@oisincoveney/pipeline 1.20.0 → 1.21.0

package/README.md

@@ -1,16 +1,15 @@
 # @oisincoveney/pipeline
 
-Config-driven multi-agent pipeline runner for repository work. The source of
-truth is three YAML files: `.pipeline/runners.yaml` declares runner adapters,
-`.pipeline/profiles.yaml` declares reusable profiles and their grants, and
-`.pipeline/pipeline.yaml` declares orchestration, workflows, gates, hooks, and
-artifacts.
+Config-driven multi-agent pipeline runner for repository work. Runtime config is
+owned by the installed `@oisincoveney/pipeline` package. Repo-local `.pipeline`
+paths are runtime artifact locations only; they are not the runtime config
+source.
 
 ## Requirements
 
 - Bun 1.1 or newer
 - Node.js 22.13 or newer
-- `npx`, `backlog`, `uvx`, and Docker on `PATH` for default skills and MCP setup
+- `npx`, `backlog`, `uvx`, and Docker on `PATH` for default skills and MCP gateway setup
 - At least one configured runner CLI on `PATH`: `codex`, `opencode`, `kimi`,
   `pi`, or a declared command runner
 
@@ -22,33 +21,31 @@ bun install --frozen-lockfile
 
 ## Start A Repository
 
-Scaffold the default YAML workflow:
+Initialize package-owned pipeline support:
 
 ```shell
 pipe init
 ```
 
 `pipe init` installs default project skills with
-`npx skills add oisincoveney/skills` and registers default MCP servers with the
-MCPM CLI from https://mcpm.sh/. Default profiles point at the installed
-`.agents/skills/<skill>/SKILL.md` files in the target repository. The package
-invokes MCPM through `uvx --python 3.12 mcpm`, so generated `.mcp.json` entries
-do not depend on a globally installed `mcpm` binary. The default Qdrant/memory
-MCP is the Momokaya remote endpoint
-`https://memory-mcp.momokaya.ee/mcp/`.
-
-The default GitHub MCP registration uses GitHub's official container in
-read-only mode and reads `GITHUB_PERSONAL_ACCESS_TOKEN` from the environment.
-The Momokaya gateway endpoint is protected by Traefik HTTP Basic auth. Set
-`PIPELINE_MCP_GATEWAY_AUTHORIZATION` to the full HTTP `Authorization` header
-value before starting Codex or OpenCode:
+`npx skills add oisincoveney/skills`, then writes generated Codex and OpenCode
+command surfaces plus their singleton `pipeline-gateway` MCP entries. It does
+not create repo-local `.pipeline` config files.
+
+The default MCP gateway can run locally or point at the hosted Momokaya
+gateway. Set `PIPELINE_MCP_GATEWAY_AUTHORIZATION` to the full HTTP
+`Authorization` header value before starting Codex or OpenCode when using a
+protected gateway:
 
 ```shell
 export PIPELINE_MCP_GATEWAY_AUTHORIZATION="Basic $(printf '%s' 'user:password' | base64)"
 ```
 
-`pipe init` writes project-level Codex and OpenCode config that points at the
-singleton `pipeline-gateway` MCP server.
+To refresh or check generated host files later, use:
+
+```shell
+pipe install-commands --host all --check
+```
 
 Check local prerequisites and config health:
 
@@ -136,9 +133,12 @@ validation, contract-version checks, and JSON Schema generation.
 Use `PIPELINE_TARGET_PATH=/path/to/worktree` when the checked-out target repo is
 mounted somewhere other than the process working directory.
 
-## Minimal YAML
+## Custom YAML Parts
+
+Runtime execution uses package-owned defaults. Tests and advanced embedding code
+can still parse explicit YAML parts with `parsePipelineConfigParts()`.
 
-`.pipeline/runners.yaml`:
+`runners`:
 
 ```yaml
 version: 1
@@ -156,7 +156,7 @@ runners:
       output_formats: [text, json, jsonl, json_schema]
 ```
 
-`.pipeline/profiles.yaml`:
+`profiles`:
 
 ```yaml
 version: 1
@@ -182,7 +182,7 @@ profiles:
       format: text
 ```
 
-`.pipeline/pipeline.yaml`:
+Example workflow shape:
 
 ```yaml
 version: 1
@@ -215,14 +215,12 @@ workflows:
             builtin: typecheck
 ```
 
-Projects can also declare `entrypoints` in `.pipeline/pipeline.yaml` to expose
-stable app or CLI names that resolve to workflows or schedule policies. Direct
-`--workflow` selection remains available and takes precedence over `--entrypoint`
-when both are set.
+Package-owned defaults declare `entrypoints` that expose stable app or CLI names
+resolving to workflows or schedule policies. Direct `--workflow` selection
+remains available and takes precedence over `--entrypoint` when both are set.
 
