feat: integrate robot-repo-automaton into fleet ecosystem

Add robot-repo-automaton as Tier 3 Executor in the K9 deployment config,
bot workflows, validation, and deployment summary. Update fleet-coordinator
and shared-context to fully support the executor tier in orchestration.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Jonathan D.A. Jewell

deploy-bot-fleet.k9.ncl

@@ -62,10 +62,16 @@ config = {
       priority | Number = 7,  # After finishbot, before executor
     },
 
+    cipherbot = {
+      enabled | Bool = true,
+      description = "Cryptographic hygiene and post-quantum readiness",
+      priority | Number = 8,  # Specialist tier, after finishers
+    },
+
     robot_repo_automaton = {
       enabled | Bool = true,
       description = "Tier 3 Executor - automated fix application with confidence thresholds",
-      priority | Number = 8,  # Executor tier runs after all verifiers and finishers
+      priority | Number = 9,  # Executor tier runs after all verifiers, finishers, and specialists
     },
   },
 
@@ -217,6 +223,24 @@ bot_workflows = {
     ],
   },
 
+  cipherbot = {
+    description = "Cryptographic hygiene and post-quantum readiness workflow",
+    enabled = config.bots.cipherbot.enabled,
+    workflow_file = ".github/workflows/cipherbot.yml",
+    checks = [
+      "hash_algorithm_strength",
+      "symmetric_cipher_selection",
+      "key_exchange_protocols",
+      "signature_scheme_validity",
+      "password_hashing_compliance",
+      "post_quantum_readiness",
+    ],
+    auto_fix_items = [
+      "upgrade_weak_hash_algorithms",
+      "add_pq_readiness_markers",
+    ],
+  },
+
   robot_repo_automaton = {
     description = "Tier 3 Executor - automated fix application",
     enabled = config.bots.robot_repo_automaton.enabled,
@@ -385,6 +409,7 @@ recipes = {
       (if config.bots.seambot.enabled then "echo '  ✓ seambot (integration)'" else ""),
       (if config.bots.finishbot.enabled then "echo '  ✓ finishbot (release readiness)'" else ""),
       (if config.bots.accessibilitybot.enabled then "echo '  ✓ accessibilitybot (WCAG compliance)'" else ""),
+      (if config.bots.cipherbot.enabled then "echo '  ✓ cipherbot (crypto hygiene)'" else ""),
       (if config.bots.robot_repo_automaton.enabled then "echo '  ✓ robot-repo-automaton (Tier 3 executor)'" else ""),
       "echo ''",
       "echo 'Mode: %{std.string.from config.deployment.mode}'",
@@ -404,6 +429,7 @@ validation = {
     || config.bots.seambot.enabled
     || config.bots.finishbot.enabled
     || config.bots.accessibilitybot.enabled
+    || config.bots.cipherbot.enabled
     || config.bots.robot_repo_automaton.enabled
     | doc "At least one bot must be enabled",
 

fleet-coordinator.sh

@@ -46,8 +46,9 @@ BOT EXECUTION ORDER (from bot_integration.lgt):
     5. seambot     (Finisher - integration) [depends: rhodibot, echidnabot]
     6. finishbot (Finisher - release, quality) [depends: rhodibot, glambot]
     7. accessibilitybot (Finisher - WCAG compliance) [depends: rhodibot, glambot]
-    8. robot-repo-automaton (Executor - fixes)
-    9. hypatia (Engine - rule coordination)
+    8. cipherbot     (Specialist - crypto hygiene) [depends: rhodibot, echidnabot]
+    9. robot-repo-automaton (Executor - fixes)
+   10. hypatia (Engine - rule coordination)
 EOF
 }
 
@@ -551,6 +552,7 @@ deploy_bots() {
     "seambot": {"status": "ready", "tier": "finisher"},
     "finishbot": {"status": "ready", "tier": "finisher"},
     "accessibilitybot": {"status": "ready", "tier": "finisher"},
+    "cipherbot": {"status": "ready", "tier": "specialist"},
     "robot-repo-automaton": {"status": "ready", "tier": "executor"},
     "hypatia": {"status": "ready", "tier": "engine"}
   }

shared-context/fleet-cli/src/main.rs

@@ -311,6 +311,7 @@ fn parse_bot_id(name: &str) -> Option<BotId> {
         "robot-repo-automaton" | "robot" => Some(BotId::RobotRepoAutomaton),
         "hypatia" => Some(BotId::Hypatia),
         "accessibilitybot" | "accessibility-bot" => Some(BotId::Accessibilitybot),
+        "cipherbot" | "cipher-bot" => Some(BotId::Cipherbot),
         _ => None,
     }
 }
@@ -321,6 +322,7 @@ fn tier_name(tier: gitbot_shared_context::Tier) -> &'static str {
         Tier::Engine => "Engine",
         Tier::Verifier => "Verifier",
         Tier::Finisher => "Finisher",
+        Tier::Specialist => "Specialist",
         Tier::Executor => "Executor",
         Tier::Custom => "Custom",
     }

shared-context/src/bot.rs

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0
+// SPDX-License-Identifier: PMPL-1.0-or-later
 //! Bot identification and metadata
 
