@ai-dev-methodologies/rlp-desk 0.9.2 → 0.10.0

package/src/commands/rlp-desk.md

@@ -75,13 +75,13 @@ Ask about these items one by one (or in small groups):
 
    | Complexity | Worker | per-US Verifier | Final Verifier | Consensus |
    |------------|--------|-----------------|----------------|-----------|
-   | LOW | gpt-5.4:medium | sonnet | opus | final-only |
-   | MEDIUM | gpt-5.4:medium | opus | opus | final-only |
-   | HIGH | gpt-5.4:high | opus | opus | all |
-   | CRITICAL | gpt-5.4:high | opus | opus + human | all |
+   | LOW | gpt-5.5:medium | sonnet | opus | final-only |
+   | MEDIUM | gpt-5.5:medium | opus | opus | final-only |
+   | HIGH | gpt-5.5:high | opus | opus | all |
+   | CRITICAL | gpt-5.5:high | opus | opus + human | all |
 
    **Worker model selection** (cross-engine):
-   - **gpt-5.4:medium** — default recommendation (full context window, progressive upgrade handles harder US)
+   - **gpt-5.5:medium** — default recommendation (full context window, progressive upgrade handles harder US)
    - **spark:high** — only when US is small enough for spark's 100k context (single-file, AC count <= 4, simple logic). Do NOT use as primary recommendation — spark context window is too small for most tasks
 
    Present complexity score with evidence to the user, e.g.: "I rate this MEDIUM because: US count=4 (MEDIUM), file scope=2 (MEDIUM), logic=conditionals (MEDIUM), deps=none (LOW), impact=modify (MEDIUM). Highest=MEDIUM."
@@ -91,8 +91,8 @@ Ask about these items one by one (or in small groups):
    **If codex is NOT installed** — say: "Codex is not installed. Defaulting to claude-only Worker. Note: without a second engine, your Verifier shares the same perspective as the Worker — there is a risk of blind spots where both Worker and Verifier miss the same issue. To unlock cross-engine coverage: `npm install -g @openai/codex`"
 
 8. **Batch Capacity Check** — when verify-mode is batch and PRD is large:
-   - batch + spark + AC > 4 → warn "spark 100k context limit — switch to gpt-5.4 or split smaller"
-   - batch + gpt-5.4 + AC > 15 → warn "too many ACs for single batch — consider wave split (3-4 US per wave)"
+   - batch + spark + AC > 4 → warn "spark 100k context limit — switch to gpt-5.5 or split smaller"
+   - batch + gpt-5.5 + AC > 15 → warn "too many ACs for single batch — consider wave split (3-4 US per wave)"
    - per-us → no warning (US-level processing, no limit concern)
 9. **Verify Mode** — per-us (default) or batch. Ask: "Verify after each user story (per-us, recommended) or only after all stories are done (batch)?" Default recommendation: per-us for 2+ stories.
 10. **Consensus** — Ask: "Use cross-engine consensus? off (single engine), final-only (cross-engine on final verify only), or all (cross-engine on every verify). Requires codex CLI." Default: off. Recommended: final-only when codex is installed.
@@ -164,26 +164,26 @@ Tell the user:
    Available run commands (copy the one you want):
 
    # ★ Recommended: cross-engine + final-consensus (full context + blind-spot coverage):
-   /rlp-desk run <actual-slug> --mode tmux --worker-model gpt-5.4:medium --consensus final-only --debug
+   /rlp-desk run <actual-slug> --mode tmux --worker-model gpt-5.5:medium --consensus final-only --debug
 
    # Small tasks only (single-file, AC <= 4, simple logic — spark 100k context limit):
    /rlp-desk run <actual-slug> --mode tmux --worker-model spark:high --consensus final-only --debug
 
    # Critical (full consensus on every verify):
-   /rlp-desk run <actual-slug> --mode tmux --worker-model gpt-5.4:high --consensus all --debug
+   /rlp-desk run <actual-slug> --mode tmux --worker-model gpt-5.5:high --consensus all --debug
 
