refactor: remove the ReScript CLI; the Elixir escript is the sole CLI (#76)

Removes the redundant ReScript CLI, per the estate "no ReScript" policy.
**Scope is CLI-only** (owner-approved) — `opsm_mobile`'s ReScript is
deferred to a next-version follow-up.

## Why this is safe

OPSM carried **two parallel CLIs**: the Elixir escript (`Opsm.CLI`, 807
tests, `mix escript.build`) and a ReScript CLI (`cli/Main.res.js`, run
via Deno). The escript already covers the same surface — trust-pipeline
commands and the checky-monkey/oikos/palimpsest clients — so the
ReScript copy was redundant. Nothing imports `cli/` or `lib/ocaml/`, and
no CI compiles ReScript (the `.res.js` were committed and run directly).

`lib/ocaml/*.res` was a **byte-identical dead duplicate** of `cli/*.res`
(`diff -q` confirms all 5 shared modules identical).

## What changed (−5,109 lines)

**Deleted:** `cli/*.res` (+ compiled `.res.js`), `lib/ocaml/*` (+
`.cmj`, `rescript.lock`), and `rescript.json` / `deno.json` /
`deno.lock` — the last three existed solely to build/run that CLI
(`deno.json` exported `cli/Main.res.js`; every task was rescript/cli).
No other main-tree code uses Deno; `opsm_mobile` has its own.

**Rewired onto the escript:**
- `Justfile` + `contractiles/Justfile`: dropped `build-cli`,
`build-cli-watch`, `test-cli`, `fmt-deno`, deno-lint, `opsm-cli`, the
deno `clean` step, and `.res` references in `loc`/`todos`/`doctor`.
`build` → `build-escript`; `lint` → `mix compile --warnings-as-errors`
(credo isn't a dep, and `just lint` is a mandatory Mustfile check that
must actually run).
- `k9iser.toml`: removed the `deno.json` `[[source]]` + `deno.imports`
`[[constraint]]` — the **"Validate K9 contracts"** CI job would
otherwise fail on the missing file.
- `echidna-validation.yml`: dropped the now-dead `cli/**` push path
trigger.
- `.bot_directives/sustainabot.a2ml`: dropped `deno.json`/`deno.lock`
watches.
- `docs/TOOLCHAIN.adoc`: Deno's remaining consumer is `opsm_mobile`, not
the root CLI.

## Verified (OTP 28.3.1 / Elixir 1.19.5, real toolchain here)
- `mix escript.build` succeeds; **`./opsm --help` runs** (the CLI works)
- `mix compile --warnings-as-errors` clean; `just toolchain-check` clean
- Full dangling-reference sweep across config/CI/manifests — no leftover
pointers to the deleted files (`opsm_mobile` + vendored deps excluded)

## Known / expected
The **governance ReScript check stays red** on `opsm_mobile/src/*.res`
(5 files) until the deferred follow-up removes/migrates those —
**owner-marked for the next version**, recorded in `STATE.a2ml`
next-actions. This PR is the CLI-scope slice.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01Kq24sZCEohSrNFXSuEuz6C

---
_Generated by [Claude
Code](https://claude.ai/code/session_01Kq24sZCEohSrNFXSuEuz6C)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.bot_directives/sustainabot.a2ml

@@ -20,8 +20,6 @@ watch = [
   "Cargo.lock",
   "opsm_ex/mix.exs",
   "opsm_ex/mix.lock",
-  "deno.json",
-  "deno.lock",
   ".github/workflows/",
   "guix.scm",
   "flake.nix",

.github/workflows/echidna-validation.yml

@@ -6,7 +6,6 @@ on:
     branches: [main]   # only post-merge; feature-branch PRs are gated by the pull_request run below
     paths:
       - 'services/*/src/**'
-      - 'cli/**'
       - 'opsm_ex/native/**'
       - '.github/workflows/echidna-validation.yml'
   # No pull_request paths-filter: ECHIDNA Safety Audit is a REQUIRED status check,

.machine_readable/6a2/STATE.a2ml

@@ -1,11 +1,11 @@
 # SPDX-License-Identifier: MPL-2.0
 # STATE.a2ml — Project state checkpoint
-# Updated 2026-07-09: toolchain single source of truth (opsm.toml [runtime])
+# Updated 2026-07-21: ReScript CLI removed (Elixir escript is the sole CLI)
 
 [metadata]
 project = "odds-and-sods-package-manager"
 version = "2.0.0"
-last-updated = "2026-07-09"
+last-updated = "2026-07-21"
 status = "first-class system active"
 
 [project-context]
@@ -181,7 +181,23 @@ evidence-file = "READINESS.md"
   - [runtime] parser hardened: comment lines + inline comments (manager.ex)
   - Full story: docs/TOOLCHAIN.adoc (incl. bootstrap layering + Idris2/pack route)
 
