Extract OikosBot Rust workspace from gitbot-fleet/bots/sustainabot; decouple + disambiguate

.claude/CLAUDE.md

@@ -19,13 +19,17 @@ The following files in `.machine_readable/6a2/` contain structured project metad
 
 ## Language Policy (Hyperpolymath Standard)
 
-> **Policy refresh 2026-05-28**: This repo has two products. (1) The **Oikos DSL** at the repo root is **Rust** (compiler crates `oikos-syntax`, `oikos-parser`, `oikos-desugar`, `oikos-check`); (2) **OikosBot** at `bot-integration-affine/` is **AffineScript** as of the 2026-05-28 legacy-shutoff (oikos#41) — the previous ReScript implementation at `bot-integration/` was removed in the same PR. Write no new ReScript or TypeScript here. MPL-1.0 / MPL-1.0-or-later are banned; rewrite to MPL-2.0 wherever encountered (DR-010 supersedes DR-002).
+> **Disambiguation (READ FIRST — see [`DISAMBIGUATION.adoc`](../DISAMBIGUATION.adoc)):** this repo is **OikosBot** and **only** OikosBot. Do not conflate it with two separate, similarly-named projects:
+> - **oikos** — the stock-flow-consistent economics *DSL* (crates `oikos-syntax`/`oikos-parser`/`oikos-desugar`/`oikos-check`). It lives in its **own** repo `hyperpolymath/oikos-economics-accounting-dsl`, **not here**. Do **not** add `oikos-*` DSL crates to this repo.
+> - **sustainabot** — a *reserved member slot* of `hyperpolymath/gitbot-fleet` (`bots/sustainabot/`). **Not here.** A misfiled copy of OikosBot once lived there; it was moved into this repo and renamed `sustainabot-*` → `oikosbot-*`. Do **not** reintroduce the `sustainabot` name here (the sole exception is the legacy `crates/oikosbot-fleet` bridge, which still targets the fleet's `BotId::Sustainabot`).
+>
+> **Policy refresh 2026-06-19**: This repo has two surfaces, both OikosBot. (1) The **Rust analysis workspace** at the repo root — crates `oikosbot-*` (`oikosbot-cli`/`-analysis`/`-metrics`/`-sarif`/`-eclexia`, plus the optional, workspace-excluded `oikosbot-fleet` bridge). The default `cargo` workspace builds **standalone** with no dependency on gitbot-fleet. (2) **OikosBot's webhook bot** at `bot-integration-affine/` is **AffineScript** as of the 2026-05-28 legacy-shutoff (oikos#41) — the previous ReScript implementation at `bot-integration/` was removed in the same PR. Write no new ReScript or TypeScript here. MPL-1.0 / MPL-1.0-or-later are banned; rewrite to MPL-2.0 wherever encountered (DR-010 supersedes DR-002).
 
 ### ALLOWED Languages & Tools
 
 | Language/Tool | Use Case | Notes |
 |---------------|----------|-------|
-| **Rust** | Oikos DSL compiler crates | Repo root; performance-critical |
+| **Rust** | OikosBot analysis workspace (`crates/oikosbot-*`) | Repo root; performance-critical. NOT the `oikos-*` DSL (separate repo). |
 | **AffineScript** (`.affine`) | OikosBot (`bot-integration-affine/`) | Affine types, dependent types, row polymorphism, extensible effects |
 | **Haskell** | OikosBot analyser backend (`analyzers/`) | Existing surface; pure analysis |
 | **Deno** | Runtime & package management | Replaces Node/npm/bun |

.github/dependabot.yml

@@ -8,3 +8,11 @@ updates:
       actions:
         patterns:
           - "*"
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      cargo:
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -41,6 +41,35 @@ jobs:
       - name: Test Haskell analyzer
         working-directory: analyzers/code-haskell
         run: cabal test all
+  rust:
+    name: Rust Workspace
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Cache cargo
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
+      # Uses the runner's preinstalled stable toolchain (no third-party action).
+      # NB: the default workspace deliberately EXCLUDES crates/oikosbot-fleet so
+      # OikosBot builds with no dependency on hyperpolymath/gitbot-fleet.
+      - name: Format check
+        run: cargo fmt --check
+      - name: Build (standalone workspace)
+        run: cargo build --workspace --locked
+      - name: Test (standalone workspace)
+        run: cargo test --workspace --locked
+      - name: Clippy (informational)
+        run: cargo clippy --workspace
+        continue-on-error: true
   affine:
     name: AffineScript Scaffold
     runs-on: ubuntu-latest

.machine_readable/6a2/ECOSYSTEM.a2ml

@@ -1,20 +1,28 @@
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
-# ECOSYSTEM.a2ml — Oikos ecosystem position
+# ECOSYSTEM.a2ml — OikosBot ecosystem position
 [metadata]
-version = "1.0"
-last-updated = "2026-04-11"
+version = "1.1"
+last-updated = "2026-06-19"
 
 [project]
-name = "Oikos"
-purpose = ""
-role = ""
+name = "OikosBot"
+purpose = "An ecological & economic code-analysis GitHub/GitLab App that adds an eco/econ review lens to pull requests, complementing (not replacing) Dependabot/CodeQL/linters."
+role = "Standalone analysis product. Optionally plugs into the gitbot fleet via the excluded crates/oikosbot-fleet bridge."
 