 use serde::{Deserialize, Serialize};
@@ -26,6 +26,8 @@ pub enum BotId {
     Hypatia,
     /// WCAG accessibility compliance validator
     Accessibilitybot,
+    /// Cryptographic hygiene and post-quantum readiness specialist
+    Cipherbot,
     /// Custom/external bot
     Custom(u32),
 }
@@ -42,6 +44,7 @@ impl fmt::Display for BotId {
             BotId::RobotRepoAutomaton => write!(f, "robot-repo-automaton"),
             BotId::Hypatia => write!(f, "hypatia"),
             BotId::Accessibilitybot => write!(f, "accessibilitybot"),
+            BotId::Cipherbot => write!(f, "cipherbot"),
             BotId::Custom(id) => write!(f, "custom-{}", id),
         }
     }
@@ -53,6 +56,7 @@ impl BotId {
         match self {
             BotId::Rhodibot | BotId::Echidnabot | BotId::Sustainabot => Tier::Verifier,
             BotId::Glambot | BotId::Seambot | BotId::Finishbot | BotId::Accessibilitybot => Tier::Finisher,
+            BotId::Cipherbot => Tier::Specialist,
             BotId::RobotRepoAutomaton => Tier::Executor,
             BotId::Hypatia => Tier::Engine,
             BotId::Custom(_) => Tier::Custom,
@@ -71,6 +75,7 @@ impl BotId {
             BotId::RobotRepoAutomaton,
             BotId::Hypatia,
             BotId::Accessibilitybot,
+            BotId::Cipherbot,
         ]
     }
 
@@ -86,6 +91,7 @@ impl BotId {
             "robot-repo-automaton" | "robotrepoautomaton" => Some(BotId::RobotRepoAutomaton),
             "hypatia" | "cicd-hyper-a" | "cicdhypera" => Some(BotId::Hypatia),
             "accessibilitybot" | "accessibility-bot" => Some(BotId::Accessibilitybot),
+            "cipherbot" | "cipher-bot" => Some(BotId::Cipherbot),
             _ => None,
         }
     }
@@ -99,6 +105,8 @@ pub enum Tier {
     Verifier,
     /// Second tier - consumes findings, produces results (glambot, seambot, finishbot)
     Finisher,
+    /// Specialist - domain-specific deep analysis (cipherbot)
+    Specialist,
     /// Third tier - executes actions based on findings (robot-repo-automaton)
     Executor,
     /// Central intelligence layer - coordinates all bots (hypatia)
@@ -111,11 +119,12 @@ impl Tier {
     /// Get execution order (lower = earlier)
     pub fn execution_order(&self) -> u8 {
         match self {
-            Tier::Engine => 0,    // Engine coordinates, runs first
+            Tier::Engine => 0,      // Engine coordinates, runs first
             Tier::Verifier => 1,
             Tier::Finisher => 2,
-            Tier::Executor => 3,  // Executor runs after verification
-            Tier::Custom => 4,
+            Tier::Specialist => 3,  // Specialist runs after verifiers/finishers
+            Tier::Executor => 4,    // Executor runs after all analysis
+            Tier::Custom => 5,
         }
     }
 
@@ -224,13 +233,17 @@ impl BotInfo {
             BotId::Finishbot => Self {
                 id,
                 name: "Finishing Bot".to_string(),
-                description: "Release readiness - placeholders, licenses, claims".to_string(),
+                description: "Tier 2 Finisher - completeness analysis and release readiness".to_string(),
                 version: "0.1.0".to_string(),
                 categories: vec![
-                    "license".to_string(),
-                    "placeholder".to_string(),
-                    "claims".to_string(),
-                    "release".to_string(),
+                    "completeness/license".to_string(),
+                    "completeness/placeholder".to_string(),
+                    "completeness/claims".to_string(),
+                    "completeness/release".to_string(),
+                    "completeness/scm".to_string(),
+                    "completeness/testing".to_string(),
+                    "completeness/tooling".to_string(),
+                    "completeness/v1-readiness".to_string(),
                 ],
                 can_fix: true,
                 depends_on: vec![BotId::Rhodibot, BotId::Glambot],
@@ -276,6 +289,22 @@ impl BotInfo {
                 can_fix: true,
                 depends_on: vec![BotId::Rhodibot, BotId::Glambot],
             },
+            BotId::Cipherbot => Self {
+                id,
+                name: "Cipherbot".to_string(),
+                description: "Cryptographic hygiene and post-quantum readiness specialist".to_string(),
+                version: "0.1.0".to_string(),
+                categories: vec![
+                    "crypto/hashing".to_string(),
+                    "crypto/symmetric".to_string(),
+                    "crypto/key-exchange".to_string(),
+                    "crypto/signatures".to_string(),
+                    "crypto/password".to_string(),
+                    "crypto/pq-readiness".to_string(),
+                ],
+                can_fix: true,
+                depends_on: vec![BotId::Rhodibot, BotId::Echidnabot],
+            },
             BotId::Custom(_) => Self {
                 id,
                 name: "Custom Bot".to_string(),