@gobing-ai/spur 0.3.30 → 0.3.31

package/config/workflows/idea-pipeline.yaml

@@ -28,6 +28,14 @@
 #   spurBin  — PATH-independent spur invocation (overridden by CLI at run start)
 #   agent    — agent for agent.run steps (default: omp)
 #
+# Reliability (aligned with task-pipeline / ADR-043):
+#   - Soft agent doctor at start → failed via transitions (not raw lifecycle abort)
+#   - expectFile on feature-create / ac-generate / decompose artifacts (no silent no-ops)
+#   - Caped AC and batch-create retry loops with fail-closed escalation
+#   - HITL taste gates (idea-eval, design-approval) exhaustive yes/no/cancel
+#   - Free-form skill pointers remain only where no pure slash surface exists yet
+#     (discovery/sys-architecture/decompose internals — residual until dedicated commands)
+#
 # Seeded by `spur init`; adapt the agent.run inputs to your project's command set.
 
 "$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
@@ -43,6 +51,9 @@ terminalStates:
   - handoff
   - cancelled
   - failed
+failureStates:
+  - failed
+  - cancelled
 vars:
   idea: ""
   profile: "standard"
@@ -55,44 +66,55 @@ vars:
   # R8 (0366): injected by WorkflowAppService.run(); stamps discovery artifact provenance.
   __runId: ""
   agent: "omp"
-  stepTimeoutMs: "600000"
+  stepTimeoutMs: "1800000"
 
 states:
   - id: start
     description: >
       Pipeline start. The idea text arrives as vars.idea. The pipeline stops at
-      handoff — no task execution.
+      handoff — no task execution. Soft agent doctor (status file) so doctor red
+      routes to `failed` via transitions instead of a raw lifecycle abort.
     onEnter:
       - kind: note
         options:
           message: "Idea pipeline start for idea: ${vars.idea}"
       - kind: shell
         options:
-          command: "${vars.spurBin} agent doctor ${vars.agent}"
-      - kind: shell
-        options:
-          command: 'mkdir -p .spur/run && { [ -f .spur/run/idea-eval-report.md ] || [ -f .spur/run/idea-needs-design.json ]; } && { a=".spur/run/idea-archive/$(date +%Y%m%d-%H%M%S)"; mkdir -p "$a"; mv -f .spur/run/idea-eval-report.md "$a/" 2>/dev/null; mv -f .spur/run/idea-needs-design.json "$a/" 2>/dev/null; } ; rm -f .spur/run/idea-ac-retry-count .spur/run/idea-decompose-retry-count .spur/run/idea-feature-id.txt .spur/run/idea-ac-content.md .spur/run/idea-ac-done.txt .spur/run/idea-task-batch.json .spur/run/idea-batch-create.done .spur/run/idea-batch-create.failed'
+          command: >-
+            mkdir -p .spur/run &&
+            DOCTOR_FILE=".spur/run/$__runId-idea-precheck-doctor.status" &&
+            set +e &&
+            $spurBin agent doctor $agent; doctor_rc=$?;
+            set -e &&
+            if [ "$doctor_rc" -eq 0 ] && test -n "$idea"; then
+              printf 'PASS\n' > "$DOCTOR_FILE";
+            else
+              printf 'FAIL\n' > "$DOCTOR_FILE";
+            fi &&
+            exit 0
 