 [position-in-ecosystem]
-category = ""
+category = "code-analysis-app"
+
+# Disambiguation — three similarly-named, SEPARATE projects. See DISAMBIGUATION.adoc.
+[disambiguation]
+this-project = "OikosBot (this repo, hyperpolymath/oikosbot) — crates oikosbot-*"
+not-the-dsl = "oikos — the stock-flow-consistent economics DSL — lives in hyperpolymath/oikos-economics-accounting-dsl (crates oikos-*). NOT here."
+not-the-fleet-slot = "sustainabot — a reserved member slot of hyperpolymath/gitbot-fleet (bots/sustainabot/), to be prototyped later. NOT here. A misfiled copy of OikosBot once lived there and was moved into this repo."
 
 [related-projects]
 projects = [
-  # No related projects recorded
+  { name = "oikos-economics-accounting-dsl", repo = "hyperpolymath/oikos-economics-accounting-dsl", relation = "name-sibling", note = "Separate DSL; shares the οἶκος root only." },
+  { name = "gitbot-fleet", repo = "hyperpolymath/gitbot-fleet", relation = "optional-consumer", note = "OikosBot can run as a fleet member via the excluded crates/oikosbot-fleet bridge; the bots/sustainabot/ slot is reserved and separate." },
+  { name = "affinescript", repo = "hyperpolymath/affinescript", relation = "upstream-toolchain", note = "Provides the AffineScript compiler/stdlib for bot-integration-affine/." }
 ]

.machine_readable/6a2/STATE.a2ml

@@ -3,16 +3,16 @@
 #
 # STATE.a2ml — Oikos project state
 [metadata]
-project = "oikos"
+project = "oikosbot"
 version = "0.1.0-dev"
-last-updated = "2026-05-28"
+last-updated = "2026-06-19"
 status = "active"
-session = "2026-05-28 Phase 5 scaffold + legacy shutoff; upstream RSR rewires landed in affinescript"
+session = "2026-06-19 extract Rust analysis workspace from gitbot-fleet/bots/sustainabot → crates/oikosbot-* (renamed, decoupled, standalone, 35 tests green); add DISAMBIGUATION.adoc"
 
 [project-context]
-name = "Oikos"
-purpose = "Two products: (1) the Oikos DSL — typed compiler for stock-flow-consistent macroeconomic models; (2) OikosBot — code-analysis GitHub App. See docs/disambiguation/oikos-dsl-vs-oikosbot.adoc."
-completion-percentage = 30
+name = "OikosBot"
+purpose = "OikosBot — an ecological & economic code-analysis GitHub/GitLab App. NB: the similarly-named 'oikos' DSL (separate repo hyperpolymath/oikos-economics-accounting-dsl) and the 'sustainabot' gitbot-fleet slot are SEPARATE projects — see DISAMBIGUATION.adoc."
+completion-percentage = 40
 
 [position]
 phase = "implementation"   # design | implementation | testing | maintenance | archived
@@ -22,6 +22,7 @@ maturity = "alpha"  # experimental | alpha | beta | production | lts
 milestones = [
   { id = "phase-5-scaffold", status = "landed", pr = 35, summary = "OikosBot AffineScript scaffold at bot-integration-affine/" },
   { id = "legacy-shutoff", status = "landed", pr = 41, summary = "Clean shutoff of ReScript bot-integration/ (-33,061 lines)" },
+  { id = "crates-extraction", status = "landed", summary = "Extract Rust analysis workspace from gitbot-fleet/bots/sustainabot; rename sustainabot-* → oikosbot-*; decouple from fleet (oikosbot-fleet bridge excluded from default workspace); 35 tests green" },
   { id = "stdlib-json-v03", status = "landed-upstream", repo = "affinescript", pr = 421, summary = "stdlib/json.affine RSR rewire to hpm-json-rsr Zig FFI — unblocks OikosBot webhook payload extraction" },
   { id = "stdlib-http-server", status = "landed-upstream", repo = "affinescript", pr = 425, summary = "stdlib/Http.affine RSR rewire — surfaces hpm-http-rsr Zig FFI server externs — unblocks OikosBot accept loop" },
   { id = "bot-affine-implementation", status = "pending", summary = "Implement webhook handler + HMAC verification + dispatch in bot-integration-affine/ now that both stdlib gates are closed" },