+[completed-2026-07-21]
+- ReScript CLI removed: cli/ + lib/ocaml/ (byte-identical dead duplicate)
+  deleted, along with rescript.json / deno.json / deno.lock (their sole
+  purpose was building/running that CLI). The Elixir escript (Opsm.CLI,
+  mix escript.build) is the sole CLI; it already covered the same
+  trust-pipeline commands and clients, so no functionality was lost.
+- Justfile + contractiles/Justfile rewired off deno/rescript onto the
+  escript; docs/TOOLCHAIN.adoc updated (Deno's remaining consumer is
+  opsm_mobile, not the root CLI).
+- Scope was owner-approved as CLI-only; opsm_mobile ReScript deferred
+  (see next-actions). Governance ReScript check therefore stays red on
+  opsm_mobile/src/*.res until that follow-up lands.
+
 [next-actions]
+- NEXT VERSION (owner-marked): remove/migrate the remaining ReScript in
+  opsm_mobile/ (App/OpsmCommands/Route/RuntimeBridge/TauriFFI .res) — the
+  wider ReScript-elimination work. Clears the last governance red.
 - Grade A: requires external user confirmation outside hyperpolymath
 - guix.scm is a stub (source #f) — grow into real manifest (erlang, elixir,
   zig, just, nickel, idris2, chez-scheme, gmp) for reproducible bootstrap

.machine_readable/contractiles/Justfile

@@ -22,15 +22,7 @@ default:
 # BUILD
 # ═══════════════════════════════════════════════════════════════════════════════
 
-# Build ReScript CLI
-build-cli:
-    deno task build
-
-# Build ReScript CLI in watch mode
-build-cli-watch:
-    deno task build:watch
-
-# Build Elixir escript (standalone binary)
+# Build Elixir escript (standalone binary) — the OPSM CLI
 build-escript:
     cd opsm_ex && mix deps.get && mix escript.build
 
@@ -56,11 +48,10 @@ build-services:
     done
 
 # Build everything
-build: build-cli build-escript
+build: build-escript
 
 # Clean all build artifacts
 clean:
-    deno task clean
     cd opsm_ex && mix clean
     rm -rf opsm_ex/opsm
 
@@ -76,12 +67,8 @@ test *args:
 test-verbose:
     cd opsm_ex && mix test --trace
 
-# Run Deno tests
-test-cli:
-    deno task test
-
 # Run all tests
-test-all: test test-cli
+test-all: test
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # LINT & FORMAT
@@ -91,20 +78,16 @@ test-all: test test-cli
 fmt-ex:
     cd opsm_ex && mix format
 
-# Format with Deno
-fmt-deno:
-    deno fmt
-
-# Lint ReScript output with Deno
+# Lint Elixir code (strict compile — warnings are errors)
 lint:
-    deno lint cli/*.res.js cli/clients/*.res.js
+    cd opsm_ex && mix deps.get && mix compile --warnings-as-errors
 
 # Check Elixir format
 fmt-check:
     cd opsm_ex && mix format --check-formatted
 
 # Format all code
-fmt: fmt-ex fmt-deno
+fmt: fmt-ex
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # RUN
@@ -114,10 +97,6 @@ fmt: fmt-ex fmt-deno
 opsm *args:
     cd opsm_ex && ./opsm {{args}}
 
-# Run OPSM via Deno (ReScript CLI — trust pipeline)
-opsm-cli *args:
-    deno task opsm -- {{args}}
-
 # Run OPSM Elixir in dev mode with IEx
 repl:
     cd opsm_ex && iex -S mix
@@ -156,7 +135,6 @@ deps-ex:
 
 # Install all dependencies
 deps: deps-ex
-    @echo "Deno deps auto-resolved via import maps"
 
 # Audit Elixir dependencies
 deps-audit:
@@ -207,13 +185,12 @@ ci: deps build test lint fmt-check
 loc:
     @echo "=== OPSM Lines of Code ==="
     @echo -n "Elixir: " && find opsm_ex/lib -name "*.ex" | xargs wc -l 2>/dev/null | tail -1
-    @echo -n "ReScript: " && find cli -name "*.res" | xargs wc -l 2>/dev/null | tail -1
     @echo -n "Rust (services): " && find services -name "*.rs" | xargs wc -l 2>/dev/null | tail -1
     @echo -n "Rust (mobile): " && find opsm_mobile -name "*.rs" | xargs wc -l 2>/dev/null | tail -1
 
 # Show TODO comments
 todos:
-    @grep -rn "TODO\|FIXME" --include="*.ex" --include="*.res" --include="*.rs" . 2>/dev/null | grep -v node_modules | grep -v _build | grep -v target || echo "No TODOs"
+    @grep -rn "TODO\|FIXME" --include="*.ex" --include="*.rs" . 2>/dev/null | grep -v node_modules | grep -v _build | grep -v target || echo "No TODOs"
 
 # Show git status
 status:
@@ -234,7 +211,7 @@ doctor:
     @command -v just >/dev/null 2>&1 && echo "  [OK] just" || echo "  [FAIL] just not found"
     @command -v git >/dev/null 2>&1 && echo "  [OK] git" || echo "  [FAIL] git not found"
     @echo "Checking for hardcoded paths..."
-    @grep -rn '$HOME\|$ECLIPSE_DIR' --include='*.rs' --include='*.ex' --include='*.res' --include='*.gleam' --include='*.sh' . 2>/dev/null | head -5 || echo "  [OK] No hardcoded paths"
+    @grep -rn '$HOME\|$ECLIPSE_DIR' --include='*.rs' --include='*.ex' --include='*.gleam' --include='*.sh' . 2>/dev/null | head -5 || echo "  [OK] No hardcoded paths"
     @echo "Diagnostics complete."
 
