@decantr/cli 2.9.7 → 2.10.0

package/README.md

@@ -17,10 +17,10 @@ Or run it without installing:
 npx @decantr/cli new my-app --blueprint=esports-hq
 ```
 
-Use `decantr setup` when you are unsure which path applies. It detects whether the repo is empty, already attached, or a Brownfield app and recommends the next command.
+Use `decantr setup` when you are unsure which path applies. It detects whether the repo is empty, already attached, or a Brownfield app and recommends the right entry path.
 Use `decantr new` for a greenfield workspace in a fresh directory. With a blueprint/archetype it uses the runnable adapter and Decantr CSS; without registry content it creates a contract-only workspace unless you explicitly pass `--adoption=decantr-css`.
 Use `decantr adopt` when you already have an app and want Decantr governance without adopting a blueprint. Brownfield attach is proposal-driven: Decantr inventories the app, writes an observed essence proposal, hydrates hosted execution packs when online, and only applies the contract when you explicitly accept or merge it.
-Use `decantr doctor` when the next step is unclear, `decantr task` before asking an LLM to modify a route, `decantr verify` after the edit, and `decantr ci` in required automation. Use `decantr codify --from-audit` when you want project-owned UI patterns and local rules such as button/card/shell/theme standards to appear in future task context and verification.
+Use `decantr doctor` when the next step is unclear, `decantr task` before asking an LLM to modify a route, `decantr verify` after the edit, and `decantr ci` in required automation. Use `decantr codify --from-audit` when you want project-owned UI patterns and local rules such as button/card/shell/theme standards to appear in future task context and verification. Once accepted, that local law is the first Hybrid lane: the app still owns source and styling, but Decantr treats accepted local patterns and rules as project authority.
 In monorepos, app-scoped commands accept `--project <app-path>`. `setup` shows attach guidance before adoption and the day-two loop after adoption. Hosted pack hydration also follows the essence path: `decantr registry compile-packs apps/web/decantr.essence.json --write-context` writes into `apps/web/.decantr/context`. In contract-only/offline Brownfield, deferred hosted packs are optional context unless a present manifest references missing files.
 Use `decantr init`, `decantr analyze`, `decantr check`, and `decantr health` as advanced primitives when you need direct control over one step.
 
@@ -80,13 +80,13 @@ pnpm exec decantr ci init --project apps/web
 
 Assistant rule integration is preview-first: `--assistant-bridge=preview` writes `.decantr/context/assistant-bridge.md`, `decantr rules preview` prints the bridge, and `--assistant-bridge=apply` or `decantr rules apply` mutates supported rule files with idempotent marked blocks.
 
-Brownfield analysis also writes `.decantr/doctrine-map.json`, a ranked source-precedence map across security/data, architecture, design-system, workflow/CI, feature/business, assistant-specific, stale, and unsafe-to-cite evidence. It also writes `.decantr/brownfield-intelligence.json`, `.decantr/theme-inventory.json`, and `.decantr/enrichment-backlog.md`. The proposal groups routes into observed semantic domains such as auth, RBAC, billing, reporting, facilities, settings, and public surfaces across Next App/Pages Router, React Router, Angular Router, SvelteKit, Vue Router, and Nuxt file routes. Existing styling systems such as Tailwind, Bootstrap, MUI, Chakra, plain CSS, and Decantr CSS are observed as evidence instead of replaced. Theme variants are observed in the theme inventory without changing Essence V4. `decantr codify --from-audit` proposes `.decantr/local-patterns.proposal.json` and `.decantr/rules.proposal.json`; after review, `decantr codify --accept` promotes `.decantr/local-patterns.json` and `.decantr/rules.json`. `decantr verify --brownfield --local-patterns` uses the Brownfield guard layer plus accepted local law to flag actionable missing doctrine coverage, unsafe context, missing assistant bridges, style drift, raw local-rule violations, and unsafe defaults without treating current database migrations as stale docs.
