refactor: remove the ReScript CLI; the Elixir escript is the sole CLI

OPSM carried two parallel CLIs: the Elixir escript (Opsm.CLI, 807 tests,
`mix escript.build`) and a ReScript CLI (cli/Main.res.js, run via Deno).
The escript already covered the same surface — trust-pipeline commands
and the checky-monkey/oikos/palimpsest clients — so the ReScript copy
was redundant. Per the estate "no ReScript" policy, remove it (owner-
approved scope: the CLI only; opsm_mobile's ReScript is deferred to a
follow-up, recorded in STATE.a2ml next-actions).

Deleted:
- cli/*.res (+ compiled .res.js) — the ReScript CLI
- lib/ocaml/*.res (+ .cmj, rescript.lock) — a byte-identical dead
  duplicate of cli/ (diff -q confirms 5/5 shared modules identical)
- rescript.json, deno.json, deno.lock — existed solely to build/run
  that CLI (deno.json exports cli/Main.res.js; every task was rescript/
  cli). No other main-tree code uses Deno; opsm_mobile has its own.

Rewired onto the escript:
- Justfile + .machine_readable/contractiles/Justfile: dropped build-cli,
  build-cli-watch, test-cli, fmt-deno, deno-lint, opsm-cli, the deno
  clean step, and .res references in loc/todos/doctor. `build` -> just
  build-escript; `lint` -> `mix compile --warnings-as-errors` (credo is
  not a dep, and `just lint` is a mandatory Mustfile check that must run)
- k9iser.toml: removed the deno.json [[source]] and the deno.imports
  [[constraint]] (the "Validate K9 contracts" CI job would otherwise fail
  on the missing file)
- echidna-validation.yml: dropped the now-dead `cli/**` push path trigger
- .bot_directives/sustainabot.a2ml: dropped deno.json/deno.lock watches
- docs/TOOLCHAIN.adoc: Deno's remaining consumer is opsm_mobile, not the
  root CLI

Verified (OTP 28.3.1 / Elixir 1.19.5): `mix escript.build` succeeds and
`./opsm --help` runs; `mix compile --warnings-as-errors` clean;
`just toolchain-check` clean; no dangling refs to the deleted files in
any config/CI/manifest (opsm_mobile and vendored deps excluded).

Note: the governance ReScript check stays red on opsm_mobile/src/*.res
until the deferred follow-up removes/migrates those — owner-marked for
the next version.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kq24sZCEohSrNFXSuEuz6C

Author: claude

.bot_directives/sustainabot.a2ml

@@ -20,8 +20,6 @@ watch = [
   "Cargo.lock",
   "opsm_ex/mix.exs",
   "opsm_ex/mix.lock",
-  "deno.json",
-  "deno.lock",
   ".github/workflows/",
   "guix.scm",
   "flake.nix",

.github/workflows/echidna-validation.yml

@@ -6,7 +6,6 @@ on:
     branches: [main]   # only post-merge; feature-branch PRs are gated by the pull_request run below
     paths:
       - 'services/*/src/**'
-      - 'cli/**'
       - 'opsm_ex/native/**'
       - '.github/workflows/echidna-validation.yml'
   # No pull_request paths-filter: ECHIDNA Safety Audit is a REQUIRED status check,

.machine_readable/6a2/STATE.a2ml

@@ -1,11 +1,11 @@
 # SPDX-License-Identifier: MPL-2.0
 # STATE.a2ml — Project state checkpoint
-# Updated 2026-07-09: toolchain single source of truth (opsm.toml [runtime])
+# Updated 2026-07-21: ReScript CLI removed (Elixir escript is the sole CLI)
 
 [metadata]
 project = "odds-and-sods-package-manager"
 version = "2.0.0"
-last-updated = "2026-07-09"
+last-updated = "2026-07-21"
 status = "first-class system active"
 
 [project-context]
@@ -181,7 +181,23 @@ evidence-file = "READINESS.md"
   - [runtime] parser hardened: comment lines + inline comments (manager.ex)
   - Full story: docs/TOOLCHAIN.adoc (incl. bootstrap layering + Idris2/pack route)
 
+[completed-2026-07-21]
+- ReScript CLI removed: cli/ + lib/ocaml/ (byte-identical dead duplicate)
+  deleted, along with rescript.json / deno.json / deno.lock (their sole
+  purpose was building/running that CLI). The Elixir escript (Opsm.CLI,
+  mix escript.build) is the sole CLI; it already covered the same
+  trust-pipeline commands and clients, so no functionality was lost.
+- Justfile + contractiles/Justfile rewired off deno/rescript onto the
+  escript; docs/TOOLCHAIN.adoc updated (Deno's remaining consumer is
+  opsm_mobile, not the root CLI).
+- Scope was owner-approved as CLI-only; opsm_mobile ReScript deferred
+  (see next-actions). Governance ReScript check therefore stays red on
+  opsm_mobile/src/*.res until that follow-up lands.
+
 [next-actions]
+- NEXT VERSION (owner-marked): remove/migrate the remaining ReScript in
+  opsm_mobile/ (App/OpsmCommands/Route/RuntimeBridge/TauriFFI .res) — the
+  wider ReScript-elimination work. Clears the last governance red.
 - Grade A: requires external user confirmation outside hyperpolymath
 - guix.scm is a stub (source #f) — grow into real manifest (erlang, elixir,
   zig, just, nickel, idris2, chez-scheme, gmp) for reproducible bootstrap

