@gobing-ai/spur 0.2.12 → 0.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.2.12",
+    "version": "0.3.0",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",

package/spur-cli/config/workflows/idea-pipeline.yaml

@@ -17,6 +17,8 @@
 #   idea     — the idea text (required), e.g. --vars '{"idea":"add a --dry-run flag to dev-wrap"}'
 #   profile  — set --vars '{"profile":"auto"}' to skip objective HITL gates (feature-check, batch-create)
 #   design   — "auto" (default, signal-driven), "force" (--design), "skip" (--skip-design)
+#   design_approved — "true" only when the operator explicitly approved the design in-session;
+#              lets profile=auto route around the design-approval taste gate (default "false")
 #   spurBin  — PATH-independent spur invocation (overridden by CLI at run start)
 #   agent    — agent for agent.run steps (default: omp)
 #
@@ -26,7 +28,10 @@
 kind: state-machine
 name: idea-pipeline
 description: "Idea to feature + AC + task batch: discovery, feature-create, ac-generate, feature-check, system-design, decompose, batch-create, handoff"
-iterationBound: 15
+# Worst legal auto path with advertised caps: start/discovery/feature/ac plus 2 AC retries,
+# design, one design rejection, decompose plus 2 batch retries, handoff ≈22 transitions.
+# Keep a small cushion so the explicit retry caps fail first, not the engine bound.
+iterationBound: 25
 initialState: start
 terminalStates:
   - handoff
@@ -36,6 +41,9 @@ vars:
   idea: ""
   profile: "standard"
   design: "auto"
+  design_approved: "false"
+  featureId: ""
+  __hitlAnswer: ""
   spurBin: "spur"
   agent: "omp"
   stepTimeoutMs: "600000"
@@ -51,7 +59,10 @@ states:
           message: "Idea pipeline start for idea: ${vars.idea}"
       - kind: shell
         options:
-          command: 'rm -f .spur/run/idea-ac-retry-count .spur/run/idea-decompose-retry-count'
+          command: "${vars.spurBin} agent doctor ${vars.agent}"
+      - kind: shell
+        options:
+          command: 'mkdir -p .spur/run && rm -f .spur/run/idea-ac-retry-count .spur/run/idea-decompose-retry-count .spur/run/idea-feature-id.txt .spur/run/idea-ac-content.md .spur/run/idea-ac-done.txt .spur/run/idea-task-batch.json .spur/run/idea-batch-create.done .spur/run/idea-batch-create.failed'
 
   - id: discovery
     description: >
@@ -64,7 +75,7 @@ states:
       - kind: agent.run
         options:
           agent: ${vars.agent}
-          input: "Run sp:brainstorm for the idea: ${vars.idea}. Generate 2-3 approaches with trade-offs and a design summary. Perform the scope decomposition check and write the needs_design boolean to .spur/run/idea-needs-design.json as {\"needs_design\": true|false}. Criteria: true if multiple subsystems/schema/transport/dependency changes; false if single-module/bug-fix/pattern-following. Ties lean true. ALWAYS record a design summary — no idea is too simple."
+          input: "Run sp:brainstorm for the idea: ${vars.idea}. The skill owns the approach-generation, design summary, and `needs_design` signal criteria; emit .spur/run/idea-needs-design.json ({\"needs_design\": true|false}) and the design summary per the skill's `Design Approval Gate` and `The needs_design signal` sections."
           timeoutMs: ${vars.stepTimeoutMs}
 
   - id: feature-create
@@ -77,30 +88,52 @@ states:
         options:
           agent: ${vars.agent}
           input: "Create a feature for the idea: ${vars.idea}. Use 'spur feature create \"<name>\" --json' to create it. Write the feature id to .spur/run/idea-feature-id.txt. If an existing feature is appropriate, use its id instead."
+          expectFile: .spur/run/idea-feature-id.txt
           timeoutMs: ${vars.stepTimeoutMs}
+      - kind: file.read.into-var
+        options:
+          path: .spur/run/idea-feature-id.txt
+          var: featureId
 