+Brownfield analysis also writes `.decantr/doctrine-map.json`, a ranked source-precedence map across security/data, architecture, design-system, workflow/CI, feature/business, assistant-specific, stale, and unsafe-to-cite evidence. It also writes `.decantr/brownfield-intelligence.json`, `.decantr/theme-inventory.json`, and `.decantr/enrichment-backlog.md`. The proposal groups routes into observed semantic domains such as auth, RBAC, billing, reporting, facilities, settings, and public surfaces across Next App/Pages Router, React Router, Angular Router, SvelteKit, Vue Router, and Nuxt file routes. Existing styling systems such as Tailwind, Bootstrap, MUI, Chakra, plain CSS, and Decantr CSS are observed as evidence instead of replaced. Theme variants are observed in the theme inventory without changing Essence V4. `decantr codify --from-audit` proposes `.decantr/local-patterns.proposal.json` and `.decantr/rules.proposal.json` with Hybrid authority guidance; after review, `decantr codify --accept` promotes `.decantr/local-patterns.json` and `.decantr/rules.json`. `decantr doctor` reports whether the app is contract-only, Hybrid local law, style bridge, Decantr CSS, or Hybrid composition. `decantr task` prints that authority block and warns before mixing runtimes or adding Decantr CSS to a non-Decantr-CSS app. `decantr verify --brownfield --local-patterns` uses the Brownfield guard layer plus accepted local law to flag actionable missing doctrine coverage, unsafe context, missing assistant bridges, style drift, raw local-rule violations, and unsafe defaults without treating current database migrations as stale docs.
 
 ## What It Does
 
 - scaffolds Decantr projects from blueprints, archetypes, or prompts
 - guides users through human workflow commands: setup, adopt, doctor, task, verify, ci, and codify
-- supports explicit workflow lanes: greenfield blueprint, greenfield contract-only, brownfield adoption, and hybrid composition
+- supports explicit workflow lanes: greenfield blueprint, greenfield contract-only, brownfield adoption, Hybrid local law, Hybrid style bridge, Hybrid Decantr CSS, and hybrid composition
 - generates execution-pack context files for AI coding assistants
 - audits projects against Decantr contracts
 - produces local Project Health reports, Evidence Bundles, workspace health, and a localhost Studio dashboard for end-user drift triage
@@ -96,6 +96,12 @@ Brownfield analysis also writes `.decantr/doctrine-map.json`, a ranked source-pr
 - syncs paginated hosted registry content into a full slug-keyed local cache for offline guards and context generation
 - validates, refreshes, and maintains `decantr.essence.json`
 
+## Security And Permissions
+
+The CLI is intentionally a local project inspector and artifact writer. It reads selected project/workspace files, package manifests, routing/style/config files, `.decantr` artifacts, and Decantr cache/config files. It writes `decantr.essence.json`, `DECANTR.md`, `.decantr/*`, generated context packs, optional CI workflows/snippets, optional style/export files, and auth/telemetry config only when explicitly requested.
+
+Telemetry is disabled by default. Hosted registry, hosted pack hydration, hosted critique/audit, and browser evidence are explicit command paths; screenshots and Evidence Bundles stay local unless a hosted workflow is invoked. Release audits prove the installed package with `npm pack --dry-run --json`. See [security permissions](https://decantr.ai/reference/security-permissions.md).
+
 ## Common Commands
 
 ```bash
@@ -142,7 +148,7 @@ decantr showcase verification --json
 
 `decantr verify` is the workflow command most users should run locally after edits. It delegates to Project Health, can add Brownfield guard validation with `--brownfield`, requires an accepted local pattern pack with `--local-patterns`, scans `.decantr/rules.json` when present, supports workspace mode, and writes evidence to `.decantr/evidence/latest.json` by default when `--evidence` is used.
 
-`decantr doctor` explains project/workspace state, adoption mode, generated artifacts, local law, visual evidence, design authority signals, CI wiring, and the next command to run. It is the command to reach for when an app is in a monorepo, has stale Decantr files, or someone is not sure what Decantr expects next.
+`decantr doctor` explains project/workspace state, adoption mode, adoption lane, generated artifacts, local law, visual evidence, design authority signals, CI wiring, and an ordered next-step queue. It is the command to reach for when an app is in a monorepo, has stale Decantr files, or someone is not sure what Decantr expects next.
 
 `decantr setup` is non-mutating orientation. In an attached Brownfield app it reflects whether local law is already accepted, so the recommended verify command includes `--local-patterns` only when the project has that layer.
