fix(sustainabot): reconcile hand-port against AffineScript grammar + stdlib

Static-review pass on the 2026-05-24 hand-port (per issue #148 policy
override). Reconciles the .affine files against
hyperpolymath/affinescript/lib/parser.mly and the canonical stdlib:

- `open X` -> `use X::*;` (no `open` keyword in the lexer)
- Each file now opens with a `module Name;` declaration
- `Dict[K,V]` field types -> `[(K, V)]` (stdlib/dict.affine shape)
- `Json.foo` -> `json::foo`, `Dict.foo` -> `dict::foo`, etc. (module
  paths use `::`; `.` is field access only)
- Top-level `let x: T = ...` -> `const x: T = ...;`
- Top-level `let _ = main()` removed (no top-level imperative slot)
- `|>` pipe rewritten as nested calls / let chains (no pipe operator
  in the grammar)
- tea/ServerTea.affine split into tea/Cmd.affine, tea/Sub.affine,
  tea/Runtime.affine; the inline `module Name { ... }` form is not in
  the parser
- ServerTea's `let rec ... and ...` mutual-recursion dispatch loop
  collapsed to a TODO stub (no `let rec ... and ...` form); the
  mechanical migrator must rebuild against the final effect-row shape

Drops the Json/Dict placeholder caveats from MIGRATION-NOTES: both
stdlib/json.affine and stdlib/dict.affine have landed and are the
canonical surfaces the rewrite now points at.

Adds MISSING-EXTERNS.md listing every stdlib surface the hand-port
calls that is not yet bound in canonical stdlib (Bytes, Base64, Time,
Crypto extended, Env, Console, full Http::Request/Response, Array.*,
Exn::message). The mechanical migrator (affinescript#57 Phase 3) must
re-point each against whatever the canonical binding lands with.

Prunes 24 stale .res entries from .hypatia-baseline.json: every
bots/sustainabot/bot-integration/{src,bindings,lib/ocaml}/*.res path
the migration removed. 35 entries remain (gsbot Python + a few others).

Compiler check not run: the remote environment has no OCaml/dune/
affinescript toolchain. Edits verified against lib/parser.mly by hand
only.

