@sun-asterisk/sungen 3.2.16-beta.1 → 3.2.16-beta.2

package/dist/orchestrator/templates/ai-src/commands/delivery.md

@@ -74,11 +74,37 @@ dispositions:                      # scenarios intentionally NOT delivered as te
   locales.
 - MUST split: different target, intent, oracle family, category, execution mode (`@manual` vs
   auto), test layer (`@api`/`@query`), or priority tag; sequence-sensitive flows (re-Given/When
-  after a Then) stay solo.
+  after a Then) stay solo. **Different risk classes never merge** — XSS and SQL injection are
+  separate items even though both are "injection on the same field" (different risk, action,
+  and oracle family); a component's visibility rule and its action/revalidation rule are two
+  intents, not one.
 - Every scenario must land in exactly one group **or** one disposition (Gate B enforces 100%
   disposition). Data-setup blocks (`@manual:data-setup`) → `excluded`; SPEC-GAP placeholders →
   `blocked`.
 
+**Wording rules for `intent`/`oracle` (customer-facing — Gate W lints these):**
+- Plain product language, present simple, ~10–20 words, one behavior:
+  "A user can sign in with valid credentials and is redirected to the Jobs page."
+- Oracle = the observable outcome as a definite assertion ("The Jobs page is displayed and the
+  Logout link is visible.") — no `should`, no tester actions.
+- NEVER: `{{tokens}}`, `[Selector]` references, DSL phrasing (`User fill/click/see`), generator
+  labels (`Setup:`/`Observable:`/`Oracle:`), or vague verbs (`handles`, `surfaces`) when a precise
+  behavior exists. Use the visible UI label (the Login button, the Email field).
+- **Preserve the source meaning exactly** — never strengthen, weaken, or reinterpret an oracle
+  (a security assertion especially: if the source says "the password appears ONLY in the HTTPS
+  POST body", do not write "no plaintext password on the network").
+
+**Requirement coverage (`requirements:` section, optional):** `sungen delivery` scans
+`requirements/spec.md` for FR-/TR-/NFR- ids; ids traced by `@spec:` tags are `covered`, the rest
+are `gap` (Gate R warning). Record the reviewed status for genuine non-gaps:
+
+```yaml
+requirements:
+  TR-007: { status: planned, note: Performance needs Lighthouse-style tooling }
+  TR-004: { status: partially_covered, note: client-side covered by VP-SEC-003; hashing needs DB verify }
+  # status: covered | partially_covered | covered_elsewhere | planned | gap | not_applicable
+```
+
 Then validate and fix any ERROR findings:
 
 ```bash

package/dist/orchestrator/templates/ai-src/skills/sungen-delivery/SKILL.md

@@ -32,16 +32,39 @@ spec is `docs/spec/delivery-coverage-matrix-spec.md`.
 B mapping (every scenario in exactly one group XOR one disposition) · C aggregation (mode/layer/
 priority recomputed and equal within a group — heuristic oracle-shape/precondition mismatches are
 review-level, silenced once approved and unchanged) · D executability (precondition · condition+
-data · trigger · oracle all renderable; every `{{var}}` resolves) · E drift (fingerprint mismatch
-→ back to review) · G review state (proposed groups block the official render; `--preview` renders
-a DRAFT watermark).
-
-**Workbook**: `Testcases` sheet (parent rows + outline-level-1 variant sub-rows — collapse for the
-customer view, expand to execute; result roll-up failed→blocked→not_run→partial→passed, counts like
-`7/8 Passed · 1 Failed`) + `Coverage` sheet (target × category grid with explicit `—` gaps,
-dispositions, generation manifest). CSV is flat with a `Level` column (`item`/`variant`).
+data · trigger · oracle all renderable; every `{{var}}` resolves; **no template token may survive
+into a rendered cell** — test-data cross-references are resolved for display) · E drift
+(fingerprint mismatch → back to review) · G review state (proposed groups block the official
+render; `--preview` renders a DRAFT watermark) · R requirement coverage (spec FR/TR/NFR ids with
+no trace and no `requirements:` status → warning) · W wording lint (map intent/oracle containing
+tokens, `[Selector]` refs, DSL phrasing, or generator labels → warning).
