@sun-asterisk/sungen 3.2.17 → 3.2.18

package/dist/orchestrator/assets-drift.js

@@ -0,0 +1,80 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkAssetsDrift = checkAssetsDrift;
+exports.warnAssetsDrift = warnAssetsDrift;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const package_info_1 = require("../exporters/package-info");
+function checkAssetsDrift(cwd) {
+    const manifestPath = path.join(cwd, '.sungen', 'manifest.json');
+    if (!fs.existsSync(manifestPath))
+        return null; // not a sungen project (yet)
+    let manifest;
+    try {
+        manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf-8'));
+    }
+    catch {
+        return null; // unreadable → say nothing
+    }
+    const recordedVersion = manifest.version ?? '';
+    const runningVersion = (0, package_info_1.getPackageVersion)();
+    const managed = manifest.managed ?? {};
+    const total = Object.keys(managed).length;
+    if (!recordedVersion || total === 0)
+        return null;
+    // A version match is the common case — trust it and skip hashing entirely.
+    if (recordedVersion === runningVersion)
+        return null;
+    let changed = 0;
+    for (const rel of Object.keys(managed)) {
+        if (!fs.existsSync(path.join(cwd, rel)))
+            changed++;
+    }
+    return { recordedVersion, runningVersion, changed, total };
+}
+/** One line, on stderr so `--json` output stays machine-readable. */
+function warnAssetsDrift(cwd) {
+    const drift = checkAssetsDrift(cwd);
+    if (!drift)
+        return;
+    const gray = '\x1b[90m';
+    const cyan = '\x1b[36m';
+    const reset = '\x1b[0m';
+    process.stderr.write(`${gray}note: this project's AI commands/skills were written by sungen ${drift.recordedVersion}, ` +
+        `you are running ${drift.runningVersion} — run ${cyan}sungen update${reset}${gray} to refresh them ` +
+        `(upgrading the package alone does not).${reset}\n`);
+}
+//# sourceMappingURL=assets-drift.js.map

package/dist/orchestrator/assets-drift.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets-drift.js","sourceRoot":"","sources":["../../src/orchestrator/assets-drift.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,4CAwBC;AAGD,0CAWC;AA/DD,uCAAyB;AACzB,2CAA6B;AAC7B,4DAA8D;AAuB9D,SAAgB,gBAAgB,CAAC,GAAW;IAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAChE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC,CAAG,6BAA6B;IAE9E,IAAI,QAAgE,CAAC;IACrE,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAoC,2BAA2B;IAC7E,CAAC;IACD,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;IAC/C,MAAM,cAAc,GAAG,IAAA,gCAAiB,GAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,CAAC,eAAe,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjD,2EAA2E;IAC3E,IAAI,eAAe,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IAEpD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC7D,CAAC;AAED,qEAAqE;AACrE,SAAgB,eAAe,CAAC,GAAW;IACzC,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,MAAM,IAAI,GAAG,UAAU,CAAC;IACxB,MAAM,IAAI,GAAG,UAAU,CAAC;IACxB,MAAM,KAAK,GAAG,SAAS,CAAC;IACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,IAAI,kEAAkE,KAAK,CAAC,eAAe,IAAI;QAClG,mBAAmB,KAAK,CAAC,cAAc,UAAU,IAAI,gBAAgB,KAAK,GAAG,IAAI,mBAAmB;QACpG,0CAA0C,KAAK,IAAI,CACpD,CAAC;AACJ,CAAC"}

package/dist/orchestrator/templates/ai-src/commands/create-test.md

@@ -115,12 +115,16 @@ If the unit is **api-first** (`qa/api/<name>/` or `qa/api/flows/<name>/`), the d
      - **Fill test-viewpoint.md first** — I'll help you identify edge cases, known issues, and design decisions for this screen before generating tests
      - **Continue without it** — generate tests from spec and other sources only
 