-The default scaffold includes a full research, red, green, verify, learn
-workflow. See `docs/config-architecture.md` for a complete example and the host
-support matrix.
+The package defaults include a full research, red, green, verify, learn
+workflow. See `docs/config-architecture.md` for the host support matrix.
 
 ### Structural Parallelism
 
@@ -292,22 +290,22 @@ branches share a base SHA, and merges passing branches into an integration
 branch in declaration order. It reports merge conflicts; it does not resolve
 them automatically.
 
-Default profile skills are installed into `.agents/skills` by `pipe init`.
-Runtime MCP projection and host-specific isolation policy live in `src/mcp`; see
-[`docs/mcp-host-isolation.md`](docs/mcp-host-isolation.md) and
+Default profile skills and generated host resources are installed by
+`pipe init`. Runtime MCP projection and host-specific isolation policy live in
+`src/mcp`; see [`docs/mcp-host-isolation.md`](docs/mcp-host-isolation.md) and
 [`docs/mcp-gateway.md`](docs/mcp-gateway.md).
 
 ## Generated Host Resources
 
-Generate native host files from the YAML config:
+Generate native host files during setup:
 
 ```shell
-pipe install-commands --host all
+pipe init
 ```
 
-Generated resources are derived from the three config files; they are not
-separate sources of truth. Host resources use exact native agents when the node
-runner matches the host. OpenCode also uses native subagents for cross-runner
+Generated resources are derived from package-owned config; they are not separate
+sources of truth. Host resources use exact native agents when the node runner
+matches the host. OpenCode also uses native subagents for cross-runner
 model-backed nodes when the runner/profile provides an OpenCode-compatible
 `model` or `host_models.opencode` value. Otherwise generated instructions
 dispatch to that runner's CLI instead of inventing a host model.
@@ -336,8 +334,8 @@ runners:
 
 ## Runtime Guarantees
 
-- `pipe run` fails without `.pipeline/pipeline.yaml`,
-  `.pipeline/profiles.yaml`, and `.pipeline/runners.yaml`.
+- `pipe run` loads package-owned `@oisincoveney/pipeline` config even when the
+  repository has no repo-local `.pipeline` config files.
 - Multi-agent workflows execute as separate agent boundaries; nodes are not
   merged into one prompt.
 - Native subagent strategy is preferred when the selected runner can represent

package/dist/commands/pipeline-command.js

@@ -12,7 +12,6 @@ const BUILTIN_PIPE_COMMANDS = new Set([
 ]);
 function registerConfiguredEntrypointCommands(program, config, runEntrypoint) {
 	const registered = /* @__PURE__ */ new Set();
-	if (!config) return registered;
 	const reservedCommands = new Set(program.commands.map((command) => command.name()));
 	for (const [id, entrypoint] of Object.entries(config.entrypoints)) {
 		if (reservedCommands.has(id)) continue;

