@sun-asterisk/sungen 3.2.16-beta.11 → 3.2.16-beta.12

package/dist/cli/index.js

@@ -36,6 +36,7 @@ const repair_1 = require("./commands/repair");
 const login_1 = require("./commands/login");
 const registry_1 = require("../capabilities/registry");
 const discover_1 = require("../capabilities/discover");
+const assets_drift_1 = require("../orchestrator/assets-drift");
 // Read version from package.json so `--version` never drifts from the released version.
 const { version } = require('../../package.json');
 async function main() {
@@ -83,6 +84,10 @@ async function main() {
         for (const registerCommand of cap.cliCommands ?? [])
             registerCommand(program);
     }
+    // Every command warns once when the project's AI assets came from a different
+    // build — `update` is the only thing that refreshes them, and nothing used to
+    // say so (stderr, so `--json` output stays parseable).
+    program.hook('preAction', () => { (0, assets_drift_1.warnAssetsDrift)(process.cwd()); });
     await program.parseAsync(process.argv);
 }
 main().catch((error) => {

package/dist/cli/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";;AACA;;;GAGG;;AAEH,yCAAoC;AACpC,0CAAsD;AACtD,wCAAoD;AACpD,kDAA8D;AAC9D,kDAA8D;AAC9D,8CAA0D;AAC1D,kDAA8D;AAC9D,4CAAwD;AACxD,kDAA6D;AAC7D,oDAAgE;AAChE,4CAAwD;AACxD,sDAAiE;AACjE,gDAA4D;AAC5D,0CAAsD;AACtD,8CAA0D;AAC1D,0CAAsD;AACtD,kDAA8D;AAC9D,8CAA0D;AAC1D,kDAA8D;AAC9D,wDAAmE;AACnE,0DAAqE;AACrE,4CAAwD;AACxD,oDAAgE;AAChE,oDAAgE;AAChE,sDAAkE;AAClE,sDAAiE;AACjE,gDAA4D;AAC5D,8CAA0D;AAC1D,4CAAwD;AACxD,uDAA8D;AAC9D,uDAA2E;AAE3E,wFAAwF;AACxF,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAwB,CAAC;AAEzE,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;IAE9B,OAAO;SACJ,IAAI,CAAC,QAAQ,CAAC;SACd,WAAW,CAAC,oEAAoE,CAAC;SACjF,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB,iBAAiB;IACjB,OAAO;SACJ,MAAM,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IAErD,oBAAoB;IACpB,IAAA,0BAAmB,EAAC,OAAO,CAAC,CAAC;IAC7B,IAAA,wBAAkB,EAAC,OAAO,CAAC,CAAC;IAC5B,IAAA,kCAAuB,EAAC,OAAO,CAAC,CAAC;IACjC,IAAA,kCAAuB,EAAC,OAAO,CAAC,CAAC;IACjC,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;IAC/B,IAAA,kCAAuB,EAAC,OAAO,CAAC,CAAC;IACjC,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;IAC9B,IAAA,iCAAsB,EAAC,OAAO,CAAC,CAAC;IAChC,IAAA,oCAAwB,EAAC,OAAO,CAAC,CAAC;IAClC,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;IAC9B,IAAA,qCAAwB,EAAC,OAAO,CAAC,CAAC;IAClC,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;IAChC,IAAA,0BAAmB,EAAC,OAAO,CAAC,CAAC;IAC7B,IAAA,kCAAuB,EAAC,OAAO,CAAC,CAAC;IACjC,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;IAC/B,IAAA,kCAAuB,EAAC,OAAO,CAAC,CAAC;IACjC,IAAA,uCAAyB,EAAC,OAAO,CAAC,CAAC;IACnC,IAAA,yCAA0B,EAAC,OAAO,CAAC,CAAC;IACpC,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;IAC9B,IAAA,oCAAwB,EAAC,OAAO,CAAC,CAAC;IAClC,IAAA,oCAAwB,EAAC,OAAO,CAAC,CAAC;IAClC,IAAA,sCAAyB,EAAC,OAAO,CAAC,CAAC;IACnC,IAAA,qCAAwB,EAAC,OAAO,CAAC,CAAC;IAClC,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;IAChC,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;IAC/B,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;IAC/B,IAAA,0BAAmB,EAAC,OAAO,CAAC,CAAC;IAC7B,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;IAE9B,6FAA6F;IAC7F,iFAAiF;IACjF,IAAA,0CAA+B,GAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,6BAAkB,CAAC,GAAG,EAAE,EAAE,CAAC;QAC3C,KAAK,MAAM,eAAe,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE;YAAE,eAAe,CAAC,OAAO,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";;AACA;;;GAGG;;AAEH,yCAAoC;AACpC,0CAAsD;AACtD,wCAAoD;AACpD,kDAA8D;AAC9D,kDAA8D;AAC9D,8CAA0D;AAC1D,kDAA8D;AAC9D,4CAAwD;AACxD