    # Claude-only:
    /rlp-desk run <actual-slug> --debug
 
    # Full options reference:
    #   --mode agent|tmux                      (default: agent)
-   #   --worker-model MODEL                   haiku|sonnet|opus or gpt-5.4:high|spark:high (default: haiku)
+   #   --worker-model MODEL                   haiku|sonnet|opus or gpt-5.5:high|spark:high (default: haiku)
    #   --lock-worker-model                    disable auto model upgrade
    #   --verifier-model MODEL                 per-US verifier (default: sonnet)
    #   --final-verifier-model MODEL           final ALL verifier (default: opus)
    #   --consensus off|all|final-only         cross-engine consensus (default: off)
-   #   --consensus-model MODEL                per-US cross-verifier (default: gpt-5.4:medium)
-   #   --final-consensus-model MODEL          final cross-verifier (default: gpt-5.4:high)
+   #   --consensus-model MODEL                per-US cross-verifier (default: gpt-5.5:medium)
+   #   --final-consensus-model MODEL          final cross-verifier (default: gpt-5.5:high)
    #   --verify-mode per-us|batch             (default: per-us)
    #   --cb-threshold N                       (default: 6)
    #   --max-iter N                           (default: 100)
@@ -192,6 +192,8 @@ Tell the user:
    #   --with-self-verification               post-campaign SV report
    #   --flywheel off|on-fail                 direction review on fail (default: off)
    #   --flywheel-model MODEL                 flywheel reviewer model (default: opus)
+   #   --flywheel-guard off|on                  guard validates flywheel decisions (default: off)
+   #   --flywheel-guard-model MODEL             guard reviewer model (default: opus)
    ```
 
    **If codex is NOT installed** — show claude-only presets + install recommendation:
@@ -222,6 +224,8 @@ Tell the user:
    #   --with-self-verification               post-campaign SV report
    #   --flywheel off|on-fail                 direction review on fail (default: off)
    #   --flywheel-model MODEL                 flywheel reviewer model (default: opus)
+   #   --flywheel-guard off|on                  guard validates flywheel decisions (default: off)
+   #   --flywheel-guard-model MODEL             guard reviewer model (default: opus)
    ```
 
    Replace `<actual-slug>` with the real slug from this init (e.g. `auth-refactor`).
@@ -236,16 +240,16 @@ Tell the user:
 