+   **A filled `test-viewpoint.md` is an INPUT — never an output.** Do NOT rewrite, re-order, or replace its viewpoint declarations as part of generating tests. It is the yardstick two scored axes measure the suite against (`traceability`, `atomicLedger`): rewrite it to match what you just generated and both read 100% by construction, while any viewpoint you quietly dropped stops being missing from anything. If the declared taxonomy genuinely does not fit the screen, **report the mismatch and ask** — propose the diff (ids added / removed and why) and let the QA decide. `sungen audit` reports `VIEWPOINT-BASELINE-CHANGED` and stops scoring both axes when this file moves, so an unannounced rewrite lowers the score rather than raising it.
+
    **Context discovery (prefer an isolated agent).** Reading all sources here can flood this context. **Claude Code:** spawn the **`sungen-discovery`** sub-agent (Task tool, `subagent_type: sungen-discovery`) to read spec/figma/ui/live in isolation and return a **compact discovery report** (sources, completeness, conflicts, recommended route, key facts); use that report instead of pasting raw sources. **Copilot / no sub-agents:** do the reading inline as below.
 {{/cap}}
 {{^cap parallel-subagents}}
    - If `test-viewpoint.md` exists → read it. If it only contains HTML comments (scaffold template), ask:
      - **1) Fill test-viewpoint.md first** — identify edge cases, known issues, and design decisions before generating tests
      - **2) Continue without it** — generate tests from spec and other sources only
+
+   **A filled `test-viewpoint.md` is an INPUT — never an output.** Do NOT rewrite, re-order, or replace its viewpoint declarations while generating tests. It is the yardstick two scored axes measure the suite against (`traceability`, `atomicLedger`): rewrite it to match what you just generated and both read 100% by construction, while any viewpoint you quietly dropped stops being missing from anything. If the declared taxonomy genuinely does not fit the screen, **report the mismatch and ask** — propose the diff (ids added / removed and why) and let the QA decide. `sungen audit` reports `VIEWPOINT-BASELINE-CHANGED` and stops scoring both axes when this file moves.
 {{/cap}}
 
    **Auto-detect visual source** — do NOT ask the user to pick a source. Instead, check what already exists and use it:
@@ -256,3 +260,23 @@ If the unit is **api-first** (`qa/api/<name>/` or `qa/api/flows/<name>/`), the d
 {{^cap parallel-subagents}}
 **No selectors.yaml** — selectors are generated during `/sungen-run-test`.
 {{/cap}}
+
+## Finish — always hand the next step back
+
+Do not stop after writing the files. Close every run with, in this order:
+
+1. **The traceability check below** — an untagged requirement becomes an uncovered gap at delivery.
+2. **The harness result in one line** — score, gate verdict, and the axis the `SCORE-CAPPED` finding
+   names (that finding is the single answer to "how do I raise the score").
+3. **`AskUserQuestion` with the next actions** — never end with prose alone. Offer
+   `/sungen:run-test <name>` (recommended once the tiers are written), re-running `create-test` to
+   extend, and "Done for now". A run that ends without this leaves the operator guessing.
+
+### Requirement traceability
+
+Cross-check `requirements/spec.md` against the scenarios you wrote: every `FR-`/`TR-`/`NFR-` id
+must either carry a `@spec:<id>` tag on the scenario that proves it, or be a conscious
+out-of-scope decision you state in the summary. `sungen audit` reports `SPEC-TRACE-IMPLICIT` for
+requirements it could only match by keyword — treat that list as a to-do: add the tag to the
+proving scenario, do not leave the link to inference. Delivery's requirement table follows the
+tag only, so an untagged requirement is later reported as an uncovered gap.

package/dist/orchestrator/templates/ai-src/commands/delivery.md

@@ -1,146 +1,229 @@
 ---
 name: delivery
-description: "Export Gherkin scenarios + Playwright results to CSV test case file for QA delivery."
-argument-hint: "[screen-name...] [--env <locale>] (omit screens for all; --env for locale-specific export)"
+description: "Export the Test Case & Coverage Matrix (review/manual/customer deliverable) from Gherkin + Playwright results. --legacy exports the classic per-scenario CSV/XLSX."
+argument-hint: "[name...] [--format csv] [--env <locale>] [--legacy] (omit names for all)"
 order: 50
-claude-tools: "Bash, Read, AskUserQuestion"
+claude-tools: "Bash, Read, Write, AskUserQuestion"
 copilot-tools: "[read, execute, edit, vscode/askQuestions]"
-codex-trigger: "Run when the user asks to EXPORT or deliver test cases to CSV/XLSX for QA hand-off. Final step. Do NOT use for creating or running tests."
+codex-trigger: "Run when the user asks to EXPORT or deliver test cases for QA hand-off. Final step. Do NOT use for creating or running tests."
 ---
 ## Role
 
-You are a **QA Test Delivery Engineer**. Your job is to invoke the deterministic `sungen delivery` CLI that performs all parsing and CSV export. Your role is minimal — just run the CLI and help the user if pre-flight checks fail.
+You are a **QA Test Delivery Engineer**. The deterministic `sungen delivery` CLI does all parsing,
+gating, and rendering. Your job is (1) invoking it, (2) **proposing the Delivery Map** when a unit
+does not have one yet — the one semantic step the CLI cannot do — and (3) walking the user through
+review → approve → official render.
+
+## The two delivery modes
+
+- **Matrix (default)** — the Test Case & Coverage Matrix: one row per *delivery item* (one target +
+  one test intent + one oracle family), with each Gherkin scenario / `@cases` row preserved as a
+  collapsible *coverage variant* sub-row. No numbered step dumps. This is the reviewable /
+  manually-executable / customer-facing standard.
+- **Legacy (`--legacy`, alias `--full`)** — the classic per-scenario-steps workbook (BM-2-901-13).
+  Use it when the user asks for the old format or a project is mid-engagement on it.
 