Author: claude

.hypatia-baseline.json

@@ -208,149 +208,5 @@
     "rule_module": "cicd_rules",
     "type": "banned_language_file",
     "file": "bots/gsbot/tests/unit/test_services.py"
-  },
-  {
-    "severity": "high",
-    "rule_module": "code_safety",
-    "type": "obj_magic",
-    "file": "bots/sustainabot/bot-integration/lib/ocaml/Analysis.res"
-  },
-  {
-    "severity": "high",
-    "rule_module": "code_safety",
-    "type": "obj_magic",
-    "file": "bots/sustainabot/bot-integration/src/Analysis.res"
-  },
-  {
-    "severity": "high",
-    "rule_module": "migration_rules",
-    "type": "deprecated_api",
-    "file": "bots/sustainabot/bot-integration/bindings/Deno.res"
-  },
-  {
-    "severity": "high",
-    "rule_module": "migration_rules",
-    "type": "deprecated_api",
-    "file": "bots/sustainabot/bot-integration/lib/ocaml/Analysis.res"
-  },
-  {
-    "severity": "high",
-    "rule_module": "migration_rules",
-    "type": "deprecated_api",
-    "file": "bots/sustainabot/bot-integration/lib/ocaml/Deno.res"
-  },
-  {
-    "severity": "high",
-    "rule_module": "migration_rules",
-    "type": "deprecated_api",
-    "file": "bots/sustainabot/bot-integration/lib/ocaml/GitHubAPI.res"
-  },
-  {
-    "severity": "high",
-    "rule_module": "migration_rules",
-    "type": "deprecated_api",
-    "file": "bots/sustainabot/bot-integration/lib/ocaml/GitHubApp.res"
-  },
-  {
-    "severity": "high",
-    "rule_module": "migration_rules",
-    "type": "deprecated_api",
-    "file": "bots/sustainabot/bot-integration/lib/ocaml/Main.res"
-  },
-  {
-    "severity": "high",
-    "rule_module": "migration_rules",
-    "type": "deprecated_api",
-    "file": "bots/sustainabot/bot-integration/lib/ocaml/Oikos.res"
-  },
-  {
-    "severity": "high",
-    "rule_module": "migration_rules",
-    "type": "deprecated_api",
-    "file": "bots/sustainabot/bot-integration/lib/ocaml/Report.res"
-  },
-  {
-    "severity": "high",
-    "rule_module": "migration_rules",
-    "type": "deprecated_api",
-    "file": "bots/sustainabot/bot-integration/lib/ocaml/Router.res"
-  },
-  {
-    "severity": "high",
-    "rule_module": "migration_rules",
-    "type": "deprecated_api",
-    "file": "bots/sustainabot/bot-integration/lib/ocaml/ServerTea.res"
-  },
-  {
-    "severity": "high",
-    "rule_module": "migration_rules",
-    "type": "deprecated_api",
-    "file": "bots/sustainabot/bot-integration/lib/ocaml/Types.res"
-  },
-  {
-    "severity": "high",
-    "rule_module": "migration_rules",
-    "type": "deprecated_api",
-    "file": "bots/sustainabot/bot-integration/lib/ocaml/Webhook.res"
-  },
-  {
-    "severity": "high",
-    "rule_module": "migration_rules",
-    "type": "deprecated_api",
-    "file": "bots/sustainabot/bot-integration/src/Analysis.res"
-  },
-  {
-    "severity": "high",
-    "rule_module": "migration_rules",
-    "type": "deprecated_api",
-    "file": "bots/sustainabot/bot-integration/src/GitHubAPI.res"
-  },
-  {
-    "severity": "high",
-    "rule_module": "migration_rules",
-    "type": "deprecated_api",
-    "file": "bots/sustainabot/bot-integration/src/GitHubApp.res"
-  },
-  {
-    "severity": "high",
-    "rule_module": "migration_rules",
-    "type": "deprecated_api",
-    "file": "bots/sustainabot/bot-integration/src/Main.res"
-  },
-  {
-    "severity": "high",
-    "rule_module": "migration_rules",
-    "type": "deprecated_api",
-    "file": "bots/sustainabot/bot-integration/src/Oikos.res"
-  },
-  {
-    "severity": "high",
-    "rule_module": "migration_rules",
-    "type": "deprecated_api",
-    "file": "bots/sustainabot/bot-integration/src/Report.res"
-  },
-  {
-    "severity": "high",
-    "rule_module": "migration_rules",
-    "type": "deprecated_api",
-    "file": "bots/sustainabot/bot-integration/src/Router.res"
-  },
-  {
-    "severity": "high",
-    "rule_module": "migration_rules",
-    "type": "deprecated_api",
-    "file": "bots/sustainabot/bot-integration/src/Types.res"
-  },
-  {
-    "severity": "high",
-    "rule_module": "migration_rules",
-    "type": "deprecated_api",
-    "file": "bots/sustainabot/bot-integration/src/Webhook.res"
-  },
-  {
-    "severity": "high",
-    "rule_module": "migration_rules",
-    "type": "deprecated_api",
-    "file": "bots/sustainabot/bot-integration/src/tea/ServerTea.res"
   }
 ]

bots/sustainabot/bot-integration/MIGRATION-NOTES.md

@@ -5,6 +5,11 @@ This subtree was migrated from ReScript to AffineScript on 2026-05-24 by a
 **hand-port under explicit policy override** of issue #148's
 "do-not-hand-port-ahead-of-the-compiler" rule.
 
+A follow-up static-review pass on 2026-05-25 reconciled the hand-port
+against the canonical AffineScript grammar (`hyperpolymath/affinescript`
+`lib/parser.mly`) and stdlib. See **"Static review changes (2026-05-25)"**
+below.
+
 ## Scope of migration
 