 

package/dist/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import "./chunk-66L74ZNJ.js";
+import "./chunk-HQUTNZKF.js";
 import "./chunk-IQZCIMQJ.js";
 import "./chunk-QDMXZSVK.js";
 import "./chunk-WPP3JEMC.js";

package/dist/{chunk-66L74ZNJ.js → chunk-HQUTNZKF.js}

@@ -3025,7 +3025,8 @@ var RESET2 = "\x1B[0m";
 var GREEN2 = "\x1B[32m";
 var CYAN = "\x1B[36m";
 var YELLOW2 = "\x1B[33m";
-async function cmdAnalyze(projectRoot = process.cwd(), workspace) {
+async function cmdAnalyze(projectRoot = process.cwd(), workspace, options = {}) {
+  const printNextStep = options.printNextStep ?? true;
   const startedAt = Date.now();
   console.log(`
 ${BOLD}Analyzing project...${RESET2}
@@ -3190,11 +3191,13 @@ ${DIM2}Written to:${RESET2} ${outputPath}`);
   console.log(`${DIM2}Brownfield intelligence:${RESET2} ${intelligenceArtifacts.intelligencePath}`);
   console.log(`${DIM2}Theme inventory:${RESET2} ${intelligenceArtifacts.themeInventoryPath}`);
   console.log(`${DIM2}Enrichment backlog:${RESET2} ${intelligenceArtifacts.backlogPath}`);
-  console.log(
-    `
+  if (printNextStep) {
+    console.log(
+      `
 ${YELLOW2}Next step:${RESET2} Review ${BOLD}${reportDisplayPath}${RESET2}, then run ${BOLD}${recommendedAttachCommand}${RESET2} to attach Decantr using the observed proposal.
 `
-  );
+    );
+  }
   await sendAnalyzeCompletedTelemetry({
     componentCount: components.componentCount,
     dependencyCategoryCount: [
@@ -3281,7 +3284,17 @@ function createBrownfieldCodifyProposal(input) {
       ruleFiles: input.detected.existingRuleFiles,
       routeCount: routes.length
     },
-    purpose: "Project-owned Brownfield UI law. Review and edit before accepting; Decantr treats this as authoritative only after it is copied to .decantr/local-patterns.json.",
+    purpose: "Project-owned Brownfield/Hybrid UI law. Review and edit before accepting; Decantr treats this as authoritative only after it is copied to .decantr/local-patterns.json.",
+    hybrid: {
+      intent: "This local pattern pack is the first Hybrid authority layer: it maps Decantr concepts onto project-owned components, tokens, classes, and rules without replacing the app runtime.",
+      authorityPrecedence: [
+        "existing production source",
+        "accepted local patterns and rules",
+        "Decantr Essence V4 contract",
+        "hosted registry patterns and execution packs as optional guidance"
+      ],
+      hostedPatternMapping: "Use hosted patterns as vocabulary and review guidance. Before enforcing one, map it to a project-owned component path, class recipe, token recipe, or explicit exception here."
+    },
     patterns: [
       {
         id: "button",
@@ -3356,13 +3369,15 @@ function createBrownfieldCodifyProposal(input) {
       "Avoid raw hex/rgb values in component templates unless documented as dynamic data.",
       "Avoid static inline styles for reusable visual treatment.",
       "When adding a new route, map it to an existing local pattern before inventing a new visual variant.",
-      "When adding a theme variant, update .decantr/theme-inventory.json and this local pattern pack."
+      "When adding a theme variant, update .decantr/theme-inventory.json and this local pattern pack.",
+      "Map hosted Decantr patterns into project-owned local law before making them enforceable."
     ],
     nextSteps: [
       "Edit this proposal with real component paths and token/class recipes.",
       "Run decantr codify --accept after review.",
       "Use decantr task <route> before LLM edits so local law appears in task context.",
       "Run decantr verify --brownfield --local-patterns after edits.",
+      "For Hybrid adoption, start with warn-level local rules and raise severities only after the team agrees the law is stable.",
       "Wire deterministic project rules into ESLint, Biome, Storybook, visual tests, or CI where Decantr should not guess."
     ]
   };
@@ -3371,7 +3386,7 @@ function createBrownfieldCodifyProposal(input) {
     status: "proposal",
     generatedAt,
     source: input.fromAudit ? "decantr codify --from-audit" : "decantr codify",
-    purpose: "Mechanical Brownfield checks owned by this project. These rules are intentionally local and stack-agnostic; edit before accepting.",
+    purpose: "Mechanical Brownfield/Hybrid checks owned by this project. These rules are intentionally local and stack-agnostic; edit before accepting.",
     enforcement: {
       defaultSeverity: "warn",
       mode: "warn",
@@ -4462,6 +4477,111 @@ function statusFromIssues(issues, essenceVersion) {
   }
   return "healthy";
 }
+function appendUnique(commands, command) {
+  if (!command) return;
+  if (!commands.includes(command)) commands.push(command);
+}
+function deriveAdoptionLane(input) {
+  if (input.workspaceMode) {
+    return {
+      id: "workspace",
+      label: "Workspace overview",
+      sourceAuthority: "Each attached app keeps its own Decantr contract and source authority.",
+      styleAuthority: "Per-app adoption mode",
+      activeAuthorities: ["workspace project list", "attached app contracts"],
+      nextChoice: "Pick an app with --project when you want route-level or source-level guidance."