,kDAA6D;AAC7D,oDAAgE;AAChE,4CAAwD;AACxD,sDAAiE;AACjE,gDAA4D;AAC5D,0CAAsD;AACtD,8CAA0D;AAC1D,0CAAsD;AACtD,kDAA8D;AAC9D,8CAA0D;AAC1D,kDAA8D;AAC9D,wDAAmE;AACnE,0DAAqE;AACrE,4CAAwD;AACxD,oDAAgE;AAChE,oDAAgE;AAChE,sDAAkE;AAClE,sDAAiE;AACjE,gDAA4D;AAC5D,8CAA0D;AAC1D,4CAAwD;AACxD,uDAA8D;AAC9D,uDAA2E;AAC3E,+DAA+D;AAE/D,wFAAwF;AACxF,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAwB,CAAC;AAEzE,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;IAE9B,OAAO;SACJ,IAAI,CAAC,QAAQ,CAAC;SACd,WAAW,CAAC,oEAAoE,CAAC;SACjF,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB,iBAAiB;IACjB,OAAO;SACJ,MAAM,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IAErD,oBAAoB;IACpB,IAAA,0BAAmB,EAAC,OAAO,CAAC,CAAC;IAC7B,IAAA,wBAAkB,EAAC,OAAO,CAAC,CAAC;IAC5B,IAAA,kCAAuB,EAAC,OAAO,CAAC,CAAC;IACjC,IAAA,kCAAuB,EAAC,OAAO,CAAC,CAAC;IACjC,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;IAC/B,IAAA,kCAAuB,EAAC,OAAO,CAAC,CAAC;IACjC,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;IAC9B,IAAA,iCAAsB,EAAC,OAAO,CAAC,CAAC;IAChC,IAAA,oCAAwB,EAAC,OAAO,CAAC,CAAC;IAClC,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;IAC9B,IAAA,qCAAwB,EAAC,OAAO,CAAC,CAAC;IAClC,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;IAChC,IAAA,0BAAmB,EAAC,OAAO,CAAC,CAAC;IAC7B,IAAA,kCAAuB,EAAC,OAAO,CAAC,CAAC;IACjC,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;IAC/B,IAAA,kCAAuB,EAAC,OAAO,CAAC,CAAC;IACjC,IAAA,uCAAyB,EAAC,OAAO,CAAC,CAAC;IACnC,IAAA,yCAA0B,EAAC,OAAO,CAAC,CAAC;IACpC,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;IAC9B,IAAA,oCAAwB,EAAC,OAAO,CAAC,CAAC;IAClC,IAAA,oCAAwB,EAAC,OAAO,CAAC,CAAC;IAClC,IAAA,sCAAyB,EAAC,OAAO,CAAC,CAAC;IACnC,IAAA,qCAAwB,EAAC,OAAO,CAAC,CAAC;IAClC,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;IAChC,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;IAC/B,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;IAC/B,IAAA,0BAAmB,EAAC,OAAO,CAAC,CAAC;IAC7B,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;IAE9B,6FAA6F;IAC7F,iFAAiF;IACjF,IAAA,0CAA+B,GAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,6BAAkB,CAAC,GAAG,EAAE,EAAE,CAAC;QAC3C,KAAK,MAAM,eAAe,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE;YAAE,eAAe,CAAC,OAAO,CAAC,CAAC;IAChF,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,uDAAuD;IACvD,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,IAAA,8BAAe,EAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAErE,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/orchestrator/assets-drift.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Are this project's AI assets (commands + skills under `.claude/` etc.) the ones
+ * the running sungen would write?
+ *
+ * Upgrading the npm package does NOT refresh them — `sungen update` does. Nothing
+ * said so, so a project kept running prompts from an older build indefinitely: a
+ * QA upgraded, re-ran `/sungen:create-test`, and got the OLD command (141 lines vs
+ * the shipped 267) with none of the newer guidance. The failure is invisible
+ * because everything still "works", just to an older specification.
+ *
+ * The manifest already records the version + a hash per managed file; this only
+ * reads it and reports.
+ */
+export interface AssetsDrift {
+    recordedVersion: string;
+    runningVersion: string;
+    /** Managed files whose content no longer matches the manifest's hash. */
+    changed: number;
+    total: number;
+}
+export declare function checkAssetsDrift(cwd: string): AssetsDrift | null;
+/** One line, on stderr so `--json` output stays machine-readable. */
+export declare function warnAssetsDrift(cwd: string): void;
+//# sourceMappingURL=assets-drift.d.ts.map