 ## Parameters
 
 Parse from `$ARGUMENTS`:
-{{#cap parallel-subagents}}
-- **screens** — zero or more screen/flow names. Empty → CLI processes all targets in `qa/screens/` + `qa/flows/`.
-{{/cap}}
-{{^cap parallel-subagents}}
-- **names** — zero or more screen/flow names. Empty → CLI processes all targets in `qa/screens/` + `qa/flows/`.
-{{/cap}}
-- **`--env <locale>`** — optional. Sets `SUNGEN_ENV=<locale>` for the run so the CLI merges `<name>.<locale>.yaml` over the base test-data and writes `<name>-testcases.<locale>.csv` / `.xlsx`. Accept `--locale <locale>` as an alias.
-
-If `--env` is passed but no value follows, ask the user which locale to use.
+- **names** — zero or more screen/flow/api names. Empty → **a sweep of every unit**.
+  Strictness follows the scope: a **named** unit that is not ready aborts the run (the user asked
+  for that unit); a **sweep** exports every ready unit and skips the rest with an accounted
+  "Not exported" list, succeeding as long as something was written. So `/sungen:delivery` with no
+  argument is safe in a work-in-progress project — scaffolded units (added but `create-test` not
+  run) no longer block the units that are ready.
+- **`--format <xlsx|csv|both>`** — output format. **Default `xlsx` — one artifact only.** Pass
+  `--format csv` when the user wants the flat CSV (pipelines/diffing), `--format both` for both.
+- **`--env <locale>`** — sets `SUNGEN_ENV=<locale>` for the run (accept `--locale` as alias).
+- **`--legacy` / `--full`** — pass through to the CLI and skip the map flow entirely.
 