.machine_readable/contractiles/Justfile

@@ -22,15 +22,7 @@ default:
 # BUILD
 # ═══════════════════════════════════════════════════════════════════════════════
 
-# Build ReScript CLI
-build-cli:
-    deno task build
-
-# Build ReScript CLI in watch mode
-build-cli-watch:
-    deno task build:watch
-
-# Build Elixir escript (standalone binary)
+# Build Elixir escript (standalone binary) — the OPSM CLI
 build-escript:
     cd opsm_ex && mix deps.get && mix escript.build
 
@@ -56,11 +48,10 @@ build-services:
     done
 
 # Build everything
-build: build-cli build-escript
+build: build-escript
 
 # Clean all build artifacts
 clean:
-    deno task clean
     cd opsm_ex && mix clean
     rm -rf opsm_ex/opsm
 
@@ -76,12 +67,8 @@ test *args:
 test-verbose:
     cd opsm_ex && mix test --trace
 
-# Run Deno tests
-test-cli:
-    deno task test
-
 # Run all tests
-test-all: test test-cli
+test-all: test
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # LINT & FORMAT
@@ -91,20 +78,16 @@ test-all: test test-cli
 fmt-ex:
     cd opsm_ex && mix format
 
-# Format with Deno
-fmt-deno:
-    deno fmt
-
-# Lint ReScript output with Deno
+# Lint Elixir code (strict compile — warnings are errors)
 lint:
-    deno lint cli/*.res.js cli/clients/*.res.js
+    cd opsm_ex && mix deps.get && mix compile --warnings-as-errors
 
 # Check Elixir format
 fmt-check:
     cd opsm_ex && mix format --check-formatted
 
 # Format all code
-fmt: fmt-ex fmt-deno
+fmt: fmt-ex
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # RUN
@@ -114,10 +97,6 @@ fmt: fmt-ex fmt-deno
 opsm *args:
     cd opsm_ex && ./opsm {{args}}
 
-# Run OPSM via Deno (ReScript CLI — trust pipeline)
-opsm-cli *args:
-    deno task opsm -- {{args}}
-
 # Run OPSM Elixir in dev mode with IEx
 repl:
     cd opsm_ex && iex -S mix
@@ -156,7 +135,6 @@ deps-ex:
 
 # Install all dependencies
 deps: deps-ex
-    @echo "Deno deps auto-resolved via import maps"
 
 # Audit Elixir dependencies
 deps-audit:
@@ -207,13 +185,12 @@ ci: deps build test lint fmt-check
 loc:
     @echo "=== OPSM Lines of Code ==="
     @echo -n "Elixir: " && find opsm_ex/lib -name "*.ex" | xargs wc -l 2>/dev/null | tail -1
-    @echo -n "ReScript: " && find cli -name "*.res" | xargs wc -l 2>/dev/null | tail -1
     @echo -n "Rust (services): " && find services -name "*.rs" | xargs wc -l 2>/dev/null | tail -1
     @echo -n "Rust (mobile): " && find opsm_mobile -name "*.rs" | xargs wc -l 2>/dev/null | tail -1
 
 # Show TODO comments
 todos:
-    @grep -rn "TODO\|FIXME" --include="*.ex" --include="*.res" --include="*.rs" . 2>/dev/null | grep -v node_modules | grep -v _build | grep -v target || echo "No TODOs"
+    @grep -rn "TODO\|FIXME" --include="*.ex" --include="*.rs" . 2>/dev/null | grep -v node_modules | grep -v _build | grep -v target || echo "No TODOs"
 
 # Show git status
 status:
@@ -234,7 +211,7 @@ doctor:
     @command -v just >/dev/null 2>&1 && echo "  [OK] just" || echo "  [FAIL] just not found"
     @command -v git >/dev/null 2>&1 && echo "  [OK] git" || echo "  [FAIL] git not found"
     @echo "Checking for hardcoded paths..."
-    @grep -rn '$HOME\|$ECLIPSE_DIR' --include='*.rs' --include='*.ex' --include='*.res' --include='*.gleam' --include='*.sh' . 2>/dev/null | head -5 || echo "  [OK] No hardcoded paths"
+    @grep -rn '$HOME\|$ECLIPSE_DIR' --include='*.rs' --include='*.ex' --include='*.gleam' --include='*.sh' . 2>/dev/null | head -5 || echo "  [OK] No hardcoded paths"
     @echo "Diagnostics complete."
 