package/dist/orchestrator/assets-drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets-drift.d.ts","sourceRoot":"","sources":["../../src/orchestrator/assets-drift.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,WAAW;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAwBhE;AAED,qEAAqE;AACrE,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAWjD"}

package/dist/orchestrator/assets-drift.js

@@ -0,0 +1,80 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkAssetsDrift = checkAssetsDrift;
+exports.warnAssetsDrift = warnAssetsDrift;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const package_info_1 = require("../exporters/package-info");
+function checkAssetsDrift(cwd) {
+    const manifestPath = path.join(cwd, '.sungen', 'manifest.json');
+    if (!fs.existsSync(manifestPath))
+        return null; // not a sungen project (yet)
+    let manifest;
+    try {
+        manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf-8'));
+    }
+    catch {
+        return null; // unreadable → say nothing
+    }
+    const recordedVersion = manifest.version ?? '';
+    const runningVersion = (0, package_info_1.getPackageVersion)();
+    const managed = manifest.managed ?? {};
+    const total = Object.keys(managed).length;
+    if (!recordedVersion || total === 0)
+        return null;
+    // A version match is the common case — trust it and skip hashing entirely.
+    if (recordedVersion === runningVersion)
+        return null;
+    let changed = 0;
+    for (const rel of Object.keys(managed)) {
+        if (!fs.existsSync(path.join(cwd, rel)))
+            changed++;
+    }
+    return { recordedVersion, runningVersion, changed, total };
+}
+/** One line, on stderr so `--json` output stays machine-readable. */
+function warnAssetsDrift(cwd) {
+    const drift = checkAssetsDrift(cwd);
+    if (!drift)
+        return;
+    const gray = '\x1b[90m';
+    const cyan = '\x1b[36m';
+    const reset = '\x1b[0m';
+    process.stderr.write(`${gray}note: this project's AI commands/skills were written by sungen ${drift.recordedVersion}, ` +
+        `you are running ${drift.runningVersion} — run ${cyan}sungen update${reset}${gray} to refresh them ` +
+        `(upgrading the package alone does not).${reset}\n`);
+}
+//# sourceMappingURL=assets-drift.js.map