+    };
+  }
+  if (!input.essenceVersion) {
+    return {
+      id: "unattached",
+      label: "Unattached app",
+      sourceAuthority: "Existing app only",
+      styleAuthority: "Existing app styling system",
+      activeAuthorities: ["source tree"],
+      nextChoice: "Run decantr adopt to attach an observed contract before choosing Brownfield or Hybrid law."
+    };
+  }
+  const hasLocalLaw = input.localPatternsPresent || input.localRulesPresent;
+  if (input.workflowMode === "hybrid-compose") {
+    return {
+      id: "hybrid-compose",
+      label: "Hybrid composition",
+      sourceAuthority: "Existing app plus selected Decantr/local law",
+      styleAuthority: input.adoptionMode === "decantr-css" ? "Decantr CSS runtime is active where adopted" : input.adoptionMode === "style-bridge" ? "Style bridge maps Decantr intent into the app styling system" : "Existing app styling system remains primary",
+      activeAuthorities: [
+        "existing source",
+        "Essence V4 contract",
+        hasLocalLaw ? "accepted local law" : "reviewed Hybrid choices",
+        input.packManifestPresent ? "hosted execution packs" : "optional hosted packs"
+      ],
+      nextChoice: "Use task/verify for daily work and keep any hosted pattern adoption mapped into project-owned law."
+    };
+  }
+  if (input.workflowMode === "brownfield-attach") {
+    if (input.adoptionMode === "decantr-css") {
+      return {
+        id: "hybrid-decantr-css",
+        label: "Hybrid with Decantr CSS",
+        sourceAuthority: "Existing app plus explicitly adopted Decantr CSS runtime",
+        styleAuthority: "Decantr CSS runtime is active where adopted",
+        activeAuthorities: ["existing source", "Essence V4 contract", "Decantr CSS runtime"],
+        nextChoice: "Keep Decantr CSS usage explicit and validate route changes with task and verify."
+      };
+    }
+    if (input.adoptionMode === "style-bridge") {
+      return {
+        id: "hybrid-style-bridge",
+        label: "Hybrid style bridge",
+        sourceAuthority: "Existing app plus Decantr intent mapped through a style bridge",
+        styleAuthority: "Style bridge over the existing app styling system",
+        activeAuthorities: ["existing source", "Essence V4 contract", "style bridge"],
+        nextChoice: "Use local law to decide which component families the bridge governs before making it strict."
+      };
+    }
+    if (hasLocalLaw) {
+      return {
+        id: "hybrid-local-law",
+        label: "Hybrid local law",
+        sourceAuthority: "Existing app plus accepted project-owned UI law",
+        styleAuthority: input.designAuthority.length > 0 ? "Existing design authority plus accepted local rules" : "Accepted local rules over the current app styling system",
+        activeAuthorities: [
+          "existing source",
+          "Essence V4 contract",
+          "accepted local patterns/rules",
+          input.packManifestPresent ? "hosted execution packs as guidance" : "optional hosted packs"
+        ],
+        nextChoice: "Use task before edits and verify --local-patterns after edits; map hosted patterns into local law before enforcing them."
+      };
+    }
+    return {
+      id: "brownfield-contract-only",
+      label: "Brownfield contract-only",
+      sourceAuthority: "Existing app is authoritative",
+      styleAuthority: "Existing app styling system",
+      activeAuthorities: ["existing source", "Essence V4 contract"],
+      nextChoice: "Stay contract-only for context, or codify local patterns/rules when you want Hybrid drift control."
+    };
+  }
+  if (input.workflowMode === "greenfield-contract-only") {
+    return {
+      id: "greenfield-contract-only",
+      label: "Greenfield contract-only",
+      sourceAuthority: "Essence V4 contract",
+      styleAuthority: "Project-chosen styling system",
+      activeAuthorities: ["Essence V4 contract", "generated context"],
+      nextChoice: "Add local rules or a style bridge only after the runtime conventions are clear."
+    };
+  }
+  return {
+    id: "greenfield-scaffold",
+    label: "Greenfield scaffold",
+    sourceAuthority: "Decantr contract and certified adapter output",
+    styleAuthority: input.adoptionMode === "contract-only" ? "Project-chosen styling system" : "Decantr CSS",
+    activeAuthorities: ["Essence V4 contract", "adapter output", "execution packs"],
+    nextChoice: "Use task and verify to keep generated routes aligned with the compiled contract."
