[exim] Hints needed to run forwarded messages through a pipe

I currently use an SQL lookup and a redirect driver to handle forwarding
through a machine we user exclusively for mail forwarding - it
forwards messages that come through our spam filter appliance that are
"alias" accounts, or relays messages that are destined to our local
domains to a local spool server.

What I'd like to do is send messages with recipients that are "forward
users" (as picked up by the sql_aliases router shown below) through a
pipe, so the pipe can check and add some headers, and then re-inject
into the queue as a new outbound message. Procmail will NOT be used for
local deliveries (there should be no local deliveries on this system, as
it's only used to forward mail)

Would something like this work? How would i separate the task into a
router and a transport?

fwd_procmail:
local_parts = ${lookup mysql {SELECT user FROM virtuser WHERE
user='$local_part' AND domain='$domain' AND is_alias='Y' AND active
='Y'}{$value}}
driver = pipe
user = mailpriv
path = "/usr/local/exim/bin:/usr/bin:/usr/local/bin"
command = "forward_prog -f '$header_from' -r
'${local_part}@${domain}' -t '${lookup mysql {SELECT alias FROM
email_virtuser WHERE user='$local_part' AND domain='$domain' AND
is_alias='Y' AND active='Y'}{$value}}'"

Has someone already done this, or can point me to an example or previous
message that shows how?

Here's my current router specification to determine if a recipient
should be forwarded:

cis_aliases:
# the local parts must match output of sql, otherwise skip this router
local_parts = ${lookup mysql {SELECT user FROM virtuser WHERE
user='$local_part' AND domain='$domain' AND is_alias='Y' AND active
='Y'}{$value}}
driver = redirect
allow_fail
allow_defer
data = ${lookup mysql {SELECT alias FROM email_virtuser WHERE
user='$local_part' AND domain='$domain' AND is_alias='Y' AND
active='Y'}{$value}}
file_transport = address_file
pipe_transport = address_pipe