Remove unused pipeline process stage (#26)

Author: bomly-guy

AGENTS.md

@@ -43,7 +43,7 @@ See [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for full detail. Component ma
 | `internal/testutil`    | Test helpers (fake binary builder)                                                                |
 | `internal/system`      | OS-level helpers                                                                                  |
 
-Scan pipeline: `runtimePreparation → subprojectDiscovery → preResolveHooks → detect (per-package-manager chains) → scopeFilter → consolidate → match (license enrichment on the consolidated graph) → commandProcess → audit → postResolveHooks → format`.
+Scan pipeline: `runtimePreparation → subprojectDiscovery → preResolveHooks → detect (per-package-manager chains) → scopeFilter → consolidate → match (license enrichment on the consolidated graph) → audit → postResolveHooks → format`.
 
 Runtime preparation is owned by `internal/engine`: build the filtered registry once, index the execution target with that same registry, and reuse the prepared runtime for `scan`, `diff`, `explain`, license enrichment, and auditing. The CLI resolves raw execution targets and flags, but it must not discover subprojects with a separate registry.
 

CLAUDE.md

@@ -72,7 +72,7 @@ internal/testutil/               Test helpers (fake binary builder)
 
 **`bomly explain`** is implemented by `newExplainCmd` in `internal/cli/explain_cmd.go`.
 
-**Scan pipeline order**: `runtimePreparation → subprojectDiscovery → preResolveHooks → detect (per-package-manager chains) → scopeFilter → consolidate → match (license enrichment) → commandProcess → audit → postResolveHooks → format`
+**Scan pipeline order**: `runtimePreparation → subprojectDiscovery → preResolveHooks → detect (per-package-manager chains) → scopeFilter → consolidate → match (license enrichment) → audit → postResolveHooks → format`
 
 Runtime preparation is owned by `internal/engine` and is reached through CLI option helpers before pipeline execution. The CLI resolves raw targets and flags but must not discover subprojects with a separate registry.
 