   - id: discovery
     description: >
       Dispatch sp:brainstorm to explore the idea, generate approaches with trade-offs,
       and record a design summary. The brainstorm ALWAYS records a design summary
       ("nothing is too simple" pattern). The brainstorm also emits a needs_design
-      boolean signal written to .spur/run/idea-needs-design.json — this determines
+      boolean signal written to .spur/run/${vars.__runId}-idea-needs-design.json — this determines
       whether the system-design state runs. As its terminal artifact for the idea path,
-      brainstorm also emits the idea-evaluation report to .spur/run/idea-eval-report.md
+      brainstorm also emits the idea-evaluation report to .spur/run/${vars.__runId}-idea-eval-report.md
       (template: plugins/sp/skills/spur-dev/references/idea-evaluation.md).
+      expectFile fails a silent no-op discovery (no eval report).
     onEnter:
       - kind: agent.run
         options:
           agent: ${vars.agent}
-          input: "Run sp:brainstorm for the idea: ${vars.idea}. The skill owns the approach-generation, design summary, and `needs_design` signal criteria; emit .spur/run/idea-needs-design.json ({\"needs_design\": true|false}) and the design summary per the skill's `Design Approval Gate` and `The needs_design signal` sections. Also emit the idea-evaluation report to .spur/run/idea-eval-report.md per plugins/sp/skills/spur-dev/references/idea-evaluation.md (urgency/necessity 0–5, premises, pros/cons, alternatives, enhanced idea, recommendation). At the END of the report, append a provenance footer block of the exact form: `---\\nrun_id: ${vars.__runId}\\ngenerated_at: <RFC3339 timestamp>\\n---` (omit the footer only if run_id is empty)."
+          input: "Run sp:brainstorm for the idea: ${vars.idea}. The skill owns the approach-generation, design summary, and `needs_design` signal criteria; emit .spur/run/${vars.__runId}-idea-needs-design.json ({\"needs_design\": true|false}) and the design summary per the skill's `Design Approval Gate` and `The needs_design signal` sections. Also emit the idea-evaluation report to .spur/run/${vars.__runId}-idea-eval-report.md per plugins/sp/skills/spur-dev/references/idea-evaluation.md (urgency/necessity 0–5, premises, pros/cons, alternatives, enhanced idea, recommendation). At the END of the report, append a provenance footer block of the exact form: `---\\nrun_id: ${vars.__runId}\\ngenerated_at: <RFC3339 timestamp>\\n---` (omit the footer only if run_id is empty)."
+          expectFile: .spur/run/${vars.__runId}-idea-eval-report.md
           timeoutMs: ${vars.stepTimeoutMs}
 
   - id: idea-eval
     description: >
       HITL taste gate. Discovery has produced the idea-evaluation report
-      (.spur/run/idea-eval-report.md) with urgency/necessity scores, premises,
+      (.spur/run/${vars.__runId}-idea-eval-report.md) with urgency/necessity scores, premises,
       pros/cons, and a recommendation. The operator reviews and approves or
       rejects. This gate is NOT auto-clicked by --auto (taste gate, like
       design-approval). Only routes around when vars.idea_approved=true
@@ -101,24 +123,24 @@ states:
     onEnter:
       - kind: hitl.confirm
         options:
-          prompt: "Review the idea evaluation report (.spur/run/idea-eval-report.md). Approve to create a feature, or reject to cancel? (Reject creates no feature.)"
+          prompt: "Review the idea evaluation report (.spur/run/${vars.__runId}-idea-eval-report.md). Approve to create a feature, or reject to cancel? (Reject creates no feature.)"
 
   - id: feature-create
     description: >
       Create a feature via spur feature create, or select an existing feature id.
-      The agent writes the feature id to .spur/run/idea-feature-id.txt for subsequent
-      states to read. Prefer the enhanced idea from .spur/run/idea-eval-report.md as
+      The agent writes the feature id to .spur/run/${vars.__runId}-idea-feature-id.txt for subsequent
+      states to read. Prefer the enhanced idea from .spur/run/${vars.__runId}-idea-eval-report.md as
       context; do not overwrite vars.idea.
     onEnter:
       - kind: agent.run
         options:
           agent: ${vars.agent}
-          input: "Create a feature for the idea: ${vars.idea}. Read .spur/run/idea-eval-report.md if present for the enhanced idea and scores. Use 'spur feature create \"<name>\" --json' to create it. Write the feature id to .spur/run/idea-feature-id.txt. If an existing feature is appropriate, use its id instead."
-          expectFile: .spur/run/idea-feature-id.txt
+          input: "Create a feature for the idea: ${vars.idea}. Read .spur/run/${vars.__runId}-idea-eval-report.md if present for the enhanced idea and scores. Use 'spur feature create \"<name>\" --json' to create it. Write the feature id to .spur/run/${vars.__runId}-idea-feature-id.txt. If an existing feature is appropriate, use its id instead."
+          expectFile: .spur/run/${vars.__runId}-idea-feature-id.txt
           timeoutMs: ${vars.stepTimeoutMs}
       - kind: file.read.into-var
         options:
-          path: .spur/run/idea-feature-id.txt
+          path: .spur/run/${vars.__runId}-idea-feature-id.txt
           var: featureId
 
