feature/Scaffold-skill · L-260906-8ac105 — front door to a project not yet made

[lchoquel]

Adds pipelex-scaffold, the plugin's front door for a user who has a method but no project: it acquires one of the two Pipelex starters and drives that clone's own bootstrap skill, or runs the ecosystem's initializer when the user wants their own framework, and hands the result to /pipelex-integrate. The work was cut out of #18 so the integrate half could land alone; this branch takes dev as a merge rather than a rebase, which keeps the recorded review passes reachable, and the integrate skill's two forward references to /pipelex-scaffold are restored now that the skill ships.

It also implements the founder's ruling on L-260912-724b71: a directory holding nothing but .git reads as empty and is written into, while everything else goes on refusing. The cruft list was declined in that ruling, so the exception is written as one directory entry named .git rather than a predicate over ignorable files, and the test pins .DS_Store, .idea/, .vscode/ and Thumbs.db as still refusing.

Closes L-260906-8ac105

🤖 Generated with Claude Code

---

Summary by cubic

Adds pipelex-scaffold, the front door for a user who has a method but no project: it clones one of the two Pipelex starters and runs that clone's own bootstrap skill, or runs the ecosystem's initializer when the user wants their own framework, then hands the result to /pipelex-integrate. Closes L-260906-8ac105 and restores /pipelex-integrate's two forward references to the skill.

New Features

• Ships in all three plugin targets with no MCP dependency, plus references/starters.md and references/initializers.md.

Bug Fixes

• Implements the L-260912-724b71 ruling: a directory holding only .git reads as empty; any other entry refuses, with .DS_Store, .idea/, .vscode/, and Thumbs.db pinned as refusing.
• Branch A honors that state by cloning into a temp path beside the target and copying the starter's contents in, preserving the user's repository; the destination is resolved first so . and paths with spaces work, and a test executes the recipe against real directory states.
• pipelex-integrate now offers /pipelex-scaffold when no project exists instead of stopping.
• Scaffold recipes and references now agree: uv init uses --no-workspace, key writes never duplicate an existing value, the pristine commit scopes staging and commit, says what it will stage, and asks, starter clone blocks name one starter, gh repo create --clone handles its actual destination, and the minimal TypeScript recipe skips mkdir <dir>.
• The initializer branch locks the Python project before the hand-off, since uv init writes no lock file and pipelex-integrate reads an absent one as pip.
• The fresh-clone shortcut and template-checkout stop no longer share a detection signal; the discipline test covers the template and all three renders.

^{Written for commit 96bb083. Summary will update on new commits.}

[lchoquel]

Review round 1 — bar open — reviewed d53f3cf, now at 51395ef

Reviewers that produced a review: cubic, Codex review (gpt-6-astra, high effort), Codex adversarial (gpt-6-astra, medium, verdict needs-attention / "do not ship yet"), and the official code-review. The round was raised from profile 3 to 4 mid-flight, so the parameters are mixed: the Codex review pass ran at 3's settings and the adversarial pass at 4's. code-review was invoked at medium but announced minimal, so its coverage is shallower than the profile asked for — recorded rather than smoothed over.

Fixed in 51395ef, each verified in the tree before it was touched:

• The named-framework recipe prescribed a bare uv init --package <dir> while references/initializers.md states in bold that --no-workspace is on every uv init — so the executable line appended a [tool.uv.workspace] table to the user's own pyproject.toml. Raised independently by three reviewers. The discipline test pinned the rule in the reference and never in the skill body, which is how the half-application shipped; it now runs on the template and all three renders.
• The key write was an unconditional append. On the fresh-clone shortcut it landed a second PIPELEX_API_KEY after one the user had filled, and every dotenv reader resolves a repeated name to the later line — a stale exported value silently replacing a working key while the report said theirs was kept. Now gated on a file-side presence test.
• git -C <dir> add -A -- . bounds the staging, but the bare git commit after it commits the whole index. Demonstrated: a file staged elsewhere in an enclosing repository was committed under this skill's message. Both commits carry the pathspec now, and the guard's description says what it actually guarantees.
• gh repo create --clone takes no destination and clones into ./<name>, which every later step addressed as <dir>.
• The minimal TypeScript recipe opened with mkdir <dir>, which aborts its own && chain when <dir> is the "here" directory the skill permits (mkdir: .: File exists).
• The fresh-clone shortcut and the template-checkout stop shared a detection signal and prescribed opposite actions.
• The default TypeScript row prescribed the resolution the same file calls broken; the caveat is now where the command is chosen.

Deferred with traces:

• A directory holding only .git — which the 2026-09-13 ruling admits — is one branch A cannot clone into: git clone refuses it, while branch B's uv init succeeds on the identical directory. Every fix changes behaviour that was ruled on, so it is a decision item rather than an edit.
• A branch-B .env that nothing loads was rediscovered; it was already open and needed no new trace.
• The remaining confirmed-but-minor findings are recorded in wip/pipelex-integrate/scaffold-review-deferrals.md.

make agent-check and make agent-test both pass at the tip. No version bump: version-check.yml fires only on pull requests into main or release/*, and this repo accumulates under [Unreleased] with /release moving targets/prod.toml.

[lchoquel]

Review round 2 — bar defects — reviewed 3a57f7d, now at 96bb083

Reviewers that produced a review: cubic, Codex review and Codex adversarial (both gpt-6-astra at medium, profile 4's mode = "both"), and the official code-review. Note for the record that code-review announced no effort level at all, despite medium being passed explicitly — so the depth it actually ran at is not confirmable from its own output.

Seven findings fixed. The sharpest was found independently by three of us: the preserving acquisition derived its temporary path from the destination's spelling, and dirname . is . — so a destination given as ., which is the ordinary one since the user is standing in the directory they just git init-ed, put the temporary clone inside the target, where the emptiness re-check found it beside .git and refused. The acquisition served every shape except the one the ruling exists for. It was invisible because every recipe test bound the destination to an absolute path; there is now an execution test spelled . and ./, proven to fail against the old form.

Where the rest sit is the decision signal. In the ruling's implementation (3a57f7d): that one, plus the references carrying both starters' clone URLs on consecutive lines of a block whose own prose calls it one chain. In round 1's own fixes (51395ef): its -- . pathspec rule reached the skill body and not the reference, while its changelog line said both commits carried it — the same half-application round 1 was convened to fix, mirrored. In the original work: the initializers reference prescribing the inference the body forbids by name, the lone-.git rule justifying itself with a git init that must not run in that case, the Mode section's confirmation carve-out that the ruling made false on all three grounds, and branch B handing over a Python project with neither lock file nor environment.

Five findings deferred with traces in wip/pipelex-integrate/scaffold-review-deferrals.md, including the .git-as-a-file case, which was weighed deliberately and left: branch B accepts the identical directory through rev-parse --show-toplevel, so narrowing branch A alone would re-create the A/B disagreement L-260913-f28d9d was ruled to remove.

make agent-check and make agent-test both green at 96bb083.