   - id: ac-generate
     description: >
       Generate acceptance criteria per ac-style-guide.md. Write AC scenarios to the
-      feature file via spur feature update (direct body edit, not --section). The
-      agent authors R-numbered Gherkin scenarios tied to the design summary.
+      feature file via `spur feature update --section "Acceptance Criteria"
+      --from-file`. The agent authors R-numbered Gherkin scenarios tied to the
+      design summary into a captured file; the shell step verifies the file is
+      non-empty, writes it through the CLI, and writes a completion sentinel
+      (.spur/run/idea-ac-done.txt). AC quality checking lives in the transition
+      guards (`spur feature check --strict`), NOT in this action chain — a failing
+      check must route through the capped retry loop, not fail the run (the engine's
+      default onError policy is `fail`, so an in-action check failure would kill the
+      run before the retry edges are ever evaluated).
     onEnter:
+      - kind: shell
+        options:
+          command: 'mkdir -p .spur/run && count=$(cat .spur/run/idea-ac-retry-count 2>/dev/null || echo 0); echo $((count + 1)) > .spur/run/idea-ac-retry-count; rm -f .spur/run/idea-ac-content.md .spur/run/idea-ac-done.txt'
       - kind: agent.run
         options:
           agent: ${vars.agent}
-          input: "Generate acceptance criteria for the feature whose id is in .spur/run/idea-feature-id.txt. Read the feature file, author R-numbered BDD Gherkin scenarios per ac-style-guide.md, and write them to the feature body via direct file edit (spur feature update does not support --section for features). Run 'spur feature check <id>' to validate."
+          input: "Generate acceptance criteria for feature ${vars.featureId}. Read the feature file and author R-numbered BDD Gherkin scenarios per ac-style-guide.md. Output only the complete Acceptance Criteria section body, including the gherkin code fence, with no surrounding commentary and no section heading."
+          answerFile: .spur/run/idea-ac-content.md
+          expectFile: .spur/run/idea-ac-content.md
           timeoutMs: ${vars.stepTimeoutMs}
+      - kind: shell
+        options:
+          command: 'test -s .spur/run/idea-ac-content.md && ${vars.spurBin} feature update ${vars.featureId} --section "Acceptance Criteria" --from-file .spur/run/idea-ac-content.md && date -u +%Y-%m-%dT%H:%M:%SZ > .spur/run/idea-ac-done.txt'
 
   - id: feature-check
     description: >
-      Objective gate: run spur feature check <id> --strict. Under --auto, routes
-      around the HITL gate when the check passes. On failure, routes back to
-      ac-generate for AC revision. The feature id is read from
-      .spur/run/idea-feature-id.txt.
+      HITL gate: runs spur feature check <id> --strict. The check is objective
+      (schema/AC validation) and auto-routable — under profile=auto the transition
+      guards route directly from ac-generate to the appropriate next state, so this
+      state is only entered in interactive mode. On failure, the retry cap routes
+      back to ac-generate (≤3 retries) or escalates to failed.
+    pause: true
     onEnter:
-      - kind: note
+      - kind: hitl.confirm
         options:
-          message: "Running feature check for feature $(cat .spur/run/idea-feature-id.txt)"
+          prompt: "Feature check for ${vars.featureId}. Review the AC and confirm to proceed? (Failures route back to ac-generate for revision, capped at 3 retries.)"
 
   - id: system-design
     description: >
@@ -112,7 +145,7 @@ states:
       - kind: agent.run
         options:
           agent: ${vars.agent}
-          input: "Run sp:sys-architecture for the feature whose id is in .spur/run/idea-feature-id.txt. Read the brainstorm artifact and feature AC. Produce ADR entries, architecture updates, and design satellites (docs/design/<slug>.md) following the constitution edit rules. Do not write task or feature corpus files directly."
+          input: "Run sp:sys-architecture for feature ${vars.featureId}. Read the brainstorm artifact and feature AC. Produce ADR entries, architecture updates, and design satellites (docs/design/<slug>.md) following the constitution edit rules. Do not write task or feature corpus files directly."
           timeoutMs: ${vars.stepTimeoutMs}
 
   - id: design-approval
@@ -125,7 +158,7 @@ states:
     onEnter:
       - kind: hitl.confirm
         options:
-          prompt: "Review the system design for feature $(cat .spur/run/idea-feature-id.txt). Approve to proceed to decomposition?"
+          prompt: "Review the system design for feature ${vars.featureId}. Approve to proceed to decomposition?"
 