   - id: ac-generate
@@ -128,29 +150,47 @@ states:
       --from-file`. The agent authors R-numbered Gherkin scenarios tied to the
       design summary into a captured file; the shell step verifies the file is
       non-empty, writes it through the CLI, and writes a completion sentinel
-      (.spur/run/idea-ac-done.txt). AC quality checking lives in the transition
-      guards (`spur feature check --strict`), NOT in this action chain — a failing
+      (.spur/run/${vars.__runId}-idea-ac-done.txt). AC quality checking lives in the transition
+      guards (`spur feature check`), NOT in this action chain — a failing
       check must route through the capped retry loop, not fail the run (the engine's
       default onError policy is `fail`, so an in-action check failure would kill the
       run before the retry edges are ever evaluated).
     onEnter:
       - kind: shell
         options:
-          command: 'mkdir -p .spur/run && count=$(cat .spur/run/idea-ac-retry-count 2>/dev/null || echo 0); echo $((count + 1)) > .spur/run/idea-ac-retry-count; rm -f .spur/run/idea-ac-content.md .spur/run/idea-ac-done.txt'
+          command: 'mkdir -p .spur/run && count=$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0); echo $((count + 1)) > .spur/run/$__runId-idea-ac-retry-count; rm -f .spur/run/$__runId-idea-ac-content.md .spur/run/$__runId-idea-ac-done.txt'
       - kind: agent.run
         options:
           agent: ${vars.agent}
           input: "Generate acceptance criteria for feature ${vars.featureId}. Read the feature file and author R-numbered BDD Gherkin scenarios per ac-style-guide.md. Output only the complete Acceptance Criteria section body, including the gherkin code fence, with no surrounding commentary and no section heading."
-          answerFile: .spur/run/idea-ac-content.md
-          expectFile: .spur/run/idea-ac-content.md
+          answerFile: .spur/run/${vars.__runId}-idea-ac-content.md
+          expectFile: .spur/run/${vars.__runId}-idea-ac-content.md
           timeoutMs: ${vars.stepTimeoutMs}
+      # Empty capture is a RETRYABLE outcome, not a run abort. `answerFile` always
+      # creates the file (so `expectFile` above cannot catch an empty answer), and the
+      # old `test -s … && …` chain exited 1 on empty content — killing the run under
+      # the default `fail` policy before the capped retry edges were ever evaluated,
+      # contradicting this state's own contract. Empty now falls through with exit 0
+      # so `spur feature check` in the guards routes it back here (cap: 3). A failing
+      # CLI *write* still exits non-zero and aborts — that one is not retryable.
       - kind: shell
         options:
-          command: 'test -s .spur/run/idea-ac-content.md && ${vars.spurBin} feature update ${vars.featureId} --section "Acceptance Criteria" --from-file .spur/run/idea-ac-content.md && date -u +%Y-%m-%dT%H:%M:%SZ > .spur/run/idea-ac-done.txt'
+          command: >-
+            if test -s .spur/run/$__runId-idea-ac-content.md; then
+              $spurBin feature update $featureId --section "Acceptance Criteria" --from-file .spur/run/$__runId-idea-ac-content.md && date -u +%Y-%m-%dT%H:%M:%SZ > .spur/run/$__runId-idea-ac-done.txt;
+            else
+              exit 0;
+            fi
 