+  };
+}
 function buildDoctorReport(root, args) {
   let projectArg;
   for (let index = 1; index < args.length; index += 1) {
@@ -4495,6 +4615,8 @@ function buildDoctorReport(root, args) {
   const workflowMode = projectJson?.initialized?.workflowMode ?? null;
   const adoptionMode = projectJson?.initialized?.adoptionMode ?? null;
   const packHydrationOptional = adoptionMode === "contract-only";
+  const localPatternsPresent = existsSync16(localPatternsPath(appRoot));
+  const localRulesPresent = existsSync16(localRulesPath(appRoot));
   const missingPackReferences = workspaceMode ? projects.flatMap(
     (project) => collectMissingPackManifestFiles(join18(workspaceRoot, project.path)).map(
       (missing) => `${project.path}/${missing.relativePath}`
@@ -4587,7 +4709,7 @@ function buildDoctorReport(root, args) {
       nextCommand: "decantr registry compile-packs <app-path>/decantr.essence.json --write-context"
     });
   }
-  if (workflowMode === "brownfield-attach" && !existsSync16(localPatternsPath(appRoot))) {
+  if (workflowMode === "brownfield-attach" && !localPatternsPresent) {
     issues.push({
       category: "local-law",
       severity: "info",
@@ -4615,7 +4737,49 @@ function buildDoctorReport(root, args) {
     issues,
     workspaceMode || workspaceInfo.requiresProjectSelection ? "4.0.0" : essenceVersion
   );
-  const recommendedNextCommand = issues.find((issue) => issue.category === "workspace" && issue.nextCommand)?.nextCommand ?? issues.find((issue) => issue.nextCommand)?.nextCommand ?? (workspaceMode ? "decantr ci --workspace" : projectPath ? `decantr ci --project ${projectPath}` : "decantr ci");
+  const lane = deriveAdoptionLane({
+    workspaceMode: workspaceMode || workspaceInfo.requiresProjectSelection,
+    essenceVersion,
+    workflowMode,
+    adoptionMode,
+    localPatternsPresent,
+    localRulesPresent,
+    designAuthority,
+    packManifestPresent
+  });
+  const projectFlag = projectPath ? ` --project ${projectPath}` : "";
+  const verifyCommand = workflowMode === "brownfield-attach" ? `decantr verify --brownfield --local-patterns${projectFlag}` : workspaceMode ? "decantr ci --workspace" : `decantr verify${projectFlag}`;
+  const ciCommand = workspaceMode ? "decantr ci --workspace --fail-on error" : `decantr ci${projectFlag} --fail-on error`;
+  const recommendedNextCommands = [];
+  const blockingIssue = issues.find((issue) => issue.category === "workspace" && issue.nextCommand) ?? issues.find(
+    (issue) => (issue.category === "setup" || issue.category === "migration") && issue.nextCommand
+  );
+  if (blockingIssue) {
+    appendUnique(recommendedNextCommands, blockingIssue.nextCommand);
+  } else {
+    appendUnique(
+      recommendedNextCommands,
+      issues.find((issue) => issue.category === "ci" && issue.message.includes("not pinned"))?.nextCommand
+    );
+    if (workflowMode === "brownfield-attach" && !localPatternsPresent) {
+      appendUnique(recommendedNextCommands, `decantr codify --from-audit${projectFlag}`);
+      appendUnique(recommendedNextCommands, `decantr codify --accept${projectFlag}`);
+    }
+    appendUnique(
+      recommendedNextCommands,
+      issues.find((issue) => issue.category === "generated-artifact")?.nextCommand
+    );
+    appendUnique(
+      recommendedNextCommands,
+      issues.find((issue) => issue.category === "ci" && issue.message.includes("No Decantr CI"))?.nextCommand
+    );
+    if (workflowMode === "brownfield-attach") {
+      appendUnique(recommendedNextCommands, `decantr task <route> "<change>"${projectFlag}`);
+    }
+    appendUnique(recommendedNextCommands, verifyCommand);
+    appendUnique(recommendedNextCommands, ciCommand);
+  }
+  const recommendedNextCommand = recommendedNextCommands[0] ?? ciCommand;
   return {
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     workspaceRoot,
@@ -4647,16 +4811,18 @@ function buildDoctorReport(root, args) {
       missingReferencedFiles: missingPackReferences.slice(0, 25)
     },
     localLaw: {
-      patternsPresent: existsSync16(localPatternsPath(appRoot)),
-      rulesPresent: existsSync16(localRulesPath(appRoot))
+      patternsPresent: localPatternsPresent,
+      rulesPresent: localRulesPresent
     },