   - id: decompose
     description: >
@@ -133,21 +166,38 @@ states:
       design doc as input. The agent produces a task-batch JSON file at
       .spur/run/idea-task-batch.json, validated against task-batch.schema.json.
     onEnter:
+      - kind: shell
+        options:
+          command: 'mkdir -p .spur/run && count=$(cat .spur/run/idea-decompose-retry-count 2>/dev/null || echo 0); echo $((count + 1)) > .spur/run/idea-decompose-retry-count; rm -f .spur/run/idea-task-batch.json .spur/run/idea-batch-create.done .spur/run/idea-batch-create.failed'
       - kind: agent.run
         options:
           agent: ${vars.agent}
-          input: "Run sp:spec-decomposition for the feature whose id is in .spur/run/idea-feature-id.txt. Read the brainstorm artifact, feature AC, and design doc. Produce a task-batch JSON array at .spur/run/idea-task-batch.json, validated against apps/cli/schemas/task-batch.schema.json. Each entry must have filled Requirements, AC, Design, and Plan sections."
+          input: "Run sp:spec-decomposition for feature ${vars.featureId}. Read the brainstorm artifact, feature AC, and design doc. Produce a task-batch JSON array at .spur/run/idea-task-batch.json, validated against apps/cli/schemas/task-batch.schema.json. Schema-permitted fields per entry: `name`, `background`, `requirements`, `feature_id`, `parent_wbs`, `priority`, `tags`, `template` — schema validation rejects anything else. Acceptance Criteria, Design, and Plan sections are filled in by the per-task refine step after batch-create, NOT at decompose time. Validate locally against the schema before emitting."
           timeoutMs: ${vars.stepTimeoutMs}
 
   - id: batch-create
     description: >
-      Objective gate: run spur task batch-create with the batch JSON from the
-      decompose state. Under --auto, routes around the HITL gate when the batch
-      validates. On failure, routes back to decompose.
+      HITL gate: runs spur task batch-create with the batch JSON from the
+      decompose state. The check is objective (schema validation) and
+      auto-routable — under profile=auto the transition guards route directly
+      from decompose to the appropriate next state, so this state is only
+      entered in interactive mode. On failure, the retry cap routes back to
+      decompose (≤3 retries) or escalates to failed.
+    pause: true
     onEnter:
-      - kind: note
+      - kind: hitl.confirm
+        options:
+          prompt: "Batch-create for feature ${vars.featureId}. Review the task batch and confirm to proceed? (Failures route back to decompose for revision, capped at 3 retries.)"
+
+  - id: batch-create-run
+    description: >
+      Executes task batch creation exactly once per decomposition attempt. The
+      side effect lives in onEnter and records a sentinel; transition guards only
+      inspect sentinel/retry state.
+    onEnter:
+      - kind: shell
         options:
-          message: "Running batch-create for feature $(cat .spur/run/idea-feature-id.txt)"
+          command: 'if test -f .spur/run/idea-batch-create.done; then exit 0; fi; rm -f .spur/run/idea-batch-create.failed; if ${vars.spurBin} task batch-create --file .spur/run/idea-task-batch.json; then date -u +%Y-%m-%dT%H:%M:%SZ > .spur/run/idea-batch-create.done; else date -u +%Y-%m-%dT%H:%M:%SZ > .spur/run/idea-batch-create.failed; fi'
 