package/dist/config.d.ts

@@ -10,11 +10,13 @@ declare const HOOK_EVENTS: readonly ["workflow.start", "workflow.success", "work
 declare const GATE_KINDS: readonly ["acceptance", "artifact", "builtin", "changed_files", "command", "json_schema", "verdict"];
 declare const SCHEDULE_BASELINES: readonly ["epic", "pipe"];
 declare const SCHEDULING_ROLES: readonly ["coverage", "implementation"];
+declare const MCP_GATEWAY_BACKEND_LOCALITIES: readonly ["repo-local", "repo-scoped-remote", "shared-remote"];
+declare const MCP_GATEWAY_WORKSPACE_PATH_SOURCES: readonly ["PIPELINE_TARGET_PATH", "cwd"];
 declare const DEFAULT_RUNNER_JOB_GIT_COMMITTER: {
   readonly email: "git@oisin.ee";
   readonly name: "oisin-bot";
 };
-type PipelineConfigErrorCode = "PIPELINE_CONFIG_LEGACY_UNSUPPORTED" | "PIPELINE_CONFIG_MISSING" | "PIPELINE_CONFIG_PARSE_ERROR" | "PIPELINE_CONFIG_VALIDATION_ERROR";
+type PipelineConfigErrorCode = "PIPELINE_CONFIG_LEGACY_UNSUPPORTED" | "PIPELINE_CONFIG_PARSE_ERROR" | "PIPELINE_CONFIG_VALIDATION_ERROR";
 interface PipelineConfigIssue {
   message: string;
   path?: string;
@@ -237,6 +239,19 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>;
   }, z.core.$strict>>;
   mcp_gateway: z.ZodOptional<z.ZodObject<{
+    backends: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+      locality: z.ZodEnum<{
+        "repo-local": "repo-local";
+        "repo-scoped-remote": "repo-scoped-remote";
+        "shared-remote": "shared-remote";
+      }>;
+      required: z.ZodDefault<z.ZodBoolean>;
+      tool_prefixes: z.ZodArray<z.ZodString>;
+      workspace_path_source: z.ZodOptional<z.ZodEnum<{
+        PIPELINE_TARGET_PATH: "PIPELINE_TARGET_PATH";
+        cwd: "cwd";
+      }>>;
+    }, z.core.$strict>>>;
     default_profile: z.ZodOptional<z.ZodString>;
     mode: z.ZodEnum<{
       hosted: "hosted";
@@ -411,6 +426,8 @@ type HookEvent = (typeof HOOK_EVENTS)[number];
 type GateKind = (typeof GATE_KINDS)[number];
 type ScheduleBaseline = (typeof SCHEDULE_BASELINES)[number];
 type SchedulingRole = (typeof SCHEDULING_ROLES)[number];
+type McpGatewayBackendLocality = (typeof MCP_GATEWAY_BACKEND_LOCALITIES)[number];
+type McpGatewayWorkspacePathSource = (typeof MCP_GATEWAY_WORKSPACE_PATH_SOURCES)[number];
 interface PipelineConfigParts {
   pipeline: string;
   profiles: string;
@@ -421,9 +438,8 @@ interface PipelineConfigValidationOptions {
 }
 declare function loadPipelineConfig(projectRoot: string, options?: PipelineConfigValidationOptions): PipelineConfig;
 declare function loadPackagePipelineConfig(projectRoot: string, options?: PipelineConfigValidationOptions): PipelineConfig;
-declare function tryLoadPipelineConfig(projectRoot: string, options?: PipelineConfigValidationOptions): PipelineConfig | null;
 declare function parsePipelineConfigYaml(source: string, sourcePath?: string, projectRoot?: string): PipelineConfig;
 declare function parsePipelineConfigParts(sources: PipelineConfigParts, projectRoot?: string, sourcePaths?: PipelineConfigParts, options?: PipelineConfigValidationOptions): PipelineConfig;
 declare function validatePipelineConfig(rawConfig: PipelineConfig, projectRoot?: string, options?: PipelineConfigValidationOptions): PipelineConfig;
 //#endregion
-export { DEFAULT_RUNNER_JOB_GIT_COMMITTER, GateKind, HookEvent, PIPELINE_CONFIG_PATH, PROFILES_CONFIG_PATH, PipelineConfig, PipelineConfigError, PipelineConfigErrorCode, PipelineConfigIssue, PipelineConfigParts, PipelineConfigValidationOptions, RUNNERS_CONFIG_PATH, RunnerType, ScheduleBaseline, SchedulingRole, WorkflowNodeKind, loadPackagePipelineConfig, loadPipelineConfig, parsePipelineConfigParts, parsePipelineConfigYaml, tryLoadPipelineConfig, validatePipelineConfig, workflowSchema };
+export { DEFAULT_RUNNER_JOB_GIT_COMMITTER, GateKind, HookEvent, McpGatewayBackendLocality, McpGatewayWorkspacePathSource, PIPELINE_CONFIG_PATH, PROFILES_CONFIG_PATH, PipelineConfig, PipelineConfigError, PipelineConfigErrorCode, PipelineConfigIssue, PipelineConfigParts, PipelineConfigValidationOptions, RUNNERS_CONFIG_PATH, RunnerType, ScheduleBaseline, SchedulingRole, WorkflowNodeKind, loadPackagePipelineConfig, loadPipelineConfig, parsePipelineConfigParts, parsePipelineConfigYaml, validatePipelineConfig, workflowSchema };