 Options (parse from `$ARGUMENTS`):
 - `--mode agent|tmux` (default: `agent`) — execution mode
-- `--worker-model MODEL` (default: `haiku`) — Worker model. Format: `model` = claude engine, `model:reasoning` = codex engine. Examples: `haiku`, `sonnet`, `opus`, `spark:high`, `gpt-5.4:high`. Parsed by `parse_model_flag()` which auto-splits engine/model/reasoning.
-- `--lock-worker-model` — disable automatic model upgrade on failure (check_model_upgrade). Worker stays on the specified model regardless of consecutive failures.
+- `--worker-model MODEL` (default: `haiku`) — Worker model. Format: `model` = claude engine, `model:reasoning` = codex engine. Examples: `haiku`, `sonnet`, `opus`, `spark:high`, `gpt-5.5:high`. Parsed by `parse_model_flag()` which auto-splits engine/model/reasoning.
+- `--lock-worker-model` — disable automatic model upgrade on failure. Worker stays on the specified model regardless of consecutive failures.
 - `--verifier-model MODEL` (default: `sonnet`) — per-US verification model. Campaign-fixed (no progressive upgrade). Lighter than final verifier.
 - `--final-verifier-model MODEL` (default: `opus`) — final ALL verification model. Independent from per-US verifier. Used only for the final full-AC verify pass.
 - `--consensus off|all|final-only` (default: `off`) — cross-engine consensus verification mode.
   - `off`: single-engine verification only
   - `all`: cross-engine consensus on every verify (per-US and final)
   - `final-only`: cross-engine consensus only on the final ALL verify
-- `--consensus-model MODEL` (default: `gpt-5.4:medium`) — per-US cross-verifier model. Lighter weight for cost efficiency.
-- `--final-consensus-model MODEL` (default: `gpt-5.4:high`) — final cross-verifier model. Stricter. Note: spark is not allowed here (100k output limit).
+- `--consensus-model MODEL` (default: `gpt-5.5:medium`) — per-US cross-verifier model. Lighter weight for cost efficiency.
+- `--final-consensus-model MODEL` (default: `gpt-5.5:high`) — final cross-verifier model. Stricter. Note: spark is not allowed here (100k output limit).
 - `--verify-mode per-us|batch` (default: `per-us`) — verification strategy
   - `per-us`: verify after each US, then final full verify of all AC
   - `batch`: verify only after all US done (legacy behavior)
@@ -288,8 +292,8 @@ VERIFIER_MODEL=<--verifier-model value, default: sonnet> \
 FINAL_VERIFIER_MODEL=<--final-verifier-model value, default: opus> \
 VERIFY_MODE=<--verify-mode value, default: per-us> \
 CONSENSUS_MODE=<--consensus value, default: off> \
-CONSENSUS_MODEL=<--consensus-model value, default: gpt-5.4:medium> \
-FINAL_CONSENSUS_MODEL=<--final-consensus-model value, default: gpt-5.4:high> \
+CONSENSUS_MODEL=<--consensus-model value, default: gpt-5.5:medium> \
+FINAL_CONSENSUS_MODEL=<--final-consensus-model value, default: gpt-5.5:high> \
 CB_THRESHOLD=<--cb-threshold value, default: 6> \
 ITER_TIMEOUT=<--iter-timeout value, default: 600> \
 DEBUG=<1 if --debug, else 0> \
@@ -469,8 +473,8 @@ Bash("codex exec --model <codex_model> --reasoning-effort <codex_reasoning> <ful
 **⑦b Consensus Verification** (when `--consensus` is `all`, or `final-only` and scope is ALL):
 After the primary verifier runs, run a cross-engine second verifier:
 - Determine cross-verifier model based on scope:
-  - per-US verify → use `--consensus-model` (default: gpt-5.4:medium)
-  - final ALL verify → use `--final-consensus-model` (default: gpt-5.4:high)
+  - per-US verify → use `--consensus-model` (default: gpt-5.5:medium)
+  - final ALL verify → use `--final-consensus-model` (default: gpt-5.5:high)
 - If primary engine is claude → cross-verifier uses codex (the consensus model)
 - If primary engine is codex → cross-verifier uses claude `opus` (fixed)
 - Both produce `verify-verdict.json` (Leader renames to `verify-verdict-claude.json` and `verify-verdict-codex.json`)
@@ -728,13 +732,13 @@ Example:
 
 Run options:
   --mode agent|tmux                    Execution mode (default: agent)
-  --worker-model MODEL                 Worker model: haiku|sonnet|opus or gpt-5.4:high|spark:high (default: haiku)
+  --worker-model MODEL                 Worker model: haiku|sonnet|opus or gpt-5.5:high|spark:high (default: haiku)
   --lock-worker-model                  Disable auto model upgrade on failure
   --verifier-model MODEL               per-US verifier (default: sonnet)
   --final-verifier-model MODEL         Final ALL verifier (default: opus)
   --consensus off|all|final-only       Cross-engine consensus (default: off)
-  --consensus-model MODEL              per-US cross-verifier (default: gpt-5.4:medium)
-  --final-consensus-model MODEL        Final cross-verifier (default: gpt-5.4:high)
+  --consensus-model MODEL              per-US cross-verifier (default: gpt-5.5:medium)
+  --final-consensus-model MODEL        Final cross-verifier (default: gpt-5.5:high)
   --verify-mode per-us|batch           Verification strategy (default: per-us)
   --cb-threshold N                     Consecutive failures before BLOCKED (default: 6)
   --max-iter N                         Max iterations (default: 100)