   - id: handoff
     description: >
@@ -157,11 +207,11 @@ states:
     onEnter:
       - kind: note
         options:
-          message: "Idea pipeline handoff. Feature: $(cat .spur/run/idea-feature-id.txt). Tasks created. Next: /sp:dev-runall --tasks feature:$(cat .spur/run/idea-feature-id.txt)"
+          message: "Idea pipeline handoff. Feature: ${vars.featureId}. Tasks created. Next: /sp:dev-runall --tasks feature:${vars.featureId}"
       # Checkpoint write: record session state for resume (Phase 4, task 0171 R3)
       - kind: shell
         options:
-          command: 'mkdir -p .spur/memory/sessions && echo "checkpoint: idea-pipeline handoff feature=$(cat .spur/run/idea-feature-id.txt) ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)" > .spur/memory/sessions/idea-checkpoint.md'
+          command: 'mkdir -p .spur/memory/sessions && echo "checkpoint: idea-pipeline handoff feature=${vars.featureId} ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)" > .spur/memory/sessions/idea-checkpoint.md'
 
   - id: cancelled
     description: Terminal — pipeline cancelled by operator or error.
@@ -194,10 +244,48 @@ transitions:
     guard:
       kind: always
 
-  # ── ac-generate -> feature-check ──
+  # ── ac-generate: auto-skip (profile=auto) OR enter feature-check HITL gate (interactive) ──
+  # Declaration order: auto-skip guards tried FIRST (same pattern as task-pipeline review→verify
+  # and design-gen→handoff). Under profile=auto, the feature check runs as a transition guard and
+  # routes directly to the appropriate next state. Under interactive, the always fallback enters
+  # the feature-check state whose onEnter hitl.confirm pauses for operator confirmation.
+  #
+  # Auto-skip 1: pass + design route → system-design
+  - from: ac-generate
+    to: system-design
+    description: "profile=auto, check passed, design route — run system design."
+    guard:
+      kind: shell
+      options:
+        command: 'test "${vars.profile}" = auto && ${vars.spurBin} feature check ${vars.featureId} --strict && (test "${vars.design}" = force || (test "${vars.design}" = auto && test "$(jq -r .needs_design .spur/run/idea-needs-design.json 2>/dev/null)" != false))'
+  # Auto-skip 2: pass + skip-design route → decompose
+  - from: ac-generate
+    to: decompose
+    description: "profile=auto, check passed, skip-design route — go directly to decompose."
+    guard:
+      kind: shell
+      options:
+        command: 'test "${vars.profile}" = auto && ${vars.spurBin} feature check ${vars.featureId} --strict && (test "${vars.design}" = skip || (test "${vars.design}" = auto && test "$(jq -r .needs_design .spur/run/idea-needs-design.json 2>/dev/null)" = false))'
+  # Auto-skip 3: check failed, retry < 3 → loop back to ac-generate (self-loop)
+  - from: ac-generate
+    to: ac-generate
+    description: "profile=auto, check failed, retry cap not reached — re-run ac-generate."
+    guard:
+      kind: shell
+      options:
+        command: 'test "${vars.profile}" = auto && ! ${vars.spurBin} feature check ${vars.featureId} --strict && test "$(cat .spur/run/idea-ac-retry-count 2>/dev/null || echo 0)" -lt 3'
+  # Auto-skip 4: check failed, retry cap reached → escalate to failed
+  - from: ac-generate
+    to: failed
+    description: "profile=auto, check failed after 3 retries — escalate to failed."
+    guard:
+      kind: shell
+      options:
+        command: 'test "${vars.profile}" = auto && ! ${vars.spurBin} feature check ${vars.featureId} --strict && test "$(cat .spur/run/idea-ac-retry-count 2>/dev/null || echo 0)" -ge 3'
+  # Interactive fallback: enter feature-check HITL gate
   - from: ac-generate
     to: feature-check
-    description: AC generated — run feature check.
+    description: Interactive — enter feature-check HITL gate for operator confirmation.
     guard:
       kind: always
 
