chore(runtime): purge python and deno tooling; bun validator + ban check

[hyperpolymath]

Summary

Removes the remaining python and deno tooling from echidna, and makes the banned-runtime check actually enforce what it claims. The eclexiaiser manifest check moves from a python3 tomllib heredoc to a tested bun script. scripts/ban-npm.sh said deno was banned but never checked for it; it now does, under 5 planted-fixture tests.

📌 New pins

• Head SHA: 1b2561e
• oven-sh/setup-bun@v2.2.0 → 0c5077e51419868618aeaa5fe8019c62421857d6: a new actions.lock entry, plus a workflow entry under dogfood-gate.yml. It is the same SHA standards already vets. The lock diff against main is additive only.
• bun 1.3.14 via bun-version:, matching mise.lock.

Changes

• dogfood-gate.yml / eclexiaiser job: the python heredoc is replaced by bun scripts/validate-eclexiaiser.js, with the same four rejection messages plus a parse-error case.
• dogfood-gate.yml: a new Banned-runtime check job runs bun test scripts/ and bash scripts/ban-npm.sh. It is added to the summary job's needs:.
• scripts/ban-npm.sh: now fails on any deno.json, deno.jsonc or deno.lock. The Deno bare-import warning (which scanned a nonexistent src/provers/) and the "Deno approved" text are gone.
• hooks/pre-commit (the core.hooksPath hook): runs ban-npm.sh before the just check, so it runs even when just is missing.
• Deleted:
  • .github/hooks/pre-commit: unreferenced; it ran deno lint/check on a path that does not exist.
  • .pre-commit-config.yaml: needs the Python pre-commit framework; hooks/ is the canonical hook set.
  • scripts/build-production.sh: builds the nonexistent src/rescript via node_modules and python3 -m http.server; referenced nowhere.
• NOTICE: the deno.json dependency line is replaced by the bun scripts line.

RSR Quality Checklist

Required

• Tests pass: bun test scripts/ → 12 pass, 0 fail. No Rust code changed, so cargo test is not affected.
• Code is formatted. The new JS follows the repo's existing style; there is no JS formatter configured.
• Linter is clean. actionlint dogfood-gate.yml reports only the pre-existing SC2129/SC2295 findings, identical to main.
• No banned language patterns: this PR removes python, deno and ReScript tooling. (The template text "no npm/bun" predates the estate bun doctrine; bun is the estate runtime.)
• No unsafe blocks: no Rust touched.
• No banned functions.
• SPDX headers on all new files (MPL-2.0).
• No secrets, credentials or .env files.

As Applicable

• Repo deed status/maturity: not applicable, project state unchanged.
• Repo deed ecosystem: not applicable, no integration changed.
• Deed meta / docs/decisions/: not applicable, not an architectural decision.
• ROADMAP.adoc: not applicable.
• Documentation: not applicable beyond the NOTICE line above.
• TOPOLOGY.md: not applicable.
• CHANGELOG: not applicable to a tooling-only change.
• New dependencies reviewed: oven-sh/setup-bun is MIT, CI-only, and not distributed.
• ABI/FFI: not applicable, untouched.

Testing

• TDD. scripts/validate-eclexiaiser.test.js (7 tests) and scripts/ban-npm.test.js (5 tests) were each run RED before the implementation existed. The three deno cases failed before the check was added. Both now give 12 pass / 0 fail.
• CLI. bun scripts/validate-eclexiaiser.js eclexiaiser.toml exits 0 on the repo manifest and 1 on a broken one.
• Lock. gh actions-lock --no-fix --verify --json=valid,findings reports valid: true, 0 errors, and 1 warning (cicd-suite@4c772eb sha-as-ref, from ci: pin cicd-suite, dtolnay/rust-toolchain and the Hypatia clone (#401) #410; cicd-suite has no tags).
  • The lock was regenerated in a scratch copy with --no-narrow --no-migrate-local-actions --no-interactive. Write mode was never run in the repo.
  • Planted control: corrupting the setup-bun commit by one hex digit reports unreachable-pin.
• Python check. grep -c python dogfood-gate.yml gives 0.

Out of scope, recorded as findings rather than changed here: echidna-playground/src/PlaygroundServer.affine still drives deno serve/deno task.

🤖 Generated with Claude Code

https://claude.ai/code/session_01P48P9ErT8UFFeDUfEQiYV7

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 7efbc88e-f7f4-422a-9569-c5a9cdee6641

📥 Commits

Reviewing files that changed from the base of the PR and between c28d09a and 1b2561e.

⛔ Files ignored due to path filters (1)

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (10)

• .github/hooks/pre-commit
• .github/workflows/dogfood-gate.yml
• .pre-commit-config.yaml
• NOTICE
• hooks/pre-commit
• scripts/ban-npm.sh
• scripts/ban-npm.test.js
• scripts/build-production.sh
• scripts/validate-eclexiaiser.js
• scripts/validate-eclexiaiser.test.js

 ______________________________
< torvalds@linux:~$ git review >
 ------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Add Carrot credits or activate Agent usage billing to use Autopilot