docs/ARCHITECTURE.md

@@ -28,9 +28,8 @@ flowchart TD
     E --> F[Run detector chains]
     F --> G[Consolidate graph]
     G --> H[Optional package enrichment]
-    H --> I[Command-specific processing]
-    I --> J[Optional policy evaluation]
-    J --> K[Render report or SBOM]
+    H --> I[Optional policy evaluation]
+    I --> J[Render report or SBOM]
 ```
 
 ## Execution Targets
@@ -53,7 +52,7 @@ flowchart LR
     A[Runtime preparation]
     B[Subproject discovery]
     C[Detector chains]
-    D[Scope filtering and command processing]
+    D[Scope filtering]
     E[Graph consolidation]
     F[Matchers]
     G[Auditors]
@@ -67,13 +66,14 @@ Stage summary:
 1. Runtime preparation builds the filtered registry and execution plan.
 2. Subproject discovery finds supported package-manager roots for the target.
 3. Detector chains resolve dependency graphs per package manager.
-4. Command processing applies scope filtering or focused queries when needed.
+4. Scope filtering applies requested dependency scopes before consolidation.
 5. Consolidation merges subproject graphs into a unified view.
 6. Matchers enrich packages with additional metadata such as licenses, EOL status, and vulnerability records.
-7. Command processing applies focused graph transforms such as scope filtering or explain-path selection.
-8. Auditors evaluate policy against whatever vulnerability data is already present on packages and create findings when `--audit` is enabled.
-9. Users combine `--enrich --audit` when they want external matcher data to feed policy evaluation in the same run.
-10. Output rendering emits text, JSON, SARIF, or SBOM documents.
+7. Auditors evaluate policy against whatever vulnerability data is already present on packages and create findings when `--audit` is enabled.
+8. Users combine `--enrich --audit` when they want external matcher data to feed policy evaluation in the same run.
+9. Output rendering emits text, JSON, SARIF, or SBOM documents.
+
+`bomly explain` reuses the same resolution, scope filtering, consolidation, and matching stages, then performs dependency path selection in its explain orchestration before optional component audit.
 
 ## Detector and Auditor Model
 

internal/engine/pipeline.go

@@ -11,7 +11,7 @@ import (
 )
 
 // Pipeline orchestrates a full scan through a sequence of typed stages:
-// pre-resolve hooks -> detect -> consolidate -> match -> process -> audit -> post-resolve hooks.
+// pre-resolve hooks -> detect -> scope filter -> consolidate -> match -> audit -> post-resolve hooks.
 type Pipeline struct {
 	Registry *Registry
 	Logger   *zap.Logger
@@ -49,9 +49,6 @@ func (p *Pipeline) Run(ctx context.Context, req PipelineRequest) (PipelineResult
 		return result, err
 	}
 	p.runMatch(ctx, &result, req)
-	if err := p.runProcessor(ctx, &result, req); err != nil {
-		return result, err
-	}
 	p.runAudit(ctx, &result, req)
 	p.runPost(ctx, req, result)
 	return result, nil
@@ -124,16 +121,6 @@ func (p *Pipeline) runMatch(ctx context.Context, result *PipelineResult, req Pip
 	}
 }
 
-func (p *Pipeline) runProcessor(ctx context.Context, result *PipelineResult, req PipelineRequest) error {
-	if req.Processor == nil {
-		return nil
-	}
-	if err := req.Processor(ctx, result); err != nil {
-		return fmt.Errorf("stage processor: %w", err)
-	}
-	return nil
-}
-
 func (p *Pipeline) runAudit(ctx context.Context, result *PipelineResult, req PipelineRequest) {
 	if !req.AuditEnabled || result.Graph == nil {
 		return

internal/engine/pipeline_explain.go

@@ -38,7 +38,6 @@ func (p *Pipeline) RunExplain(ctx context.Context, req ExplainRequest) (ExplainR
 	pipeReq := req.Pipeline
 	auditEnabled := pipeReq.AuditEnabled
 	pipeReq.AuditEnabled = false
-	pipeReq.Processor = nil
 
 	base := PipelineResult{}
 	if err := p.runPre(ctx, pipeReq); err != nil {

internal/engine/pipeline_test.go

@@ -394,37 +394,6 @@ func TestPipeline_Run_ProducesConsolidatedResult(t *testing.T) {
 	}
 }
 
-func TestPipeline_Run_WithStageProcessor(t *testing.T) {
-	registry := newTestRegistry()
-	registry.registerDetector(fakeDetector{
-		descriptor: DetectorDescriptor{Name: "npm-detector", Enabled: true, SupportedEcosystems: []Ecosystem{EcosystemNPM}, SupportedManagers: []PackageManager{PackageManagerNPM}, SupportedModes: []TargetMode{TargetModeFullGraph}},
-		result:     ResolveGraphResult{Graphs: SingleGraphContainer(sdk.New(), sdk.ManifestMetadata{Path: "package-lock.json", Kind: "package-lock.json"})},
-	})
-
-	processorCalled := false
-	pipeline := NewPipeline(registry, zap.NewNop())
-	result, err := pipeline.Run(context.Background(), PipelineRequest{
-		Subprojects: []Subproject{{
-			ExecutionTarget:         ExecutionTarget{Kind: ExecutionTargetFilesystem, Location: "/repo"},
-			RelativePath:            ".",
-			PrimaryDetector:         "npm-detector",
-			DetectedPackageManagers: []PackageManager{PackageManagerNPM},
-			Ecosystem:               EcosystemNPM,
-		}},
-		Processor: func(_ context.Context, r *PipelineResult) error {
-			processorCalled = true
-			return nil
-		},
-	})
-	if err != nil {
-		t.Fatalf("Run() error = %v", err)
-	}
-	if !processorCalled {
-		t.Fatal("expected stage processor to be called")
-	}
-	_ = result
-}
-
 func TestPipeline_Run_DeduplicatesAuditFindings(t *testing.T) {
 	registry := newTestRegistry()
 	g := sdk.New()

internal/engine/types.go

@@ -1,7 +1,6 @@
 package engine
 
 import (
-	"context"
 	"io"
 
 	"github.com/bomly-dev/bomly-cli/internal/engine/hooks"
@@ -19,16 +18,11 @@ type (
 	PostResolveHook    = hooks.PostResolveHook
 )
 
-// StageProcessor is a command-specific graph manipulation step injected into the
-// pipeline between consolidation and audit. Return a non-nil error to abort.
-type StageProcessor func(context.Context, *PipelineResult) error
-
 // PipelineRequest defines input for a full pipeline run.
 type PipelineRequest struct {
 	ProjectPath     string
 	ExecutionTarget sdk.ExecutionTarget
 	Subprojects     []sdk.Subproject
-	Processor       StageProcessor
 	EnrichEnabled   bool
 	MatchEnabled    bool
 	AuditEnabled    bool