@@ -209,28 +297,35 @@ transitions:
     guard:
       kind: shell
       options:
-        command: '${vars.spurBin} feature check $(cat .spur/run/idea-feature-id.txt) --strict && (test "${vars.design}" = force || (test "${vars.design}" = auto && test "$(jq -r .needs_design .spur/run/idea-needs-design.json 2>/dev/null)" != false))'
+        command: 'test "${vars.__hitlAnswer}" = yes && ${vars.spurBin} feature check ${vars.featureId} --strict && (test "${vars.design}" = force || (test "${vars.design}" = auto && test "$(jq -r .needs_design .spur/run/idea-needs-design.json 2>/dev/null)" != false))'
   - from: feature-check
     to: decompose
     description: Feature check passed, skip-design route — go directly to decompose.
     guard:
       kind: shell
       options:
-        command: '${vars.spurBin} feature check $(cat .spur/run/idea-feature-id.txt) --strict && (test "${vars.design}" = skip || (test "${vars.design}" = auto && test "$(jq -r .needs_design .spur/run/idea-needs-design.json 2>/dev/null)" = false))'
+        command: 'test "${vars.__hitlAnswer}" = yes && ${vars.spurBin} feature check ${vars.featureId} --strict && (test "${vars.design}" = skip || (test "${vars.design}" = auto && test "$(jq -r .needs_design .spur/run/idea-needs-design.json 2>/dev/null)" = false))'
   - from: feature-check
     to: ac-generate
     description: "Feature check failed — revise AC (retry cap: 3)."
     guard:
       kind: shell
       options:
-        command: '! ${vars.spurBin} feature check $(cat .spur/run/idea-feature-id.txt) --strict && test "$(cat .spur/run/idea-ac-retry-count 2>/dev/null || echo 0)" -lt 3 && echo $(( $(cat .spur/run/idea-ac-retry-count 2>/dev/null || echo 0) + 1 )) > .spur/run/idea-ac-retry-count'
+        command: '(test "${vars.__hitlAnswer}" = no || ! ${vars.spurBin} feature check ${vars.featureId} --strict) && test "$(cat .spur/run/idea-ac-retry-count 2>/dev/null || echo 0)" -lt 3'
   - from: feature-check
     to: failed
     description: Feature check failed after 3 retries — escalate to failed.
     guard:
       kind: shell
       options:
-        command: '! ${vars.spurBin} feature check $(cat .spur/run/idea-feature-id.txt) --strict && test "$(cat .spur/run/idea-ac-retry-count 2>/dev/null || echo 0)" -ge 3'
+        command: '(test "${vars.__hitlAnswer}" = no || ! ${vars.spurBin} feature check ${vars.featureId} --strict) && test "$(cat .spur/run/idea-ac-retry-count 2>/dev/null || echo 0)" -ge 3'
+  - from: feature-check
+    to: cancelled
+    description: Operator cancelled the feature-check gate.
+    guard:
+      kind: shell
+      options:
+        command: 'test "${vars.__hitlAnswer}" = cancel'
 
   # ── system-design: -> design-approval (normal) OR -> decompose (auto + prior approval) ──
   # Declaration order: auto-skip guard tried FIRST (like task-pipeline's review->verify pattern).
@@ -252,34 +347,80 @@ transitions:
     to: decompose
     description: Design approved — proceed to decomposition.
     guard:
-      kind: always
+      kind: shell
+      options:
+        command: 'test "${vars.__hitlAnswer}" = yes'
+  - from: design-approval
+    to: system-design
+    description: Design rejected — revise system design.
+    guard:
+      kind: shell
+      options:
+        command: 'test "${vars.__hitlAnswer}" = no'
+  - from: design-approval
+    to: cancelled
+    description: Operator cancelled design approval.
+    guard:
+      kind: shell
+      options:
+        command: 'test "${vars.__hitlAnswer}" = cancel'
 
-  # ── decompose -> batch-create ──
+  # ── decompose: auto-skip (profile=auto) OR enter batch-create HITL gate (interactive) ──
+  - from: decompose
+    to: batch-create-run
+    description: "profile=auto — execute batch-create side effect."
+    guard:
+      kind: shell
+      options:
+        command: 'test "${vars.profile}" = auto'
+  # Interactive fallback: enter batch-create HITL gate
   - from: decompose
     to: batch-create
-    description: Decomposition complete — create task batch.
+    description: Interactive — enter batch-create HITL gate for operator confirmation.
     guard:
       kind: always
 