 - All `.res` / `.res.js` under `src/`, `src/tea/`, `bindings/`, and
@@ -16,42 +21,61 @@ This subtree was migrated from ReScript to AffineScript on 2026-05-24 by a
 - The 11 in-scope `.res` files were re-expressed as `.affine`:
   `Types`, `Config`, `Webhook`, `Analysis`, `GitHubAPI`, `GitHubApp`,
   `Report`, `Router`, `Oikos`, `Main`, and `tea/ServerTea`.
+- After the static-review pass, `tea/ServerTea.affine` was split into
+  three siblings: `tea/Cmd.affine`, `tea/Sub.affine`, `tea/Runtime.affine`
+  (the parser has no inline `module Name { ... }` form, so the original
+  three-module file was structurally invalid).
+
+## Static review changes (2026-05-25)
+
+The hand-port was originally written against the README spec only,
+without access to the parser. Reconciling it against
+`lib/parser.mly` + the actual stdlib produced these edits:
+
+| Change | Reason |
+|---|---|
+| `open Types` → `use Types::*;` | The lexer has no `open` keyword. Module-level imports use `use … ::*;` or `use … ::{Foo, Bar};`. |
+| Each file now starts with `module <Name>;` | The parser requires a single `module Name;` decl at the head of every file. |
+| `Dict[K, V]` field types → `[(K, V)]` | `stdlib/dict.affine` represents a dict as an assoc list of pairs (no `Dict` type symbol exists). |
+| `Json` references kept (no `<…>` args) | `stdlib/json.affine` exports `pub type Json = JNull \| JBool(Bool) \| …` — Json is unparameterised. |
+| `Json.foo(…)` → `json::foo(…)` | Module path uses `::`, and the canonical module is lowercase `json`. Similarly `Dict.foo` → `dict::foo`, `Option.foo` → `option::foo`. |
+| `String.foo(…)` → `String::foo(…)` etc. | Capital-cased modules (Http, Crypto, Bytes, Env, Console, Time, Base64, String, Int, Float, Exn, Array, Config) still need `::` for module access; `.` is field access only. |
+| Top-level `let x: T = …` → `const x: T = …;` | `let`-bindings only appear inside block/fn bodies. Module-level bindings use `const`. |
+| Top-level `let _ = main()` removed | There is no top-level imperative slot; the program entry is the `pub fn main` itself. |
+| `let rec … and …` (ServerTea Runtime) → individual `fn` decls with state passed explicitly, stubbed | The parser has no mutually-recursive `let rec … and …` form. The dispatch loop reduces to a TODO stub awaiting the mechanical migrator. |
+| Inline `module Cmd { … }` → separate `tea/Cmd.affine` (plus `Sub`/`Runtime`) | The parser only accepts file-level `module Name;` — inline module bodies are not in the grammar. |
+| `\|>` pipe operator → nested calls / let-binding chains | The lexer has no pipe operator. Each pipeline was rewritten as nested function calls or stepwise `let` bindings. |
+| Variant decls with leading `\|` allowed (kept consistent) | Both `type X = A \| B` and `type X = \| A \| B` parse; we kept the no-leading-pipe form. |
+
+The Json/Dict placeholder caveats from the original notes are gone:
+`stdlib/json.affine` (the `Json` ADT, encoders/decoders, `stringify`) and
+`stdlib/dict.affine` (the `[(String, V)]` assoc-list dict) have both
+landed and are the canonical surfaces the rewritten files now point at.
+
+**Compiler check not run.** The remote environment has no OCaml /
+`dune` / `affinescript` toolchain available, so `affinescript check
+src/` could not be executed. The edits above were verified against
+`lib/parser.mly` by hand only.
+
+## Known unbound surfaces
 
-## Known caveats (must be verified by the real mechanical migrator)
-
-The hand-port was done without an AffineScript compiler available to the
-porter, against the canonical README spec only. Several pieces are
-educated guesses that the upstream Phase-3 migration assistant
-(affinescript#57 / PR #314) is expected to redo:
-
-1. **`Json` and `Dict` are placeholder names** in many type signatures.
-   The portable `Json` primitive is tracked by affinescript#161 (OPEN)
-   and `Dict`/`Map` by #162 (OPEN). Once those land, the placeholders
-   need to be re-pointed at the canonical stdlib names.
-2. **Effect rows** use a conservative `-{IO + Http + Crypto + Exn[E]}->`
-   shape. These need narrowing against the actual effect declarations
-   in the stdlib.
-3. **TEA runtime (`tea/ServerTea.affine`)** uses `mut` cells and
-   mutually-recursive closures. The borrow checker may force this into
-   a single-owner / handler-state shape — exact form to be settled by
-   the actual checker.
-4. **JWT crypto chain (`GitHubApp.affine`)** assumes Web Crypto-derived
-   stdlib bindings (`Crypto.import_key_pkcs8`,
-   `Crypto.sign_with_algorithm`). Real binding names will land with
-   `#103` (Async-extern ABI — closed 2026-05-18) once the canonical
-   stdlib surface is published.
-5. **Bindings deleted** (`bindings/Deno.res`, `bindings/Fetch.res`) —
-   their callers now reference target-agnostic stdlib names
-   (`Http.fetch`, `Env.get`, `Console.log`, etc.). The compiler's
-   target-binding layer is expected to lower these per backend.
+A list of stdlib surfaces these files call that are **not yet bound** in
+canonical AffineScript stdlib lives in `MISSING-EXTERNS.md`. The
+mechanical migrator (affinescript#57 Phase 3) must re-point those calls
+against whatever names the eventual bindings land with.
 