     visualEvidence: {
       manifestPresent: existsSync16(join18(appRoot, ".decantr", "evidence", "visual-manifest.json"))
     },
+    lane,
     designAuthority,
     status,
     issues,
-    recommendedNextCommand
+    recommendedNextCommand,
+    recommendedNextCommands
   };
 }
 function colorForStatus(status) {
@@ -4680,6 +4846,13 @@ function formatDoctorText(report) {
     `  Workflow: ${report.project.workflowMode ?? "unknown"} | adoption ${report.project.adoptionMode ?? "unknown"}`,
     `  Sync state: ${report.project.syncStatus ?? "unknown"} ${DIM4}(registry/cache state, not generated context freshness)${RESET4}`,
     "",
+    `${BOLD3}Adoption Lane:${RESET4}`,
+    `  ${report.lane.label}`,
+    `  Source authority: ${report.lane.sourceAuthority}`,
+    `  Style authority: ${report.lane.styleAuthority}`,
+    `  Active: ${report.lane.activeAuthorities.join(", ")}`,
+    `  Choice: ${report.lane.nextChoice}`,
+    "",
     `${BOLD3}Generated Artifacts:${RESET4}`,
     `  Context directory: ${report.generatedArtifacts.contextDirPresent ? "present" : "missing"}`,
     `  Pack manifest: ${report.generatedArtifacts.packManifestPresent ? "present" : "missing"}`,
@@ -4713,13 +4886,20 @@ function formatDoctorText(report) {
       if (issue.nextCommand) lines.push(`    ${DIM4}${issue.nextCommand}${RESET4}`);
     }
   }
-  lines.push("", `${BOLD3}Next:${RESET4}`, `  ${report.recommendedNextCommand}`, "");
+  lines.push("", `${BOLD3}Next steps:${RESET4}`);
+  for (const [index, command] of report.recommendedNextCommands.entries()) {
+    lines.push(`  ${index + 1}. ${command}`);
+  }
+  if (report.recommendedNextCommands.length === 0) {
+    lines.push(`  ${report.recommendedNextCommand}`);
+  }
+  lines.push("");
   return `${lines.join("\n")}
 `;
 }
 function cmdDoctorHelp() {
   console.log(`
-${BOLD3}decantr doctor${RESET4} \u2014 Explain Decantr state and the next command to run
+${BOLD3}decantr doctor${RESET4} \u2014 Explain Decantr state and the next commands to run
 
 ${BOLD3}Usage:${RESET4}
   decantr doctor [--project <path>] [--workspace] [--json]
@@ -10399,8 +10579,10 @@ async function cmdAdoptWorkflow(args) {
       return;
     }
   }
-  await cmdAnalyze(projectRoot, workspaceInfo);
+  await cmdAnalyze(projectRoot, workspaceInfo, { printNextStep: false });
   if (process.exitCode && process.exitCode !== 0) return;
+  const initCommand = projectArg ? `decantr init --project ${projectArg} --existing ${proposalFlag}` : `decantr init --existing ${proposalFlag}`;
+  console.log(dim3(`Analysis artifacts written; continuing with ${initCommand}.`));
   await cmdInit({
     existing: true,
     yes: true,
@@ -10614,6 +10796,81 @@ function readJsonIfPresent(path) {
     return null;
   }
 }
+function mentionsWord(text, term) {
+  const escaped = term.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`\\b${escaped}\\b`, "i").test(text);
+}
+function createTaskAuthoritySummary(input) {
+  const detected = detectProject(input.projectRoot);
+  const hasLocalLaw = input.hasLocalPatterns || input.hasLocalRules;
+  let lane = "Brownfield contract-only";
+  let sourceAuthority = "Existing app is authoritative; Decantr supplies contract context.";
+  let styleAuthority = "Use the existing styling system.";
+  const activeAuthorities = ["existing source", "Essence V4 contract"];
+  if (input.workflowMode === "hybrid-compose") {
+    lane = "Hybrid composition";
+    sourceAuthority = "Existing app plus selected Decantr/local law are authoritative.";
+  } else if (input.workflowMode === "brownfield-attach" && input.adoptionMode === "decantr-css") {
+    lane = "Hybrid with Decantr CSS";
+    sourceAuthority = "Existing app remains authoritative except where Decantr CSS is explicitly adopted.";
+    styleAuthority = "Decantr CSS runtime is active where adopted.";
+    activeAuthorities.push("Decantr CSS runtime");
+  } else if (input.workflowMode === "brownfield-attach" && input.adoptionMode === "style-bridge") {
+    lane = "Hybrid style bridge";
+    sourceAuthority = "Existing app remains authoritative; Decantr intent maps through the style bridge.";
+    styleAuthority = "Use bridge tokens/classes as a mapping layer onto the app styling system.";
+    activeAuthorities.push("style bridge");
+  } else if (input.workflowMode === "brownfield-attach" && hasLocalLaw) {
+    lane = "Hybrid local law";
+    sourceAuthority = "Existing app plus accepted project-owned UI law are authoritative.";
+    styleAuthority = "Use project-owned components, tokens, classes, and accepted local rules.";
+  } else if (input.workflowMode?.startsWith("greenfield")) {
+    lane = input.workflowMode === "greenfield-contract-only" ? "Greenfield contract-only" : "Greenfield scaffold";
+    sourceAuthority = "Essence V4 and generated context are authoritative.";
+    styleAuthority = input.adoptionMode === "contract-only" ? "Use the project-chosen styling system." : "Use Decantr CSS where generated by the adapter.";
+  }
+  if (hasLocalLaw) activeAuthorities.push("accepted local patterns/rules");
+  if (input.hasPackManifest) activeAuthorities.push("hosted execution packs as guidance");
+  const framework = detected.framework ?? "unknown";
+  const runtimeBoundary = `Detected ${framework}; do not introduce another frontend runtime inside this route unless the task is explicitly a reviewed migration or isolated integration plan.`;
+  const warnings = [];
+  const task = input.taskSummary;
+  const runtimeTerms = [
+    "angular",
+    "vue",
+    "svelte",
+    "solid",
+    "nextjs",
+    "next.js",
+    "react",
+    "bootstrap",
+    "shadcn"
+  ];
+  const compatibleMentions = /* @__PURE__ */ new Set();
+  if (framework === "nextjs") compatibleMentions.add("react");
+  if (framework === "react") compatibleMentions.add("react");
+  if (framework === "vue" || framework === "nuxt") compatibleMentions.add("vue");
+  for (const term of runtimeTerms) {
+    if (!mentionsWord(task, term)) continue;
+    if (term === framework || compatibleMentions.has(term)) continue;
+    if ((term === "nextjs" || term === "next.js") && framework === "nextjs") continue;
+    if (term === "shadcn" || term === "bootstrap") {
+      warnings.push(
+        `Requested ${term} should be treated as optional Hybrid guidance unless this project already owns that library or the task explicitly adopts it.`
+      );
+      continue;
+    }
+    warnings.push(
+      `Task mentions ${term}, but the detected runtime is ${framework}. Prefer a dry-run plan or local pattern mapping before adding cross-runtime code.`
+    );
+  }
+  if (input.adoptionMode !== "decantr-css" && (/@decantr\/css/i.test(task) || /\bdecantr css\b/i.test(task) || /\bd-[a-z0-9-]+/i.test(task))) {
+    warnings.push(
+      "This project is not in decantr-css adoption mode. Do not add @decantr/css or d-* classes unless the user explicitly changes adoption mode."
+    );
+  }
+  return { lane, sourceAuthority, styleAuthority, activeAuthorities, runtimeBoundary, warnings };
+}
 async function cmdTaskWorkflow(args) {
   const { flags, positional } = parseLooseArgs(args);
   const workspaceInfo = resolveWorkflowProject(flags, "task");
@@ -10657,6 +10914,7 @@ async function cmdTaskWorkflow(args) {
   const page = section?.pages.find((entry) => entry.id === target.page);
   const contextDir = join31(workspaceInfo.appRoot, ".decantr", "context");
   const manifest = readJsonIfPresent(join31(contextDir, "pack-manifest.json"));
+  const projectJson = readJsonIfPresent(join31(workspaceInfo.appRoot, ".decantr", "project.json"));
   const pagePack = manifest?.pages?.find((entry) => entry.id === target.page);
   const sectionPack = manifest?.sections?.find((entry) => entry.id === target.section);
   const visualManifest = readJsonIfPresent(join31(workspaceInfo.appRoot, ".decantr", "evidence", "visual-manifest.json"));
@@ -10672,6 +10930,15 @@ async function cmdTaskWorkflow(args) {
   const changedSince = flagString(flags, "since");
   const currentChangedFiles = changedFiles(workspaceInfo.appRoot, changedSince);
   const changedRoutes = routeImpacts(workspaceInfo.appRoot, currentChangedFiles);
+  const authority = createTaskAuthoritySummary({
+    projectRoot: workspaceInfo.appRoot,
+    workflowMode: projectJson?.initialized?.workflowMode ?? null,
+    adoptionMode: projectJson?.initialized?.adoptionMode ?? null,
+    hasLocalPatterns: existsSync29(localPatternPackPath),
+    hasLocalRules: existsSync29(localRuleManifestPath),
+    hasPackManifest: Boolean(manifest),
+    taskSummary
+  });
   const context = {
     route,
     task: taskSummary || null,
@@ -10689,6 +10956,7 @@ async function cmdTaskWorkflow(args) {
       existsSync29(localRuleManifestPath) ? displayProjectPath(workspaceInfo, ".decantr/rules.json") : null
     ].filter(Boolean),
     screenshot: screenshot?.startsWith(".decantr/") ? displayProjectPath(workspaceInfo, screenshot) : screenshot ?? null,
+    authority,
     localLaw: displayedLocalLaw,
     changedFiles: currentChangedFiles,
     changedRoutes,
@@ -10714,6 +10982,16 @@ async function cmdTaskWorkflow(args) {
     console.log(`${BOLD9}Visual evidence:${RESET16}`);
     console.log(`  ${cyan3(context.screenshot)}`);
   }
+  console.log("");
+  console.log(`${BOLD9}Authority for this task:${RESET16}`);
+  console.log(`  Lane: ${context.authority.lane}`);
+  console.log(`  Source: ${context.authority.sourceAuthority}`);
+  console.log(`  Style: ${context.authority.styleAuthority}`);
+  console.log(`  Active: ${context.authority.activeAuthorities.join(", ")}`);
+  console.log(`  Runtime: ${context.authority.runtimeBoundary}`);
+  for (const warning of context.authority.warnings) {
+    console.log(`  ${YELLOW12}Boundary:${RESET16} ${warning}`);
+  }
   if (context.localLaw.patternCount > 0 || context.localLaw.ruleCount > 0) {
     console.log("");
     console.log(`${BOLD9}Project-owned local law:${RESET16}`);
@@ -10752,7 +11030,7 @@ async function cmdTaskWorkflow(args) {
   console.log("");
   console.log(`${BOLD9}LLM instruction:${RESET16}`);
   console.log(
-    "  Preserve the existing runtime and styling system. Use the route pack, section context, local laws, changed-file impact, and visual evidence above as the task contract before changing code."
+    "  Preserve the active authority above. Use the route pack, section context, local laws, changed-file impact, and visual evidence as the task contract before changing code."
   );
   console.log(`  After editing, run ${cyan3(context.verifyCommand)}.`);
 }
@@ -10785,6 +11063,11 @@ async function cmdCodifyWorkflow(args) {
     if (result2.rulesAcceptedPath) {
       console.log(success3(`Accepted local rule manifest: ${result2.rulesAcceptedPath}`));
     }
+    console.log(
+      dim3(
+        "Hybrid local law is now active: Decantr will treat accepted local patterns and rules as project-owned authority in task and verify flows."
+      )
+    );
     console.log(
       dim3(
         `Run \`${withProject("decantr verify --brownfield --local-patterns", projectArg)}\` after project edits.`
@@ -10808,12 +11091,14 @@ async function cmdCodifyWorkflow(args) {
   console.log(success3(`Wrote local rule proposal: ${result.rulesPath}`));
   if (fromAudit) {
     console.log(
-      dim3("Proposal includes source-derived component candidates and starter mechanical rules.")
+      dim3(
+        "Proposal includes source-derived component candidates, starter mechanical rules, and Hybrid authority guidance."
+      )
     );
   }
   console.log(
     dim3(
-      `Review both files, add real component paths/token recipes, then run \`${withProject("decantr codify --accept", projectArg)}\`.`
+      `Review both files, add real component paths/token recipes, map hosted pattern ideas into project-owned law, then run \`${withProject("decantr codify --accept", projectArg)}\`.`
     )
   );
 }

package/dist/index.js

@@ -1,4 +1,4 @@
-import "./chunk-66L74ZNJ.js";
+import "./chunk-HQUTNZKF.js";
 import "./chunk-IQZCIMQJ.js";
 import "./chunk-QDMXZSVK.js";
 import "./chunk-WPP3JEMC.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decantr/cli",
-  "version": "2.9.7",
+  "version": "2.10.0",
   "description": "Decantr CLI - scaffold, audit, inspect Project Health, and maintain Decantr projects from the terminal",
   "keywords": [
     "decantr",
@@ -49,10 +49,10 @@
   "dependencies": {
     "ajv": "^8.20.0",
     "@decantr/core": "2.1.0",
-    "@decantr/registry": "2.2.0",
-    "@decantr/verifier": "2.3.3",
     "@decantr/essence-spec": "2.0.1",
-    "@decantr/telemetry": "2.2.1"
+    "@decantr/registry": "2.2.0",
+    "@decantr/telemetry": "2.2.1",
+    "@decantr/verifier": "2.3.3"
   },
   "scripts": {
     "build": "tsup",