Address tenth review: max_iterations validation, catalog config guard, version alignment

- Validate max_iterations is int >= 1 in while and do-while steps
- Guard add_catalog against corrupted config (non-dict/non-list)
- Align speckit_version requirement to >=0.6.1 (current package version)
- Fan-out template validation uses separate seen_ids set to avoid
  false duplication errors with user-defined step IDs

Author: mnriem

src/specify_cli/workflows/catalog.py

@@ -455,11 +455,18 @@ def add_catalog(self, url: str, name: str | None = None) -> None:
 
         data: dict[str, Any] = {"catalogs": []}
         if config_path.exists():
-            data = yaml.safe_load(config_path.read_text(encoding="utf-8")) or {
-                "catalogs": []
-            }
+            raw = yaml.safe_load(config_path.read_text(encoding="utf-8"))
+            if not isinstance(raw, dict):
+                raise WorkflowValidationError(
+                    "Catalog config file is corrupted (expected a mapping)."
+                )
+            data = raw
 
         catalogs = data.get("catalogs", [])
+        if not isinstance(catalogs, list):
+            raise WorkflowValidationError(
+                "Catalog config 'catalogs' must be a list."
+            )
         # Check for duplicate URL
         for cat in catalogs:
             if cat.get("url") == url:

src/specify_cli/workflows/engine.py

@@ -189,10 +189,13 @@ def _validate_steps(
         if isinstance(default, list):
             _validate_steps(default, seen_ids, errors)
 
-        # Validate fan-out nested step
+        # Validate fan-out nested step (template — not added to seen_ids
+        # since the engine renames items to _fanout_<step>_<base>_<idx>)
         fan_step = step_config.get("step")
         if isinstance(fan_step, dict):
-            _validate_steps([fan_step], seen_ids, errors)
+            fan_errors: list[str] = []
+            _validate_steps([fan_step], set(), fan_errors)
+            errors.extend(fan_errors)
 
 
 # -- Run State Persistence ------------------------------------------------

src/specify_cli/workflows/steps/do_while/__init__.py

@@ -49,6 +49,13 @@ def validate(self, config: dict[str, Any]) -> list[str]:
                 f"Do-while step {config.get('id', '?')!r} is missing "
                 f"'max_iterations' field."
             )
+        else:
+            max_iter = config.get("max_iterations")
+            if not isinstance(max_iter, int) or max_iter < 1:
+                errors.append(
+                    f"Do-while step {config.get('id', '?')!r}: "
+                    f"'max_iterations' must be an integer >= 1."
+                )
         nested = config.get("steps", [])
         if not isinstance(nested, list):
             errors.append(

src/specify_cli/workflows/steps/while_loop/__init__.py

@@ -56,6 +56,13 @@ def validate(self, config: dict[str, Any]) -> list[str]:
                 f"While step {config.get('id', '?')!r} is missing "
                 f"'max_iterations' field."
             )
+        else:
+            max_iter = config.get("max_iterations")
+            if not isinstance(max_iter, int) or max_iter < 1:
+                errors.append(
+                    f"While step {config.get('id', '?')!r}: "
+                    f"'max_iterations' must be an integer >= 1."
+                )
         nested = config.get("steps", [])
         if not isinstance(nested, list):
             errors.append(

workflows/speckit/workflow.yml

@@ -8,7 +8,7 @@ workflow:
   integration: copilot
 
 requires:
-  speckit_version: ">=0.7.0"
+  speckit_version: ">=0.6.1"
   integrations:
     any: ["copilot", "claude", "gemini"]