fix!: restore gitbot-fleet from mass-deletion + permanent integrity guard

main had been silently gutted from 1777 files to 2 by a squash-merge
from a near-empty base (the post-#126/#128/#141/#142 sequence). The
loss went unrepaired for months and broke hypatia's Phase-2 learning
submission estate-wide: scripts/submit-finding.sh — the findings sink
hypatia-scan.yml execs in every consuming repo — no longer existed,
exit-127ing the security gate for any repo with >=1 finding.

This restores the full repo to last-good tree 9b0a29e (the last
first-parent commit on main before the deletion: all bots, scripts/,
shared-context/, dashboard, docs, robot-repo-automaton/, etc.),
preserving the only two legitimate post-deletion improvements:

  * .github/workflows/secret-scanner.yml — kept current main (#141:
    step-level Cargo.toml gate).
  * .github/workflows/hypatia-scan.yml — replaced with the canonical
    post-hypatia#252 hardened workflow (Layer-1: Phase-2 step is
    continue-on-error + self-healing, so a future fleet-side hiccup
    can never again hard-fail the gate).

scripts/submit-finding.sh is the already-hardened version (input
validation, JSON-shape normalisation, best-effort push with
::warning::, repository_dispatch intake) — restored verbatim, mode
0755.

"Forever" guard: .github/workflows/repo-integrity-guard.yml fails any
push/PR to main that (a) deletes >50 tracked files vs base without an
explicit [mass-delete-ok] marker, or (b) drops a critical path
(scripts/submit-finding.sh, run-fleet.sh, fleet-coordinator.sh,
README.adoc). A stale-base squash can no longer silently nuke main.

Refs hyperpolymath/hypatia#252

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.claude/CLAUDE.md

@@ -0,0 +1,69 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+
+# CLAUDE.md - Gitbot Fleet
+
+## Project Overview
+
+Gitbot Fleet is the bot orchestration hub for automated repository quality enforcement across 500+ hyperpolymath repositories. It coordinates multiple bots through a shared-context system with safety-triangle-aware routing.
+
+## Architecture
+
+```
+hypatia (scanner)  →  findings JSONL  →  fleet-coordinator.sh  →  dispatch-runner.sh
+                                               ↓
+                                    ┌──────────┼──────────┐
+                                    ▼          ▼          ▼
+                               rhodibot   echidnabot  sustainabot
+                               (git ops)  (quality)   (deps)
+                                    ↓
+                        robot-repo-automaton
+                        (scan → fix → commit → PR)
+```
+
+## Key Components
+
+| Component | Location | Purpose |
+|-----------|----------|---------|
+| fleet-coordinator.sh | root | Orchestrates bot dispatching |
+| dispatch-runner.sh | scripts/ | Reads JSONL manifests, executes fixes |
+| process-review-findings.sh | scripts/ | Creates GitHub issues for review-tier |
+| fix-*.sh | scripts/ | 7 fix scripts for eliminate-tier patterns |
+| shared-context/ | shared-context/ | Rust crate for inter-bot communication |
+| robot-repo-automaton/ | robot-repo-automaton/ | Rust CLI: scan, fix, PR creation |
+
+## Build & Run
+
+```bash
+# Shell scripts (no build needed)
+bash fleet-coordinator.sh --help
+
+# Robot-repo-automaton (Rust)
+cd robot-repo-automaton
+OPENSSL_NO_VENDOR=1 cargo build --release
+./target/release/robot-repo-automaton scan /path/to/repo
+./target/release/robot-repo-automaton fix /path/to/repo --create-pr
+```
+
+## Safety Triangle
+
+```
+Eliminate (auto_execute >= 0.95)  →  Direct fix, no review
+Substitute (review >= 0.85)      →  proven module replacement, needs review
+Control (report < 0.85)          →  Human review required
+```
+
+## Code Style
+
+- SPDX headers: `PMPL-1.0-or-later`
+- Author: Jonathan D.A. Jewell <jonathan.jewell@open.ac.uk>
+- Shell scripts: bash with `set -euo pipefail`
+- Rust: standard formatting, `anyhow::Result` for error handling
+- JSON construction in shell: always use `jq` (never string interpolation)
+
+## Critical Invariants
+
+1. SCM files ONLY in `.machine_readable/6scm/` (never root)
+2. All shell scripts must validate untrusted input before use
+3. No hardcoded secrets — use env vars with `${VAR:-}` defaults
+4. Fix scripts must be idempotent (safe to run multiple times)
+5. Confidence thresholds gate all automated actions