-  # ── batch-create: success -> handoff, failure -> decompose (retry cap: 3), failure+cap -> failed ──
   - from: batch-create
+    to: batch-create-run
+    description: Operator approved batch creation — execute side effect.
+    guard:
+      kind: shell
+      options:
+        command: 'test "${vars.__hitlAnswer}" = yes'
+  - from: batch-create
+    to: decompose
+    description: Operator requested decomposition revisions.
+    guard:
+      kind: shell
+      options:
+        command: 'test "${vars.__hitlAnswer}" = no'
+  - from: batch-create
+    to: cancelled
+    description: Operator cancelled batch creation.
+    guard:
+      kind: shell
+      options:
+        command: 'test "${vars.__hitlAnswer}" = cancel'
+
+  # ── batch-create-run: success -> handoff, failure -> decompose (retry cap: 3), failure+cap -> failed ──
+  - from: batch-create-run
     to: handoff
     description: Batch created — handoff.
     guard:
       kind: shell
       options:
-        command: '${vars.spurBin} task batch-create --file .spur/run/idea-task-batch.json'
-  - from: batch-create
+        command: 'test -f .spur/run/idea-batch-create.done'
+  - from: batch-create-run
     to: decompose
     description: "Batch-create failed — revise decomposition (retry cap: 3)."
     guard:
       kind: shell
       options:
-        command: '! ${vars.spurBin} task batch-create --file .spur/run/idea-task-batch.json && test "$(cat .spur/run/idea-decompose-retry-count 2>/dev/null || echo 0)" -lt 3 && echo $(( $(cat .spur/run/idea-decompose-retry-count 2>/dev/null || echo 0) + 1 )) > .spur/run/idea-decompose-retry-count'
-  - from: batch-create
+        command: 'test -f .spur/run/idea-batch-create.failed && test "$(cat .spur/run/idea-decompose-retry-count 2>/dev/null || echo 0)" -lt 3'
+  - from: batch-create-run
     to: failed
     description: Batch-create failed after 3 retries — escalate to failed.
     guard:
       kind: shell
       options:
-        command: '! ${vars.spurBin} task batch-create --file .spur/run/idea-task-batch.json && test "$(cat .spur/run/idea-decompose-retry-count 2>/dev/null || echo 0)" -ge 3'
+        command: 'test -f .spur/run/idea-batch-create.failed && test "$(cat .spur/run/idea-decompose-retry-count 2>/dev/null || echo 0)" -ge 3'

package/spur-cli/config/workflows/planning-pipeline.yaml

@@ -20,6 +20,8 @@
 #   slug     — the design-doc slug, e.g. `--vars '{"slug":"auth-migration"}'`
 #   profile  — set `--vars '{"profile":"auto"}'` to skip the HITL gates (Q4)
 #   feature  — optional parent feature ID for derivation context
+#   design_approved — "true" only when the operator explicitly approved the design in-session;
+#              lets profile=auto route around the design-approval taste gate (default "false")
 #
 # Seeded by `spur init`; adapt the agent.run inputs to your project's command set.
 
@@ -36,6 +38,11 @@ vars:
   slug: "draft"
   profile: "interactive"
   feature: ""
+  design_approved: "false"
+  __hitlAnswer: ""
+  spurBin: "spur"
+  agent: "omp"
+  stepTimeoutMs: "600000"
 
 states:
   - id: start
@@ -57,14 +64,16 @@ states:
 