 ## Steps
 
-### 1. Invoke the CLI
-
-{{#cap parallel-subagents}}
-Run via Bash (single command, no extra parsing). Prefer the local `./bin/sungen.js` when it exists — the sungen monorepo ships local-only features the global npm package doesn't have yet (multi-sheet locale aggregation, `.<env>` filename suffix, locale-aware step rendering). Fall back to `npx sungen` in downstream projects.
-{{/cap}}
-{{^cap parallel-subagents}}
-Run via Bash (single command, no extra parsing):
-{{/cap}}
+### 1. Run the CLI once
 
 ```bash
-# No env — local-first dispatcher:
-{{#cap parallel-subagents}}
-[ -x ./bin/sungen.js ] && ./bin/sungen.js delivery <screens> || npx sungen delivery <screens>
-{{/cap}}
-{{^cap parallel-subagents}}
 [ -x ./bin/sungen.js ] && ./bin/sungen.js delivery <names> || npx sungen delivery <names>
-{{/cap}}
-
-# Locale-specific:
-{{#cap parallel-subagents}}
-[ -x ./bin/sungen.js ] && SUNGEN_ENV=<locale> ./bin/sungen.js delivery <screens> || SUNGEN_ENV=<locale> npx sungen delivery <screens>
-{{/cap}}
-{{^cap parallel-subagents}}
-[ -x ./bin/sungen.js ] && SUNGEN_ENV=<locale> ./bin/sungen.js delivery <names> || SUNGEN_ENV=<locale> npx sungen delivery <names>
-{{/cap}}
+```
+(prepend `SUNGEN_ENV=<locale>` when `--env` was given; append `--format <fmt>` when the user asked
+for a non-default format; append `--legacy` when requested — then skip to step 5.)
+
+Three outcomes per target:
+- **Rendered** → done, go to step 5.
+- **"no delivery map"** → go to step 2 (propose it).
+- **Gate findings / "not approved"** → go to step 4 (review & approve).
+
+On a sweep, read the **"Not exported"** list at the end: units marked *not authored yet* need
+`/sungen:create-test` first, the others each printed their own reason above (missing map, gate
+errors, or awaiting approval). Handle them one unit at a time — do not re-run the sweep expecting
+a different result.
+
+### 2. Propose the Delivery Map (only when missing or the user asks to regroup)
+
+Read the unit's `.feature` (and `requirements/spec.md` for target naming). Write
+`qa/<screens|flows|api>/<unit>/delivery/<unit>.map.yaml`:
+
+```yaml
+version: 1
+unit: <unit>
+groups:
+  - id: DI-<TARGET>-<THEME>        # stable kebab id, never renumbered
+    target: login.email            # ONE target: field/component dot-path, flow phrase, or METHOD /path
+    intent: <one behavior/rule this item verifies>
+    oracle: <the shared observable Pass/Fail statement>
+    dimensions: violated rule — required ×3 · format ×10 · full-width ×2   # see below
+    category: normal | abnormal | security | nfr   # see the rule below
+    review: proposed               # ALWAYS proposed — only QA approval flips it
+    variants: [VP-VAL-001-B, VP-VAL-001-S]   # the scenario ids of THIS project (VP-…, SEC-123, MS-HP-001 —
+                                             # whatever the titles use); a bare id on a @cases scenario = all its rows
+dispositions:                      # scenarios intentionally NOT delivered as test cases
+  VP-DATA-000: { as: excluded, reason: data-setup checklist }
+  # as: excluded | blocked | covered_elsewhere | accepted_risk
+```
+
+**Grouping rules (the aggregation signature) — group COMPACTLY.** The matrix exists to be
+substantially shorter than the scenario list, so a reviewer can see missing viewpoints at a
+glance. Merge whenever the cases share ALL of: target · test intent/business rule ·
+precondition/condition · trigger or procedure shape · **the way the expected result is
+determined** (its oracle *family*, not its exact message).
+
+- **Oracle family = the determination method, parameterized.** All validation branches of ONE
+  field belong to ONE item — required, format, length, character-class are *expected branches*
+  (parameters) of "the field shows the validation message defined for the violated rule", shown
+  per variant, never separate items.
+- MAY vary inside one item (coverage dimensions, visible on the sub-rows): data values, boundary
+  points, **account states** (a seeded/locked/deleted account next to a wrong-password case),
+  provider/browser/locale, `@cases` rows, a different trigger with the same oracle (blur vs
+  submit), **execution mode** (auto + manual mix — the parent shows `Auto n · Manual m`), and
+  **priority** (the item takes the highest; per-variant priorities stay visible).
+- MUST split: different target, different intent/business rule, different way of determining the
+  expected result (a field-error family ≠ a session-established family), different test layer
+  (`@api`/`@query`), materially different precondition, or a different procedure shape —
+  sequence-sensitive flows (re-Given/When after a Then) stay solo. **Different risk classes never
+  merge**: XSS and SQL injection are separate items (different risk and determination), even on
+  the same field.
+- **Look for these families before settling on a grouping** — they are where under-merging happens:
+  | Family | Merge into one item |
+  |---|---|
+  | Static render | every "element X is visible/has its content on load" scenario of the screen — title, instructions, progress step, buttons present, header/footer |
+  | Field validation branches | all rules of ONE field (required · format · length · character class · full-width) |
+  | Account/entity states | wrong-credentials · locked · deleted · unverified for the same rejection oracle |
+  | Provider / surface sets | the 3 OAuth providers, header+footer, the a11y surfaces of one behaviour |
+  | Lifetime / mode pairs | checked vs unchecked, mobile vs desktop, when the oracle is one rule with two branches |
+  On a 36-scenario screen, four separate one-variant "renders on load" items should have been one.
+- When unsure, keep items separate — the gates and QA decide, never guess-merge.
+- Every scenario must land in exactly one group **or** one disposition (Gate B enforces 100%
+  disposition). Data-setup blocks (`@manual:data-setup`) → `excluded`; SPEC-GAP placeholders →
+  `blocked`.
+
+**`dimensions:` — the compact coverage digest (required for items with >3 variants).**
+This one short line is what the collapsed parent row shows instead of listing every variant, so a
+reviewer sees *which dimensions* the item covers without expanding it. Name the dimension, then the
+branches with counts:
+- `violated rule — required ×3 · format ×10 · full-width ×2`
+- `account state — wrong password · unregistered · locked · soft-deleted`
+- `submission method — Login button · Enter in Password · Enter in Email`
+
+Keep it ≤120 chars (Gate W warns). **YAML caveat:** a bare `: ` inside the value breaks the parse —
+use ` — ` as the label separator (as above) or quote the whole string.
+
+**`category` is not free choice for two classes (Gate K checks it):** a group whose variants are
+`VP-SEC-*` MUST be `category: security`, and `VP-NFR-*` MUST be `nfr` — otherwise the Coverage
+sheet's security/nfr column renders empty and the grid reports a gap the unit does not have while
+hiding the work it does have. `normal` vs `abnormal` stays your judgement.
+
+**Wording rules for `intent`/`oracle` (customer-facing — Gate W lints these):**
+- Plain product language, present simple, ~10–20 words, one behavior:
+  "A user can sign in with valid credentials and is redirected to the Jobs page."
+- Oracle = the observable outcome as a definite assertion ("The Jobs page is displayed and the
+  Logout link is visible.") — no `should`, no tester actions.
+- NEVER: `{{tokens}}`, `[Selector]` references, DSL phrasing (`User fill/click/see`), generator
+  labels (`Setup:`/`Observable:`/`Oracle:`), or vague verbs (`handles`, `surfaces`) when a precise
+  behavior exists. Use the visible UI label (the Login button, the Email field).
+- **Preserve the source meaning exactly** — never strengthen, weaken, or reinterpret an oracle
+  (a security assertion especially: if the source says "the password appears ONLY in the HTTPS
+  POST body", do not write "no plaintext password on the network").
+
+**Requirement coverage (`requirements:` section, optional):** `sungen delivery` scans
+`requirements/spec.md` for FR-/TR-/NFR- ids; ids traced by `@spec:` tags are `covered`, the rest
+are `gap` (Gate R warning). Record the reviewed status for genuine non-gaps:
+
+```yaml
+requirements:
+  TR-007: { status: planned, note: Performance needs Lighthouse-style tooling }
+  TR-004: { status: partially_covered, note: client-side covered by VP-SEC-003; hashing needs DB verify }
+  # status: covered | partially_covered | covered_elsewhere | planned | gap | not_applicable
+```
+
+**Never write `status: covered` for a requirement no variant traces to** (Gate R flags it). A note
+saying "proven by DI-SEC-CSRF" is prose — nothing detects it when that scenario later changes. If a
+scenario in THIS feature proves the requirement, **add `@spec:<id>` to that scenario** so the trace
+is real, then drop the override (it derives as `covered` on its own). Use `covered_elsewhere` only
+when another suite proves it, and name that suite; `not_applicable` when the spec itself excludes
+the requirement.
+
+Then validate and fix any ERROR findings:
+
+```bash
+[ -x ./bin/sungen.js ] && ./bin/sungen.js delivery <unit> --check || npx sungen delivery <unit> --check
 ```
 