package/dist/config.js

@@ -1,4 +1,5 @@
 import { resolveFileReference } from "./path-refs.js";
+import { standardOutputSchemaNameFromPath } from "./standard-output-schemas.js";
 import { existsSync } from "node:fs";
 import { parseDocument } from "yaml";
 import { z } from "zod";
@@ -54,6 +55,12 @@ const RETRY_REASONS = [
 ];
 const SCHEDULE_BASELINES = ["epic", "pipe"];
 const SCHEDULING_ROLES = ["coverage", "implementation"];
+const MCP_GATEWAY_BACKEND_LOCALITIES = [
+	"repo-local",
+	"repo-scoped-remote",
+	"shared-remote"
+];
+const MCP_GATEWAY_WORKSPACE_PATH_SOURCES = ["PIPELINE_TARGET_PATH", "cwd"];
 const PIPELINE_GATEWAY_SERVER_ID = "pipeline-gateway";
 const DEFAULT_RUNNER_JOB_GIT_COMMITTER = {
 	email: "git@oisin.ee",
@@ -104,6 +111,29 @@ mcp_gateway:
   url_env: PIPELINE_MCP_GATEWAY_URL
   authorization_env: PIPELINE_MCP_GATEWAY_AUTHORIZATION
   default_profile: default
+  backends:
+    context7:
+      locality: shared-remote
+      tool_prefixes: [context7]
+    uidotsh:
+      locality: shared-remote
+      tool_prefixes: [uidotsh]
+    qdrant:
+      locality: repo-scoped-remote
+      tool_prefixes: [qdrant]
+    fallow:
+      locality: repo-local
+      workspace_path_source: PIPELINE_TARGET_PATH
+      required: false
+      tool_prefixes: [fallow]
+    serena:
+      locality: repo-local
+      workspace_path_source: PIPELINE_TARGET_PATH
+      tool_prefixes: [serena]
+    backlog:
+      locality: repo-local
+      workspace_path_source: PIPELINE_TARGET_PATH
+      tool_prefixes: [backlog]
 profiles:
   orchestrator:
     runner: codex
@@ -121,6 +151,10 @@ profiles:
     tools: [read, list, grep, glob, bash]
     filesystem: { mode: read-only, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
     network: { mode: inherit }
+    output:
+      format: json_schema
+      schema_path: .pipeline/schemas/research.schema.json
+      repair: { enabled: true, max_attempts: 1 }
   pipeline-inspector:
     runner: codex
     description: Inspect the repository without modifying files.
@@ -139,12 +173,17 @@ profiles:
     network: { mode: inherit }
   pipeline-test-writer:
     runner: codex
+    scheduling_roles: [implementation]
     description: Add focused failing tests for the requested behavior.
-    instructions: { inline: "Add focused failing tests for the requested behavior only. Do not change production code." }
+    instructions: { inline: "Add focused failing tests for the requested behavior only. Do not change production code. Return only valid JSON with top-level changes and verification. Every changes entry must include summary, why, and files. Include risks, followups, and lessons when present. Do not use Markdown fences or prose outside the JSON object." }
     mcp_servers: [pipeline-gateway]
     tools: [read, list, grep, glob, bash, edit, write]
     filesystem: { mode: workspace-write, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
     network: { mode: inherit }
+    output:
+      format: json_schema
+      schema_path: .pipeline/schemas/implementation.schema.json
+      repair: { enabled: true, max_attempts: 1 }
   pipeline-epic-router:
     runner: codex
     description: Route epic sub-tickets into fixed implementation tracks.
@@ -157,11 +196,15 @@ profiles:
     runner: codex
     scheduling_roles: [implementation]
     description: Implement production code until the failing tests pass.
-    instructions: { inline: "Implement the smallest production change that satisfies the failing tests." }
+    instructions: { inline: "Implement the smallest production change that satisfies the failing tests. Return only valid JSON with top-level changes and verification. Every changes entry must include summary, why, and files. Include risks, followups, and lessons when present. Do not use Markdown fences or prose outside the JSON object." }
     mcp_servers: [pipeline-gateway]
     tools: [read, list, grep, glob, bash, edit, write]
     filesystem: { mode: workspace-write, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
     network: { mode: inherit }
+    output:
+      format: json_schema
+      schema_path: .pipeline/schemas/implementation.schema.json
+      repair: { enabled: true, max_attempts: 1 }
   pipeline-acceptance-reviewer:
     runner: codex
     scheduling_roles: [coverage]
@@ -171,6 +214,10 @@ profiles:
     tools: [read, list, grep, glob, bash]
     filesystem: { mode: read-only, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
     network: { mode: inherit }
+    output:
+      format: json_schema
+      schema_path: .pipeline/schemas/acceptance.schema.json
+      repair: { enabled: true, max_attempts: 1 }
   pipeline-thermo-nuclear-reviewer:
     runner: codex
     scheduling_roles: [coverage]
@@ -180,6 +227,10 @@ profiles:
     tools: [read, list, grep, glob, bash]
     filesystem: { mode: read-only, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
     network: { mode: inherit }
+    output:
+      format: json_schema
+      schema_path: .pipeline/schemas/review.schema.json
+      repair: { enabled: true, max_attempts: 1 }
   pipeline-verifier:
     runner: codex