+
+**Wording normalization (deterministic, after semantic normalization):** DSL steps render as
+controlled manual-test English without changing meaning — actions in the imperative (`User fill
+[Email] field with X` → `Enter X in the Email field.`), expected results as observable assertions
+(`User see [Jobs] page` → `The Jobs page is displayed.`), preconditions as states (`The user is
+signed out.`). Manual `# Tester verifies:` labels become structured fields: `Setup:` →
+Precondition, `Action:` → Action, `Observable:` → Expected Result, `Oracle:` → a separate
+`Verification method:` line. Sequence-sensitive flows keep event order: actions numbered with
+mid-flow assertions inline as `Verify: …`; only the final Then block is the Expected Result.
+Empty test values render as `(empty)`.
+
+**Workbook**: `Testcases` sheet — parent rows + outline-level-1 variant sub-rows for **every**
+item (single-variant included: the sub-row carries the source VP-id, resolved data, and the
+result/evidence entry). Collapse outline for the customer view, expand to execute. Variant Result
+cells have a dropdown (Passed/Failed/Blocked/Pending/N/A) and the parent Result is a **live Excel
+formula** over its children (failed→blocked→pending→partial→passed, e.g. `2/3 Passed · 1 Failed`)
+— a parent can never contradict its variants, even after manual edits. ID + Target columns are
+frozen; dates are ISO (`2026-08-04`). `Coverage` sheet — requirement coverage table (every FR/TR/
+NFR id with an explicit status), target × category grid with explicit `—` gaps, dispositions,
+manifest. CSV is flat with a `Level` column (`item`/`variant`) + a requirement-coverage appendix.
 `delivery_item_count` ≠ progress — variants are the execution metric.
 
+**Authoring guidance the matrix rewards** (create-test side): payload/provider matrices (SQLi
+payload lists, OAuth provider sets) belong in `@cases` datasets so each case is an atomic,
+independently-reportable variant; keep dataset `case:` labels short and stable (`CHK-EMAIL-I1`),
+with descriptions in other columns — the label is part of the variant's identity.
+
 ---
 
 ## Legacy mode (--legacy / --full)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sun-asterisk/sungen",
-  "version": "3.2.16-beta.1",
+  "version": "3.2.16-beta.2",
   "description": "Deterministic E2E Test Compiler - Gherkin + Selectors → Playwright tests",
   "main": "src/index.ts",
   "types": "src/index.ts",
@@ -39,8 +39,8 @@
     "@babel/types": "^7.28.5",
     "@cucumber/gherkin": "^37.0.0",
     "@cucumber/messages": "^31.0.0",
-    "@sungen/driver-data-factory": "3.2.16-beta.1",
-    "@sungen/driver-ui": "3.2.16-beta.1",
+    "@sungen/driver-data-factory": "3.2.16-beta.2",
+    "@sungen/driver-ui": "3.2.16-beta.2",
     "chalk": "^5.6.2",
     "commander": "^14.0.2",
     "dotenv": "^17.2.3",

package/src/cli/commands/delivery.ts

@@ -621,6 +621,7 @@ function matrixPathsFor(cwd: string, target: DeliveryTarget): MatrixTargetPaths
     featureFile: path.join(base, 'features', `${target.featureBaseName}.feature`),
     testDataFile: resolveTestDataPathForTarget(cwd, target),
     specFile: path.join(genBase, `${target.featureBaseName}.spec.ts`),
+    specMdFile: path.join(base, 'requirements', 'spec.md'),
     resultsPath: resolveResultsPath(cwd, target),
     mapFile: mapFilePath(base, target.featureBaseName),
   };

package/src/exporters/matrix/build.ts

@@ -6,7 +6,7 @@
  */
 
 import { FeatureMetadata, PlaywrightResult } from '../types';
-import { MergedScenario, parseManualComments } from '../scenario-merger';
+import { MergedScenario } from '../scenario-merger';
 import {
   extractAuthRole,
   extractPriority,
@@ -14,7 +14,7 @@ import {
   splitVpAndName,
 } from '../feature-parser';
 import { getCasesDatasetRows, resolveResultVariants } from '../result-variants';
-import { substituteTestDataVars } from '../test-data-resolver';
+import { classifyManualComments, renderAction, renderExpected, renderPrecondition } from './wording';
 import { scenarioFingerprint, combinedFingerprint, mapContentFingerprint } from './fingerprint';
 import {
   CoverageVariant,
@@ -24,6 +24,7 @@ import {
   MatrixDisposition,
   MatrixLayer,
   MatrixModel,
+  RequirementCoverage,
   MAX_VARIANTS_PER_ITEM,
 } from './types';
 import { runGates } from './gates';
@@ -89,6 +90,8 @@ export interface BuildInputs {
   results: Map<string, PlaywrightResult> | null;
   map: DeliveryMap;
   transformerVersion: string;
+  /** requirements/spec.md content — source of the requirement-id inventory (FR/TR/NFR). */
+  specText?: string;
 }
 
 /**
@@ -97,7 +100,10 @@ export interface BuildInputs {
  * support tooling see the same universe the builder does.