package/src/governance.md

@@ -14,7 +14,7 @@ The Leader orchestrates, while Worker/Verifier run in isolated fresh contexts ev
 - **Worker must NEVER modify Claude Code settings** (settings.json, settings.local.json). Permission prompts must be reported as blocked, not bypassed by editing settings.
 - **Verifier is independent**: The Verifier judges based on evidence alone, without knowledge of the Worker's reasoning process.
 - **Sentinels are Leader-owned**: Only the Leader writes COMPLETE/BLOCKED sentinels.
-- **Supported engines**: claude (default; models: haiku, sonnet, opus) and codex (opt-in via `--worker-model spark:high` or `--worker-model gpt-5.4:high`).
+- **Supported engines**: claude (default; models: haiku, sonnet, opus) and codex (opt-in via `--worker-model spark:high` or `--worker-model gpt-5.5:high`).
 
 ## 1a. Iron Laws
 
@@ -300,11 +300,11 @@ The Leader decides each iteration. Decision criteria:
 
 ### Codex (opt-in engine)
 
-Model routing uses `--worker-model` and `--verifier-model` with codex format: `spark:high` or `gpt-5.4:high`.
+Model routing uses `--worker-model` and `--verifier-model` with codex format: `spark:high` or `gpt-5.5:high`.
 
 ```
 --worker-model spark:high        # codex worker, spark model, high reasoning
---verifier-model gpt-5.4:high    # codex verifier, gpt-5.4, high reasoning
+--verifier-model gpt-5.5:high    # codex verifier, gpt-5.5, high reasoning
 ```
 