-{{#cap parallel-subagents}}
-- If no screen args → omit `<screens>` (CLI processes all targets).
-{{/cap}}
-{{^cap parallel-subagents}}
-- If no name args → omit `<names>` (CLI processes all targets).
-{{/cap}}
-- If `--env <locale>` was provided → prepend `SUNGEN_ENV=<locale>` to the command. Do NOT pass `--env` to the CLI itself — it's not a CLI flag, only a slash-command convenience.
-
-The CLI handles:
-{{#cap parallel-subagents}}
-- Scope detection (all screens + flows vs specific)
-{{/cap}}
-{{^cap parallel-subagents}}
-- Scope detection (all screens + flows vs specific names)
-- Auto-detect: `qa/flows/<name>/` → flow, `qa/screens/<name>/` → screen
-{{/cap}}
-- Pre-flight source checks with colorful output
-- Parsing `.feature`, `.spec.ts`, `test-data.yaml` (+ `<name>.<env>.yaml` overlay when `SUNGEN_ENV` is set), and per-target `<name>-test-result[.<env>].json`
-- Generating CSV/XLSX at `qa/deliverables/<name>-testcases[.<env>].csv` / `.xlsx`
-- Printing summary table
-
-### 2. Handle pre-flight failures (if CLI exits non-zero)
-
-{{#cap parallel-subagents}}
-If the CLI exits with blocking issues, it will have already printed a clear table showing exactly what's missing per screen.
-{{/cap}}
-{{^cap parallel-subagents}}
-If the CLI exits with blocking issues, it will have already printed a clear table showing exactly what's missing per target.
-{{/cap}}
-
-Use `AskUserQuestion` to offer next steps:
-
-**Options:**
-- **Fix missing sources** (Recommended) — Print the suggested commands from CLI output and stop. User will run those commands manually, then re-invoke `/sungen:delivery`.
-{{#cap parallel-subagents}}
-- **Continue with available screens** — Re-run as `npx sungen delivery <screens> --continue-on-missing` to skip screens with blocking issues.
-{{/cap}}
-{{^cap parallel-subagents}}
-- **Continue with available targets** — Re-run as `npx sungen delivery <names> --continue-on-missing` to skip targets with blocking issues.
-{{/cap}}
-- **Cancel** — Exit.
-
-### 3. Show summary + offer next steps (on success)
-
-Forward the CLI's summary table to the user verbatim. Then use `AskUserQuestion`:
-
-- **Open a specific CSV** — Help user inspect one of the exported files with Read tool.
-{{#cap parallel-subagents}}
-- **Run tests to refresh results** — Suggest `/sungen:run-test <screen>` to update `test-results/results.json`, then re-run delivery.
-- **Export another screen** — User can run `/sungen:delivery <other-screen>`.
-{{/cap}}
-{{^cap parallel-subagents}}
-- **Run tests to refresh results** — Suggest `/sungen-run-test <name>` to update test results, then re-run delivery.
-- **Export another target** — User can run `/sungen-delivery <other-name>`.
-{{/cap}}
-- **Done** — Exit.
+### 3. Present the grouping for review
+
+Show the user a compact summary: item count vs variant count, the groups (id · target · intent ·
+variant count), dispositions, and every remaining `review`-level finding (oracle-shape /
+precondition heuristics — these are exactly what QA must confirm). Then `AskUserQuestion`:
+
+- **Approve all groups** (Recommended when the findings look right)
+- **Adjust the grouping** — user names the groups to change; edit the map, re-run `--check`, re-present.
+- **Preview draft first** — `sungen delivery <unit> --preview` (DRAFT watermark), then re-ask.
+- **Cancel**
+
+### 4. Approve + official render
+
+```bash
+[ -x ./bin/sungen.js ] && ./bin/sungen.js delivery <unit> --approve || npx sungen delivery <unit> --approve
+[ -x ./bin/sungen.js ] && ./bin/sungen.js delivery <unit> || npx sungen delivery <unit>
+```
+
+`--approve` stamps scenario fingerprints into the map — if the `.feature` changes later, Gate E
+flips the affected groups back to review (drift). Approved + unchanged groups render without
+re-asking.
+
+### 5. Show summary + offer next steps
+
+Forward the CLI summary verbatim (Items = review rows; **Variants = execution units — progress is
+counted in variants, never items**). Then `AskUserQuestion`:
+
+- **Open the workbook** — inspect `qa/deliverables/<unit>-testcases.xlsx` (Testcases sheet:
+  collapse outline level 1 for the customer view; Coverage sheet: target × category grid + gaps).
+- **Run tests to refresh results** — `/sungen:run-test <unit>`, then re-run delivery.
+- **Also export CSV** — `sungen delivery <unit> --format csv` (flat `item`/`variant` rows for pipelines).
+- **Export the legacy workbook too** — `sungen delivery <unit> --legacy`.
+- **Done**
 
