ansible: entry-list play bodies + ansible-applier

.gitignore

@@ -5,7 +5,6 @@ openrc
 .terraform/
 *.tfstate
 *.tfstate.*
-deploy/apply.log
 tfplan
 
 # Real, sops-sealed secrets for examples/homelab.scm — never commit.

CHANGELOG.md

@@ -12,8 +12,19 @@ All notable changes to hexol are documented here. The format follows
 - `import` verb: turn existing manifests/config into an inventory.
 - `lint` verb: static checks over an inventory.
 - `--validate` flag: schema-check the resolved state before rendering.
+- `ansible-applier`: `hexol apply` on an `(ansible_plays)` inventory writes the
+  playbook + inventory JSON and runs `ansible-playbook`. Flags `apply` does not
+  own pass through to the tool (`hexol apply -i x.scm --list-tasks --limit h`).
 - `explain` reports the fix location for ops generated under `hx-each`.
 
+### Changed
+- Ansible library: play bodies are entry lists. `tasks`/`as`/`each`/`only`/
+  `handlers` share one grammar — `("Name" (module (arg val) …) #:keyword val …)`
+  declares a task, a symbol-headed entry is a Scheme expression whose tasks
+  splice in; bare module names resolve to `ansible.builtin`. Replaces the
+  `task`/`handler` record macros and the `as` procedure. `examples/ansible.scm`
+  rewritten as one declaration list per host.
+
 ## [0.1.0] - 2026-09-03
 
 First tagged release: the engine, the author surface, the target libraries,

Makefile

@@ -13,7 +13,7 @@ help:
 	@echo
 	@echo "everything else is the CLI — ./bin/hexol --help:"
 	@echo "  ./bin/hexol render [-o sexp|json|yaml|terraform|ansible] [--query K=V,…] [--path P] [-i INVENTORY]"
-	@echo "  ./bin/hexol apply [--only SPEC] [--dry-run] [--list] [-i INVENTORY]"
+	@echo "  ./bin/hexol apply [--only SPEC] [--dry-run] [--list] [-i INVENTORY] [TOOL-FLAGS...]"
 	@echo "  ./bin/hexol diff [--only SPEC] [--explain] [-i INVENTORY]"
 	@echo "  ./bin/hexol tree [-i INVENTORY]"
 	@echo "  ./bin/hexol explain [--query K=V,…] PATH|HASH [-i INVENTORY]"

bin/hexol

@@ -12,7 +12,7 @@
 ;;;
 ;;;   hexol render [-o FMT] [--path P]    [-i INV]   resolve + emit (default)
 ;;;                [--validate]                      (yaml: pipe to kubeconform)
-;;;   hexol apply [--only SPEC] [--dry-run] [-i INV] run the appliers (plan)
+;;;   hexol apply [--only SPEC] [--dry-run] [-i INV] [TOOL-FLAGS…] run the appliers
 ;;;   hexol diff [--only SPEC] [--explain] [-i INV]  drift: 0 clean, 1 drift, 2 error
 ;;;   hexol tree [-v]                     [-i INV]   op tree, indented
 ;;;                                                  (-v: + per-op fold time)
@@ -64,7 +64,7 @@
              (hexol json)
              (hexol construct)
              (hexol doc)
-             ((hexol apply) #:select (current-diff-explainer))
+             ((hexol apply) #:select (current-diff-explainer applier-args))
              ((hexol sh) #:select (which-cmd))
              (ice-9 popen)
              (hexol version)
@@ -351,7 +351,9 @@
 ;; `render` makes artifacts; `apply` pushes them.
 ;; ---------------------------------------------------------------------------
 ;;
-;;   hexol apply [--only SPEC] [--dry-run] [--list] [-i INVENTORY]
+;;   hexol apply [--only SPEC] [--dry-run] [--list] [-i INVENTORY] [TOOL-FLAGS…]
+;; Flags hexol doesn't own (the first `-x' it doesn't know and all that follows)
+;; reach the appliers via `applier-args' — `hexol apply --list-tasks --limit web1'.
 ;;   hexol diff  [--only SPEC] [--explain]         [-i INVENTORY]
 ;;
 ;; Resolve once, then run the `applies-with` appliers in registration order,
@@ -384,7 +386,10 @@
           ((arg . rest)
            (cond
              ((string-prefix? "--only=" arg) (loop rest (flag-value "--only=" arg) mode list?))
-             ((string-prefix? "-" arg) (usage-error "apply: unknown flag ~a" arg))
+             ;; first foreign flag: it and everything after go to the appliers
+             ((string-prefix? "-" arg)
+              (parameterize ((applier-args args))
+                (do-apply (inventory-or-default "apply" inv) only mode list? #f)))
              (else (usage-error "apply: unexpected argument ~a (inventory is -i/--inventory)" arg)))))))))
 
 (define (cmd-diff args)