 ## Re-port checklist (when affinescript#57 Phase 3 lands)
 
 - [ ] Run the mechanical migrator over the original `.res` (via
       `git show <pre-migration-sha>:path/to/file.res`) and diff its
       output against the hand-port.
-- [ ] Substitute placeholder `Json` / `Dict[String, V]` references with
-      whatever canonical names #161 / #162 land with.
-- [ ] Re-narrow effect rows against the actual stdlib declarations.
-- [ ] Run `affinescript check src/` against every file and resolve any
-      remaining errors that the hand-port couldn't anticipate.
+- [ ] Resolve every `TODO(mechanical-migrator):` annotation. The
+      densest cluster is in `tea/Runtime.affine` (the dispatch loop
+      stub) and `src/Main.affine` / `src/Router.affine` (the HTTP
+      serve loop stubs).
+- [ ] Re-bind every name listed in `MISSING-EXTERNS.md`.
+- [ ] Re-narrow effect rows against the actual stdlib declarations
+      (the hand-port uses a conservative `-{IO}->` everywhere).
+- [ ] Run `affinescript check src/` (in an environment that has the
+      compiler) and resolve any remaining errors that the hand-port
+      couldn't anticipate.

bots/sustainabot/bot-integration/MISSING-EXTERNS.md

@@ -0,0 +1,138 @@
+<!-- SPDX-License-Identifier: PMPL-1.0-or-later -->
+# Unbound stdlib surfaces
+
+Generated by the static-review pass on 2026-05-25 (see
+`MIGRATION-NOTES.md`). Each entry lists a name called by the hand-port
+that does not currently appear in `hyperpolymath/affinescript`
+`stdlib/`. The mechanical migrator (affinescript#57 Phase 3) must
+re-point each call against whatever the canonical binding lands with,
+or supply an explicit `extern fn` declaration at the call site.
+
+The names are kept here (rather than mass-inventing `extern fn`s in the
+.affine files) because guessing the wrong signature would silently
+mask the gap once the real binding lands.
+
+## `Env`
+
+| Call | Used in | Likely target |
+|---|---|---|
+| `Env::get(name) -> Option<String>` | Config, Oikos | Maps to the existing `getenv` builtin in `stdlib/io.affine`; awaits a thin `Env` module wrapper or a direct `use io::{getenv};` rewrite. |
+
+## `String` (extensions)
+
+`stdlib/string.affine` exists but does not cover these:
+
+| Call | Used in |
+|---|---|
+| `String::to_lower(s)` | Config — canonical builtin is `to_lowercase(s)`, no module prefix |
+| `String::replace(s, needle, replacement)` | Webhook |
+| `String::replace_regex(s, pattern, replacement)` | GitHubApp, Main |
+| `String::replace_all(s, needle, replacement)` | GitHubApp, Report |
+| `String::split(s, sep)` | Router — canonical builtin is `split(s, sep)`, no module prefix |
+| `String::slice_from(s, n)` | Router |
+| `String::starts_with(s, prefix)` | Router |
+
+## `Int` / `Float`
+
+| Call | Used in | Likely target |
+|---|---|---|
+| `Int::to_string(n)` | every file | builtin `int_to_string(n)` (no module prefix) |
+| `Int::from_string(s)` | Config, Oikos | builtin `parse_int(s) -> Option<Int>` |
+| `Float::to_string(f)` | Report | builtin `float_to_string(f)` |
+| `Float::to_int(f)` | Report, GitHubAPI, Main, GitHubApp | needs a cast primitive |
+
+## `Time`
+
+No `Time` module in stdlib. The Crypto module exposes `time_ms() -> Int`
+which covers `Time::now_millis` if the lowering can pun Int↔Float.
+
+| Call | Used in |
+|---|---|
+| `Time::now_millis() -> Float` | GitHubApp, Oikos |
+| `Time::iso_now() -> String` | Main |