   - id: feature-id
     description: >
-      Derive the feature ID by scanning docs/features + 05_FEATURES for the parent and
-      allocating the child id (same rule as `spur feature create`). Result is recorded for
-      the design-doc generation step. Invokes sp:doc-evolve if 05_FEATURES index needs a
-      placeholder row.
+      Allocate the feature id via the canonical `spur feature create` verb (it owns the
+      hierarchical ID rule per DD-14). The agent derives a feature name from ${vars.slug}
+      and invokes the verb; the new id is captured for the design-doc generation step.
     onEnter:
       - kind: agent.run
         options:
-          input: "Derive the feature ID for ${vars.slug} (scan docs/features + docs/05_FEATURES.md; allocate child id under parent ${vars.feature}). Record the derived id."
+          agent: ${vars.agent}
+          input: "Allocate a feature id for slug ${vars.slug} via the canonical verb. Run `${vars.spurBin} feature create \"<human title derived from ${vars.slug}>\" --parent ${vars.feature} --json` and capture the new feature id from the JSON output into .spur/run/plan-feature-id.txt for the design-gen step. If an existing feature for ${vars.slug} is appropriate, use its id instead and write it to the same file. Do not re-implement id-allocation rules in prose; the verb owns them."
+          expectFile: .spur/run/plan-feature-id.txt
+          timeoutMs: ${vars.stepTimeoutMs}
 
   - id: design-gen
     description: >
@@ -75,7 +84,9 @@ states:
     onEnter:
       - kind: agent.run
         options:
+          agent: ${vars.agent}
           input: "Author the design doc at docs/design/${vars.slug}.md from docs/plans/${vars.slug}-drafted.md. Invoke sp:doc-evolve to stage the 04_DESIGN index edit."
+          timeoutMs: ${vars.stepTimeoutMs}
 
   - id: design-approval
     description: >
@@ -127,12 +138,16 @@ transitions:
     to: feature-id
     description: Phasing decided — proceed to feature-ID derivation.
     guard:
-      kind: always
+      kind: shell
+      options:
+        command: 'test "${vars.__hitlAnswer}" = yes || test "${vars.__hitlAnswer}" = no'
   - from: phasing
     to: cancelled
     description: Operator cancelled planning.
     guard:
-      kind: always
+      kind: shell
+      options:
+        command: 'test "${vars.__hitlAnswer}" = cancel'
 
   # ── linear body ──
   - from: feature-id
@@ -163,14 +178,20 @@ transitions:
     to: handoff
     description: Design approved — hand off to sp:spur-dev.
     guard:
-      kind: always
+      kind: shell
+      options:
+        command: 'test "${vars.__hitlAnswer}" = yes'
   - from: design-approval
     to: design-gen
     description: Rework — operator requested design revisions.
     guard:
-      kind: always
+      kind: shell
+      options:
+        command: 'test "${vars.__hitlAnswer}" = no'
   - from: design-approval
     to: cancelled
     description: Operator cancelled planning.
     guard:
-      kind: always
+      kind: shell
+      options:
+        command: 'test "${vars.__hitlAnswer}" = cancel'

package/spur-cli/config/workflows/task-pipeline.yaml

@@ -7,7 +7,8 @@
 # (0055) apply identically. Run linkage is written to `task_run_links` (kind=pipeline).
 #
 # Shape: precheck → implement → test → review → approve(HITL) → verify → record → done
-#        (precheck failure short-circuits to `failed`).
+#        (precheck failure short-circuits to `failed`; approve routes to `failed` on
+#        operator rejection or `cancelled` on operator cancel — R1, bug-750).
 #
 # Vars (passed as a JSON object via `--vars`):
 #   wbs      — the task WBS (required), e.g. `--vars '{"wbs":"0042"}'`
@@ -24,6 +25,7 @@ initialState: precheck
 terminalStates:
   - done
   - failed
+  - cancelled
 vars:
   wbs: "0000"
   profile: "standard"
@@ -39,6 +41,15 @@ vars:
   # subprocess is killed (not abandoned) and the step fails → pipeline routes to
   # `failed`. Override per run with `--vars '{"stepTimeoutMs":120000}'`.
   stepTimeoutMs: "600000"
+  # Timeout for the `implement` step specifically (R2a). Implementation is the
+  # heaviest agent.run step (full read/write/test-probe loop) and has timed out
+  # at the 600s default in five consecutive dogfood runs (bugs 742/744/746/748),
+  # a 100% failure rate at that budget. 30 min gives real headroom; STOP and
+  # record honestly rather than raising it further without operator sign-off.
+  implementTimeoutMs: "1800000"
+  # Answer captured by the approve gate's hitl.confirm (R1): "yes" | "no" | "cancel".
+  # Empty by default; only meaningful once the approve state has been entered.
+  __hitlAnswer: ""
 