  */
 export function deriveVariants(inputs: Pick<BuildInputs, 'feature' | 'merged' | 'testData' | 'results'>): CoverageVariant[] {
-  const { merged, testData, results } = inputs;
+  const { merged, results } = inputs;
+  // Test-data values may cross-reference other keys (email_padded: " {{valid_email}} ") —
+  // resolve one level so display cells never leak a template token (review B-04).
+  const testData = resolveCrossRefs(inputs.testData);
   const variants: CoverageVariant[] = [];
 
   for (const m of merged) {
@@ -107,26 +113,36 @@ export function deriveVariants(inputs: Pick<BuildInputs, 'feature' | 'merged' |
     const mode = extractTestcaseType(tags) === 'Manual' ? 'manual' : 'auto';
     const authRole = extractAuthRole(tags);
     const vpCategory = vpId.replace(/^VP-/, '').replace(/-\d+[a-zA-Z]?$/, '');
+    const procedureProfile = deriveProcedureProfile(m);
 
-    // Manual procedure comes from the parsed comment block; auto from Gherkin buckets.
+    // Manual scenarios: the `# Tester verifies:` block is classified into structured
+    // fields — Setup → precondition (review B-02), Action → trigger, Observable →
+    // expected, Oracle → verification method. Labels never remain inside prose.
     const manual = mode === 'manual' && m.feature.comments?.length
-      ? parseManualComments(m.feature.comments)
+      ? classifyManualComments(m.feature.comments)
       : null;
-    // A pure-render check (Given + Then only) is triggered by the page load itself —
-    // that IS its action, not a Gate-D executability gap.
-    const rawTrigger = manual ? manual.steps.map((s) => s.text) : m.feature.rawWhenSteps;
-    const triggerSteps = rawTrigger.length > 0 ? rawTrigger : ['(on page load)'];
-    const oracleSteps = m.resolvedExpected.map((s) => s.text);
+
+    // Raw (pre-wording) step texts — these feed shapes + Gate C, never the cells.
+    const rawTrigger = manual ? manual.actions : m.feature.rawWhenSteps;
+    const rawOracle = manual
+      ? (manual.expected.length > 0 ? manual.expected : m.feature.rawThenSteps)
+      : m.resolvedExpected.filter((s) => s.bucket === 'then').map((s) => s.text);
 
     const preconditionProfile = [
       authRole ?? '-',
       m.feature.extendsName ?? '-',
       ...m.feature.rawGivenSteps.map(normalizeShape),
+      ...(manual?.preconditions ?? []).map(normalizeShape),
     ].join(' | ');
-    const precondition = [
-      ...(authRole ? [authRole === 'no-auth' ? 'Not authenticated' : `Authenticated as ${authRole}`] : []),
-      ...m.feature.rawGivenSteps,
-    ];
+    // Display precondition = auth state + Background Given (shared start state) +
+    // the scenario's own Given steps + manual Setup lines — deduplicated (a manual
+    // scenario often repeats the Background navigation as its own Given).