 # Auto-repair common issues

Justfile

@@ -23,15 +23,7 @@ default:
 # BUILD
 # ═══════════════════════════════════════════════════════════════════════════════
 
-# Build ReScript CLI
-build-cli:
-    deno task build
-
-# Build ReScript CLI in watch mode
-build-cli-watch:
-    deno task build:watch
-
-# Build Elixir escript (standalone binary)
+# Build Elixir escript (standalone binary) — the OPSM CLI
 build-escript:
     cd opsm_ex && mix deps.get && mix escript.build
 
@@ -57,11 +49,10 @@ build-services:
     done
 
 # Build everything
-build: build-cli build-escript
+build: build-escript
 
 # Clean all build artifacts
 clean:
-    deno task clean
     cd opsm_ex && mix clean
     rm -rf opsm_ex/opsm
 
@@ -77,12 +68,8 @@ test *args:
 test-verbose:
     cd opsm_ex && mix test --trace
 
-# Run Deno tests
-test-cli:
-    deno task test
-
 # Run all tests
-test-all: test test-cli
+test-all: test
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # LINT & FORMAT
@@ -92,20 +79,16 @@ test-all: test test-cli
 fmt-ex:
     cd opsm_ex && mix format
 
-# Format with Deno
-fmt-deno:
-    deno fmt
-
-# Lint ReScript output with Deno
+# Lint Elixir code (strict compile — warnings are errors)
 lint:
-    deno lint cli/*.res.js cli/clients/*.res.js
+    cd opsm_ex && mix deps.get && mix compile --warnings-as-errors
 
 # Check Elixir format
 fmt-check:
     cd opsm_ex && mix format --check-formatted
 
 # Format all code
-fmt: fmt-ex fmt-deno
+fmt: fmt-ex
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # TOOLCHAIN (single source of truth: opsm.toml [runtime] — docs/TOOLCHAIN.adoc)
@@ -123,14 +106,10 @@ toolchain-check:
 # RUN
 # ═══════════════════════════════════════════════════════════════════════════════
 
-# Run OPSM via escript (primary CLI)
+# Run OPSM via escript (the CLI)
 opsm *args:
     cd opsm_ex && ./opsm {{args}}
 
-# Run OPSM via Deno (ReScript CLI — trust pipeline)
-opsm-cli *args:
-    deno task opsm -- {{args}}
-
 # Run OPSM Elixir in dev mode with IEx
 repl:
     cd opsm_ex && iex -S mix
@@ -169,7 +148,6 @@ deps-ex:
 
 # Install all dependencies
 deps: deps-ex
-    @echo "Deno deps auto-resolved via import maps"
 
 # Audit Elixir dependencies
 deps-audit:
@@ -220,13 +198,11 @@ ci: deps build test lint fmt-check
 loc:
     @echo "=== OPSM Lines of Code ==="
     @echo -n "Elixir: " && find opsm_ex/lib -name "*.ex" | xargs wc -l 2>/dev/null | tail -1
-    @echo -n "ReScript: " && find cli -name "*.res" | xargs wc -l 2>/dev/null | tail -1
     @echo -n "Rust (services): " && find services -name "*.rs" | xargs wc -l 2>/dev/null | tail -1
-    @echo -n "Rust (mobile): " && find opsm_mobile -name "*.rs" | xargs wc -l 2>/dev/null | tail -1
 
 # Show TODO comments
 todos:
-    @grep -rn "TODO\|FIXME" --include="*.ex" --include="*.res" --include="*.rs" . 2>/dev/null | grep -v node_modules | grep -v _build | grep -v target || echo "No TODOs"
+    @grep -rn "TODO\|FIXME" --include="*.ex" --include="*.rs" . 2>/dev/null | grep -v node_modules | grep -v _build | grep -v target || echo "No TODOs"
 
 # Show git status
 status:
@@ -247,7 +223,7 @@ doctor:
     @command -v just >/dev/null 2>&1 && echo "  [OK] just" || echo "  [FAIL] just not found"
     @command -v git >/dev/null 2>&1 && echo "  [OK] git" || echo "  [FAIL] git not found"
     @echo "Checking for hardcoded paths..."
-    @grep -rn '$HOME\|$ECLIPSE_DIR' --include='*.rs' --include='*.ex' --include='*.res' --include='*.gleam' --include='*.sh' . 2>/dev/null | head -5 || echo "  [OK] No hardcoded paths"
+    @grep -rn '$HOME\|$ECLIPSE_DIR' --include='*.rs' --include='*.ex' --include='*.gleam' --include='*.sh' . 2>/dev/null | head -5 || echo "  [OK] No hardcoded paths"
     @echo "Diagnostics complete."
 
 # Auto-repair common issues