   - id: feature-check
     description: >
-      HITL gate: runs spur feature check <id> --strict. The check is objective
+      HITL gate: runs spur feature check <id>. Deliberately NOT --strict: before
+      decompose/batch-create a feature has scenarios but zero linked tasks, which
+      emits L4.orphan-scenarios at severity `warning`; --strict would elevate that
+      to a failure, making the success edges unreachable and looping ac-generate
+      into `failed`. Malformed AC still blocks via the error-severity L3 BDD
+      checks. Strict coverage belongs at the shippable gate, not here. The check
+      is objective
       (schema/AC validation) and auto-routable — under profile=auto the transition
       guards route directly from ac-generate to the appropriate next state, so this
       state is only entered in interactive mode. On failure, the retry cap routes
@@ -180,8 +220,17 @@ states:
       rejects it. This gate is NOT auto-clicked by --auto (Auto-Decision Principle
       #5: taste-decision -> surface to human). Only routes around when
       vars.design_approved=true (explicit prior approval).
+
+      R7 (0433): a headless `no` persisted by DefaultHitlResponder would loop
+      design-approval -> system-design -> design-approval, burning unbounded
+      agent passes. The onEnter shell increments a reject counter; the `no`
+      edge to system-design is capped at 1 revise, after which the run
+      terminates as `failed` naming this gate.
     pause: true
     onEnter:
+      - kind: shell
+        options:
+          command: 'mkdir -p .spur/run && count=$(cat .spur/run/$__runId-idea-design-reject-count 2>/dev/null || echo 0); echo $((count + 1)) > .spur/run/$__runId-idea-design-reject-count'
       - kind: hitl.confirm
         options:
           prompt: "Review the system design for feature ${vars.featureId}. Approve to proceed to decomposition?"
@@ -190,15 +239,16 @@ states:
     description: >
       Dispatch sp:spec-decomposition with the brainstorm artifact, feature AC, and
       design doc as input. The agent produces a task-batch JSON file at
-      .spur/run/idea-task-batch.json, validated against task-batch.schema.json.
+      .spur/run/${vars.__runId}-idea-task-batch.json, validated against task-batch.schema.json.
     onEnter:
       - kind: shell
         options:
-          command: 'mkdir -p .spur/run && count=$(cat .spur/run/idea-decompose-retry-count 2>/dev/null || echo 0); echo $((count + 1)) > .spur/run/idea-decompose-retry-count; rm -f .spur/run/idea-task-batch.json .spur/run/idea-batch-create.done .spur/run/idea-batch-create.failed'
+          command: 'mkdir -p .spur/run && count=$(cat .spur/run/$__runId-idea-decompose-retry-count 2>/dev/null || echo 0); echo $((count + 1)) > .spur/run/$__runId-idea-decompose-retry-count; rm -f .spur/run/$__runId-idea-task-batch.json .spur/run/$__runId-idea-batch-create.done .spur/run/$__runId-idea-batch-create.failed'
       - kind: agent.run
         options:
           agent: ${vars.agent}
-          input: "Run sp:spec-decomposition for feature ${vars.featureId}. Read the brainstorm artifact, feature AC, and design doc. Produce a task-batch JSON array at .spur/run/idea-task-batch.json, validated against apps/cli/schemas/task-batch.schema.json. Schema-permitted fields per entry: `name`, `background`, `requirements`, `feature_id`, `parent_wbs`, `priority`, `tags`, `template` — schema validation rejects anything else. Acceptance Criteria, Design, and Plan sections are filled in by the per-task refine step after batch-create, NOT at decompose time. Validate locally against the schema before emitting."
+          input: "Run sp:spec-decomposition for feature ${vars.featureId}. Read the brainstorm artifact, feature AC, and design doc. Produce a task-batch JSON array at .spur/run/${vars.__runId}-idea-task-batch.json, validated against apps/cli/schemas/task-batch.schema.json. Schema-permitted fields per entry: `name`, `background`, `requirements`, `feature_id`, `parent_wbs`, `priority`, `tags`, `template` — schema validation rejects anything else. Acceptance Criteria, Design, and Plan sections are filled in by the per-task refine step after batch-create, NOT at decompose time. Validate locally against the schema before emitting."
+          expectFile: .spur/run/${vars.__runId}-idea-task-batch.json
           timeoutMs: ${vars.stepTimeoutMs}
 