     scheduling_roles: [coverage]
@@ -189,6 +240,10 @@ profiles:
     tools: [read, list, grep, glob, bash]
     filesystem: { mode: read-only, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
     network: { mode: inherit }
+    output:
+      format: json_schema
+      schema_path: .pipeline/schemas/verify.schema.json
+      repair: { enabled: true, max_attempts: 1 }
   pipeline-learner:
     runner: codex
     description: Store durable lessons from the completed run.
@@ -197,6 +252,10 @@ profiles:
     tools: [read, list, grep, glob, bash]
     filesystem: { mode: read-only, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
     network: { mode: inherit }
+    output:
+      format: json_schema
+      schema_path: .pipeline/schemas/learn.schema.json
+      repair: { enabled: true, max_attempts: 1 }
 `;
 const PACKAGE_DEFAULT_PIPELINE_YAML = `version: 1
 default_workflow: default
@@ -419,7 +478,28 @@ const mcpServerSchema = z.object({
 		path: ["bearer_token_env_var"]
 	});
 });
+const mcpGatewayBackendSchema = z.object({
+	locality: z.enum(MCP_GATEWAY_BACKEND_LOCALITIES),
+	required: z.boolean().default(true),
+	tool_prefixes: z.array(z.string().min(1)).min(1),
+	workspace_path_source: z.enum(MCP_GATEWAY_WORKSPACE_PATH_SOURCES).optional()
+}).strict().superRefine((backend, ctx) => {
+	if (backend.locality === "repo-local") {
+		if (!backend.workspace_path_source) ctx.addIssue({
+			code: "custom",
+			message: "repo-local gateway backend must declare workspace_path_source as PIPELINE_TARGET_PATH or cwd",
+			path: ["workspace_path_source"]
+		});
+		return;
+	}
+	if (backend.workspace_path_source) ctx.addIssue({
+		code: "custom",
+		message: "workspace_path_source is only valid for repo-local gateway backends",
+		path: ["workspace_path_source"]
+	});
+});
 const mcpGatewaySchema = z.object({
+	backends: strictRecord(mcpGatewayBackendSchema).default({}),
 	default_profile: z.string().min(1).optional(),
 	mode: z.enum(["hosted", "local"]),
 	provider: z.literal("toolhive"),
@@ -804,9 +884,6 @@ function loadPackagePipelineConfig(projectRoot, options = {}) {
 		runners: "@oisincoveney/pipeline/defaults/runners.yaml"
 	}, options);
 }
-function tryLoadPipelineConfig(projectRoot, options = {}) {
-	return loadPipelineConfig(projectRoot, options);
-}
 function parsePipelineConfigYaml(source, sourcePath = PIPELINE_CONFIG_PATH, projectRoot) {
 	return parsePipelineConfigParts({
 		pipeline: source,
@@ -950,10 +1027,13 @@ function validateActor(label, path, actor, runner, config, issues, projectRoot,
 	validatePath(`${path}.instructions.path`, actor.instructions.path, projectRoot, issues, options);
 	validateReferences(`${path}.rules`, actor.rules, config.rules, "rule", issues);
 	validateReferences(`${path}.skills`, actor.skills, config.skills, "skill", issues);
-	validateReferences(`${path}.mcp_servers`, actor.mcp_servers, config.mcp_gateway ? {
-		...config.mcp_servers,
-		[PIPELINE_GATEWAY_SERVER_ID]: {}
-	} : config.mcp_servers, "MCP server", issues);
+	validateReferences(`${path}.mcp_servers`, actor.mcp_servers, config.mcp_gateway ? { [PIPELINE_GATEWAY_SERVER_ID]: {} } : config.mcp_servers, "MCP server", issues);
+	if (config.mcp_gateway) {
+		for (const serverId of actor.mcp_servers ?? []) if (serverId !== PIPELINE_GATEWAY_SERVER_ID) issues.push({
+			path: `${path}.mcp_servers`,
+			message: `${path}.mcp_servers must only reference ${PIPELINE_GATEWAY_SERVER_ID} when mcp_gateway is configured`
+		});
+	}
 	validateBooleanCapability(`${path}.rules`, actor.rules, runner.capabilities.rules, "rules", issues);
 	validateBooleanCapability(`${path}.skills`, actor.skills, runner.capabilities.skills, "skills", issues);
 	validateBooleanCapability(`${path}.mcp_servers`, actor.mcp_servers, runner.capabilities.mcp_servers, "MCP servers", issues);
@@ -1052,6 +1132,7 @@ function validateListCapability(path, requested, supported, label, issues) {
 }
 function validatePath(path, value, projectRoot, issues, options = {}) {
 	if (!(value && projectRoot)) return;
+	if (standardOutputSchemaNameFromPath(value)) return;
 	if (!existsSync(resolveFileReference(projectRoot, value))) {
 		if (options.allowMissingLintFileReferences && isLintableMissingFileReferencePath(path)) return;
 		issues.push({
@@ -1070,4 +1151,4 @@ function validationError(issues) {
 	return new PipelineConfigError("PIPELINE_CONFIG_VALIDATION_ERROR", ["Invalid pipeline config:", ...issues.map((issue) => issue.path ? `- ${issue.path}: ${issue.message}` : `- ${issue.message}`)].join("\n"), issues);
 }
 //#endregion
-export { DEFAULT_RUNNER_JOB_GIT_COMMITTER, PIPELINE_CONFIG_PATH, PROFILES_CONFIG_PATH, PipelineConfigError, RUNNERS_CONFIG_PATH, loadPackagePipelineConfig, loadPipelineConfig, parsePipelineConfigParts, parsePipelineConfigYaml, tryLoadPipelineConfig, validatePipelineConfig, workflowSchema };
+export { DEFAULT_RUNNER_JOB_GIT_COMMITTER, PIPELINE_CONFIG_PATH, PROFILES_CONFIG_PATH, PipelineConfigError, RUNNERS_CONFIG_PATH, loadPackagePipelineConfig, loadPipelineConfig, parsePipelineConfigParts, parsePipelineConfigYaml, validatePipelineConfig, workflowSchema };