ARCHITECTURE.md

@@ -9,14 +9,19 @@ Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 
 > **Note — which product is this?**
 > This document describes **OikosBot**, the code-analysis GitHub/GitLab App.
-> Its AffineScript port lives in
-> [`bot-integration-affine/`](bot-integration-affine/) (in-flight; the
+> Its Rust analysis workspace is `crates/oikosbot-*`; its AffineScript port lives
+> in [`bot-integration-affine/`](bot-integration-affine/) (in-flight; the
 > previous ReScript codebase at `bot-integration/` was retired on
 > 2026-05-28 — see git history for the prior implementation).
-> The DSL of the same root name (a typed compiler for stock-flow consistent
-> macroeconomic models) now lives in
-> [`hyperpolymath/oikos-economics-accounting-dsl`](https://github.com/hyperpolymath/oikos-economics-accounting-dsl).
-> They share the οἶκος root but are otherwise unrelated.
+> Two similarly-named-but-**separate** projects are easy to confuse with this one
+> (full breakdown in [`DISAMBIGUATION.adoc`](DISAMBIGUATION.adoc)):
+> the **oikos** DSL (a typed compiler for stock-flow consistent macroeconomic
+> models) now lives in
+> [`hyperpolymath/oikos-economics-accounting-dsl`](https://github.com/hyperpolymath/oikos-economics-accounting-dsl);
+> and **sustainabot** is a reserved member slot of
+> [`hyperpolymath/gitbot-fleet`](https://github.com/hyperpolymath/gitbot-fleet)
+> (`bots/sustainabot/`), not OikosBot. They share the οἶκος root but are
+> otherwise unrelated.
 
 ## Vision
 

CHANGELOG.md

@@ -19,6 +19,10 @@ this project aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- feat(crates): extract the Rust analysis workspace from `gitbot-fleet/bots/sustainabot/` into this repo, renamed `sustainabot-*` → `oikosbot-*` (`oikosbot-cli`/`-analysis`/`-metrics`/`-sarif`/`-eclexia`, plus the optional `oikosbot-fleet` bridge). Adds `policies/`, `fuzz/`, `examples/`, `containers/`, and `QUICKSTART.md`. Builds and tests green (35 tests).
+- docs: `DISAMBIGUATION.adoc` — canonical breakdown of **oikos** (the DSL) vs **OikosBot** (this App) vs **sustainabot** (a reserved gitbot-fleet slot), with guardrails to prevent the misfiling recurring.
+- ci(rust): add a `rust` job (fmt-check + build + test, informational clippy) to `ci.yml` and a `cargo` dependabot ecosystem. New `just rust-build` / `rust-test` targets.
+- feat(bot): missing AffineScript modules `GitHubAPI`, `GitHubApp`, and the TEA runtime (`tea/Cmd`, `tea/Runtime`, `tea/Sub`) added to `bot-integration-affine/src/` from the former sustainabot tree.
 - feat(bot): `bot-integration-affine/` Phase 5 AffineScript scaffold (#35) — initial AS port of OikosBot; cross-module type-check, JSON payload extraction, and HTTP-server accept loop are gated on upstream `affinescript` stdlib work (Json v0.3 RSR rewire `affinescript#421` + Http server FFI `affinescript#425`).
 - feat: Oikos Bot v0.1.0-beta - TEA architecture with typed HTTP routing
 - feat: add GitHub App manifest for developer programme registration
@@ -39,6 +43,7 @@ this project aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- chore(decouple): sever OikosBot's dependency on `gitbot-fleet`. The default `cargo` workspace **excludes** `crates/oikosbot-fleet` (the only fleet-aware crate), and the optional `panic-attacker` / `eclexia` path dependencies that escaped the repo were neutralised to no-op feature seams — OikosBot now builds from a clean checkout with no sibling repos present.
 - chore(repo): split OikosBot into its own repository separate from the Oikos economics accounting DSL.
 - chore(bot-integration): clean shutoff of the legacy ReScript `bot-integration/` (#41) — 208 files / -33,061 lines: removes `bot-integration/`, `containers/`, `.github/workflows/oikos.yml`, the `rescript:` job from `ci.yml`, the npm/bot-integration dependabot entry, and `.gitmodules`. README / ARCHITECTURE / ROADMAP / DEPLOY / disambiguation docs repointed at `bot-integration-affine/`. No production blast radius (`.github/app.yml` URLs were `*.example.com` placeholders).
 - chore(license): align stale SPDX headers + `Cargo.toml` manifest with `MPL-2.0` (#36) — completes the 2026-05-22 EUPL → MPL migration that had left 45 file headers + the manifest at `EUPL-1.2`.