+    const precondition = Array.from(new Set([
+      ...(authRole ? [authRole === 'no-auth' ? 'The user is signed out.' : `The user is signed in as ${authRole}.`] : []),
+      ...inputs.feature.backgroundGivenSteps.map(renderPrecondition),
+      ...m.feature.rawGivenSteps.map(renderPrecondition),
+      ...(manual?.preconditions ?? []).map((t) => renderPrecondition(t)),
+    ]));
 
     const base = {
       vpId,
@@ -136,11 +152,46 @@ export function deriveVariants(inputs: Pick<BuildInputs, 'feature' | 'merged' |
       manualReason: manualReason(tags),
       layers: deriveLayers(tags),
       traces: tags.filter((t) => t.startsWith('@spec:')).map((t) => t.slice('@spec:'.length)),
-      triggerShape: triggerSteps.map(normalizeShape),
-      oracleShape: oracleSteps.map(normalizeShape),
+      triggerShape: rawTrigger.map(normalizeShape),
+      oracleShape: rawOracle.map(normalizeShape),
       preconditionProfile,
       precondition,
-      procedureProfile: deriveProcedureProfile(m),
+      procedureProfile,
+      verification: manual?.verification.map((t) => sentenceOf(t)) ?? [],
+    };
+
+    /** Render the display cells for one data context (vars resolved first). */
+    const renderCells = (vars: Record<string, string>): { trigger: string[]; oracle: string[]; precondition: string[]; verification: string[] } => {
+      const sub = (s: string): string => substituteDisplayVars(s, vars);
+      const preconditionOut = precondition.map(sub);
+      const verificationOut = base.verification.map(sub);
+      if (procedureProfile === 'sequence' && !manual) {
+        // Ordered flow (review B-03): keep the event order — actions stay numbered in
+        // the trigger, mid-flow assertions render inline as "Verify:", and only the
+        // FINAL Then block becomes the expected result.
+        const steps = m.feature.orderedSteps;
+        let lastActionIdx = -1;
+        steps.forEach((s, i) => { if (s.bucket !== 'then') lastActionIdx = i; });
+        const trigger: string[] = [];
+        const oracle: string[] = [];
+        steps.forEach((s, i) => {
+          if (i > lastActionIdx) oracle.push(renderExpected(sub(s.text)));           // trailing Then block
+          else if (s.bucket === 'then') trigger.push(`Verify: ${renderExpected(sub(s.text))}`);
+          else if (s.bucket === 'when') trigger.push(renderAction(sub(s.text)));
+          // leading given steps already live in the precondition
+        });
+        return { trigger, oracle, precondition: preconditionOut, verification: verificationOut };
+      }
+      const trigger = rawTrigger.map((s) => renderAction(sub(s)));
+      const oracle = rawOracle.map((s) => renderExpected(sub(s)));
+      return {
+        // A pure-render check (Given + Then only) is checked on page load — say so
+        // in words instead of a placeholder token (review §10.3).
+        trigger: trigger.length > 0 ? trigger : ['No action — the state is checked on page load.'],
+        oracle,
+        precondition: preconditionOut,
+        verification: verificationOut,
+      };
     };
 
     const rows = getCasesDatasetRows(m, testData ?? undefined);
@@ -150,6 +201,7 @@ export function deriveVariants(inputs: Pick<BuildInputs, 'feature' | 'merged' |
       const resultByLabel = new Map(resultVariants.map((rv) => [rv.nameSuffix.replace(/^ — /, ''), rv.result]));
       rows.forEach((row, i) => {
         const label = String(row.case ?? row.name ?? row.label ?? `row ${i + 1}`);
+        const cells = renderCells({ ...(testData ?? {}), ...rowAsStrings(row) });
         variants.push({
           ...base,
           ref: `${vpId}#${label}`,
@@ -157,21 +209,26 @@ export function deriveVariants(inputs: Pick<BuildInputs, 'feature' | 'merged' |
           title: `${category1} — ${label}`,
           condition: label,
           data: resolveDataPairs(m.feature.referencedVars, testData, row),
-          trigger: triggerSteps.map((s) => substituteTestDataVars(s, { ...(testData ?? {}), ...rowAsStrings(row) })),
-          oracle: oracleSteps.map((s) => substituteTestDataVars(s, { ...(testData ?? {}), ...rowAsStrings(row) })),
+          trigger: cells.trigger,
+          oracle: cells.oracle,
+          precondition: cells.precondition,
+          verification: cells.verification,
           fingerprint: scenarioFingerprint(m.feature, row),
           result: resultByLabel.get(label),
         });
       });
     } else {
+      const cells = renderCells(testData ?? {});
       variants.push({
         ...base,
         ref: vpId,
         title: category1,
         condition: category1,
         data: resolveDataPairs(m.feature.referencedVars, testData),
-        trigger: triggerSteps.map((s) => substituteTestDataVars(s, testData ?? {})),
-        oracle: oracleSteps.map((s) => substituteTestDataVars(s, testData ?? {})),
+        trigger: cells.trigger,
+        oracle: cells.oracle,
+        precondition: cells.precondition,
+        verification: cells.verification,
         fingerprint: scenarioFingerprint(m.feature),
         result: resolveResultVariants(m, results ?? null, testData ?? undefined)[0]?.result,
       });
@@ -180,9 +237,77 @@ export function deriveVariants(inputs: Pick<BuildInputs, 'feature' | 'merged' |
   return variants;
 }
 
+/**
+ * Display substitution for matrix cells. Unlike the legacy exporter's
+ * substituteTestDataVars (which keeps EMPTY values literal for the Steps
+ * column), an empty value is a legitimate test input here (an intentionally
+ * empty field) — it renders as `(empty)` so the tester sees the intent and no
+ * `{{token}}` survives into the deliverable (Gate D would reject it).