 ## Important notes
 
-- **Do NOT parse files yourself** — the CLI is the source of truth for parsing logic. Your job is orchestration + user interaction.
-- **Do NOT modify feature/spec.ts/test-data files** — the delivery is read-only.
-- **The CLI already respects `@manual` tags, skips `@steps:` base scenarios, groups by Category 2, and generates UTF-8 BOM CSV for Excel compatibility with Vietnamese.**
-- **Pre-flight check is built into the CLI** — use `--skip-preflight` only in CI/automated pipelines where checks are done externally.
+- **Do NOT parse/duplicate what the CLI computes** — gates recompute mode/layer/priority/oracle
+  shapes from the `.feature`; the map only carries the semantic fields (target/intent/oracle/
+  category/grouping).
+- **Never write `review: approved` yourself** — only `--approve` after the user agreed. Proposing
+  with `review: approved` defeats the QA review this format exists for.
+- **Do NOT modify feature/test-data files during delivery** — read-only except the map file.
+- The map is committed and stable: adding a group never renumbers others; deleting scenarios →
+  update the map (Gate B lists exactly what's unmapped/stale).
 
-## CLI Reference
+## CLI reference
 
 ```
-{{#cap parallel-subagents}}
-sungen delivery [screens...]
-{{/cap}}
-{{^cap parallel-subagents}}
-sungen delivery [names...]
-{{/cap}}
-  [--skip-preflight]          Skip pre-flight checks (not recommended)
-{{#cap parallel-subagents}}
-  [--continue-on-missing]     Skip screens with blocking misses
-{{/cap}}
-{{^cap parallel-subagents}}
-  [--continue-on-missing]     Skip targets with blocking misses
-{{/cap}}
-
-# Locale-aware export (env var, not a CLI flag):
-{{#cap parallel-subagents}}
-SUNGEN_ENV=<locale> sungen delivery [screens...]
-{{/cap}}
-{{^cap parallel-subagents}}
-SUNGEN_ENV=<locale> sungen delivery [names...]
-{{/cap}}
-  → reads <name>.<locale>.yaml overlay, picks <name>-test-result.<locale>.json,
-    writes <name>-testcases.<locale>.csv / .xlsx
+sungen delivery [names...]        # matrix (default; needs the map) → XLSX only
+  --format <xlsx|csv|both>        # output format; default xlsx (one artifact)
+  --check                         # gates only — validate the map, write nothing
+  --approve [DI-a,DI-b]           # flip proposed→approved (+ stamp fingerprints); all groups when bare
+  --preview                       # render despite review findings (DRAFT watermark)
+  --legacy | --full               # classic per-scenario workbook (no map needed)
+  --skip-preflight | --continue-on-missing | --env <env>   # as before
 ```
+
+Outputs: `qa/deliverables/<unit>-testcases.xlsx` (Testcases + Coverage sheets) by default;
+`--format csv` writes `<unit>-testcases.csv` instead (flat, `Level` column `item|variant`),
+`--format both` writes both. Legacy mode writes the classic files instead.

package/dist/orchestrator/templates/ai-src/config/claude.md

@@ -30,7 +30,7 @@ You generate 3 files for sungen — a Gherkin compiler that produces Playwright
 | `/sungen:create-data-test <name>` | Generate standardized test-data (valid/boundary/invalid + CHK trace) from the Data Factory catalog; no name = all units (asks to confirm) |
 | `/sungen:review <name>` | Score syntax, coverage, viewpoint quality (auto-detects screen or flow) |
 | `/sungen:run-test <name>` | Generate `selectors.yaml`, compile, run, auto-fix (auto-detects screen or flow) |
-| `/sungen:delivery [name...]` | Export test cases → CSV for QA delivery (all screens if no arg) |
+| `/sungen:delivery [name...]` | Export the Test Case & Coverage Matrix (review/manual/customer deliverable; `--legacy` = classic CSV; all screens if no arg) |
 | `/sungen:locale <name> <locale>` | Bootstrap i18n for a screen — audit selectors, detect locale switch, generate overlay (run before `/sungen:run-test --env <locale>`) |
 