   - id: batch-create
@@ -223,7 +273,7 @@ states:
     onEnter:
       - kind: shell
         options:
-          command: 'if test -f .spur/run/idea-batch-create.done; then exit 0; fi; rm -f .spur/run/idea-batch-create.failed; if ${vars.spurBin} task batch-create --file .spur/run/idea-task-batch.json; then date -u +%Y-%m-%dT%H:%M:%SZ > .spur/run/idea-batch-create.done; else date -u +%Y-%m-%dT%H:%M:%SZ > .spur/run/idea-batch-create.failed; fi'
+          command: 'if test -f .spur/run/$__runId-idea-batch-create.done; then exit 0; fi; rm -f .spur/run/$__runId-idea-batch-create.failed; if $spurBin task batch-create --file .spur/run/$__runId-idea-task-batch.json; then date -u +%Y-%m-%dT%H:%M:%SZ > .spur/run/$__runId-idea-batch-create.done; else date -u +%Y-%m-%dT%H:%M:%SZ > .spur/run/$__runId-idea-batch-create.failed; fi'
 
   - id: handoff
     description: >
@@ -237,7 +287,7 @@ states:
       # Checkpoint write: record session state for resume (Phase 4, task 0171 R3)
       - kind: shell
         options:
-          command: 'mkdir -p .spur/memory/sessions && echo "checkpoint: idea-pipeline handoff feature=${vars.featureId} ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)" > .spur/memory/sessions/idea-checkpoint.md'
+          command: 'mkdir -p .spur/memory/sessions && echo "checkpoint: idea-pipeline handoff feature=$featureId ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)" > .spur/memory/sessions/idea-checkpoint.md'
 
   - id: cancelled
     description: Terminal — pipeline cancelled by operator or error.
@@ -252,7 +302,14 @@ transitions:
   # ── start -> discovery ──
   - from: start
     to: discovery
-    description: Begin discovery — brainstorm the idea.
+    description: Agent doctor PASS — begin discovery.
+    guard:
+      kind: shell
+      options:
+        command: 'test "$(cat .spur/run/$__runId-idea-precheck-doctor.status 2>/dev/null)" = PASS'
+  - from: start
+    to: failed
+    description: Agent doctor FAIL — stop before discovery.
     guard:
       kind: always
 
@@ -266,7 +323,7 @@ transitions:
     guard:
       kind: shell
       options:
-        command: 'test "${vars.profile}" = auto && test "${vars.idea_approved}" = true'
+        command: 'test "$profile" = auto && test "$idea_approved" = true'
   - from: discovery
     to: idea-eval
     description: Discovery complete — gate on idea evaluation taste decision.
@@ -281,21 +338,21 @@ transitions:
     guard:
       kind: shell
       options:
-        command: 'test "${vars.profile}" = auto && test "${vars.idea_approved}" = true'
+        command: 'test "$profile" = auto && test "$idea_approved" = true'
   - from: idea-eval
     to: feature-create
     description: Idea evaluation approved — create or select a feature.
     guard:
       kind: shell
       options:
-        command: 'test "${vars.__hitlAnswer}" = yes'
+        command: 'test "$__hitlAnswer" = yes'
   - from: idea-eval
     to: cancelled
     description: Idea evaluation rejected or cancelled — no feature created.
     guard:
       kind: shell
       options:
-        command: 'test "${vars.__hitlAnswer}" = no || test "${vars.__hitlAnswer}" = cancel'
+        command: 'test "$__hitlAnswer" = no || test "$__hitlAnswer" = cancel'
 