+ */
+function substituteDisplayVars(text: string, vars: Record<string, string>): string {
+  return text.replace(/\{\{\s*([^}\s]+)\s*\}\}/g, (m, key: string) => {
+    if (!(key in vars)) return m; // unknown stays literal → Gate D flags it
+    const v = vars[key];
+    return v === '' ? '(empty)' : v;
+  });
+}
+
+function sentenceOf(text: string): string {
+  const s = text.trim();
+  if (!s) return s;
+  const cap = s.charAt(0).toUpperCase() + s.slice(1);
+  return /[.!?…]$/.test(cap) ? cap : `${cap}.`;
+}
+
+/**
+ * Requirement inventory ∪ traces → coverage table. Ids are scanned from the spec
+ * text (FR-/TR-/NFR-<n>); map overrides win over the derived covered/gap status.
+ */
+export function computeRequirements(
+  specText: string,
+  map: DeliveryMap,
+  items: DeliveryItem[],
+): RequirementCoverage[] {
+  const ids: string[] = [];
+  const seen = new Set<string>();
+  for (const m of specText.matchAll(/\b(?:FR|TR|NFR)-\d+\b/g)) {
+    if (!seen.has(m[0])) { seen.add(m[0]); ids.push(m[0]); }
+  }
+  // Overrides may reference ids the spec text doesn't list (e.g. a shared catalog).
+  for (const id of Object.keys(map.requirements ?? {})) {
+    if (!seen.has(id)) { seen.add(id); ids.push(id); }
+  }
+  if (ids.length === 0) return [];
+
+  return ids.map((id) => {
+    const traced = items.filter((it) => it.variants.some((v) => v.traces.includes(id)));
+    const override = (map.requirements ?? {})[id];
+    return {
+      id,
+      status: override?.status ?? (traced.length > 0 ? 'covered' : 'gap'),
+      items: traced.map((it) => it.id),
+      variantCount: traced.reduce((a, it) => a + it.variants.filter((v) => v.traces.includes(id)).length, 0),
+      note: override?.note ?? '',
+    };
+  });
+}
+
+/** Resolve one level of {{key}} cross-references inside test-data VALUES. */
+function resolveCrossRefs(testData: Record<string, string> | null): Record<string, string> | null {
+  if (!testData) return null;
+  const out: Record<string, string> = {};
+  for (const [k, v] of Object.entries(testData)) {
+    out[k] = typeof v === 'string' && v.includes('{{') ? substituteDisplayVars(v, testData) : v;
+  }
+  return out;
+}
+
 function rowAsStrings(row: Record<string, unknown>): Record<string, string> {
   const out: Record<string, string> = {};
-  for (const [k, v] of Object.entries(row)) out[k] = String(v);
+  for (const [k, v] of Object.entries(row)) {
+    out[k] = String(v);
+    out[`row.${k}`] = String(v); // steps reference dataset columns as {{row.<col>}}
+  }
   return out;
 }
 
@@ -270,6 +395,18 @@ export function buildMatrix(inputs: BuildInputs): MatrixModel {
     reason: d.reason ?? '',
   }));
 
+  // Requirement coverage (review §6): the requirement-id inventory comes from
+  // requirements/spec.md; @spec: traces mark `covered`; the map's `requirements:`
+  // section carries the reviewed overrides (partially_covered / not_applicable / …).
