human-to-code 0.1.4 → 0.1.5

package/docs/roadmap/swift.md

@@ -0,0 +1,43 @@
+# Swift support plan
+
+## Status today
+Level 2 only: not in `LANGUAGE_PROFILES`; `.swift` not scanned for markers.
+
+## Target profile
+- `Ecosystem`: `swift`.
+- Variants: `spm-package` (Package.swift) first. Xcode-project apps
+  (`.xcodeproj`/`.xcworkspace`) are explicitly **out of scope** initially —
+  pbxproj is too dynamic to analyze honestly; declare `UNSUPPORTED`.
+- Versions: Swift ≥ 5.9 (from `// swift-tools-version:` header).
+
+## Detection signals (static only)
+- `Package.swift` tools-version comment line (parsed textually — the
+  manifest itself is Swift code and must never be evaluated), `Package.resolved`,
+  `Sources/`, `Tests/` layout.
+
+## Version evidence
+`Package.resolved` pins exact dependency versions; targets/products read
+only from conservative literal parsing of `Package.swift`, refusing
+computed manifests with `NEEDS_INPUT`.
+
+## Validation plan
+- `["swift", "build"]`, `["swift", "test"]` in a Swift toolchain image
+  (Linux). Apple-platform-only packages (UIKit imports) are `INCONCLUSIVE`
+  on a Linux sandbox — say so rather than skipping silently.
+
+## Skill pack
+Target/directory correspondence, XCTest conventions, access-control
+(`public`/`internal`) discipline for library targets, `Package.resolved`
+protected.
+
+## Risks & gates
+Manifest edits (executable code), macros/plugins (arbitrary build-time
+code), and `@objc`/C interop are elevated-risk.
+
+## Checklist
+0. Add `swift` to `LANGUAGE_PROFILES` (`.swift`) and scan `.swift` for `// @human`.
+1. `Ecosystem` union + `analysis/adapters/swift.ts`.
+2. `swift/spm-package` at `preview`; Xcode variants declared unsupported.
+3. Register adapter; Swift skill pack.
+4. Tests: computed manifests refused, platform-gated packages, resolved-file absence, stable fingerprints.
+5. Docs updates.

package/docs/roadmap/terraform.md

@@ -0,0 +1,47 @@
+# Terraform / HCL support plan
+
+## Status today
+Level 2 only: not in `LANGUAGE_PROFILES`; `.tf` not scanned for markers
+(`# @human` comment form would parse; extension isn't scanned).
+
+## Target profile
+- `Ecosystem`: `terraform`.
+- Variants: `root-module` (has backend/provider config) and `child-module`
+  (reusable module without backend). Workspaces with multiple root modules
+  need explicit targeting → `NEEDS_INPUT`, mirroring the multi-app rule.
+- Versions: `required_version` and `required_providers` blocks.
+
+## Detection signals (static only)
+- `*.tf`/`*.tf.json`, `.terraform.lock.hcl`, `terraform.tfvars`,
+  `backend`/`provider` blocks (textual HCL parsing, conservative),
+  `modules/` layout.
+
+## Version evidence
+`.terraform.lock.hcl` pins exact provider versions with hashes — first-class
+grounding evidence. Module registry sources with versions count; git-ref
+module sources without a pinned rev are unproven.
+
+## Validation plan
+- `["terraform", "fmt", "-check"]` and `["terraform", "validate"]` with a
+  pre-initialized `.terraform` directory baked into the image/fixture
+  (validation has no network for `init`). `plan`/`apply` are out of scope:
+  plan needs credentials and state — never available in the sandbox.
+
+## Skill pack
+Variable/output descriptions and types, no inline credentials (secret
+scanner already blocks values; the pack forbids the pattern), tagging
+conventions, `for_each` over `count` for stable addresses, state-affecting
+rename awareness (`moved` blocks).
+
+## Risks & gates
+Everything that changes resource addresses (renames without `moved`),
+`destroy`-provoking changes, provider version bumps, and backend changes
+are elevated-risk. The tool must be explicit that `validate`-clean ≠
+apply-safe — plan/apply stay human-owned.
+
+## Checklist
+0. Scan `.tf` for `# @human` markers (direct-path quick win, `LANGUAGE_PROFILES` entry `hcl`/`.tf`).
+1. `Ecosystem` union + `analysis/adapters/terraform.ts`.
+2. `terraform/root-module`, `terraform/child-module` at `preview`.
+3. Skill pack; tests for lockfile evidence, multi-root refusal, moved-block gating.
+4. Docs updates (including the honest validate-vs-apply distinction in README).

package/docs/roadmap/yaml.md

@@ -0,0 +1,47 @@
+# YAML config support plan
+
+## Status today
+Level 2 only. YAML is not a programming language here — the meaningful
+target is *schema-validated configuration editing* (CI workflows, K8s
+manifests, app config), where correctness is checkable without execution.
+
+## Target profile
+- `Ecosystem`: `yaml-config`.
+- Variants by proven schema family: `github-actions`
+  (`.github/workflows/*.yml`), `kubernetes` (apiVersion/kind docs),
+  `generic` (only when a JSON Schema is discoverable via
+  `# yaml-language-server: $schema=` or operator config).
+- Unschema'd YAML stays on the general fallback — there is nothing to
+  validate, so nothing to profile.
+
+## Detection signals (static only)
+- Path conventions (`.github/workflows/`), `apiVersion`/`kind` keys,
+  explicit `$schema` pragmas, `kustomization.yaml`.
+
+## Version evidence
+The schema is the "dependency": pin the schema source (bundled
+GitHub-Actions/K8s schemas shipped as immutable package data, like compiler
+skills) and record which schema+version validated the patch.
+
+## Validation plan
+- Offline schema validation in-process or via a bundled validator; K8s:
+  `["kubeconform", "-strict", "<files>"]` with schemas preloaded in the
+  image. Never `kubectl apply`.
+
+## Skill pack
+Anchors/aliases used sparingly, no duplicate keys, quoting rules for
+booleans/versions (Norway problem), GitHub Actions pinning conventions
+(action SHAs), K8s resource limits present.
+
+## Risks & gates
+CI workflow edits are supply-chain-sensitive: adding `run:` steps, changing
+action refs, or touching secrets contexts is elevated-risk and needs
+explicit contract authorization. Secrets scanning already covers values;
+the skill pack must also forbid *referencing* new secret names silently.
+
+## Checklist
+1. `Ecosystem` union + `analysis/adapters/yaml-config.ts`.
+2. Variants at `preview`; bundle schema data as frozen package assets.
+3. Skill pack; patch-policy tests for workflow-edit gating.
+4. Tests: schema discovery, multi-doc files, duplicate keys, unschema'd refusal.
+5. Docs updates.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "human-to-code",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Safely turn reviewed natural-language change contracts into validated code patches.",
   "type": "module",
   "main": "./dist/index.js",