feat: publish Sandwich Hime tooling preview

Publish the exact sanitized Agent Skill and VS Code preview source tree with independent license boundaries, deterministic provenance manifests, and no private development history. Material design and implementation assistance was provided by OpenAI Codex. Signed-off-by: Cole Speelman <crspeelman@gmail.com>
2026-08-12 20:33:51 -04:00
commit 6df87bc958
51 changed files with 7424 additions and 0 deletions
@@ -0,0 +1,52 @@
+# Workflow reference
+
+## Inspect and preserve pins
+
+Read `go.mod` and `go.sum`; never infer a version from marketing copy. Confirm:
+
+```sh
+himesan version --json
+himesan check --json ./path/to/templates
+```
+
+If the repository pins Beta 1 runtime and Beta 2 compiler, install in this
+order without using `@latest`:
+
+```sh
+go get gamertan.com/sandwich-hime/sando@v1.0.0-beta.1
+go install gamertan.com/sandwich-hime/cmd/himesan@v1.0.0-beta.2
+```
+
+If the nested runtime is temporarily missing from a module cache, run the exact
+`go mod download gamertan.com/sandwich-hime/sando@<pinned-version>` and retry.
+Do not delete a user's global module cache.
+
+## Authorized generation
+
+1. Edit `.sando`, never `.sando.go`.
+2. Run the exact installed/pinned `himesan generate` against the intended path.
+3. Run `himesan check --json`.
+4. Run the repository's normal `go test ./...`, `go vet ./...`, and build or
+   verifier commands. Do not claim `check` performs Go type checking.
+5. Review generated diffs and trust warnings.
+
+## Review-only work
+
+Do not generate. Use `himesan check --json`, inspect source and generated
+provenance, and report stale output rather than repairing it. Never run
+`himesan dev` for an untrusted repository; it invokes the Go toolchain and
+executes the project's program.
+
+## Migration
+
+Model pages, layouts, and partials as typed component functions. Move dynamic
+values through explicit parameters and compose with `<?~`. Keep the existing
+router, status codes, headers, caching, and deployment code in ordinary Go.
+Add adversarial tests for text, attributes, URLs, trust capabilities, and
+writer errors before replacing an existing renderer.
+
+## Platforms
+
+Use the project's shell verifier on Linux/macOS and PowerShell verifier on
+native Windows when supplied. Preserve CRLF files, use native filesystem paths,
+and compare generated bytes rather than assuming path separators are portable.