+  const requirements = computeRequirements(inputs.specText ?? '', map, items);
+  const gaps = requirements.filter((r) => r.status === 'gap');
+  if (gaps.length > 0) {
+    findings.push({
+      gate: 'R', severity: 'warning',
+      message: `${gaps.length} requirement id(s) with no coverage or disposition: ${gaps.map((g) => g.id).join(', ')} — trace them, or record a status in the map \`requirements:\` section`,
+    });
+  }
+
   const variantCount = items.reduce((a, i) => a + i.variants.length, 0);
   const approved = items.every((i) => i.review === 'approved')
     && !findings.some((f) => f.severity === 'error' || f.severity === 'review');
@@ -279,6 +416,7 @@ export function buildMatrix(inputs: BuildInputs): MatrixModel {
     formNo: map.formNo ?? 'BM-2-901-13',
     items,
     dispositions,
+    requirements,
     findings,
     manifest: {
       unit,

package/src/exporters/matrix/export.ts

@@ -31,10 +31,18 @@ export interface MatrixTargetPaths {
   featureFile: string;
   testDataFile: string;
   specFile: string;
+  /** requirements/spec.md — the requirement-id inventory for coverage (optional). */
+  specMdFile?: string;
   resultsPath: string | null;
   mapFile: string;
 }
 
+function readSpecText(paths: MatrixTargetPaths): string {
+  return paths.specMdFile && fs.existsSync(paths.specMdFile)
+    ? fs.readFileSync(paths.specMdFile, 'utf-8')
+    : '';
+}
+
 export interface MatrixLoadResult {
   model?: MatrixModel;
   map?: DeliveryMap;
@@ -64,6 +72,7 @@ export function loadMatrixModel(paths: MatrixTargetPaths): MatrixLoadResult {
     results,
     map,
     transformerVersion: getPackageVersion(),
+    specText: readSpecText(paths),
   });
   return { model, map, mapErrors: [] };
 }
@@ -88,6 +97,7 @@ export function approveMatrix(paths: MatrixTargetPaths, groupIds?: string[]): {
   const model = buildMatrix({
     unit: paths.unit, feature, merged, testData, results: null, map,
     transformerVersion: getPackageVersion(),
+    specText: readSpecText(paths),
   });
   const blocking = model.findings.filter((f) => f.severity === 'error');
   if (blocking.length > 0) return { findings: blocking, approved: [] };

package/src/exporters/matrix/gates.ts

@@ -29,6 +29,7 @@ export function runGates(ctx: GateContext): MatrixFinding[] {
   gateDExecutability(ctx, findings);
   gateEDrift(ctx, findings);
   gateGReviewState(ctx, findings);
+  gateWWording(ctx, findings);
   return findings;
 }
 
@@ -241,6 +242,21 @@ function gateDExecutability(ctx: GateContext, findings: MatrixFinding[]): void {
       }
     }
   }
+
+  // No template token may survive into a RENDERED cell (review B-04) — this also
+  // catches cross-referencing test-data values the one-level resolver couldn't close.