 `parse_model_flag()` auto-detects engine from the model name: plain names (haiku, sonnet, opus) = claude; `name:reasoning` format = codex. Claude is the default engine; codex is explicitly opt-in.
@@ -331,7 +331,7 @@ Agent(
 )
 ```
 
-If `--worker-model` or `--verifier-model` uses codex format (e.g., `spark:high`, `gpt-5.4:high`) (opt-in):
+If `--worker-model` or `--verifier-model` uses codex format (e.g., `spark:high`, `gpt-5.5:high`) (opt-in):
 ```
 # Worker or Verifier (codex engine)
 Bash("codex -m <codex_model> -c model_reasoning_effort=<codex_reasoning> --dangerously-bypass-approvals-and-sandbox <prompt>")
@@ -377,7 +377,7 @@ claude -p "$(cat /path/to/prompt.md)" \
 When `WORKER_ENGINE=codex` or `VERIFIER_ENGINE=codex`, the `codex` CLI is used instead:
 ```bash
 # codex engine (opt-in)
-codex -m gpt-5.4 \
+codex -m gpt-5.5 \
   -c model_reasoning_effort="high" \
   --dangerously-bypass-approvals-and-sandbox \
   "$(cat /path/to/prompt.md)"
@@ -483,6 +483,19 @@ for iteration in 1..max_iter:
      parsing memory.md. In Agent() mode, the Leader MAY read iter-signal.json
      as a structured alternative to parsing the Stop Status from memory.md.
 
+  ⑥½ Flywheel direction review (when --flywheel on-fail and consecutive_failures > 0)
+     - Dispatch Flywheel agent (fresh context, --flywheel-model)
+     - Read flywheel-signal.json for direction decision (hold/pivot/reduce/expand)
+     - If --flywheel-guard on:
+       - Dispatch Guard agent (fresh context, --flywheel-guard-model)
+       - Read flywheel-guard-verdict.json:
+         • pass → proceed to Worker with updated contract
+         • pass + analysis_only → skip Worker, record analysis, next iteration
+         • fail → re-run Flywheel with guard feedback (max 2 retries)
+         • fail + retries exhausted → BLOCKED
+         • inconclusive → BLOCKED (escalate to user)
+       - Guard count tracked per-US in status.json
+
   ⑦ Execute Verifier (see §7a for per-US and §7b for consensus details)
      - Build prompt (scoped to us_id if per-us mode) → log
      - Agent(subagent_type="executor", model=selected, prompt=prompt)
@@ -556,9 +569,9 @@ Worker completes US → signal verify
 
 | Scenario | Primary verifier | Cross verifier |
 |----------|-----------------|----------------|
-| per-US, primary=claude | `--verifier-model` (sonnet) | `--consensus-model` (gpt-5.4:medium) |
+| per-US, primary=claude | `--verifier-model` (sonnet) | `--consensus-model` (gpt-5.5:medium) |
 | per-US, primary=codex | `--verifier-model` | claude opus (fixed) |
-| final, primary=claude | `--final-verifier-model` (opus) | `--final-consensus-model` (gpt-5.4:high) |
+| final, primary=claude | `--final-verifier-model` (opus) | `--final-consensus-model` (gpt-5.5:high) |
 | final, primary=codex | `--final-verifier-model` | claude opus (fixed) |
 
 - Both must pass. No engine priority.

package/src/model-upgrade-table.md

@@ -18,14 +18,14 @@ CB default: 6. Override: `--cb-threshold N`. Worker only — Verifier fixed at c
 | HIGH | gpt-5.3-codex-spark:high | gpt-5.3-codex-spark:xhigh | gpt-5.3-codex-spark:xhigh | BLOCKED |
 | CRITICAL | gpt-5.3-codex-spark:xhigh | gpt-5.3-codex-spark:xhigh | gpt-5.3-codex-spark:xhigh | BLOCKED |
 
-## Non-Pro (gpt-5.4)
+## Non-Pro (gpt-5.5)
 
 | Complexity | 1-2 | 3-4 | 5-6 | 7+ |
 |------------|-----|-----|-----|-----|
-| LOW | gpt-5.4:low | gpt-5.4:medium | gpt-5.4:high | BLOCKED |
-| MEDIUM | gpt-5.4:medium | gpt-5.4:high | gpt-5.4:xhigh | BLOCKED |
-| HIGH | gpt-5.4:high | gpt-5.4:xhigh | gpt-5.4:xhigh | BLOCKED |
-| CRITICAL | gpt-5.4:xhigh | gpt-5.4:xhigh | gpt-5.4:xhigh | BLOCKED |
+| LOW | gpt-5.5:low | gpt-5.5:medium | gpt-5.5:high | BLOCKED |
+| MEDIUM | gpt-5.5:medium | gpt-5.5:high | gpt-5.5:xhigh | BLOCKED |