package/dist/gates.js

@@ -12,6 +12,9 @@ function parseFailingTests(output) {
 		return m ? [m[1].trim()] : [];
 	});
 }
+function displayCommand(command) {
+	return [command.command, ...command.args].join(" ");
+}
 function readPackageScripts(worktreePath) {
 	try {
 		return parseJson(readFileSync(join(worktreePath, "package.json"), "utf-8"), "package.json").scripts ?? {};
@@ -55,14 +58,16 @@ async function runTests(worktreePath, signal) {
 		});
 		const output = [result.stdout, result.stderr].filter(Boolean).join("\n");
 		return {
+			command: displayCommand(projectCommand),
 			exitCode: result.exitCode ?? 0,
 			output,
 			failingTests: []
 		};
 	} catch (err) {
 		const e = err;
-		const output = [e.stdout, e.stderr].filter(Boolean).join("\n");
+		const output = [e.stdout, e.stderr].filter(Boolean).join("\n") || [e.shortMessage, e.message].filter(Boolean).join("\n");
 		return {
+			command: displayCommand(projectCommand),
 			exitCode: e.exitCode ?? 1,
 			output,
 			failingTests: parseFailingTests(output)
@@ -83,26 +88,35 @@ async function runTypecheck(worktreePath, signal) {
 		});
 		const output = [result.stdout, result.stderr].filter(Boolean).join("\n");
 		return {
+			command: displayCommand(projectCommand),
 			exitCode: result.exitCode ?? 0,
 			output
 		};
 	} catch (err) {
 		const e = err;
-		const output = [e.stdout, e.stderr].filter(Boolean).join("\n");
+		const output = [e.stdout, e.stderr].filter(Boolean).join("\n") || [e.shortMessage, e.message].filter(Boolean).join("\n");
 		return {
+			command: displayCommand(projectCommand),
 			exitCode: e.exitCode ?? 1,
 			output
 		};
 	}
 }
-async function runSemgrep(worktreePath, signal) {
-	const projectCommand = envCommand("PIPELINE_SEMGREP_COMMAND") ?? {
+async function runSemgrep(worktreePath, signal, changedFiles) {
+	const overrideCommand = envCommand("PIPELINE_SEMGREP_COMMAND");
+	const targets = changedFiles ? [...new Set(changedFiles)].filter((file) => existsSync(join(worktreePath, file))) : void 0;
+	if (!overrideCommand && targets && targets.length === 0) return {
+		command: "uvx semgrep scan --config=p/ci --error",
+		exitCode: 0,
+		output: "skipped: no changed files to scan"
+	};
+	const projectCommand = overrideCommand ?? {
 		args: [
 			"semgrep",
 			"scan",
 			"--config=p/ci",
 			"--error",
-			"."
+			...targets ? ["--", ...targets] : ["."]
 		],
 		command: "uvx"
 	};
@@ -114,13 +128,15 @@ async function runSemgrep(worktreePath, signal) {
 		});
 		const output = [result.stdout, result.stderr].filter(Boolean).join("\n");
 		return {
+			command: displayCommand(projectCommand),
 			exitCode: result.exitCode ?? 0,
 			output
 		};
 	} catch (err) {
 		const e = err;
-		const output = [e.stdout, e.stderr].filter(Boolean).join("\n");
+		const output = [e.stdout, e.stderr].filter(Boolean).join("\n") || [e.shortMessage, e.message].filter(Boolean).join("\n");
 		return {
+			command: displayCommand(projectCommand),
 			exitCode: e.exitCode ?? 1,
 			output
 		};

package/dist/hooks.d.ts

@@ -13,8 +13,8 @@ declare const hookResultSchema: z.ZodObject<{
     taskContext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
   }, z.core.$strict>>;
   status: z.ZodEnum<{
-    pass: "pass";
     fail: "fail";
+    pass: "pass";
     skip: "skip";
   }>;
   summary: z.ZodOptional<z.ZodString>;

package/dist/index.d.ts

@@ -10,7 +10,7 @@ interface PipeOptions {
 }
 /**
  * Config-driven `pipe` entrypoint. Package-owned defaults are the source of
- * truth; repo-local pipeline files are only scaffolding fixtures.
+ * truth; repo-local pipeline files are ignored by runtime loading.
  */
 declare function pipe(description: string, options?: PipeOptions): Promise<void>;
 interface DoctorCheck {