+| `Time::parse_iso8601(s) -> Float` | GitHubApp (removed in static-review pass) |
+| `Time::set_interval(f, ms) -> Int` | (was in Runtime; now stubbed) |
+| `Time::clear_interval(id)` | (was in Runtime; now stubbed) |
+
+## `Crypto` (extensions)
+
+`stdlib/Crypto.affine` exports `random_string`, `random_f64`, `time_ms`
+only. The hand-port additionally calls:
+
+| Call | Used in |
+|---|---|
+| `Crypto::import_key("raw", …)` | Webhook (HMAC) |
+| `Crypto::import_key_pkcs8(…)` | GitHubApp (RSA JWT) |
+| `Crypto::verify("HMAC", key, sig, data)` | Webhook |
+| `Crypto::sign_with_algorithm(alg, key, data)` | GitHubApp |
+
+These map to Web Crypto under the Deno-ESM backend; the canonical
+binding will likely arrive with the `#103` Async-extern ABI rollout.
+
+## `Bytes`
+
+No `Bytes` module in stdlib.
+
+| Call | Used in |
+|---|---|
+| `Bytes::from_utf8(s) -> [Int]` | Webhook, GitHubApp |
+| `Bytes::from_string(s) -> [Int]` | GitHubApp |
+
+## `Base64`
+
+No `Base64` module in stdlib.
+
+| Call | Used in |
+|---|---|
+| `Base64::encode(bytes) -> String` | GitHubApp |
+| `Base64::decode(s) -> String` | GitHubApp |
+
+## `Console`
+
+| Call | Used in | Likely target |
+|---|---|---|
+| `Console::log(s)` | Oikos, Main | builtin `println(s)` (no module prefix) |
+| `Console::error(s)` | Oikos | builtin `eprintln(s)` |
+
+## `Http` (extensions beyond `stdlib/Http.affine`)
+
+`stdlib/Http.affine` provides `http_request`, `fetch`, `get`, `post`,
+`is_ok`, plus the `Request`/`Response` records. The hand-port
+additionally references:
+
+| Call | Used in |
+|---|---|
+| `Http::Request` (as a type alias) | Router, Main |
+| `Http::Response` (as a type alias) | Router, Main |
+| `Http::serve(opts, handler)` | (was in Main; now stubbed) |
+| `Http::Server` (handle type) | (was in Runtime; now opaque-Int stubbed) |
+| `Http::Server::shutdown(s)` | (was in Runtime; now stubbed) |
+| `Http::not_implemented(req) -> Response` | Router (placeholder for the dispatch stub) |
+| `Http::Url::parse(url)`, `Http::Url::pathname(u)` | (was in Router; now stubbed) |
+| `Http::Request::method(req)`, `Http::Request::url(req)`, `Http::Request::headers(req)`, `Http::Request::text(req)` | (was in Router/Main; now stubbed) |
+| `Http::Response::make(body, opts) -> Response` | (was in Router/Main; now stubbed) |
+
+## `Array`
+
+`stdlib/prelude.affine` exports `map`, `filter`, `fold`, `contains`,
+`sum`, `product` as bare functions over `[T]`. The hand-port additionally
+calls:
+
+| Call | Used in | Likely target |
+|---|---|---|
+| `Array::length(a)` | Report, Router | needs `len` builtin or a prelude `length` fn |
+| `Array::append(a, b)` | (was in Oikos; rewritten to `a ++ b`) | already covered by `++` |
+| `Array::map(a, f)` | (was in Report; rewritten to `map(a, f)`) | covered by prelude |
+| `Array::filter(a, p)` | (was in Oikos; rewritten to `filter(a, p)`) | covered by prelude |
+| `Array::slice(a, start, len)` | Report |
+| `Array::iter(a, f)` | (was in Router/Runtime; now stubbed) |
+| `Array::iter_indexed(a, f)` | (was in Router; now stubbed) |
+| `Array::fold_right(a, init, f)` | (was in Router; now stubbed) |
+| `Array::get(a, i)` | (was in Router; now stubbed) |
+| `Array::join(strs, sep)` | (was in Report; rewritten to `string::join(strs, sep)`) | covered by stdlib `string::join` |
+
+## `Exn`
+
+| Call | Used in | Likely target |
+|---|---|---|
+| `Exn::message(err)` | Analysis, GitHubAPI, GitHubApp | needs an `Exn` module or pattern-matched extraction |