+| HIGH | gpt-5.5:high | gpt-5.5:xhigh | gpt-5.5:xhigh | BLOCKED |
+| CRITICAL | gpt-5.5:xhigh | gpt-5.5:xhigh | gpt-5.5:xhigh | BLOCKED |
 
 ## Claude-only
 

package/src/node/run.mjs

@@ -11,8 +11,8 @@ const RUN_DEFAULTS = {
   verifierModel: 'sonnet',
   finalVerifierModel: 'opus',
   consensusMode: 'off',
-  consensusModel: 'gpt-5.4:medium',
-  finalConsensusModel: 'gpt-5.4:high',
+  consensusModel: 'gpt-5.5:medium',
+  finalConsensusModel: 'gpt-5.5:high',
   verifyMode: 'per-us',
   cbThreshold: 6,
   maxIterations: 100,
@@ -23,6 +23,8 @@ const RUN_DEFAULTS = {
   withSelfVerification: false,
   flywheel: 'off',
   flywheelModel: 'opus',
+  flywheelGuard: 'off',
+  flywheelGuardModel: 'opus',
 };
 
 function write(stream, value) {
@@ -61,6 +63,8 @@ function buildHelpText() {
     '  --with-self-verification',
     '  --flywheel off|on-fail',
     '  --flywheel-model MODEL',
+    '  --flywheel-guard off|on',
+    '  --flywheel-guard-model MODEL',
     '  --help',
   ].join('\n');
 }
@@ -154,6 +158,14 @@ function parseRunOptions(args, cwd) {
         options.flywheelModel = consumeValue(args, index, token);
         index += 1;
         break;
+      case '--flywheel-guard':
+        options.flywheelGuard = consumeValue(args, index, token);
+        index += 1;
+        break;
+      case '--flywheel-guard-model':
+        options.flywheelGuardModel = consumeValue(args, index, token);
+        index += 1;
+        break;
       default:
         throw new Error(`unknown option: ${token}`);
     }

package/src/node/runner/campaign-main-loop.mjs

@@ -26,9 +26,9 @@ const execFileAsync = promisify(execFile);
 const REQUIRED_SCAFFOLD_NAMES = ['workerPrompt', 'verifierPrompt', 'memoryFile', 'prdFile', 'testSpecFile'];
 const CLAUDE_MODELS = new Set(['haiku', 'sonnet', 'opus']);
 const MODEL_UPGRADES = {
-  'gpt-5.4:medium': 'gpt-5.4:high',
-  'gpt-5.4:high': 'gpt-5.4:xhigh',
-  'gpt-5.4:xhigh': 'BLOCKED',
+  'gpt-5.5:medium': 'gpt-5.5:high',
+  'gpt-5.5:high': 'gpt-5.5:xhigh',
+  'gpt-5.5:xhigh': 'BLOCKED',
   'gpt-5.3-codex-spark:medium': 'gpt-5.3-codex-spark:high',
   'gpt-5.3-codex-spark:high': 'gpt-5.3-codex-spark:xhigh',
   'gpt-5.3-codex-spark:xhigh': 'BLOCKED',
@@ -63,6 +63,8 @@ function buildPaths(rootDir, slug) {
     statusFile: path.join(campaignLogDir, 'runtime', 'status.json'),
     flywheelPromptFile: path.join(deskRoot, 'prompts', `${slug}.flywheel.prompt.md`),
     flywheelSignalFile: path.join(deskRoot, 'memos', `${slug}-flywheel-signal.json`),
+    flywheelGuardPromptFile: path.join(deskRoot, 'prompts', `${slug}.flywheel-guard.prompt.md`),
+    flywheelGuardVerdictFile: path.join(deskRoot, 'memos', `${slug}-flywheel-guard-verdict.json`),
 };
 }
 
@@ -257,6 +259,7 @@ async function readCurrentState(paths, slug, options) {
     leader_pane_id: status.leader_pane_id ?? null,
     worker_pane_id: status.worker_pane_id ?? null,
     verifier_pane_id: status.verifier_pane_id ?? null,
+    flywheel_guard_count: status.flywheel_guard_count ?? {},
     started_at_utc: startedAt,
   };
 }
@@ -412,12 +415,32 @@ async function dispatchFlywheel({ paths, sendKeys, flywheelPaneId, flywheelModel
   await sendKeys(flywheelPaneId, triggerCmd);
 }
 
+function buildGuardTriggerCmd({ guardPromptFile, guardModel, rootDir }) {
+  return `cd ${JSON.stringify(rootDir)} && DISABLE_OMC=1 claude --model ${guardModel} --no-mcp -p "$(cat ${JSON.stringify(guardPromptFile)})"`;
+}
+
+async function dispatchGuard({ paths, sendKeys, guardPaneId, guardModel, rootDir }) {
+  const triggerCmd = buildGuardTriggerCmd({
+    guardPromptFile: paths.flywheelGuardPromptFile,
+    guardModel,
+    rootDir,
+  });
+  await sendKeys(guardPaneId, triggerCmd);
+}
+