package/dist/index.js

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
-import { PipelineConfigError, loadPipelineConfig, tryLoadPipelineConfig } from "./config.js";
+import { standardOutputSchemaNameFromPath } from "./standard-output-schemas.js";
+import { PipelineConfigError, loadPipelineConfig } from "./config.js";
 import { BUILTIN_PIPE_COMMANDS, registerConfiguredEntrypointCommands } from "./commands/pipeline-command.js";
-import { configureGatewayHosts, localGatewayStatus, renderGatewayConfig, runGatewayDoctor, startLocalGateway } from "./mcp/gateway.js";
+import { configureGatewayHosts, localGatewayStatus, reconcileGateway, renderGatewayConfig, runGatewayDoctor, startLocalGateway } from "./mcp/gateway.js";
 import { createOrchestratorLaunchPlan, createRunnerLaunchPlan } from "./runner.js";
 import { compileWorkflowPlan } from "./workflow-planner.js";
 import { formatConfigError, runPipelineFromConfig } from "./pipeline-runtime.js";
@@ -19,7 +20,7 @@ const PATH_SEPARATOR_RE = /[\\/]/;
 const LINE_RE = /\r?\n/;
 /**
 * Config-driven `pipe` entrypoint. Package-owned defaults are the source of
-* truth; repo-local pipeline files are only scaffolding fixtures.
+* truth; repo-local pipeline files are ignored by runtime loading.
 */
 function pipe(description, options = {}) {
 	try {
@@ -192,9 +193,9 @@ function truncateMiddle(text, maxLength) {
 	return `${text.slice(0, keep)}\n... truncated ...\n${text.slice(-keep)}`;
 }
 function createCliProgram() {
-	const configuredPipeline = tryLoadConfiguredEntrypoints(process.env.PIPELINE_TARGET_PATH ?? process.cwd());
+	const configuredPipeline = loadConfiguredEntrypoints(process.env.PIPELINE_TARGET_PATH ?? process.cwd());
 	const program = new Command();
-	program.name("@oisincoveney/pipeline").description("Run and install the oisin pipeline").exitOverride();
+	program.name("@oisincoveney/pipeline").description("Run package-owned @oisincoveney/pipeline config").exitOverride();
 	const runAction = async (descriptionParts, flags) => {
 		await pipe(descriptionParts.join(" "), {
 			entrypoint: flags.entrypoint,
@@ -202,9 +203,9 @@ function createCliProgram() {
 			workflow: flags.workflow
 		});
 	};
-	program.command("run").description("Run a workflow from .pipeline/pipeline.yaml").argument("<description...>", "task description").option("--entrypoint <entrypoint>", "entrypoint alias from pipeline.yaml").option("--schedule <schedule>", "approved schedule YAML to execute").option("--workflow <workflow>", "workflow id from pipeline.yaml").action(runAction);
-	program.command("pipe").description("Alias for run").argument("<description...>", "task description").option("--entrypoint <entrypoint>", "entrypoint alias from pipeline.yaml").option("--schedule <schedule>", "approved schedule YAML to execute").option("--workflow <workflow>", "workflow id from pipeline.yaml").action(runAction);
-	program.command("validate").description("Validate .pipeline/pipeline.yaml and compile the workflow plan").option("--entrypoint <entrypoint>", "entrypoint alias from pipeline.yaml").option("--schedule <schedule>", "approved schedule YAML to validate").option("--strict", "fail when validation lint warnings are emitted").option("--no-lint", "skip validation lint warnings").option("--workflow <workflow>", "workflow id from pipeline.yaml").action((flags) => {
+	program.command("run").description("Run a workflow from package-owned @oisincoveney/pipeline config").argument("<description...>", "task description").option("--entrypoint <entrypoint>", "entrypoint alias from package config").option("--schedule <schedule>", "approved schedule YAML to execute").option("--workflow <workflow>", "workflow id from package config").action(runAction);
+	program.command("pipe").description("Alias for run").argument("<description...>", "task description").option("--entrypoint <entrypoint>", "entrypoint alias from package config").option("--schedule <schedule>", "approved schedule YAML to execute").option("--workflow <workflow>", "workflow id from package config").action(runAction);
+	program.command("validate").description("Validate package-owned @oisincoveney/pipeline config and compile the workflow plan").option("--entrypoint <entrypoint>", "entrypoint alias from package config").option("--schedule <schedule>", "approved schedule YAML to validate").option("--strict", "fail when validation lint warnings are emitted").option("--no-lint", "skip validation lint warnings").option("--workflow <workflow>", "workflow id from package config").action((flags) => {
 		const cwd = process.env.PIPELINE_TARGET_PATH ?? process.cwd();