package/dist/orchestrator/assets-drift.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets-drift.js","sourceRoot":"","sources":["../../src/orchestrator/assets-drift.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,4CAwBC;AAGD,0CAWC;AA/DD,uCAAyB;AACzB,2CAA6B;AAC7B,4DAA8D;AAuB9D,SAAgB,gBAAgB,CAAC,GAAW;IAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAChE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC,CAAG,6BAA6B;IAE9E,IAAI,QAAgE,CAAC;IACrE,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAoC,2BAA2B;IAC7E,CAAC;IACD,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;IAC/C,MAAM,cAAc,GAAG,IAAA,gCAAiB,GAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,CAAC,eAAe,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjD,2EAA2E;IAC3E,IAAI,eAAe,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IAEpD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC7D,CAAC;AAED,qEAAqE;AACrE,SAAgB,eAAe,CAAC,GAAW;IACzC,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,MAAM,IAAI,GAAG,UAAU,CAAC;IACxB,MAAM,IAAI,GAAG,UAAU,CAAC;IACxB,MAAM,KAAK,GAAG,SAAS,CAAC;IACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,IAAI,kEAAkE,KAAK,CAAC,eAAe,IAAI;QAClG,mBAAmB,KAAK,CAAC,cAAc,UAAU,IAAI,gBAAgB,KAAK,GAAG,IAAI,mBAAmB;QACpG,0CAA0C,KAAK,IAAI,CACpD,CAAC;AACJ,CAAC"}

package/dist/orchestrator/templates/ai-src/commands/create-test.md

@@ -68,15 +68,6 @@ If the unit is **api-first** (`qa/api/<name>/` or `qa/api/flows/<name>/`), the d
 If the unit is **api-first** (`qa/api/<name>/` or `qa/api/flows/<name>/`), the design loop differs — **no visual capture, no selectors**; the contract is the named-endpoint catalog. **Follow the `sungen-api-design` + `sungen-api-coverage-model` skills end-to-end** instead of the screen/flow steps: `sungen context --area <name>` (discover endpoints + `fields:`) → **enumerate the Tier-1 case list per endpoint from the coverage model** (contract + not-found/required-matrix + auth + idempotency, expanded mechanically from `fields:`) → generate `@api`/`@cases`/flow/`@concurrent`/`@query` scenarios with **strict assertions** (prove the effect, never status-only) → **`sungen audit --area <name>` gate + reviewer + repair loop to businessDepth ≥ 0.7** → record + trace. Then recommend `/sungen-run-test <name>`. The capture / viewpoint-group / selector steps do **not** apply.
 {{/cap}}
 
-## Requirement traceability (before you finish)
-
-Cross-check `requirements/spec.md` against the scenarios you wrote: every `FR-`/`TR-`/`NFR-` id
-must either carry a `@spec:<id>` tag on the scenario that proves it, or be a conscious
-out-of-scope decision you state in the summary. `sungen audit` reports `SPEC-TRACE-IMPLICIT` for
-requirements it could only match by keyword — treat that list as a to-do: add the tag to the
-proving scenario, do not leave the link to inference. Delivery's requirement table follows the
-tag only, so an untagged requirement is later reported as an uncovered gap.
-
 ## Steps
 
