@sun-asterisk/sungen 3.2.16-beta.1 → 3.2.16-beta.2

package/src/orchestrator/templates/ai-src/commands/delivery.md

@@ -74,11 +74,37 @@ dispositions:                      # scenarios intentionally NOT delivered as te
   locales.
 - MUST split: different target, intent, oracle family, category, execution mode (`@manual` vs
   auto), test layer (`@api`/`@query`), or priority tag; sequence-sensitive flows (re-Given/When
-  after a Then) stay solo.
+  after a Then) stay solo. **Different risk classes never merge** — XSS and SQL injection are
+  separate items even though both are "injection on the same field" (different risk, action,
+  and oracle family); a component's visibility rule and its action/revalidation rule are two
+  intents, not one.
 - Every scenario must land in exactly one group **or** one disposition (Gate B enforces 100%
   disposition). Data-setup blocks (`@manual:data-setup`) → `excluded`; SPEC-GAP placeholders →
   `blocked`.
 
+**Wording rules for `intent`/`oracle` (customer-facing — Gate W lints these):**
+- Plain product language, present simple, ~10–20 words, one behavior:
+  "A user can sign in with valid credentials and is redirected to the Jobs page."
+- Oracle = the observable outcome as a definite assertion ("The Jobs page is displayed and the
+  Logout link is visible.") — no `should`, no tester actions.
+- NEVER: `{{tokens}}`, `[Selector]` references, DSL phrasing (`User fill/click/see`), generator
+  labels (`Setup:`/`Observable:`/`Oracle:`), or vague verbs (`handles`, `surfaces`) when a precise
+  behavior exists. Use the visible UI label (the Login button, the Email field).
+- **Preserve the source meaning exactly** — never strengthen, weaken, or reinterpret an oracle
+  (a security assertion especially: if the source says "the password appears ONLY in the HTTPS
+  POST body", do not write "no plaintext password on the network").
+
+**Requirement coverage (`requirements:` section, optional):** `sungen delivery` scans
+`requirements/spec.md` for FR-/TR-/NFR- ids; ids traced by `@spec:` tags are `covered`, the rest
+are `gap` (Gate R warning). Record the reviewed status for genuine non-gaps:
+
+```yaml
+requirements:
+  TR-007: { status: planned, note: Performance needs Lighthouse-style tooling }
+  TR-004: { status: partially_covered, note: client-side covered by VP-SEC-003; hashing needs DB verify }
+  # status: covered | partially_covered | covered_elsewhere | planned | gap | not_applicable
+```
+
 Then validate and fix any ERROR findings:
 
 ```bash

package/src/orchestrator/templates/ai-src/skills/sungen-delivery/SKILL.md

@@ -32,16 +32,39 @@ spec is `docs/spec/delivery-coverage-matrix-spec.md`.
 B mapping (every scenario in exactly one group XOR one disposition) · C aggregation (mode/layer/
 priority recomputed and equal within a group — heuristic oracle-shape/precondition mismatches are
 review-level, silenced once approved and unchanged) · D executability (precondition · condition+
-data · trigger · oracle all renderable; every `{{var}}` resolves) · E drift (fingerprint mismatch
-→ back to review) · G review state (proposed groups block the official render; `--preview` renders
-a DRAFT watermark).
-
-**Workbook**: `Testcases` sheet (parent rows + outline-level-1 variant sub-rows — collapse for the
-customer view, expand to execute; result roll-up failed→blocked→not_run→partial→passed, counts like
-`7/8 Passed · 1 Failed`) + `Coverage` sheet (target × category grid with explicit `—` gaps,
-dispositions, generation manifest). CSV is flat with a `Level` column (`item`/`variant`).
+data · trigger · oracle all renderable; every `{{var}}` resolves; **no template token may survive
+into a rendered cell** — test-data cross-references are resolved for display) · E drift
+(fingerprint mismatch → back to review) · G review state (proposed groups block the official
+render; `--preview` renders a DRAFT watermark) · R requirement coverage (spec FR/TR/NFR ids with
+no trace and no `requirements:` status → warning) · W wording lint (map intent/oracle containing
+tokens, `[Selector]` refs, DSL phrasing, or generator labels → warning).
+
+**Wording normalization (deterministic, after semantic normalization):** DSL steps render as
+controlled manual-test English without changing meaning — actions in the imperative (`User fill
+[Email] field with X` → `Enter X in the Email field.`), expected results as observable assertions
+(`User see [Jobs] page` → `The Jobs page is displayed.`), preconditions as states (`The user is
+signed out.`). Manual `# Tester verifies:` labels become structured fields: `Setup:` →
+Precondition, `Action:` → Action, `Observable:` → Expected Result, `Oracle:` → a separate
+`Verification method:` line. Sequence-sensitive flows keep event order: actions numbered with
+mid-flow assertions inline as `Verify: …`; only the final Then block is the Expected Result.
+Empty test values render as `(empty)`.
+
+**Workbook**: `Testcases` sheet — parent rows + outline-level-1 variant sub-rows for **every**
+item (single-variant included: the sub-row carries the source VP-id, resolved data, and the
+result/evidence entry). Collapse outline for the customer view, expand to execute. Variant Result
+cells have a dropdown (Passed/Failed/Blocked/Pending/N/A) and the parent Result is a **live Excel
+formula** over its children (failed→blocked→pending→partial→passed, e.g. `2/3 Passed · 1 Failed`)
+— a parent can never contradict its variants, even after manual edits. ID + Target columns are
+frozen; dates are ISO (`2026-08-04`). `Coverage` sheet — requirement coverage table (every FR/TR/
+NFR id with an explicit status), target × category grid with explicit `—` gaps, dispositions,
+manifest. CSV is flat with a `Level` column (`item`/`variant`) + a requirement-coverage appendix.
 `delivery_item_count` ≠ progress — variants are the execution metric.
 
+**Authoring guidance the matrix rewards** (create-test side): payload/provider matrices (SQLi
+payload lists, OAuth provider sets) belong in `@cases` datasets so each case is an atomic,
+independently-reportable variant; keep dataset `case:` labels short and stable (`CHK-EMAIL-I1`),
+with descriptions in other columns — the label is part of the variant's identity.
+
 ---
 
 ## Legacy mode (--legacy / --full)