feat: language-agnostic pipeline

[pontino]

Context

The agentic mode is language-agnostic (tested with TypeScript, Python, Go). But the surrounding pipeline is hardcoded for TypeScript/Angular.

Problem

Layer	Issue
Analyze stage	changed-files.ts:108 filters to .ts files only. Logs say "TypeScript files".
Fix stage	Generates .test.ts files, uses ```typescript code fences
Report stage	Angular-specific knowledge source filtering, Angular doc links in formatters
Documentation loading	.qualops/unified-docs/ only has Angular, NgRx, RxJS, OWASP
Batch processor	Logs reference "TypeScript files"

The --files flag bypasses the .ts filter (which is why Python/Go e2e tests worked), but git-based mode is broken for non-TS repos.

Scope

Must-have (unblock non-TS repos)

• Remove .ts filter in changed-files.ts — detect files by configurable patterns (default: common source extensions)
• Add fileExtensions or filePatterns config field to control which files are analyzed
• Fix log messages to not say "TypeScript"

Nice-to-have (full language support)

• Fix stage: detect language from file extension for test generation and code fences
• Report stage: make knowledge source filtering generic (not Angular-hardcoded)
• Documentation loading: support user-provided docs for any framework

Key files

src/stages/analyze/git/changed-files.ts:108  (the .ts filter)
src/stages/analyze/index.ts                  (log messages)
src/stages/analyze/processors/batch-processor.ts
src/stages/fix/generators/test-generator.ts
src/stages/fix/generators/fix-generator.ts
src/stages/report/html-report.ts
src/stages/report/templates/components.ts
src/stages/report/utils/formatters.ts

Estimate

~8 hours for must-have, ~15 hours for full language support

[sebastianwessel]

Suggestion: A skill-based approach to multi-language support

Had a look into the codebase to understand the full picture here. The must-have list in the issue nails the core problem — the .ts gate in changed-files.ts:108 is the single hard blocker, and the rest are scattered defaults that assume TypeScript.

But there's something interesting: the pipeline already behaves like a skill system without calling it one. A job with filePatterns-filtered passes and a language-specific prompt is a language skill. The Python example config already reviews Python code with **/*.py patterns and a dedicated review prompt — zero pipeline code changes needed. So rather than patching each hardcoded spot, we could formalize this pattern and make it composable.

Proposed: Language skills following Anthropic's skill conventions

Following Anthropic's skill structure — SKILL.md with YAML frontmatter, kebab-case folders, progressive disclosure, and description-as-trigger:

skills/
  reviewing-python/
    SKILL.md                  # Frontmatter (metadata + pipeline) + body (= review prompt)
    references/               # Deep-dive docs loaded on-demand per pass
      fastapi-patterns.md
      async-best-practices.md
  reviewing-typescript/
    SKILL.md
    references/
      angular-patterns.md
      react-patterns.md
  reviewing-go/
    SKILL.md
    references/
      concurrency-patterns.md
  auditing-security/          # Cross-cutting, not a language
    SKILL.md

The SKILL.md body is the review prompt — no separate prompt files. The frontmatter declares language metadata and pipeline passes:

---
name: reviewing-python
description: >
  Reviews Python code for quality, security, and best practices.
  Activates when changed files include .py extensions.
  Covers error handling, async patterns, FastAPI, type hints, database access.

language:
  extensions: [".py", ".pyx", ".pyi"]
  exclude-patterns: ["**/__pycache__/**", "**/*.pyc", "**/venv/**", "**/.venv/**"]
  test-patterns: ["**/test_*.py", "**/*_test.py", "**/conftest.py"]
  code-block-language: python

passes:
  - name: error-handling
    filters:
      file-patterns: ["**/*.py"]
      exclude-patterns: ["**/test_*.py", "**/*_test.py"]
      detection-triggers: ["except", "try:", "raise", "finally:"]
  - name: async-patterns
    filters:
      file-patterns: ["**/*.py"]
      detection-triggers: ["async def", "await ", "asyncio", "gather\\("]
  - name: fastapi-endpoints
    filters:
      file-patterns: ["**/api/**/*.py", "**/routes/**/*.py", "**/main.py"]
      detection-triggers: ["@app\\.", "@router\\.", "FastAPI\\(", "HTTPException"]
    references: ["fastapi-patterns.md"]
---

# Python Code Quality Review

You are an expert Python code reviewer with deep knowledge of modern Python
practices, async programming, and software engineering best practices.

## Review Focus Areas

### Error Handling & Exceptions
- Generic exception catching (e.g., `except Exception:`)
- Missing error context or helpful error messages
...

Key design choices:

• Skill body = review prompt — keeps everything in one place, the prompt is the skill
• description is the trigger — QualOps uses it for auto-detection (extension match) and logging
• references/ for deep content — framework-specific docs loaded only when a pass declares them (progressive disclosure)
• passes in frontmatter — structural config lives in YAML, review prose lives in the body
• Kebab-case, gerund naming — reviewing-python, auditing-security per Anthropic conventions

Mixed-repo support comes naturally

For a repo with a Go backend and React frontend, multiple skills activate and each skill's passes filter to their own files:

{ "review": { "skills": ["reviewing-typescript", "reviewing-go", "auditing-security"] } }

Or omit skills entirely — auto-detect from changed file extensions. The pipeline executor doesn't change at all; it already processes multiple jobs with file-pattern filtering.

Mapping back to the issue checklist

Issue item	How skills address it
Remove .ts filter in changed-files.ts	Core change: replace with config-driven filtering, no extension gate
Add fileExtensions / filePatterns config	Each skill declares language.extensions; auto-detection activates matching skills
Fix log messages ("TypeScript files")	Use skill name from description instead of hardcoded strings
Fix stage: detect language for code fences	Skill provides language.code-block-language
Report stage: generic knowledge filtering	Skills bundle their own references/; no Angular assumption
Documentation loading for any framework	Per-pass references field loads from the skill's references/ directory

Implementation path

Phase 1 — Remove the gates (the must-have list):

• Replace .endsWith('.ts') with config-driven filtering
• Make skip/test patterns configurable
• Pass detected language to fix code fences

Phase 2 — Skill system:

• Define SKILL.md frontmatter schema
• Extract current TypeScript defaults into reviewing-typescript/SKILL.md
• Move existing Python prompt into reviewing-python/SKILL.md
• Add review.skills config field + extension-based auto-detection
• Skill loader parses frontmatter, merges passes into pipeline

Phase 3 — Expand:

• Ship Go, Rust, Java skills
• Cross-cutting skills (auditing-security, reviewing-api-contracts)
• User-defined skills in .qualops/skills/

Adding a new language becomes "create a SKILL.md with frontmatter + review prompt" — no core code changes needed.