 {{#cap parallel-subagents}}
@@ -265,3 +256,23 @@ tag only, so an untagged requirement is later reported as an uncovered gap.
 {{^cap parallel-subagents}}
 **No selectors.yaml** — selectors are generated during `/sungen-run-test`.
 {{/cap}}
+
+## Finish — always hand the next step back
+
+Do not stop after writing the files. Close every run with, in this order:
+
+1. **The traceability check below** — an untagged requirement becomes an uncovered gap at delivery.
+2. **The harness result in one line** — score, gate verdict, and the axis the `SCORE-CAPPED` finding
+   names (that finding is the single answer to "how do I raise the score").
+3. **`AskUserQuestion` with the next actions** — never end with prose alone. Offer
+   `/sungen:run-test <name>` (recommended once the tiers are written), re-running `create-test` to
+   extend, and "Done for now". A run that ends without this leaves the operator guessing.
+
+### Requirement traceability
+
+Cross-check `requirements/spec.md` against the scenarios you wrote: every `FR-`/`TR-`/`NFR-` id
+must either carry a `@spec:<id>` tag on the scenario that proves it, or be a conscious
+out-of-scope decision you state in the summary. `sungen audit` reports `SPEC-TRACE-IMPLICIT` for
+requirements it could only match by keyword — treat that list as a to-do: add the tag to the
+proving scenario, do not leave the link to inference. Delivery's requirement table follows the
+tag only, so an untagged requirement is later reported as an uncovered gap.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sun-asterisk/sungen",
-  "version": "3.2.16-beta.11",
+  "version": "3.2.16-beta.12",
   "description": "Deterministic E2E Test Compiler - Gherkin + Selectors → Playwright tests",
   "main": "src/index.ts",
   "types": "src/index.ts",
@@ -39,8 +39,8 @@
     "@babel/types": "^7.28.5",
     "@cucumber/gherkin": "^37.0.0",
     "@cucumber/messages": "^31.0.0",
-    "@sungen/driver-data-factory": "3.2.16-beta.11",
-    "@sungen/driver-ui": "3.2.16-beta.11",
+    "@sungen/driver-data-factory": "3.2.16-beta.12",
+    "@sungen/driver-ui": "3.2.16-beta.12",
     "chalk": "^5.6.2",
     "commander": "^14.0.2",
     "dotenv": "^17.2.3",

package/src/cli/index.ts

@@ -35,6 +35,7 @@ import { registerRepairCommand } from './commands/repair';
 import { registerLoginCommand } from './commands/login';
 import { capabilityRegistry } from '../capabilities/registry';
 import { discoverAndRegisterCapabilities } from '../capabilities/discover';
+import { warnAssetsDrift } from '../orchestrator/assets-drift';
 
 // Read version from package.json so `--version` never drifts from the released version.
 const { version } = require('../../package.json') as { version: string };
@@ -88,6 +89,11 @@ async function main() {
     for (const registerCommand of cap.cliCommands ?? []) registerCommand(program);
   }
 
+  // Every command warns once when the project's AI assets came from a different
+  // build — `update` is the only thing that refreshes them, and nothing used to
+  // say so (stderr, so `--json` output stays parseable).
+  program.hook('preAction', () => { warnAssetsDrift(process.cwd()); });
+
   await program.parseAsync(process.argv);
 }
 

package/src/orchestrator/assets-drift.ts

@@ -0,0 +1,64 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import { getPackageVersion } from '../exporters/package-info';
+
+/**
+ * Are this project's AI assets (commands + skills under `.claude/` etc.) the ones
+ * the running sungen would write?
+ *
+ * Upgrading the npm package does NOT refresh them — `sungen update` does. Nothing
+ * said so, so a project kept running prompts from an older build indefinitely: a
+ * QA upgraded, re-ran `/sungen:create-test`, and got the OLD command (141 lines vs
+ * the shipped 267) with none of the newer guidance. The failure is invisible
+ * because everything still "works", just to an older specification.
+ *
+ * The manifest already records the version + a hash per managed file; this only
+ * reads it and reports.
+ */
+export interface AssetsDrift {
+  recordedVersion: string;
+  runningVersion: string;
+  /** Managed files whose content no longer matches the manifest's hash. */
+  changed: number;
+  total: number;
+}
+
+export function checkAssetsDrift(cwd: string): AssetsDrift | null {
+  const manifestPath = path.join(cwd, '.sungen', 'manifest.json');
+  if (!fs.existsSync(manifestPath)) return null;   // not a sungen project (yet)
+
+  let manifest: { version?: string; managed?: Record<string, string> };
+  try {
+    manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf-8'));
+  } catch {
+    return null;                                    // unreadable → say nothing
+  }
+  const recordedVersion = manifest.version ?? '';
+  const runningVersion = getPackageVersion();
+  const managed = manifest.managed ?? {};
+  const total = Object.keys(managed).length;
+  if (!recordedVersion || total === 0) return null;
+
+  // A version match is the common case — trust it and skip hashing entirely.
+  if (recordedVersion === runningVersion) return null;
+
+  let changed = 0;
+  for (const rel of Object.keys(managed)) {
+    if (!fs.existsSync(path.join(cwd, rel))) changed++;
+  }
+  return { recordedVersion, runningVersion, changed, total };
+}
+
+/** One line, on stderr so `--json` output stays machine-readable. */
+export function warnAssetsDrift(cwd: string): void {
+  const drift = checkAssetsDrift(cwd);
+  if (!drift) return;
+  const gray = '\x1b[90m';
+  const cyan = '\x1b[36m';
+  const reset = '\x1b[0m';
+  process.stderr.write(
+    `${gray}note: this project's AI commands/skills were written by sungen ${drift.recordedVersion}, ` +
+    `you are running ${drift.runningVersion} — run ${cyan}sungen update${reset}${gray} to refresh them ` +
+    `(upgrading the package alone does not).${reset}\n`,
+  );
+}