 states:
   - id: precheck
@@ -46,6 +57,9 @@ states:
       Pre-flight structural validation. The precheck→implement guard runs
       `spur task check <wbs>`; a failure routes to `failed` (blocked report).
     onEnter:
+      - kind: shell
+        options:
+          command: "${vars.spurBin} agent doctor ${vars.agent}"
       - kind: note
         options:
           # R4 task_run_links linkage (kind=pipeline) is written by a WorkflowService
@@ -70,8 +84,12 @@ states:
       - kind: agent.run
         options:
           agent: ${vars.agent}
-          input: /sp:dev-run --mode implement ${vars.wbs} --auto
-          timeoutMs: ${vars.stepTimeoutMs}
+          input: >-
+            /sp:dev-run --mode implement ${vars.wbs} --auto.
+            Work only in this working tree on task ${vars.wbs}; NEVER invoke
+            `spur workflow run` or `/sp:dev-run` without `--mode implement` —
+            this step IS the pipeline (bug-742).
+          timeoutMs: ${vars.implementTimeoutMs}
       - kind: shell
         options:
           command: "${vars.spurBin} task update ${vars.wbs} wip --no-lifecycle"
@@ -115,6 +133,8 @@ states:
       Human-in-the-loop approval gate. Under `profile=auto` this state is never entered
       (review routes around it straight to verify). In interactive mode this state pauses
       the run for `spur workflow continue` (E3), making approval an explicit operator action.
+      The operator's answer is routed (R1, bug-750): yes -> verify; no -> failed (rejection
+      recorded, not silently approved); cancel -> cancelled (a distinct terminal state).
     pause: true
     onEnter:
       - kind: hitl.confirm
@@ -171,6 +191,9 @@ states:
   - id: failed
     description: Terminal — precheck (or a gated step) failed; reported, not advanced.
 
+  - id: cancelled
+    description: Terminal — pipeline cancelled by operator at the approval gate (R1).
+
 transitions:
   # ── precheck: shell guard runs `spur task check`; pass → implement, fail → failed ──
   - from: precheck
@@ -217,12 +240,33 @@ transitions:
     guard:
       kind: always
 
-  # ── approve: HITL gate (reached only when profile != auto) ──
+  # ── approve: HITL gate (reached only when profile != auto). Routed by the
+  # operator's captured answer (R1, bug-750) — three ordered guards, declaration
+  # order matters (yes first, then no, then cancel), mirroring idea-pipeline's
+  # design-approval gate (config/workflows/idea-pipeline.yaml:352-366). No
+  # `always` edge remains out of `approve`. ──
   - from: approve
     to: verify
     description: Approved — proceed to verification.
     guard:
-      kind: always
+      kind: shell
+      options:
+        command: 'test "${vars.__hitlAnswer}" = yes'
+  - from: approve
+    to: failed
+    description: Operator rejected at the approval gate — report and stop.
+    guard:
+      kind: shell
+      options:
+        command: 'test "${vars.__hitlAnswer}" = no'
+  - from: approve
+    to: cancelled
+    description: Operator cancelled at the approval gate.
+    guard:
+      kind: shell
+      options:
+        command: 'test "${vars.__hitlAnswer}" = cancel'
+
   # ── completion gate (the YAML-native replacement for rd3's default-on --postflight-verify) ──
   # The verify step emits .spur/run/<wbs>-verdict.json. Only `verdict: PASS` clears
   # the gate to `record`; any non-PASS (PARTIAL/FAIL), a missing file, or malformed