 		const config = loadPipelineConfig(cwd, { allowMissingLintFileReferences: true });
 		const plan = flags.schedule ? compileScheduleArtifact(config, parseScheduleArtifact(readFileSync(flags.schedule, "utf8"), flags.schedule), cwd).plan : compileWorkflowPlan(config, resolveWorkflowSelection(config, flags.workflow, flags.entrypoint));
@@ -213,7 +214,7 @@ function createCliProgram() {
 		if (flags.strict && warnings.length > 0) throw new Error(`Validation failed with ${warnings.length} warning${warnings.length === 1 ? "" : "s"}.`);
 		console.log(`OK: ${plan.workflowId} (${plan.topologicalOrder.length} nodes)`);
 	});
-	program.command("explain-plan").description("Explain workflow nodes, runners, gates, hooks, and artifacts").option("--entrypoint <entrypoint>", "entrypoint alias from pipeline.yaml").option("--schedule <schedule>", "approved schedule YAML to explain").option("--workflow <workflow>", "workflow id from pipeline.yaml").action((flags) => {
+	program.command("explain-plan").description("Explain workflow nodes, runners, gates, hooks, and artifacts").option("--entrypoint <entrypoint>", "entrypoint alias from package config").option("--schedule <schedule>", "approved schedule YAML to explain").option("--workflow <workflow>", "workflow id from package config").action((flags) => {
 		const cwd = process.env.PIPELINE_TARGET_PATH ?? process.cwd();
 		const config = loadPipelineConfig(cwd, { allowMissingLintFileReferences: true });
 		console.log(formatSelectedWorkflowPlan(config, cwd, flags));
@@ -247,6 +248,16 @@ function createCliProgram() {
 		});
 		console.log(result.map((item) => [`${item.host}: ${item.path}`, item.backupPath ? `backup=${item.backupPath}` : "backup=none"].join(" ")).join("\n"));
 	});
+	gatewayCommand.command("reconcile").description("Apply the current workspace gateway backend inventory").action(async () => {
+		const cwd = process.env.PIPELINE_TARGET_PATH ?? process.cwd();
+		const result = await reconcileGateway(loadPipelineConfig(cwd, { allowMissingLintFileReferences: true }), cwd);
+		console.log([
+			`workspace=${result.workspacePath}`,
+			`config=${result.configPath}`,
+			`backends=${result.backendCount}`,
+			result.readinessFailures.length > 0 ? `readiness_failures=${result.readinessFailures.join("; ")}` : "readiness_failures=none"
+		].join("\n"));
+	});
 	gatewayCommand.command("local-start").description("Start a local ToolHive vMCP gateway for local mode").option("--detach", "reserved for future background startup", false).action(async (flags) => {
 		if (flags.detach) throw new Error("Detached local gateway startup is not implemented.");
 		const cwd = process.env.PIPELINE_TARGET_PATH ?? process.cwd();
@@ -256,11 +267,8 @@ function createCliProgram() {
 		const cwd = process.env.PIPELINE_TARGET_PATH ?? process.cwd();
 		console.log(await localGatewayStatus(cwd));
 	});
-	program.command("init").description("Initialize package-owned pipeline support without repo-local config").option("--overwrite", "replace existing pipeline scaffold files", false).action(async (flags) => {
-		const result = await initPipelineProject({
-			cwd: process.env.PIPELINE_TARGET_PATH ?? process.cwd(),
-			overwrite: flags.overwrite ?? false
-		});
+	program.command("init").description("Initialize package-owned pipeline support without repo-local config").action(async () => {
+		const result = await initPipelineProject({ cwd: process.env.PIPELINE_TARGET_PATH ?? process.cwd() });
 		console.log(formatPipelineInitResult(result));
 	});
 	program.command("install-commands").description("Install generated slash-command adapters into this repository").addOption(new Option("--host <host>", "host command set to install").choices([
@@ -282,13 +290,8 @@ function createCliProgram() {
 	} });
 	return program;
 }
-function tryLoadConfiguredEntrypoints(cwd) {
-	try {
-		return tryLoadPipelineConfig(cwd, { allowMissingLintFileReferences: true });
-	} catch (err) {
-		if (err instanceof PipelineConfigError) return null;
-		throw err;
-	}
+function loadConfiguredEntrypoints(cwd) {
+	return loadPipelineConfig(cwd, { allowMissingLintFileReferences: true });
 }
 function parseGatewayHostScope(value) {
 	if (value === "project" || value === "global") return value;
@@ -324,7 +327,7 @@ function lintMissingFileReferences(config, projectRoot) {
 		});
 	}
 	return refs.flatMap((ref) => {
-		if (!ref.value || existsSync(resolve(projectRoot, ref.value))) return [];
+		if (!ref.value || standardOutputSchemaNameFromPath(ref.value) || existsSync(resolve(projectRoot, ref.value))) return [];
 		return [{
 			ruleId: "missing-file-reference",
 			message: `${ref.path} references missing file '${ref.value}'`