# Pipeline ordering

The recommended `all` pipeline follows this order:

1. discovery and capability detection;
2. Git status and manifest backup;
3. Node cleanup of discovered `.next` and `node_modules` directories;
4. npm lockfile import and npm-to-pnpm migration;
5. seven-day pnpm release-age policy enforcement;
6. npm-check-updates or native/fallback NuGet updates;
7. pnpm install and dotnet restore;
8. dedupe or NuGet version consolidation;
9. native security audits and optional signatures/SBOM;
10. lint, format, typecheck, build, and tests;
11. Syncpack, Knip, Dependency Cruiser, Publint, ATTW, and JSCPD;
12. optional OSV, Trivy, and Stryker deep checks;
13. summary, artifacts, backup path, and rollback guidance.

A project failure does not invalidate unrelated project results when keep-going mode is active. The final status remains unsuccessful when a selected mandatory gate fails.