 export function shouldRunFlywheel(flywheelMode, state) {
   if (flywheelMode === 'off') return false;
   if (flywheelMode === 'on-fail' && (state.consecutive_failures ?? 0) > 0) return true;
   return false;
 }
 
+export function shouldRunGuard(flywheelGuard, state, usId) {
+  if (flywheelGuard !== 'on') return false;
+  const count = (state.flywheel_guard_count ?? {})[usId] ?? 0;
+  if (count >= 3) return false;
+  return true;
+}
+
 export async function run(slug, options = {}) {
   const rootDir = path.resolve(options.rootDir ?? process.cwd());
   const paths = buildPaths(rootDir, slug);
@@ -553,9 +576,76 @@ export async function run(slug, options = {}) {
       });
 
       state.last_flywheel_decision = flywheelSignal.decision;
-      // Campaign memory already updated by flywheel agent
-      // Clean signal file for next iteration
       await fs.unlink(paths.flywheelSignalFile).catch(() => {});
+
+      // Flywheel Guard (independent validation of flywheel decision)
+      if (shouldRunGuard(options.flywheelGuard ?? 'off', state, state.current_us)) {
+        state.phase = 'guard';
+        await writeStatus(paths, state, options.onStatusChange, options.now);
+
+        const guardPaneId = state.flywheel_pane_id ?? state.verifier_pane_id;
+        const guardModel = options.flywheelGuardModel ?? 'opus';
+
+        await dispatchGuard({ paths, sendKeys, guardPaneId, guardModel, rootDir });
+
+        const guardVerdict = await pollForSignal(paths.flywheelGuardVerdictFile, {
+          mode: 'claude',
+          paneId: guardPaneId,
+        });
+
+        if (!state.flywheel_guard_count[state.current_us]) {
+          state.flywheel_guard_count[state.current_us] = 0;
+        }
+        state.flywheel_guard_count[state.current_us] += 1;
+
+        await fs.unlink(paths.flywheelGuardVerdictFile).catch(() => {});
+
+        if (guardVerdict.verdict === 'inconclusive') {
+          state.phase = 'blocked';
+          await writeSentinel(paths.blockedSentinel, 'blocked', state.current_us);
+          await writeStatus(paths, state, options.onStatusChange, options.now);
+          return {
+            status: 'blocked',
+            usId: state.current_us,
+            reason: 'flywheel-guard-escalate-inconclusive',
+            guardIssues: guardVerdict.issues,
+            statusFile: paths.statusFile,
+          };
+        }
+
+        if (guardVerdict.verdict === 'fail') {
+          if (state.flywheel_guard_count[state.current_us] >= 3) {
+            state.phase = 'blocked';
+            await writeSentinel(paths.blockedSentinel, 'blocked', state.current_us);
+            await writeStatus(paths, state, options.onStatusChange, options.now);
+            return {
+              status: 'blocked',
+              usId: state.current_us,
+              reason: 'flywheel-guard-retries-exhausted',
+              guardIssues: guardVerdict.issues,
+              statusFile: paths.statusFile,
+            };
+          }
+          // Retry: skip Worker, continue to next iteration (flywheel will re-run)
+          state.phase = 'worker';
+          await writeStatus(paths, state, options.onStatusChange, options.now);
+          state.iteration += 1;
+          continue;
+        }
+
+        // verdict === 'pass'
+        if (guardVerdict.analysis_only) {
+          state.phase = 'worker';
+          await writeStatus(paths, state, options.onStatusChange, options.now);
+          state.iteration += 1;
+          continue;
+        }
+      }
+
+      // Reset guard count on pass (flywheel direction accepted)
+      if (state.flywheel_guard_count[state.current_us]) {
+        state.flywheel_guard_count[state.current_us] = 0;
+      }
     }
 
     state.phase = 'worker';