   # ── feature-create -> ac-generate ──
   - from: feature-create
@@ -317,7 +374,7 @@ transitions:
     guard:
       kind: shell
       options:
-        command: 'test "${vars.profile}" = auto && ${vars.spurBin} feature check ${vars.featureId} --strict && test "${vars.design}" = auto && test "$(jq -r .needs_design .spur/run/idea-needs-design.json 2>/dev/null)" != false'
+        command: 'test "$profile" = auto && $spurBin feature check $featureId && test "$design" = auto && test "$(jq -r .needs_design .spur/run/$__runId-idea-needs-design.json 2>/dev/null)" != false'
   # Auto-skip 2: pass + skip-design route → decompose
   - from: ac-generate
     to: decompose
@@ -325,7 +382,7 @@ transitions:
     guard:
       kind: shell
       options:
-        command: 'test "${vars.profile}" = auto && ${vars.spurBin} feature check ${vars.featureId} --strict && (test "${vars.design}" = skip || (test "${vars.design}" = auto && test "$(jq -r .needs_design .spur/run/idea-needs-design.json 2>/dev/null)" = false))'
+        command: 'test "$profile" = auto && $spurBin feature check $featureId && (test "$design" = skip || (test "$design" = auto && test "$(jq -r .needs_design .spur/run/$__runId-idea-needs-design.json 2>/dev/null)" = false))'
   # Auto-skip 3: check failed, retry < 3 → loop back to ac-generate (self-loop)
   - from: ac-generate
     to: ac-generate
@@ -333,7 +390,7 @@ transitions:
     guard:
       kind: shell
       options:
-        command: 'test "${vars.profile}" = auto && ! ${vars.spurBin} feature check ${vars.featureId} --strict && test "$(cat .spur/run/idea-ac-retry-count 2>/dev/null || echo 0)" -lt 3'
+        command: 'test "$profile" = auto && ! $spurBin feature check $featureId && test "$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0)" -lt 3'
   # Auto-skip 4: check failed, retry cap reached → escalate to failed
   - from: ac-generate
     to: failed
@@ -341,7 +398,7 @@ transitions:
     guard:
       kind: shell
       options:
-        command: 'test "${vars.profile}" = auto && ! ${vars.spurBin} feature check ${vars.featureId} --strict && test "$(cat .spur/run/idea-ac-retry-count 2>/dev/null || echo 0)" -ge 3'
+        command: 'test "$profile" = auto && ! $spurBin feature check $featureId && test "$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0)" -ge 3'
   # Interactive fallback: enter feature-check HITL gate
   - from: ac-generate
     to: feature-check
@@ -357,35 +414,35 @@ transitions:
     guard:
       kind: shell
       options:
-        command: 'test "${vars.__hitlAnswer}" = yes && ${vars.spurBin} feature check ${vars.featureId} --strict && test "${vars.design}" = auto && test "$(jq -r .needs_design .spur/run/idea-needs-design.json 2>/dev/null)" != false'
+        command: 'test "$__hitlAnswer" = yes && $spurBin feature check $featureId && test "$design" = auto && test "$(jq -r .needs_design .spur/run/$__runId-idea-needs-design.json 2>/dev/null)" != false'
   - from: feature-check
     to: decompose
     description: Feature check passed, skip-design route — go directly to decompose.
     guard:
       kind: shell
       options:
-        command: 'test "${vars.__hitlAnswer}" = yes && ${vars.spurBin} feature check ${vars.featureId} --strict && (test "${vars.design}" = skip || (test "${vars.design}" = auto && test "$(jq -r .needs_design .spur/run/idea-needs-design.json 2>/dev/null)" = false))'
+        command: 'test "$__hitlAnswer" = yes && $spurBin feature check $featureId && (test "$design" = skip || (test "$design" = auto && test "$(jq -r .needs_design .spur/run/$__runId-idea-needs-design.json 2>/dev/null)" = false))'
   - from: feature-check
     to: ac-generate
     description: "Feature check failed — revise AC (retry cap: 3)."
     guard:
       kind: shell
       options:
-        command: '(test "${vars.__hitlAnswer}" = no || ! ${vars.spurBin} feature check ${vars.featureId} --strict) && test "$(cat .spur/run/idea-ac-retry-count 2>/dev/null || echo 0)" -lt 3'
+        command: '(test "$__hitlAnswer" = no || ! $spurBin feature check $featureId) && test "$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0)" -lt 3'
   - from: feature-check
     to: failed
     description: Feature check failed after 3 retries — escalate to failed.
     guard:
       kind: shell
       options:
-        command: '(test "${vars.__hitlAnswer}" = no || ! ${vars.spurBin} feature check ${vars.featureId} --strict) && test "$(cat .spur/run/idea-ac-retry-count 2>/dev/null || echo 0)" -ge 3'
+        command: '(test "$__hitlAnswer" = no || ! $spurBin feature check $featureId) && test "$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0)" -ge 3'
   - from: feature-check
     to: cancelled
     description: Operator cancelled the feature-check gate.
     guard:
       kind: shell
       options:
-        command: 'test "${vars.__hitlAnswer}" = cancel'
+        command: 'test "$__hitlAnswer" = cancel'
 
