos.affine: Ported TEA (The Elm Architecture) model/update/subscriptions; updated type syntax (Option[T] → Option<T>, Array[T] → [T]); added pub visibility modifiers
• Report.affine: Converted SARIF JSON construction and grade/emoji logic; updated all Float::to_string and Int::to_string calls
• Router.affine: Migrated HTTP routing DSL; updated method/path matching; changed Array[Route] to [Route]
• Webhook.affine: Ported HMAC-SHA256 verification and GitLab token validation; updated Dict[String, String] to [(String, String)] tuple list representation
• GitHubAPI.affine: Converted REST client with Http::fetch integration; refactored JSON encoding/decoding
• Analysis.affine: Ported repository analysis endpoint calls; updated JSON object construction
• Config.affine: Migrated environment variable access and bot mode parsing
• Types.affine: Updated all type definitions with canonical syntax; added module declaration

Static Review Pass (2026-05-25)

• Structural refactoring: Split tea/ServerTea.affine into three separate files (tea/Cmd.affine, tea/Sub.affine, tea/Runtime.affine) because the parser has no inline module Name { ... } form
• Stdlib alignment: Replaced all non-canonical module calls with :: syntax (e.g., Json.stringify → json::stringify, Dict.get → dict::get)
• Type syntax normalization: Converted all generic brackets from [T] to <T> where appropriate; standardized Option[T] → Option<T>
• Effect row cleanup: Removed placeholder effect annotations; aligned with {IO} effect model
• Documentation: Added MISSING-EXTERNS.md cataloging 20+ unbound stdlib surfaces (Env, String extensions, Int/Float conversions, Time, Bytes, Crypto, Base64) that the mechanical migrator must re-bind
• Baseline update: Removed 149 deprecated-API findings from .hypatia-baseline.json (all ReScript .res files now migrated)

Documentation & Housekeeping

• README.adoc: Restructured with macro TOC; added architecture diagram; clarified safety-triangle decision logic
• docs/ARCHITECTURE.md: New authoritative source of truth for system pipeline and component roles
• docs/wiki-source/: Added 5 wiki pages (Home, Architecture, Safety-Triangle, Build-and-Run, Bot-Operations) with publication notice
• MIGRATION-NOTES.md: Expanded with static-review changes and structural rework notes
• CLAUDE.md: Updated project conventions and architecture summary
• Removed obsolete llm-warmup-*.md files

Notable Implementation Details

1. Token caching: Original ReScript mut Dict replaced with cache_get/cache_set helper functions marked TODO for mechanical migrator to wire to proper state-effect cell (issue chore(deps): bump rustls-webpki from 0.103.10 to 0.103.13 in /bots/finishingbot in the cargo group across 1 directory #59)

2. Unbound surfaces: 20+ stdlib calls documented in MISSING-EXTERNS.md rather than invented as extern fn declarations,

https://claude.ai/code/session_01W3PAoaqgJj3mnM8kjhEqx4

[github-actions]

🔍 Hypatia Security Scan

Findings: 138 issues detected

Severity	Count
🔴 Critical	6
🟠 High	1
🟡 Medium	131

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "expect() in hot path (1 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/gitbot-fleet/gitbot-fleet/bots/gsbot/src/services.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (3 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/gitbot-fleet/gitbot-fleet/bots/glambot/src/analyzers/accessibility.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (3 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/gitbot-fleet/gitbot-fleet/bots/finishingbot/src/analyzers/claims.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (1 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/gitbot-fleet/gitbot-fleet/bots/finishingbot/src/analyzers/license.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (1 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/gitbot-fleet/gitbot-fleet/bots/accessibilitybot/src/analyzers/aria.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (5 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/gitbot-fleet/gitbot-fleet/bots/accessibilitybot/src/analyzers/forms.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (4 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/gitbot-fleet/gitbot-fleet/bots/accessibilitybot/src/analyzers/media.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (2 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/gitbot-fleet/gitbot-fleet/bots/accessibilitybot/src/analyzers/language.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (7 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/gitbot-fleet/gitbot-fleet/bots/accessibilitybot/src/analyzers/semantic.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence