@sun-asterisk/sungen 3.2.34 → 3.3.0-alpha.2

package/src/harness/sensors.ts

@@ -12,6 +12,9 @@ import { parse as parseYaml } from 'yaml';
 import { ScenarioInfo, ViewpointEntry, idPrefix } from './parse';
 import { readTextFile } from './read-text';
 import { keywordHit, hasKeyword } from './keyword-match';
+import { countedAssertions } from './counted-assertions';
+import { CATALOG_GATE_RULES, GateRules } from './gates/resolve-rule';
+import { ruleVerdict, sensorSeverityOf } from './gates/gate-terms';
 
 // Business-critical category keywords (matched by CONTAINMENT against the VP category, so a
 // compound category like LIST-DISPLAY / ADD-TO-CART / PRODUCT-DISCOVERY classifies correctly).
@@ -275,6 +278,8 @@ export function assertionDepth(
   scenarios: ScenarioInfo[],
   dataThemes: CatalogTheme[] = [],
   focus = 'functional',
+  /** The unit's gate rules; the catalog alone (today's levels) by default. */
+  rules: GateRules = CATALOG_GATE_RULES,
 ): DepthResult {
   const nonManual = scenarios.filter((s) => !s.manual);
   const shallow = nonManual.filter((s) => s.shallow);
@@ -298,8 +303,7 @@ export function assertionDepth(
   const ratio = required.length ? 1 - reqShallow.length / required.length : 1;
 
   const threshold = DEPTH_THRESHOLDS[focus] ?? DEPTH_THRESHOLDS.functional;
-  let verdict: DepthVerdict = 'pass';
-  if (ratio < threshold) verdict = WARN_ONLY_FOCUS.has(focus) ? 'warn' : 'fail';
+  const verdict = ruleVerdict(rules, 'audit.assertion-depth', ratio < threshold, WARN_ONLY_FOCUS.has(focus));
 
   return {
     total: nonManual.length,
@@ -710,7 +714,10 @@ export interface ClaimUnproven {
   claim: string;       // the claim keyword matched in the title
   need: string;        // the assertion shape the steps must contain
   hint: string;        // how to fix
-  severity: 'fail' | 'warn';
+  /** Resolved from the row's catalog rule (fail = blocks when under the ratio; info only via an override). */
+  severity: 'fail' | 'warn' | 'info';
+  /** The gate rule that decided `severity` (`claim.*`, or `claim.partial-proof`). */
+  rule: string;
 }
 
 export interface ClaimProofResult {
@@ -725,16 +732,17 @@ export interface ClaimProofResult {
 }
 
 interface ClaimRule {
+  /** The catalog rule (`claim.*`) whose resolved severity a missing proof gets (OES-11.2). */
+  rule: string;
   claim: string;
   title: RegExp;        // claim keyword(s) in the title
   proof: RegExp;        // required assertion shape in the steps
   need: string;
   hint: string;
-  severity: 'fail' | 'warn';
   // Optional: even when `proof` matches, if `underproof` also matches the proof is
-  // PARTIAL (the right shape exists but on the wrong/another element) → a warn-level
-  // finding. e.g. an "each card exposes <action>" claim that has a see-all on price
-  // but asserts the actions with singular presence.
+  // PARTIAL (the right shape exists but on the wrong/another element) → a finding at the
+  // `claim.partial-proof` rule's level. e.g. an "each card exposes <action>" claim that has
+  // a see-all on price but asserts the actions with singular presence.
   underproof?: RegExp;
   underNeed?: string;
   underHint?: string;
@@ -748,29 +756,30 @@ const CLAIM_RULES: ClaimRule[] = [
     // catch, so proving it with a substring proves the opposite of what the title says. Found on
     // a real basic flow whose seven confirmation rows all used `contains` while claiming the six
     // values "survive unchanged" (#599).
+    rule: 'claim.unchanged-preserved',
     claim: 'unchanged/preserved',
     title: /\b(unchanged|unmodified|un-?edited|identical|preserved|intact|verbatim|as entered|without (?:any )?(?:change|modification))\b/,
     proof: /^(?![\s\S]*\bcontains \{\{)/,
     need: 'exact-value assertions (`see [X] text with {{v}}` / `field with {{v}}`) for the values the title says are unchanged',
     hint: 'swap `contains {{v}}` for `with {{v}}` on the continuity rows. A substring match cannot distinguish "unchanged" from "changed by adding a prefix" — and if the screen genuinely renders extra text around the value, say so in the title instead of claiming exactness.',
-    severity: 'warn',
   },
   {
     // An ORDER claim ("sorted by date descending", "ties broken by last-updated") is invisible to
     // a presence check: `see [List] table` passes whatever order the rows are in. It sits ahead of
     // the generic rules so "all results sorted …" is judged as an ordering claim, not an all-claim.
     // A tiebreaker is a Tier-1 guard in the tc-generation skill, yet no rule recognised it (#810).
+    rule: 'claim.ordering-sort',
     claim: 'ordering/sort',
     title: /\b(ascending|descending|sorted|sorts|sort order|ordered by|order by|in (?:chronological|alphabetical|reverse|numeric) order|(?:newest|oldest|latest|earliest|highest|lowest) first|tie-?break(?:s|er|ers)?|ties?)\b|降順|昇順|並び順|giảm dần|tăng dần|sắp xếp/,
     proof: /match data|is sorted|sorted (?:ascending|descending)|\brow \d+\b|\.first\.|\.last\.|\[\d+\]\.|order by/,
     need: 'an order-sensitive assertion (`table match data:` rows in the expected order, `is sorted ascending|descending`, or positional `row N` checks)',
     hint: 'a presence check passes in any order — assert the rows in their expected sequence (`User see [T] table match data:`), or the column sort state; a tiebreak needs two rows sharing the primary key.',
-    severity: 'fail',
   },
   {
     // A LIMIT claim ("never exceeds 10", "at most 5 files") is a count claim in disguise.
     // Ahead of 'no-side-effect', whose negation+effect pattern would otherwise swallow
     // "never exceeds 10 records" and ask for a duplicate-count proof.
+    rule: 'claim.limit-cap',
     claim: 'limit/cap',
     // The quantity must be ≥2 ("at most ONE order" is a no-duplicate claim — left to the rules
     // below) and not a duration ("up to 30 seconds" is a timing claim, not a cap).
@@ -778,51 +787,50 @@ const CLAIM_RULES: ClaimRule[] = [
     proof: /\bcount\b|tohavecount|table with|row with \{\{|match data|is at most|\bexactly\b|field with \{\{|\berror\b|invalid|is disabled/,
     need: 'a count/boundary assertion (count is N, `is at most`, the N+1th input rejected or truncated)',
     hint: 'assert the boundary itself — the count at the cap, or the value/error when one more is attempted — not just that the list or field is present.',
-    severity: 'fail',
   },
   {
+    rule: 'claim.all-every-each',
     claim: 'all/every/each',
     title: /\b(all|every|each)\b/,
     proof: /\bsee all\b/,
     need: 'a `User see all …` assertion (every element, not one)',
     hint: 'assert across all matched elements — for per-card structure use the all-card DSL (roadmap Q2).',
-    severity: 'fail',
     // singular action presence under an "each/every" claim = partial proof
     underproof: /\bsee \[[^\]]+\] (link|button)\b/,
     underNeed: 'an all-card assertion for the claimed action (not single presence)',
     underHint: 'the actions are asserted once, not per-card — wrap them with the all-card DSL `User see all [Card] contain [Action]` (roadmap Q2).',
   },
   {
+    rule: 'claim.only-belong-to',
     claim: 'only/belong-to',
     title: /\b(only|belongs? to|exclusively)\b/,
     proof: /\bsee all\b[^.]*\bcontain/,
     need: 'all-match (`User see all … contains …`)',
     hint: 'all displayed items must match the facet; "no items OUTSIDE" is UI-limited → verify via hybrid API/DB or mark @manual with reason.',
-    severity: 'warn',
   },
   {
+    rule: 'claim.single-exactly-one',
     claim: 'single/exactly-one',
     title: /\b(a single|single|exactly one|just one|only one)\b/,
     proof: /\bcount\b|\btable with\b|\bexactly\b|tohavecount/,
     need: 'a count assertion (e.g. count is 1)',
     hint: 'assert the quantity, not just presence.',
-    severity: 'fail',
   },
   {
+    rule: 'claim.correct-matching-identity',
     claim: 'correct/matching/identity',
     title: /\b(correct|matching|the same|same (product|name|price|value|item)|consistency|identity|lands? in|is the (product|item))\b/,
     proof: /\bremember\b/,
     need: 'capture + compare (`User remember … as {{v}}` then assert {{v}})',
     hint: 'remember the value on the source, then assert it on the target (cross-screen → defer to a flow as @manual).',
-    severity: 'fail',
   },
   {
+    rule: 'claim.changes-toggles',
     claim: 'changes/toggles',
     title: /\b(changes?|toggles?|updates?|reflects?|reopens?)\b/,
     proof: /\bremember\b|\bis hidden\b/,
     need: 'a state delta (before ≠ after, or a visible→hidden contrast)',
     hint: 'capture the before-state and assert the after-state differs, or assert the visible/hidden transition.',
-    severity: 'warn',
   },
   {
     // GENERAL — mutation-absence. A title asserts that a STATE-CHANGING action does NOT
@@ -833,6 +841,7 @@ const CLAIM_RULES: ClaimRule[] = [
     // count/contrast (record count unchanged) or defer to @manual. This is the general
     // category behind "browser back does not re-submit", "does not re-charge the card",
     // "double-click does not create two orders" — not a per-feature keyword.
+    rule: 'claim.no-side-effect',
     claim: 'no-side-effect/no-duplicate',
     // The negation must attach to an EFFECT — something created, sent, stored, charged, fired
     // twice — not to the INPUT being refused. "duplicate address is rejected" is an observable
@@ -850,33 +859,33 @@ const CLAIM_RULES: ClaimRule[] = [
     proof: /\bcount\b|ok_count|status_counts|row with \{\{|table with|tohavecount|is hidden|are hidden|is disabled|are disabled|not complete|no longer/,
     need: 'a record/request-count proof (count stays at one, e.g. `User see [Table] row with {{count}}`, an API `{{name.ok_count}}` invariant, or a `@query` DB count) or @manual with a request-count oracle',
     hint: 'a "does-not-happen / does-not-repeat" claim about a state-changing action is NOT proven by a terminal `see [...] page` — that page is identical whether or not the action (re-)fired. Prove the side-effect count is unchanged, or mark @manual with a setup→action→assert-no-duplicate oracle.',
-    severity: 'fail',
   },
   {
+    rule: 'claim.hidden-rejected',
     claim: 'hidden/rejected/not-complete',
     title: /\b(hidden|closed|dismiss(es|ed)?|not complete|rejected|inert)\b/,
     proof: /\bis hidden\b|\bare hidden\b|message is hidden|not complete|\bhidden\b/,
     need: 'a negative / hidden assertion (`… is hidden`)',
     hint: 'assert the absence/hidden state that the title claims, not just an unrelated visible element.',
-    severity: 'fail',
   },
   {
+    rule: 'claim.cleared-emptied',
     claim: 'cleared/emptied',
     title: /\b(cleared|clears|emptied|empties|reset to empty|wiped)\b/,
     proof: /\bis empty\b|with \{\{empty|with ['"]?['"]?\s*$|\bempty\b/,
     need: 'an empty/cleared assertion after the action (e.g. `field with {{empty_value}}` / `is empty`)',
     hint: 'prove the value is actually gone — return to the screen and assert the field is empty, not just that the action ran.',
-    severity: 'fail',
   },
   {
+    rule: 'claim.restored-preserved',
     claim: 'restored/preserved',
     title: /\b(restored|preserved|persists?|retained|remembered|kept)\b/,
     proof: /\bremember\b|with \{\{|field with/,
     need: 'the value re-asserted after the transition (capture or `field with {{v}}` after returning)',
     hint: 'prove the value survives — assert the field still holds the typed value after the reload/return, not just that it was typed.',
-    severity: 'warn',
   },
   {
+    rule: 'claim.independent-separate',
     claim: 'independent/separate',
     title: /\b(independent|separate|isolat(ed|es)|per[- ]tab|two tabs|each tab)\b/,
     // A storage `does not exist` check on the OTHER tenant's key proves isolation
@@ -885,23 +894,22 @@ const CLAIM_RULES: ClaimRule[] = [
     proof: /\bcontext\b|tab a|tab b|second (tab|context)|does not exist/,
     need: 'a multi-context proof (tab A vs tab B)',
     hint: 'independence across tabs/contexts is rarely DSL-expressible — mark @manual with a clear setup/action/oracle.',
-    severity: 'warn',
   },
   {
+    rule: 'claim.sanitized-inert',
     claim: 'sanitized/inert',
     title: /\b(sanitized|sanitised|escaped|inert|not executed|not rendered|stripped)\b/,
     proof: /field with \{\{|payload|inert|toContainText|is hidden/,
     need: 'the payload echoed as inert text (`field with {{payload}}`) + no execution',
     hint: 'prove the payload round-trips as literal text and triggers nothing — assert the field value and the absence of any effect.',
-    severity: 'warn',
   },
   {
+    rule: 'claim.announces-aria',
     claim: 'announces/aria',
     title: /\b(announce[sd]?|aria|screen[- ]reader|programmatically associated)\b/,
     proof: /aria|role|@manual|describedby|is focused|tab order/,
     need: 'an aria/role assertion (or @manual with a screen-reader oracle)',
     hint: 'ARIA announcement is usually not DSL-expressible — assert aria attributes if possible, else @manual with an NVDA/VoiceOver oracle.',
-    severity: 'warn',
   },
   {
     // GENERAL CATCH-ALL (last) — any negative/absence title not handled by a specific
@@ -911,6 +919,7 @@ const CLAIM_RULES: ClaimRule[] = [
     // only a positive presence. WARN, because a positive proxy is sometimes a valid
     // negative proof (e.g. "stayed on the login page"); the semantic reviewer is the
     // authoritative recall layer for the residue this can't judge structurally.
+    rule: 'claim.negative-absence',
     claim: 'negative-claim/absence',
     title: /(\bno\b|\bnot\b|n['’]t\b|\bnever\b|\bwithout\b|\bcannot\b|prevent|block|avoid|reject|disabl|\bdeny\b|denies|\bkhông\b|\bchưa\b)/i,
     // `does not exist` covers the storage-absence shape — the broad "any storage
@@ -920,7 +929,6 @@ const CLAIM_RULES: ClaimRule[] = [
     proof: /is hidden|are hidden|is empty|no longer|not complete|disabl|invalid|rejected|\berror\b|\bcount\b|row with \{\{|table with|\bremember\b|\bexactly\b|tohavecount|does not exist|tab order/i,
     need: 'a proof of the ABSENCE — a contrast/empty/hidden/error/count assertion, or @manual with an oracle',
     hint: 'a negative claim ("no / not / không …") is not proven by a positive `see [X]` that looks the same whether or not the claim holds. Assert the contrast (state hidden/empty, error shown, count unchanged), or mark @manual.',
-    severity: 'warn',
   },
 ];
 
@@ -947,7 +955,14 @@ export interface TaxonomyResult {
 
 const TAXONOMY_KNOWN = new Set(['LIST', 'PRODUCT', 'CART', 'FILTER', 'NAV', 'VAL', 'SEC']);
 
-const CATEGORY_SIGNALS: { cat: string; re: RegExp }[] = [
+/**
+ * Words of ACCESS — a title about who may reach something. They make the robustness/routing words
+ * below security evidence ("deep link without authentication"); alone those words describe routing.
+ */
+const ACCESS_CONTEXT = /\b(xss|sql|injection|without authentication|unauthenticated|unauthori[sz]ed|without an? (?:authenticated|valid|active) \w+|without (?:permission|login|logging in|signing in|an? account|access)|not (?:logged|signed) in|logged[- ]out|direct(?:ly)? access\w*|auth[- ]?guard|forbidden|\b403\b|(?:no|insufficient|missing) permissions?|permission required|session expired|expired session|tamper\w*)\b/;
+
+/** `requires`: the signal counts only when the title ALSO matches it (#888). */
+const CATEGORY_SIGNALS: { cat: string; re: RegExp; requires?: RegExp }[] = [
   { cat: 'FILTER', re: /\b(categor(y|ies)|sub-?categor\w*|expand\w*|collaps\w*|\bfacet\b|filter\w*|belongs? to)\b/ },
   { cat: 'CART', re: /\b(add(ed|ing)? to cart|added (dialog|modal|message|confirmation)|cart (page|table|line|item)|view cart|continue shopping|quantit)\b/ },
   { cat: 'PRODUCT', re: /\b(product detail|product-detail|view product|product page|same product|product name and price|product identity|detail product)\b/ },
@@ -959,9 +974,16 @@ const CATEGORY_SIGNALS: { cat: string; re: RegExp }[] = [
 // SEC, so the linter told QA to re-tag genuine auth-gate tests as navigation — diluting the
 // visibility of the security suite (QA field report, 3.2.23). The guard vocabulary below is
 // what makes the INTENT matchable, and GUARD_INTENT then wins over a mere observable.
-  { cat: 'SEC', re: /\b(xss|sql|injection|payload|without authentication|unauthenticated|without an? (?:authenticated|valid|active) \w+|direct(?:ly)? access\w*|deep[- ]link\w*|auth[- ]?guard|not skippable|without having (?:completed|submitted|logged)|remains? unauthenticated|\binert\b|tamper\w*|malformed|url parameter|query param\w*|falls? back|gracefull?y|without a crash|not[- ]found|\b404\b|special character|abuse)\b/ },
+  { cat: 'SEC', re: /\b(xss|sql|injection|payload|without authentication|unauthenticated|without an? (?:authenticated|valid|active) \w+|direct(?:ly)? access\w*|auth[- ]?guard|not skippable|without having (?:completed|submitted|logged)|remains? unauthenticated|\binert\b|tamper\w*|malformed|special character|abuse)\b/ },
+  // Robustness and routing words are SEC evidence only beside an ACCESS word. Alone they describe
+  // routing — "Unknown route shows the 404 page", "Deep link opens the item", "the tab from the url
+  // parameter" — and the linter told QA to re-tag those navigation tests as VP-SEC (#888).
+  { cat: 'SEC', re: /\b(deep[- ]link\w*|url parameter|query param\w*|falls? back|gracefull?y|without a crash|not[- ]found|\b404\b)\b/, requires: ACCESS_CONTEXT },
 ];
 
+const signalMatches = (c: { re: RegExp; requires?: RegExp }, title: string): boolean =>
+  c.re.test(title) && (!c.requires || c.requires.test(title));
+
 /**
  * Categories whose signal describes the test's INTENT/risk rather than the observable action.
  * When one of these matches, a competing observable-only category (NAV: "redirects", "navigates")
@@ -979,14 +1001,19 @@ export function taxonomyLint(scenarios: ScenarioInfo[]): TaxonomyResult {
     if (!cat || !TAXONOMY_KNOWN.has(cat)) continue;
     checked++;
     const title = s.name.toLowerCase();
-    const matched = [...new Set(CATEGORY_SIGNALS.filter((c) => c.re.test(title)).map((c) => c.cat))];
+    const matched = [...new Set(CATEGORY_SIGNALS.filter((c) => signalMatches(c, title)).map((c) => c.cat))];
     if (matched.includes(cat)) continue;             // title supports its own category → fine
+    // A gate (`requires`) only stops a word from SUGGESTING its category. An author who already
+    // chose that category is supported by the word alone: a VP-SEC "Deep link to the filtered
+    // list …" stays SEC instead of being pushed toward FILTER (#888 review).
+    if (CATEGORY_SIGNALS.some((c) => c.cat === cat && c.requires && c.re.test(title))) continue;
     // The declared category may be an INTENT category whose signal this title spells
     // differently; never "correct" it toward a category that only names the observable.
     const suppressed = INTENT_OVER_OBSERVABLE[cat];
     const others = matched.filter((c) => c !== cat && !(suppressed && suppressed.has(c)));
     if (others.length === 1) {                        // unambiguous mismatch
-      const sig = CATEGORY_SIGNALS.find((c) => c.cat === others[0])!;
+      // The entry that MATCHED — a category can have several (SEC: guard words, gated robustness words).
+      const sig = CATEGORY_SIGNALS.find((c) => c.cat === others[0] && signalMatches(c, title))!;
       const m = title.match(sig.re);
       mislabeled.push({ name: s.name, current: cat, suggested: others[0], signal: m ? m[0] : others[0] });
     }
@@ -994,7 +1021,12 @@ export function taxonomyLint(scenarios: ScenarioInfo[]): TaxonomyResult {
   return { total: scenarios.length, checked, mislabeled };
 }
 
-export function claimProof(scenarios: ScenarioInfo[], focus = 'functional'): ClaimProofResult {
+/**
+ * `rules` resolves each row's catalog rule for the unit being audited (the catalog alone by default —
+ * today's levels). A rule switched `off` by a gate-override is not measured: its unproven claim is
+ * neither counted nor reported (a partial-proof switched off leaves the claim proven).
+ */
+export function claimProof(scenarios: ScenarioInfo[], focus = 'functional', rules: GateRules = CATALOG_GATE_RULES): ClaimProofResult {
   const measured = scenarios.filter((s) => !s.manual);
   const unproven: ClaimUnproven[] = [];
   let withClaims = 0;
@@ -1003,19 +1035,17 @@ export function claimProof(scenarios: ScenarioInfo[], focus = 'functional'): Cla
     const title = s.name.toLowerCase();
     const rule = CLAIM_RULES.find((r) => r.title.test(title));
     if (!rule) continue;          // no claim → not measured
+    const miss = !rule.proof.test(s.stepsText)
+      // proof shape entirely absent → the claim's own rule decides the level
+      ? { rule: rule.rule, need: rule.need, hint: rule.hint }
+      : rule.underproof && rule.underproof.test(s.stepsText)
+        // right shape exists but only as a partial proof
+        ? { rule: 'claim.partial-proof', need: rule.underNeed ?? rule.need, hint: rule.underHint ?? rule.hint }
+        : null;
+    const severity = miss ? sensorSeverityOf(rules.resolve(miss.rule)) : undefined;
+    if (miss && severity === null && miss.rule === rule.rule) continue;   // the claim's rule is off for this unit
     withClaims++;
-    if (!rule.proof.test(s.stepsText)) {
-      // proof shape entirely absent → fail at the rule's severity
-      unproven.push({ name: s.name, claim: rule.claim, need: rule.need, hint: rule.hint, severity: rule.severity });
-    } else if (rule.underproof && rule.underproof.test(s.stepsText)) {
-      // right shape exists but only as a partial proof → warn
-      unproven.push({
-        name: s.name, claim: rule.claim,
-        need: rule.underNeed ?? rule.need,
-        hint: rule.underHint ?? rule.hint,
-        severity: 'warn',
-      });
-    }
+    if (miss && severity) unproven.push({ name: s.name, claim: rule.claim, need: miss.need, hint: miss.hint, severity, rule: miss.rule });
   }
 
   const proven = withClaims - unproven.length;
@@ -1023,10 +1053,7 @@ export function claimProof(scenarios: ScenarioInfo[], focus = 'functional'): Cla
   const threshold = DEPTH_THRESHOLDS[focus] ?? DEPTH_THRESHOLDS.functional;
 
   const hasFail = unproven.some((u) => u.severity === 'fail');
-  let verdict: DepthVerdict = 'pass';
-  if (ratio < threshold) {
-    verdict = WARN_ONLY_FOCUS.has(focus) || !hasFail ? 'warn' : 'fail';
-  }
+  const verdict = ruleVerdict(rules, 'audit.claim-proof', ratio < threshold, WARN_ONLY_FOCUS.has(focus) || !hasFail);
 
   return { total: measured.length, withClaims, proven, unproven, ratio, focus, threshold, verdict };
 }
@@ -1058,9 +1085,8 @@ export function numericClaimGaps(scenarios: ScenarioInfo[]): Array<{ name: strin
     if (!m) continue;
     const claimed = NUMBER_WORDS[m[1]] ?? Number(m[1]);
     if (!Number.isFinite(claimed) || claimed < 2) continue;
-    // Only value-bearing assertions count: `see [X] … with/contains {{v}}`. A visibility check
-    // does not demonstrate one of N values.
-    const asserted = (s.stepsText.match(/\bsee \[[^\]]+\][^|]*?\b(?:with|contains) \{\{/g) ?? []).length;
+    // Values, positive states and indicator presence count; plain text visibility does not (#866).
+    const asserted = countedAssertions(s.stepsText);
     if (asserted > 0 && asserted < claimed) out.push({ name: s.name, claimed, asserted, noun: m[2] });
   }
   return out;

package/src/harness/triage-signals.ts

@@ -0,0 +1,46 @@
+/**
+ * Triage signal library — the ordered message patterns `sungen triage` matches a red scenario's
+ * error against. Seeded from the repair rules (`harness/repair.ts`, driver-mobile `mobile-repair.ts`);
+ * the patterns are COPIED, not imported, because core never loads a driver at runtime. The parity
+ * check in tests/harness/triage-classification.run.ts keeps the environment rules in step.
+ *
+ * Order matters and is the classification order: environment first (nothing about the test or the
+ * app can be judged when the session never started), then test defects (the test never reached the
+ * app). Assertions are decided in triage.ts from the parsed Expected/Received, not here.
+ */
+export type SignalClass = 'environment' | 'test-defect';
+
+export interface TriageSignal {
+  id: string;
+  class: SignalClass;
+  match: RegExp;
+}
+
+export const TRIAGE_SIGNALS: TriageSignal[] = [
+  // --- environment: the run could not reach a usable app/session -----------------------------------
+  { id: 'env-network', class: 'environment', match: /net::ERR_[A-Z_]+|\bECONNREFUSED\b|\bENOTFOUND\b|\bEAI_AGAIN\b|\bETIMEDOUT\b/ },
+  // mirrors mobile-session-not-created
+  { id: 'env-session-not-created', class: 'environment', match: /A new session could not be created|session not created/i },
+  // mirrors mobile-driver-proxy-lost
+  { id: 'env-driver-proxy-lost', class: 'environment', match: /Could not proxy command to (?:the )?remote server|socket hang up|ECONNRESET/ },
+  // mirrors mobile-instrumentation-failed
+  { id: 'env-instrumentation-failed', class: 'environment', match: /instrumentation process (?:cannot|could not) be (?:initialized|started)|Cannot start the instrumentation process/ },
+  // mirrors mobile-chromedriver-mismatch
+  { id: 'env-chromedriver-mismatch', class: 'environment', match: /No Chromedriver found|chromedriver.*(?:version|mismatch)|Chrome version must be/i },
+  // mirrors mobile-webview-context-absent
+  { id: 'env-webview-context-absent', class: 'environment', match: /no WEBVIEW\/CHROMIUM context appeared within/ },
+  { id: 'env-auth-state-missing', class: 'environment', match: /storageState|\.auth\/[\w.-]+\.json|ENOENT[^\n]*\.auth/ },
+  { id: 'env-base-url-unresolved', class: 'environment', match: /Cannot navigate to invalid URL|baseURL (?:is )?(?:not set|undefined)|Invalid URL/ },
+  { id: 'env-browser-closed', class: 'environment', match: /Target page, context or browser has been closed|browserType\.launch/ },
+
+  // --- test defect: the test could not reach the element or its data -------------------------------
+  { id: 'test-strict-mode', class: 'test-defect', match: /strict mode violation/ },
+  { id: 'test-locator-unresolved', class: 'test-defect', match: /locator\.\w+: [^\n]*(?:Timeout|timeout)[^\n]*exceeded[\s\S]*waiting for |resolved to 0 elements/ },
+  { id: 'test-element-absent', class: 'test-defect', match: /no such element|Element not found:|An element could not be located/ },
+  { id: 'test-data-missing', class: 'test-defect', match: /Test data key not found:|@cases dataset "[^"]+" not found/ },
+  { id: 'test-step-unmatched', class: 'test-defect', match: /\[sungen\] step "[^"]*" matched no pattern|\bSG\d{3}\b/ },
+  { id: 'test-tap-intercepted', class: 'test-defect', match: /element click intercepted|is not clickable at point|element is obscured|intercepts pointer events/i },
+];
+
+/** A failure that is only Playwright's test-level timeout — no locator, no assertion detail (→ unclassified). */
+export const BARE_TIMEOUT = /^(?:Error:\s*)?Test timeout of \d+ms exceeded\.?$/;

package/src/harness/triage-unit.ts

@@ -0,0 +1,113 @@
+/**
+ * `sungen triage` IO: find a unit's feature(s) and result file(s), join them on the same seam
+ * delivery and the dashboard use (`mergeFeatureAndSpec` + `resolveResultVariants`), classify each
+ * scenario, and persist `.sungen/triage/<unit>.json`. Read-only apart from that one report file.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { parseFeatureMetadata } from '../exporters/feature-parser';
+import { loadPlaywrightReport, resolveResultsPath } from '../exporters/playwright-report-parser';
+import { collectQaEnvSecretDenylist } from '../exporters/qa-env-secret-denylist';
+import { isSensitiveKey } from '../exporters/sensitive-key';
+import { resolveResultVariants } from '../exporters/result-variants';
+import { mergeFeatureAndSpec } from '../exporters/scenario-merger';
+import { parseSpecFile } from '../exporters/spec-parser';
+import { loadTestData } from '../exporters/test-data-resolver';
+import type { ResolvedUnit } from '../cli/resolve-unit';
+import { classifyScenario, TriageClass, TriageRow } from './triage';
+
+export interface TriageReport {
+  unit: string;
+  generatedAt: string;
+  /** Result files read, relative to the project root. Empty → nothing has run yet. */
+  resultFiles: string[];
+  counts: Partial<Record<TriageClass, number>>;
+  rows: TriageRow[];
+}
+
+/**
+ * Values that must never reach a triage evidence line or a defect record: the resolved `${QA_*}`
+ * secrets AND the literal values of credential-named test-data keys — an assertion on a password
+ * field prints that value in its Expected/Received.
+ */
+export function unitSecrets(testData: Record<string, string>, cwd: string): string[] {
+  const literal = Object.entries(testData)
+    .filter(([k, v]) => isSensitiveKey(k) && typeof v === 'string' && v.length >= 3 && !v.includes('${'))
+    .map(([, v]) => String(v));
+  return [...new Set([...collectQaEnvSecretDenylist(testData, cwd).values, ...literal])].sort((a, b) => b.length - a.length);
+}
+
+function generatedDir(cwd: string, u: ResolvedUnit): string {
+  return path.join(cwd, 'specs', 'generated', u.unitId);
+}
+
+/**
+ * Every result file of one feature, labelled by variant: `<base>-test-result.json` (no label),
+ * `<base>-test-result.<os|env>[.<env>].json` (label = the middle part). A mobile unit has only
+ * per-OS files, so all of them are read rather than the first one found. Falls back to the shared
+ * lookup (incl. `test-results/results.json`) when the generated dir holds none.
+ */
+function resultFilesFor(cwd: string, genDir: string, base: string): Array<{ file: string; variant?: string }> {
+  const prefix = `${base}-test-result`;
+  const own = fs.existsSync(genDir)
+    ? fs.readdirSync(genDir).filter((f) => f.startsWith(prefix) && f.endsWith('.json')).sort()
+    : [];
+  if (own.length > 0) {
+    return own.map((f) => {
+      const variant = f.slice(prefix.length, -'.json'.length).replace(/^\./, '');
+      return { file: path.join(genDir, f), ...(variant ? { variant } : {}) };
+    });
+  }
+  const shared = resolveResultsPath(cwd, genDir, base);
+  return shared ? [{ file: shared }] : [];
+}
+
+export function triageUnit(cwd: string, u: ResolvedUnit): TriageReport {
+  const genDir = generatedDir(cwd, u);
+  const featuresDir = path.join(u.dir, 'features');
+  const features = fs.existsSync(featuresDir) ? fs.readdirSync(featuresDir).filter((f) => f.endsWith('.feature')).sort() : [];
+  const rows: TriageRow[] = [];
+  const resultFiles: string[] = [];
+
+  for (const f of features) {
+    const base = f.replace(/\.feature$/, '');
+    const files = resultFilesFor(cwd, genDir, base);
+    if (files.length === 0) continue;
+    const merged = mergeFeatureAndSpec(parseFeatureMetadata(path.join(featuresDir, f)), parseSpecFile(path.join(genDir, `${base}.spec.ts`)));
+    const dataFile = path.join(u.dir, 'test-data', `${base}.yaml`);
+    const testData = fs.existsSync(dataFile) ? loadTestData(dataFile) : {};
+    const secrets = unitSecrets(testData, cwd);
+
+    for (const { file, variant } of files) {
+      resultFiles.push(path.relative(cwd, file));
+      const results = loadPlaywrightReport(file);
+      for (const m of merged) {
+        for (const v of resolveResultVariants(m, results, testData)) {
+          const r = classifyScenario({ unit: u.unitId, title: `${m.feature.name}${v.nameSuffix}`, tags: m.feature.tags, result: v.result, variant }, secrets);
+          if (r) rows.push(r);
+        }
+      }
+    }
+  }
+
+  const counts: Partial<Record<TriageClass, number>> = {};
+  for (const r of rows) counts[r.class] = (counts[r.class] ?? 0) + 1;
+  return { unit: u.unitId, generatedAt: new Date().toISOString(), resultFiles, counts, rows };
+}
+
+export function triageReportPath(cwd: string, unitId: string): string {
+  return path.join(cwd, '.sungen', 'triage', `${unitId.replace(/\//g, '-')}.json`);
+}
+
+/** The last triage of a unit, or null when `sungen triage` has not run for it. */
+export function readTriageReport(cwd: string, unitId: string): TriageReport | null {
+  try { return JSON.parse(fs.readFileSync(triageReportPath(cwd, unitId), 'utf-8')) as TriageReport; } catch { return null; }
+}
+
+/** Persist under `.sungen/triage/<unit>.json` (a flow `flows/x` → `flows-x.json`); returns the path. */
+export function writeTriageReport(cwd: string, report: TriageReport): string {
+  const out = triageReportPath(cwd, report.unit);
+  fs.mkdirSync(path.dirname(out), { recursive: true });
+  fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`, 'utf-8');
+  return out;
+}

package/src/harness/triage.ts

@@ -0,0 +1,127 @@
+/**
+ * `sungen triage` — classify each red or flaky scenario of a run into exactly one class, with the
+ * rule that fired and one evidence line. Deterministic and read-only; it reports, it never gates.
+ *
+ * Order (first match wins):
+ *   1. known-defect        `@known-defect` / `@known-defect:<id>` — an expected red.
+ *   2. blocked-capability  `@manual:*` / `@requires:*`, or skipped by design.
+ *   3. environment         the session or network never gave the test a usable app.
+ *   4. test-defect         the test could not reach its element or data.
+ *   5. product-candidate   an assertion whose Expected and Received both exist and differ.
+ *   6. unclassified        anything else — left for the agent or QA, with the raw first message.
+ * A `passed` scenario that needed a retry is `flaky` (green, listed separately).
+ *
+ * 5 is tested before 3 and 4 in code: a parsed Expected/Received pair that differs means the app
+ * answered, which outranks any wrapper text (a test timeout around the assertion included).
+ *
+ * A bare test timeout (no locator, no assertion) is `unclassified` too: a slow environment, a page
+ * that hangs on a product bug and a test waiting on the wrong thing all print the same line.
+ *
+ * An assertion on an element that never appeared (`Received: <element(s) not found>`) is NOT a test
+ * defect: a wrong selector and a missing message look identical, so it is left for judgment rather
+ * than hiding a possible product bug behind "fix the selector".
+ */
+import { redactSecrets } from '../exporters/api-testcase-formatter';
+import { parseExpectedReceived } from '../exporters/playwright-report-parser';
+import type { PlaywrightResult } from '../exporters/types';
+import { BARE_TIMEOUT, TRIAGE_SIGNALS } from './triage-signals';
+
+export type TriageClass =
+  | 'known-defect' | 'blocked-capability' | 'environment' | 'test-defect' | 'product-candidate' | 'unclassified' | 'flaky';
+
+export interface TriageInput {
+  unit: string;
+  title: string;
+  tags: string[];
+  result?: PlaywrightResult;
+  /** Result-file variant (`android`, `ios`, an env name) when the unit has several. */
+  variant?: string;
+}
+
+export interface TriageRow {
+  unit: string;
+  scenario: string;
+  variant?: string;
+  class: TriageClass;
+  ruleId: string;
+  evidence: string;
+  ids: string[];
+  legacy: string[];
+  defectId?: string;
+  tracePath?: string;
+  /** product-candidate only: the two halves of the assertion, for a defect draft. */
+  expected?: string;
+  received?: string;
+}
+
+const EVIDENCE_MAX = 200;
+const VIEWPOINT_ID = /\b(?:VP|FL)-[A-Z0-9]+(?:-[A-Z0-9]+)*\b/gi;
+const ELEMENT_ABSENT = /Received:\s*<element\(s\) not found>/;
+
+/** The part of a message the run itself wrote: before `Call log:`, without `Locator:` echo lines. */
+const runHead = (m: string): string => m.split(/\n\s*Call log:/)[0].replace(/^\s*Locator:.*$/gm, '');
+
+/** Every failure message, stack frames and a leading `Error:` dropped. */
+function messagesOf(result: PlaywrightResult): string[] {
+  const raw = result.errorMessages?.length ? result.errorMessages : [result.error ?? ''];
+  return raw.map((m) => m.split(/\n\s*at\s/)[0].replace(/^Error:\s*/i, '').trim()).filter(Boolean);
+}
+
+function evidenceLine(text: string, secrets: string[]): string {
+  const flat = redactSecrets(text, secrets).replace(/\s+/g, ' ').trim();
+  return flat.length > EVIDENCE_MAX ? `${flat.slice(0, EVIDENCE_MAX - 1)}…` : flat;
+}
+
+/** Classify one scenario. Null when it needs no triage (clean pass, or never ran). */
+export function classifyScenario(input: TriageInput, secrets: string[] = []): TriageRow | null {
+  const { result, tags } = input;
+  if (!result) return null;
+  const base = {
+    unit: input.unit,
+    scenario: input.title,
+    ...(input.variant ? { variant: input.variant } : {}),
+    ids: [...new Set([input.title, ...tags].join(' ').match(VIEWPOINT_ID) ?? [])],
+    legacy: tags.filter((t) => t.startsWith('@legacy:')).map((t) => t.slice('@legacy:'.length)),
+    ...(result.tracePath ? { tracePath: result.tracePath } : {}),
+  };
+  const row = (cls: TriageClass, ruleId: string, evidence: string): TriageRow =>
+    ({ ...base, class: cls, ruleId, evidence: evidenceLine(evidence, secrets) });
+
+  if (result.status === 'passed') {
+    return (result.attempts ?? 1) > 1 ? row('flaky', 'passed-after-retry', `passed on attempt ${result.attempts}`) : null;
+  }
+  const messages = messagesOf(result);
+  const first = messages[0] ?? result.status;
+
+  const known = tags.find((t) => t === '@known-defect' || t.startsWith('@known-defect:'));
+  if (known) {
+    const r = row('known-defect', 'tag-known-defect', first);
+    const id = known.split(':')[1];
+    return id ? { ...r, defectId: id } : r;
+  }
+  if (tags.some((t) => t.startsWith('@manual'))) return row('blocked-capability', 'tag-manual', `${tags.find((t) => t.startsWith('@manual'))} — ${first}`);
+  if (tags.some((t) => t.startsWith('@requires:'))) return row('blocked-capability', 'tag-requires', `${tags.find((t) => t.startsWith('@requires:'))} — ${first}`);
+  if (result.status === 'skipped') return row('blocked-capability', 'status-skipped', 'skipped');
+
+  // An assertion with both halves decides the case even when a timeout wraps it.
+  for (const m of messages) {
+    const { expected, received } = parseExpectedReceived(m);
+    if (expected && received && !ELEMENT_ABSENT.test(m) && expected !== received) {
+      return { ...row('product-candidate', 'assertion-mismatch', `Expected ${expected} · Received ${received}`),
+        expected: evidenceLine(expected, secrets), received: evidenceLine(received, secrets) };
+    }
+  }
+  for (const s of TRIAGE_SIGNALS) {
+    // Environment signals read only what the RUN said, never the test's own selector text that a
+    // message echoes in `Locator:` / `Call log:` — `getByText('Invalid URL')` is a missing message,
+    // not a bad base URL. Test-defect signals need the call log (`waiting for …`), so they read it all.
+    const hit = messages.find((m) => s.match.test(s.class === 'environment' ? runHead(m) : m));
+    if (hit) return row(s.class, s.id, hit);
+  }
+  const absent = messages.find((m) => ELEMENT_ABSENT.test(m));
+  if (absent) return row('unclassified', 'assertion-element-absent', absent);
+  if (messages.length > 0 && messages.every((m) => BARE_TIMEOUT.test(m))) {
+    return row('unclassified', 'bare-timeout', `${first} No locator or assertion detail: a slow environment, a hanging page, or a wait in the test. Re-run once, then read the trace's last action.`);
+  }
+  return row('unclassified', 'no-signal', first);
+}