+  for (const [, vs] of variantsByVp) {
+    for (const v of vs) {
+      const rendered = [...v.precondition, ...v.trigger, ...v.oracle, ...v.verification, ...v.data];
+      const token = rendered.map((t) => t.match(/\{\{[^}]*\}\}/)).find(Boolean);
+      if (token) {
+        findings.push({
+          gate: 'D', severity: 'error', ref: v.ref,
+          message: `${v.ref}: unresolved template token ${token[0]} remains in the rendered output — the export is not deterministic for a tester`,
+        });
+      }
+    }
+  }
 }
 
 // --- Gate E — drift (stale approval) ------------------------------------------
@@ -271,6 +287,31 @@ function gateEDrift(ctx: GateContext, findings: MatrixFinding[]): void {
   }
 }
 
+// --- Gate W — controlled-language lint on the map's semantic fields --------------
+
+/** Patterns that make customer-facing wording read machine-generated (review §10). */
+const WORDING_SMELLS: Array<[RegExp, string]> = [
+  [/\{\{[^}]*\}\}/, 'an unresolved {{token}}'],
+  [/\b(?:Setup|Observable|Oracle):/, 'a generator label (Setup:/Observable:/Oracle:)'],
+  [/\bUser (?:fill|click|press|see|wait)\b/i, 'DSL phrasing ("User fill/click/see…") — write plain product language'],
+  [/\[[^\]]+\]/, 'a [selector-style] reference — use the visible UI label'],
+];
+
+function gateWWording(ctx: GateContext, findings: MatrixFinding[]): void {
+  for (const g of ctx.inputs.map.groups) {
+    for (const [field, text] of [['intent', g.intent], ['oracle', g.oracle]] as const) {
+      for (const [re, what] of WORDING_SMELLS) {
+        if (re.test(text)) {
+          findings.push({
+            gate: 'W', severity: 'warning', ref: g.id,
+            message: `group ${g.id} ${field} contains ${what}`,
+          });
+        }
+      }
+    }
+  }
+}
+
 // --- Gate G — review state -----------------------------------------------------
 
 function gateGReviewState(ctx: GateContext, findings: MatrixFinding[]): void {

package/src/exporters/matrix/map-loader.ts

@@ -9,11 +9,13 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { parse as parseYaml, stringify as stringifyYaml } from 'yaml';
-import { DeliveryMap, MapCategory, MapDisposition, MapGroup, ReviewState } from './types';
+import { DeliveryMap, MapCategory, MapDisposition, MapGroup, RequirementOverride, RequirementStatus, ReviewState } from './types';
 
 const CATEGORIES: MapCategory[] = ['normal', 'abnormal', 'security', 'nfr'];
 const REVIEW_STATES: ReviewState[] = ['proposed', 'approved'];
 const DISPOSITIONS = ['excluded', 'blocked', 'covered_elsewhere', 'accepted_risk'];
+const REQUIREMENT_STATUSES: RequirementStatus[] =
+  ['covered', 'partially_covered', 'covered_elsewhere', 'planned', 'gap', 'not_applicable'];
 
 export interface MapLoadResult {
   map: DeliveryMap | null;
@@ -98,6 +100,21 @@ export function loadDeliveryMap(file: string): MapLoadResult {
     }
   }
 
+  const requirements: Record<string, RequirementOverride> = {};
+  if (doc.requirements !== undefined) {
+    if (!doc.requirements || typeof doc.requirements !== 'object' || Array.isArray(doc.requirements)) {
+      errors.push('`requirements` must be a mapping of requirement-id → { status, note }');
+    } else {
+      for (const [reqId, r] of Object.entries(doc.requirements as Record<string, unknown>)) {
+        const rr = (r && typeof r === 'object' ? r : {}) as Record<string, unknown>;
+        if (!REQUIREMENT_STATUSES.includes(String(rr.status) as RequirementStatus)) {
+          errors.push(`requirements.${reqId}: \`status\` must be one of ${REQUIREMENT_STATUSES.join(' | ')}`);
+        }
+        requirements[reqId] = { status: rr.status as RequirementStatus, note: rr.note ? String(rr.note) : undefined };
+      }
+    }
+  }
+
   const fingerprints: Record<string, string> = {};
   if (doc.fingerprints && typeof doc.fingerprints === 'object' && !Array.isArray(doc.fingerprints)) {
     for (const [k, v] of Object.entries(doc.fingerprints as Record<string, unknown>)) {
@@ -111,6 +128,7 @@ export function loadDeliveryMap(file: string): MapLoadResult {
     formNo: doc.form_no !== undefined ? String(doc.form_no) : undefined,
     groups,
     dispositions,
+    requirements,
     fingerprints,
   };
   return { map: errors.length > 0 ? null : map, errors };
@@ -135,6 +153,7 @@ export function writeDeliveryMap(file: string, map: DeliveryMap): void {
       variants: g.variants,
     })),
     ...(Object.keys(map.dispositions).length > 0 ? { dispositions: map.dispositions } : {}),
+    ...(Object.keys(map.requirements).length > 0 ? { requirements: map.requirements } : {}),
     ...(Object.keys(map.fingerprints).length > 0 ? { fingerprints: map.fingerprints } : {}),
   };
   fs.mkdirSync(path.dirname(file), { recursive: true });