 # Auto-repair common issues

Justfile

@@ -23,15 +23,7 @@ default:
 # BUILD
 # ═══════════════════════════════════════════════════════════════════════════════
 
-# Build ReScript CLI
-build-cli:
-    deno task build
-
-# Build ReScript CLI in watch mode
-build-cli-watch:
-    deno task build:watch
-
-# Build Elixir escript (standalone binary)
+# Build Elixir escript (standalone binary) — the OPSM CLI
 build-escript:
     cd opsm_ex && mix deps.get && mix escript.build
 
@@ -57,11 +49,10 @@ build-services:
     done
 
 # Build everything
-build: build-cli build-escript
+build: build-escript
 
 # Clean all build artifacts
 clean:
-    deno task clean
     cd opsm_ex && mix clean
     rm -rf opsm_ex/opsm
 
@@ -77,12 +68,8 @@ test *args:
 test-verbose:
     cd opsm_ex && mix test --trace
 
-# Run Deno tests
-test-cli:
-    deno task test
-
 # Run all tests
-test-all: test test-cli
+test-all: test
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # LINT & FORMAT
@@ -92,20 +79,16 @@ test-all: test test-cli
 fmt-ex:
     cd opsm_ex && mix format
 
-# Format with Deno
-fmt-deno:
-    deno fmt
-
-# Lint ReScript output with Deno
+# Lint Elixir code (strict compile — warnings are errors)
 lint:
-    deno lint cli/*.res.js cli/clients/*.res.js
+    cd opsm_ex && mix deps.get && mix compile --warnings-as-errors
 
 # Check Elixir format
 fmt-check:
     cd opsm_ex && mix format --check-formatted
 
 # Format all code
-fmt: fmt-ex fmt-deno
+fmt: fmt-ex
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # TOOLCHAIN (single source of truth: opsm.toml [runtime] — docs/TOOLCHAIN.adoc)
@@ -123,14 +106,10 @@ toolchain-check:
 # RUN
 # ═══════════════════════════════════════════════════════════════════════════════
 
-# Run OPSM via escript (primary CLI)
+# Run OPSM via escript (the CLI)
 opsm *args:
     cd opsm_ex && ./opsm {{args}}
 
-# Run OPSM via Deno (ReScript CLI — trust pipeline)
-opsm-cli *args:
-    deno task opsm -- {{args}}
-
 # Run OPSM Elixir in dev mode with IEx
 repl:
     cd opsm_ex && iex -S mix
@@ -169,7 +148,6 @@ deps-ex:
 
 # Install all dependencies
 deps: deps-ex
-    @echo "Deno deps auto-resolved via import maps"
 
 # Audit Elixir dependencies
 deps-audit:
@@ -220,13 +198,11 @@ ci: deps build test lint fmt-check
 loc:
     @echo "=== OPSM Lines of Code ==="
     @echo -n "Elixir: " && find opsm_ex/lib -name "*.ex" | xargs wc -l 2>/dev/null | tail -1
-    @echo -n "ReScript: " && find cli -name "*.res" | xargs wc -l 2>/dev/null | tail -1
     @echo -n "Rust (services): " && find services -name "*.rs" | xargs wc -l 2>/dev/null | tail -1
-    @echo -n "Rust (mobile): " && find opsm_mobile -name "*.rs" | xargs wc -l 2>/dev/null | tail -1
 
 # Show TODO comments
 todos:
-    @grep -rn "TODO\|FIXME" --include="*.ex" --include="*.res" --include="*.rs" . 2>/dev/null | grep -v node_modules | grep -v _build | grep -v target || echo "No TODOs"
+    @grep -rn "TODO\|FIXME" --include="*.ex" --include="*.rs" . 2>/dev/null | grep -v node_modules | grep -v _build | grep -v target || echo "No TODOs"
 
 # Show git status
 status:
@@ -247,7 +223,7 @@ doctor:
     @command -v just >/dev/null 2>&1 && echo "  [OK] just" || echo "  [FAIL] just not found"
     @command -v git >/dev/null 2>&1 && echo "  [OK] git" || echo "  [FAIL] git not found"
     @echo "Checking for hardcoded paths..."
-    @grep -rn '$HOME\|$ECLIPSE_DIR' --include='*.rs' --include='*.ex' --include='*.res' --include='*.gleam' --include='*.sh' . 2>/dev/null | head -5 || echo "  [OK] No hardcoded paths"
+    @grep -rn '$HOME\|$ECLIPSE_DIR' --include='*.rs' --include='*.ex' --include='*.gleam' --include='*.sh' . 2>/dev/null | head -5 || echo "  [OK] No hardcoded paths"
     @echo "Diagnostics complete."
 
 # Auto-repair common issues