.dockerignore

@@ -0,0 +1,44 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+
+# Git
+.git
+.gitignore
+.gitattributes
+
+# Build artifacts
+target/
+**/*.rs.bk
+*.pdb
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# Documentation
+*.md
+!README.md
+docs/
+
+# CI/CD
+.github/
+.gitlab-ci.yml
+
+# Testing
+tests/
+test-repo/
+
+# Development
+.env
+.env.local
+*.log
+
+# System
+.DS_Store
+Thumbs.db
+
+# Deployment (not needed in image)
+deploy/
+docker-compose.yml

.editorconfig

@@ -0,0 +1,24 @@
+# SPDX-License-Identifier: MPL-2.0
+# SPDX-FileCopyrightText: 2025 hyperpolymath
+
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.rs]
+indent_size = 4
+
+[*.scm]
+indent_size = 2
+
+[Makefile]
+indent_style = tab
+
+[*.md]
+trim_trailing_whitespace = false

.gitattributes

@@ -0,0 +1,54 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# RSR-compliant .gitattributes
+
+* text=auto eol=lf
+
+# Source
+*.rs    text eol=lf diff=rust
+*.ex    text eol=lf diff=elixir
+*.exs   text eol=lf diff=elixir
+*.jl    text eol=lf
+*.res   text eol=lf
+*.resi  text eol=lf
+*.ada   text eol=lf diff=ada
+*.adb   text eol=lf diff=ada
+*.ads   text eol=lf diff=ada
+*.hs    text eol=lf
+*.chpl  text eol=lf
+*.scm   text eol=lf
+*.ncl   text eol=lf
+*.nix   text eol=lf
+
+# Docs
+*.md    text eol=lf diff=markdown
+*.adoc  text eol=lf
+*.txt   text eol=lf
+
+# Data
+*.json  text eol=lf
+*.yaml  text eol=lf
+*.yml   text eol=lf
+*.toml  text eol=lf
+
+# Config
+.gitignore     text eol=lf
+.gitattributes text eol=lf
+justfile       text eol=lf
+Makefile       text eol=lf
+Containerfile  text eol=lf
+
+# Scripts
+*.sh   text eol=lf
+
+# Binary
+*.png   binary
+*.jpg   binary
+*.gif   binary
+*.pdf   binary
+*.woff2 binary
+*.zip   binary
+*.gz    binary
+
+# Lock files
+Cargo.lock  text eol=lf -diff
+flake.lock  text eol=lf -diff

.github/CODEOWNERS

@@ -0,0 +1,26 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath)
+#
+# CODEOWNERS — gitbot-fleet
+
+# Default owner for all files
+* @hyperpolymath
+
+# Core orchestration (security-critical — taint flow validated)
+/fleet-coordinator.sh @hyperpolymath
+/scripts/ @hyperpolymath
+
+# Rust executors
+/robot-repo-automaton/ @hyperpolymath
+/shared-context/ @hyperpolymath
+
+# Bot implementations
+/bots/ @hyperpolymath
+
+# Security-sensitive
+/.github/workflows/ @hyperpolymath
+/.well-known/ @hyperpolymath
+/SECURITY.md @hyperpolymath
+
+# Machine-readable metadata
+/.machine_readable/ @hyperpolymath

.github/dependabot.yml

@@ -0,0 +1,73 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      actions:
+        patterns:
+          - "*"
+
+  # Rust dependencies
+  - package-ecosystem: "cargo"
+    directory: "/robot-repo-automaton"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "cargo"
+    directory: "/shared-context"
+    schedule:
+      interval: "weekly"
+  
+  - package-ecosystem: "cargo"
+    directory: "/bots/echidnabot"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "cargo"
+    directory: "/bots/glambot"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "cargo"
+    directory: "/bots/rhodibot"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "cargo"
+    directory: "/bots/seambot"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "cargo"
+    directory: "/bots/sustainabot"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "cargo"
+    directory: "/bots/finishingbot"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "cargo"
+    directory: "/bots/accessibilitybot"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "cargo"
+    directory: "/bots/cipherbot"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "cargo"
+    directory: "/bots/panicbot"
+    schedule:
+      interval: "weekly"
+
+  # Python dependencies for gsbot
+  - package-ecosystem: "pip"
+    directory: "/bots/gsbot"
+    schedule:
+      interval: "weekly"

.github/workflows/boj-build.yml

@@ -0,0 +1,19 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+name: BoJ Server Build Trigger
+on:
+  push:
+    branches: [main, master]
+  workflow_dispatch:
+jobs:
+  trigger-boj:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Trigger BoJ Server (Casket/ssg-mcp)
+        run: |
+          # Send a secure trigger to boj-server to build this repository
+          curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke"             -H "Content-Type: application/json"             -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"}
+        continue-on-error: true
+permissions:
+  contents: read