   # ── system-design: -> design-approval (normal) OR -> decompose (auto + prior approval) ──
   # Declaration order: auto-skip guard tried FIRST (like task-pipeline's review->verify pattern).
@@ -395,7 +452,7 @@ transitions:
     guard:
       kind: shell
       options:
-        command: 'test "${vars.profile}" = auto && test "${vars.design_approved}" = true'
+        command: 'test "$profile" = auto && test "$design_approved" = true'
   - from: system-design
     to: design-approval
     description: System design done — gate on design approval.
@@ -409,21 +466,28 @@ transitions:
     guard:
       kind: shell
       options:
-        command: 'test "${vars.__hitlAnswer}" = yes'
+        command: 'test "$__hitlAnswer" = yes'
   - from: design-approval
     to: system-design
-    description: Design rejected — revise system design.
+    description: "Design rejected - revise system design (cap: 1 revise)."
+    guard:
+      kind: shell
+      options:
+        command: 'test "$__hitlAnswer" = no && test "$(cat .spur/run/$__runId-idea-design-reject-count 2>/dev/null || echo 0)" -le 1'
+  - from: design-approval
+    to: failed
+    description: "Design rejected after 1 revise - design-approval gate exhausted (R7 0433)."
     guard:
       kind: shell
       options:
-        command: 'test "${vars.__hitlAnswer}" = no'
+        command: 'test "$__hitlAnswer" = no && test "$(cat .spur/run/$__runId-idea-design-reject-count 2>/dev/null || echo 0)" -gt 1'
   - from: design-approval
     to: cancelled
     description: Operator cancelled design approval.
     guard:
       kind: shell
       options:
-        command: 'test "${vars.__hitlAnswer}" = cancel'
+        command: 'test "$__hitlAnswer" = cancel'
 
   # ── decompose: auto-skip (profile=auto) OR enter batch-create HITL gate (interactive) ──
   - from: decompose
@@ -432,7 +496,7 @@ transitions:
     guard:
       kind: shell
       options:
-        command: 'test "${vars.profile}" = auto'
+        command: 'test "$profile" = auto'
   # Interactive fallback: enter batch-create HITL gate
   - from: decompose
     to: batch-create
@@ -446,21 +510,21 @@ transitions:
     guard:
       kind: shell
       options:
-        command: 'test "${vars.__hitlAnswer}" = yes'
+        command: 'test "$__hitlAnswer" = yes'
   - from: batch-create
     to: decompose
     description: Operator requested decomposition revisions.
     guard:
       kind: shell
       options:
-        command: 'test "${vars.__hitlAnswer}" = no'
+        command: 'test "$__hitlAnswer" = no'
   - from: batch-create
     to: cancelled
     description: Operator cancelled batch creation.
     guard:
       kind: shell
       options:
-        command: 'test "${vars.__hitlAnswer}" = cancel'
+        command: 'test "$__hitlAnswer" = cancel'
 
   # ── batch-create-run: success -> handoff, failure -> decompose (retry cap: 3), failure+cap -> failed ──
   - from: batch-create-run
@@ -469,18 +533,18 @@ transitions:
     guard:
       kind: shell
       options:
-        command: 'test -f .spur/run/idea-batch-create.done'
+        command: 'test -f .spur/run/$__runId-idea-batch-create.done'
   - from: batch-create-run
     to: decompose
     description: "Batch-create failed — revise decomposition (retry cap: 3)."
     guard:
       kind: shell
       options:
-        command: 'test -f .spur/run/idea-batch-create.failed && test "$(cat .spur/run/idea-decompose-retry-count 2>/dev/null || echo 0)" -lt 3'
+        command: 'test -f .spur/run/$__runId-idea-batch-create.failed && test "$(cat .spur/run/$__runId-idea-decompose-retry-count 2>/dev/null || echo 0)" -lt 3'
   - from: batch-create-run
     to: failed
     description: Batch-create failed after 3 retries — escalate to failed.
     guard:
       kind: shell
       options:
-        command: 'test -f .spur/run/idea-batch-create.failed && test "$(cat .spur/run/idea-decompose-retry-count 2>/dev/null || echo 0)" -ge 3'
+        command: 'test -f .spur/run/$__runId-idea-batch-create.failed && test "$(cat .spur/run/$__runId-idea-decompose-retry-count 2>/dev/null || echo 0)" -ge 3'