 **Screen path:** add-screen → create-test → review → run-test → delivery.

package/dist/orchestrator/templates/ai-src/config/copilot.md

@@ -30,7 +30,7 @@ You generate 3 files for sungen — a Gherkin compiler that produces Playwright
 | `/sungen-create-data-test <name>` | Generate standardized test-data (valid/boundary/invalid + CHK trace) from the Data Factory catalog; no name = all units (asks to confirm) |
 | `/sungen-review <name>` | Score syntax, coverage, viewpoint quality (auto-detects screen or flow) |
 | `/sungen-run-test <name>` | Generate `selectors.yaml`, compile, run, auto-fix (auto-detects screen or flow) |
-| `/sungen-delivery [name...]` | Export test cases → CSV for QA delivery (all screens if no arg) |
+| `/sungen-delivery [name...]` | Export the Test Case & Coverage Matrix (review/manual/customer deliverable; `--legacy` = classic CSV; all screens if no arg) |
 | `/sungen-locale <name> <locale>` | Bootstrap i18n for a screen — audit selectors, detect locale switch, generate overlay (run before `/sungen-run-test --env <locale>`) |
 
 **Screen path:** add-screen → create-test → review → run-test → delivery.

package/dist/orchestrator/templates/ai-src/skills/sungen-delivery/SKILL.md

@@ -1,21 +1,117 @@
 ---
 name: sungen-delivery
-description: 'Export Gherkin scenarios + Playwright results → CSV test case deliverable. Auto-loaded by delivery command.'
+description: 'Export the Test Case & Coverage Matrix (or the legacy per-scenario CSV) from Gherkin + Playwright results. Auto-loaded by delivery command.'
 user-invocable: false
 ---
 
 ## Purpose
 
-Export test cases from Sungen screens and flows to a standardized CSV file (format BM-2-901-13) for QA delivery.
+Export test cases from Sungen units to the QA deliverable. Two modes:
 
-**This skill delegates all heavy work to the `sungen delivery` CLI.** The CLI is the single source of truth for parsing logic — do NOT re-parse files in AI. Your role is only to:
+- **Matrix (default)** — the **Test Case & Coverage Matrix**: one row per *delivery item* (one
+  target + one test intent + one oracle family); scenarios / `@cases` rows stay as collapsible
+  *coverage variant* sub-rows. Built for review, manual execution, customer hand-off, and
+  reporting — no numbered step dumps.
+- **Legacy (`--legacy`/`--full`)** — the classic per-scenario BM-2-901-13 workbook (documented
+  in the second half of this skill; unchanged).
 
-1. Invoke the CLI
-2. Show its output verbatim
-3. Help the user react to pre-flight failures
+**This skill delegates all heavy work to the `sungen delivery` CLI.** The CLI is the single source
+of truth for parsing + gating. The AI's only semantic contribution is **proposing the Delivery
+Map** (grouping) — everything else is: invoke the CLI, show output verbatim, help on failures.
 
