feat(ponsbot): phase 0 of the scanner cutover (adapter, panicbot parity fixes, owner rulings)

.github/workflows/rust.yml

@@ -49,6 +49,10 @@ jobs:
           # in CI, so its private PA numbering went unnoticed until 2026-11-04.
           - module: panicbot
             dir: bots/panicbot
+          # ponsbot: the pons adapter (cutover design phase 0); tested here with
+          # a stub pons, the real-binary test runs when PONSBOT_REAL_PONS is set.
+          - module: ponsbot
+            dir: bots/ponsbot
           - module: idris-dependents
             dir: idris-dependents
     defaults:

bots/panicbot/canon/pin.toml

@@ -14,3 +14,22 @@ path = "data/canonical-rule-ids.json"
 commit = "5175a681f9a0c82313f06e3c2cba8089f4ecfb6b"
 pinned = "2026-11-04"
 sha256 = "28ffe510535e0bc6cccc92845411d6496fe9270cce58364f4d3507c5c08337d4"
+
+# The panic-attack BUILD commit (design section 5: this file becomes the single
+# panic-attack pin). Value and provenance, not invented: it is the commit the
+# standards Hypatia lane runs, `panic-ref`'s default in metadatastician/standards
+# `.github/workflows/hypatia-scan-reusable.yml` and `PANIC_ATTACK_SHA` in its
+# `fork-governance.yml` (standards main f0b3cd4, 2026-11-12).
+#
+# NOT YET CONSUMED: the workflows still carry their own copies, and they
+# disagree. Alignment is a later phase, decided by the owner:
+#   - gitbot-fleet `.github/workflows/fleet-report-back-reusable.yml`:
+#     b689a74d2762a1c19839ae3fbd59b7fe5ef920ea (2026-10-08, older; its comment
+#     claims it is kept equal to the Hypatia lane's pin, it is not)
+#   - standards `.github/workflows/deep-recon-reusable.yml` `panic-rev`:
+#     b5530834a839734d1d181bfe6edb0d43d4233cf4 (2026-10-25)
+# The rule-ID table above was taken at 5175a681 and is a separate pin.
+[build]
+repo = "hyperpolymath/panic-attack"
+commit = "410a8f821ea8297833162565b50a298f787815da"
+pinned = "2026-11-12"

bots/panicbot/src/cli.rs

@@ -2,7 +2,7 @@
 //! CLI Interface — clap-based command-line argument parsing for panicbot.
 //!
 //! Subcommands:
-//! - `scan <dir>` — Run panic-attack assail and translate findings
+//! - `scan <dir>` — Run the allowed panic-attack suite and translate findings
 //! - `fleet <dir>` — Run as a gitbot-fleet member
 //! - `report <dir>` — Generate A2ML debt register
 
@@ -49,11 +49,24 @@ pub enum OutputFormat {
 /// Available subcommands.
 #[derive(Subcommand, Debug)]
 pub enum Command {
-    /// Run panic-attack assail on a directory and translate findings.
+    /// Run the allowed panic-attack suite on a directory and translate findings.
+    ///
+    /// Full suite by default; the repository's bot directives can narrow it.
+    /// Exits 3 if any part failed (findings of the parts that ran are still
+    /// printed) and 4 if no part analysed anything.
     Scan {
         /// Directory or binary to scan.
         #[arg(default_value = ".")]
         dir: PathBuf,
+
+        /// A built executable inside DIR for the dynamic modes (assault, ambush).
+        /// They EXECUTE it. Without it they report not_applicable.
+        #[arg(long)]
+        target: Option<PathBuf>,
+
+        /// Wall-clock budget for the whole suite, in seconds (default 240).
+        #[arg(long)]
+        budget_seconds: Option<u64>,
     },
 
     /// Run as a gitbot-fleet member.
@@ -65,6 +78,10 @@ pub enum Command {
         /// Bot operating mode (advisor, auditor, guardian).
         #[arg(short, long, default_value = "advisor")]
         mode: String,
+
+        /// A built executable inside DIR for the dynamic modes. They EXECUTE it.
+        #[arg(long)]
+        target: Option<PathBuf>,
     },
 
     /// Generate A2ML debt register for a directory.