The README makes claims. This file backs them up with architecture detail, code paths, and honest caveats sufficient for an external reviewer to trace what each bot does and how its work is gated.
Bot fleet for repository quality enforcement across the Hyperpolymath ecosystem.
The fleet operates through a three-stage pipeline:
hypatia (scanner) → findings JSONL → fleet-coordinator.sh → dispatch-runner.sh
↓
┌──────────┼──────────┐
▼ ▼ ▼
rhodibot echidnabot sustainabot
(git ops) (quality) (deps)
↓
robot-repo-automaton
(scan → fix → commit → PR)fleet-coordinator.sh (root, 27K) is the execution layer. It reads findings
JSONL from shared-context/findings/, determines the confidence tier for
each finding, and dispatches accordingly. High-confidence patterns go to
dispatch-runner.sh for automatic fix; lower-confidence patterns go to
process-review-findings.sh for GitHub issue creation.
The confidence thresholds that gate automated action are:
| Tier | Threshold | Action |
|---|---|---|
Eliminate |
|
Direct fix applied, committed, no review gate |
Substitute |
|
Proven module replacement proposed; requires human review |
Control |
|
Human review required; issue created, no auto-change |
The confidence.rs module in robot-repo-automaton/src/ computes these
scores. The design means the fleet will never auto-apply a fix it is less
than 95% certain about.
bots/rhodibot/src/main.rs starts an Axum HTTP server on port 3000. GitHub
sends webhook events; webhook.rs verifies the HMAC-SHA256 signature before
dispatching. rsr.rs encodes the RSR (Rhodium Standard Repository) policy
packs — Minimal / Standard / Strict / Enterprise / Custom — each with
Required, Recommended, and Optional severity tiers. A check that is
Required in the Strict pack blocks merge; the same check as Recommended
in Standard only influences the score.
The safety triangle is only as good as the confidence scores in
confidence.rs. The scores are heuristic (pattern-matching-based), not
formally verified. High-confidence fixes (>=0.95) can still be wrong if the
pattern detector misfires. The robot-repo-automaton creates pull requests
for review-tier findings rather than pushing directly to main, but the
Eliminate tier applies fixes immediately. Any reviewer auditing this should
inspect the pattern catalog in robot-repo-automaton/src/catalog.rs before
trusting an automated fix.
Each bot specializes in a specific aspect of repository health and compliance. Six bots, six domains.
Each bot is a separate Rust binary in bots/. They share the shared-context/
Rust crate for inter-bot communication (findings JSONL, session metadata, fix
batches, learning state).
| Bot | Specialisation | Implementation |
|---|---|---|
rhodibot |
RSR structural compliance: required files, workflows, SPDX headers, directory layout. Runs as a GitHub App (webhook listener + Axum server). Policy packs allow per-repo tuning. |
|
echidnabot |
Formal proof CI: verifies Coq/Lean/Agda/Isabelle proofs on every push. Bridges code forges to the ECHIDNA theorem proving platform. Also runs security fuzzing as a secondary function. |
|
sustainabot |
Ecological + economic + quality analysis. Computes a multi-dimensional Health Index covering energy heuristics, cost signals, and maintainability. Outputs SARIF for toolchain integration. |
|
glambot |
Presentation quality: visual polish, WCAG accessibility, SEO, machine readability for AI/bots. Checks alt text, heading hierarchy, colour contrast, Open Graph metadata. |
|
seambot |
Integration health: cross-component communication, API contracts, end-to-end flows. Verifies that advertised integrations are actually wired. |
|
finishingbot |
Release readiness: placeholder removal, license validation, claim verification, execution testing. Gates the path from draft to publishable. |
|
Additional bots present in bots/: accessibilitybot, cipherbot, panicbot
(pre-commit gate wrapping panic-attacker), gsbot (game-server integration),
the-hotchocolabot (onboarding/warmth checks).
| Technology | Role in Gitbot Fleet | Also Used In |
|---|---|---|
Rust (rhodibot, echidnabot, sustainabot, shared-context, robot-repo-automaton) |
Primary implementation language for all bots |
protocol-squisher, verisim, ephapax, Stapeln FFI |
Hypatia |
External scanner whose JSONL findings feed fleet-coordinator.sh |
Every RSR repo in the account; gitbot-fleet is a primary consumer |
Axum |
HTTP server for GitHub App webhook handlers (rhodibot, echidnabot) |
Shared pattern with burble, boj-server |
Bash ( |
Execution glue; |
infrastructure-automation, git-scripts |
ECHIDNA (proof verification platform) |
echidnabot’s backend prover |
|
robot-repo-automaton |
Rust CLI: scan → detect → fix → PR (lives inside this repo) |
Shared by all bots for automated fix application |
Stapeln containers |
|
All containerised services in the account |
Contractile.just |
|
Universal across hyperpolymath repos |
jq |
All JSON construction in shell scripts uses jq (never string interpolation) |
git-scripts, infrastructure-automation |
| Path | What It Proves |
|---|---|
|
27K Bash entry point. Reads |
|
24K Bash launcher for running the full fleet in sequence or parallel.
Wraps |
|
|
|
Full Rust workspace. |
|
Modular Rust workspace. CLI → static analysis engine → metrics/scoring → SARIF output → policy integration. Health Index computation lives in the metrics module. |
|
Accessibility and presentation checks. WCAG contrast, alt text, heading hierarchy, Open Graph, machine-readability for AI indexers. |
|
Integration health checks. Verifies API contracts and end-to-end wiring. |
|
Release gate: placeholder scanning, license validation, execution tests. |
|
|
|
Rust crate providing inter-bot communication primitives: findings JSONL schema, session metadata, fix batches, learning state, deployment status. All bots import this crate. |
|
Live JSONL findings from the most recent Hypatia scan. Fleet-coordinator reads this directory. |
|
Accumulated pattern data used to refine confidence scores over time. |
|
Batch-mode campaign definitions for scanning entire repo subsets at once. |
|
Completion dashboard and fleet status views. |
|
Git hooks installed into repos by the fleet to enforce pre-commit checks. |
|
|
|
Deployment manifests and container launch configs. |
|
Scheduled task definitions. |
|
Integration tests for the fleet coordinator and individual bots. |
|
A2ML checkpoint files. Canonical AI session state. |
|
Hypatia rule overrides and scan configuration. |
|
Visual architecture map with completion dashboard. Start here for the big-picture relationship between bots. |
|
Operational runbook for running the fleet in production. |
|
Record of where each bot has been run against the hyperpolymath estate and what patterns it found. |