 ---
 
+## Matrix mode — the Delivery Map
+
+`qa/<screens|flows|api>/<unit>/delivery/<unit>.map.yaml` — committed, AI-proposed
+(`review: proposed`), gate-validated, QA-approved (`sungen delivery --approve` stamps scenario
+fingerprints). Schema + grouping rules live in the delivery command instructions; the normative
+spec is `docs/spec/delivery-coverage-matrix-spec.md`.
+
+**Gates** (CLI `--check`): A source (VP-ids unique, oracle present, Background setup-only) ·
+B mapping (every scenario in exactly one group XOR one disposition) · C aggregation (test layer
+recomputed and equal within a group — **execution mode and priority are coverage dimensions, not
+splits**: mixed items show `Auto n · Manual m` and take the highest variant priority; heuristic
+oracle-shape/precondition mismatches are review-level, silenced once approved and unchanged) ·
+D executability (precondition · condition+
+data · trigger · oracle all renderable; every `{{var}}` resolves; **no template token may survive
+into a rendered cell** — test-data cross-references are resolved for display) · E drift
+(scenario fingerprint mismatch → back to review; the map's OWN reviewed
+wording/grouping is fingerprinted as `__map__` too, so post-approval edits re-open review) · G review state (proposed groups block the official
+render; `--preview` renders a DRAFT watermark) · K category class (a `VP-SEC-*` variant outside
+`category: security`, or `VP-NFR-*` outside `nfr` → warning: the Coverage grid's column would render
+empty and report a false gap) · R requirement coverage (spec FR/TR/NFR ids with no trace and no
+`requirements:` status → warning; **and a `status: covered` override that no variant traces to** →
+warning: tag the proving scenario `@spec:<id>` instead of asserting it in prose) · W wording lint (map intent/oracle containing
+tokens, `[Selector]` refs, DSL phrasing, or generator labels → warning).
+
+**Wording normalization (deterministic, after semantic normalization):** DSL steps render as
+controlled manual-test English without changing meaning — actions in the imperative (`User fill
+[Email] field with X` → `Enter X in the Email field.`), expected results as observable assertions
+(`User see [Jobs] page` → `The Jobs page is displayed.`), preconditions as states (`The user is
+signed out.`). Manual `# Tester verifies:` labels become structured fields: `Setup:` →
+Precondition, `Action:` → Action, `Observable:` → Expected Result, `Oracle:` → a separate
+`Verification method:` line. Sequence-sensitive flows keep event order: actions numbered with
+mid-flow assertions inline as `Verify: …`; only the final Then block is the Expected Result.
+Empty test values render as `(empty)`.
+
+**Output format**: **XLSX only by default** (one artifact). `--format csv` writes the flat CSV
+instead; `--format both` writes both.
+
+**Scope decides strictness**: a **named** unit that is not ready aborts with exit 1 (pass
+`--continue-on-missing` to tolerate it); a **no-argument sweep** exports every ready unit, lists
+every unit it did not export with the reason, and exits 0 as long as it wrote something — a
+scaffolded unit never blocks the ready ones.
+
+**Workbook**: `Testcases` sheet — parent rows + outline-level-1 variant sub-rows for **every**
+item (single-variant included: the sub-row carries the source VP-id, resolved data, and the
+result/evidence entry). Sub-rows are **delta-only**: knowledge common to the whole item
+(precondition, trigger) is written ONCE on the parent; a child repeats only what distinguishes it
+(condition/data, precondition delta, trigger when it differs) plus its own precise oracle and
+execution fields. The parent never carries placeholder text — when triggers differ the cell is
+simply empty and the sub-rows carry them.
+
+Parent preconditions are the **intersection** of the variants' and the parent's Action holds the
+**shared leading steps**; each variant renders only its remaining steps, numbered to continue the
+parent's list — so a shared prefix is written once, not repeated on every child. The parent's
+Coverage cell is the map's short `dimensions:` digest (or the variant refs when none is declared),
+never a concatenation of variant titles.
+
+Variant Result cells hold exactly one of `Passed`/`Failed`/`Blocked`/`Pending`/`N/A` (dropdown) —
+that vocabulary is the contract: the parent Result and the summary band are **live Excel formulas**
+counting those words, so a parent label is always a composed `n/m Passed …` string (`All N/A` when
+every variant is N/A) and never a bare state word. **`N/A` leaves the denominator.** Evidence and
+Defect ID are separate columns; ID + Target frozen; ISO dates; landscape print with repeated
+header rows.
+
+`Coverage` sheet — requirement coverage table (every FR/TR/NFR id with an explicit status),
+target × category grid with explicit `—` gaps, dispositions, manifest. CSV mirrors the same model
+flat with a `Level` column (`item`/`variant`) + a requirement-coverage appendix.
+`delivery_item_count` ≠ progress — variants are the execution metric.
+
+**Id schemes**: the `VP-<CAT>-<NNN>` convention is a suggestion, not a requirement — a project's own
+scheme (`SEC-123`, `PER-345`, `MS-HP-001`) is addressed the same way, and the category segment
+(`SEC`, `PER`) still drives Gate K. Requirement ids come from the spec's own bolded declarations
+(`- **REQ-12**: …`), so a project that does not use FR/TR/NFR still gets its coverage table.
+
+**Runtime-captured values**: a scenario may produce its own values — `User remember [X] text as
+{{v}}` (compared later) or a capability binding (`@query:`/`@api:`/`@dataFactory:`). These never
+exist in test-data, so Gate D does not ask for them: the capture step renders as an instruction
+(`Note the X text for later (as "v")`) and later references read `the captured v`.
+
+**Data fidelity**: invisible test data is made visible, never normalized — `''` → `(empty)`,
+whitespace-only → `(5 spaces)`, padded → `" value "` quoted verbatim. A trim/collapse here would
+silently break the whitespace tests it describes.
+
+**Authoring guidance the matrix rewards** (create-test side): payload/provider matrices (SQLi
+payload lists, OAuth provider sets) belong in `@cases` datasets so each case is an atomic,
+independently-reportable variant; keep dataset `case:` labels short and stable (`CHK-EMAIL-I1`),
+with descriptions in other columns — the label is part of the variant's identity.
+
+---
+
+## Legacy mode (--legacy / --full)
+
 ## Architecture
 
 ```