package/src/orchestrator/templates/ai-src/commands/create-test.md

@@ -68,15 +68,6 @@ If the unit is **api-first** (`qa/api/<name>/` or `qa/api/flows/<name>/`), the d
 If the unit is **api-first** (`qa/api/<name>/` or `qa/api/flows/<name>/`), the design loop differs — **no visual capture, no selectors**; the contract is the named-endpoint catalog. **Follow the `sungen-api-design` + `sungen-api-coverage-model` skills end-to-end** instead of the screen/flow steps: `sungen context --area <name>` (discover endpoints + `fields:`) → **enumerate the Tier-1 case list per endpoint from the coverage model** (contract + not-found/required-matrix + auth + idempotency, expanded mechanically from `fields:`) → generate `@api`/`@cases`/flow/`@concurrent`/`@query` scenarios with **strict assertions** (prove the effect, never status-only) → **`sungen audit --area <name>` gate + reviewer + repair loop to businessDepth ≥ 0.7** → record + trace. Then recommend `/sungen-run-test <name>`. The capture / viewpoint-group / selector steps do **not** apply.
 {{/cap}}
 
-## Requirement traceability (before you finish)
-
-Cross-check `requirements/spec.md` against the scenarios you wrote: every `FR-`/`TR-`/`NFR-` id
-must either carry a `@spec:<id>` tag on the scenario that proves it, or be a conscious
-out-of-scope decision you state in the summary. `sungen audit` reports `SPEC-TRACE-IMPLICIT` for
-requirements it could only match by keyword — treat that list as a to-do: add the tag to the
-proving scenario, do not leave the link to inference. Delivery's requirement table follows the
-tag only, so an untagged requirement is later reported as an uncovered gap.
-
 ## Steps
 
 {{#cap parallel-subagents}}
@@ -265,3 +256,23 @@ tag only, so an untagged requirement is later reported as an uncovered gap.
 {{^cap parallel-subagents}}
 **No selectors.yaml** — selectors are generated during `/sungen-run-test`.
 {{/cap}}
+
+## Finish — always hand the next step back
+
+Do not stop after writing the files. Close every run with, in this order:
+
+1. **The traceability check below** — an untagged requirement becomes an uncovered gap at delivery.
+2. **The harness result in one line** — score, gate verdict, and the axis the `SCORE-CAPPED` finding
+   names (that finding is the single answer to "how do I raise the score").
+3. **`AskUserQuestion` with the next actions** — never end with prose alone. Offer
+   `/sungen:run-test <name>` (recommended once the tiers are written), re-running `create-test` to
+   extend, and "Done for now". A run that ends without this leaves the operator guessing.
+
+### Requirement traceability
+
+Cross-check `requirements/spec.md` against the scenarios you wrote: every `FR-`/`TR-`/`NFR-` id
+must either carry a `@spec:<id>` tag on the scenario that proves it, or be a conscious
+out-of-scope decision you state in the summary. `sungen audit` reports `SPEC-TRACE-IMPLICIT` for
+requirements it could only match by keyword — treat that list as a to-do: add the tag to the
+proving scenario, do not leave the link to inference. Delivery's requirement table follows the
+tag only, so an untagged requirement is later reported as an uncovered gap.