aienvmp 0.1.40 → 0.1.42

package/BUGFIXES.md

@@ -34,6 +34,12 @@ Short record of bugs, fixes, and follow-up checks.
 - Fix: npm and Python security summaries now include fix versions and advisory references when scanners provide them.
 - Verification: parser tests cover npm remediation objects and pip-audit advisory ids; Windows and macOS tarball tests completed `sync --security`.
 
+### Advisory doctor behavior needed clearer verification
+
+- Issue: `doctor` warnings can look like failures to AI/CI consumers even though local operation should stay non-blocking by default.
+- Fix: `doctor --json` now exposes `exitBehavior`, and enforcement gate metadata explains when strict mode sets a failure exit code.
+- Verification: Windows and macOS candidate smoke checks confirmed default `doctor --json` exits successfully while `doctor --strict policy --json` fails on matching policy warnings.
+
 ## Template
 
 ### Title

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.1.42
+
+- Added explicit enforcement gate metadata so AI and CI consumers know local checks are warn-only unless `--strict` or `--ci` is requested.
+- Added `doctor --json` exit behavior metadata to distinguish advisory warnings from strict failure conditions.
+- Surfaced enforcement gate details in context, plan, and dashboard outputs.
+- Extended the GitHub Action to write `.aienvmp/schema.json` and `.aienvmp/doctor.json` artifacts by default.
+- Clarified README guidance for advisory-by-default behavior and opt-in strict/CI failure.
+- Documented advisory doctor exit behavior and strict verification steps in troubleshooting and bugfix notes.
+
+## 0.1.41
+
+- Added preflight contract metadata so AI and CI consumers can rely on stable entry fields while ignoring additive changes.
+- Added `aienvmp schema --json` to print the stable AI-readable output contract without scanning a workspace.
+- Exposed coordination summaries at the root of `context --json` and `handoff --json`, with a human-readable handoff section.
+- Added light SBOM source, confidence, and limitation hints so agents know what the lightweight snapshot does and does not prove.
+- Updated the README with the schema command and light SBOM verification boundary while keeping the quick-start compact.
+- Added an AI Contract dashboard card so humans can review the same stable fields that agents consume.
+
 ## 0.1.40
 
 - Added dependency handoff summaries so the next AI receives dependency read-set and protocol guidance directly in `handoff`.

package/README.md

@@ -16,6 +16,7 @@ It helps Codex, Claude, Gemini, and humans avoid silent runtime, package manager
 npx aienvmp sync
 npx aienvmp status
 npx aienvmp context --json
+npx aienvmp schema --json
 ```
 
 Before environment changes:
@@ -27,6 +28,7 @@ npx aienvmp handoff --record --actor agent:codex
 ```
 
 Use `--dir <workspace>` when AI or CI runs outside the target project.
+Warnings are advisory by default. Use `doctor --strict <scope>` only when you want CI-style failure.
 
 ## What It Creates
 
@@ -43,11 +45,14 @@ AIENV.md                 # Markdown env map for AI agents
 ## AI Contract
 
 - `status`, `context`, `plan`, and `handoff` share one preflight contract.
+- `schema --json` prints the stable AI-readable output contract without scanning.
 - `status.json.nextAgent` tells the next AI what to read and whether to review first.
 - `dependencyReadSet` lists manifests and lockfiles before package or security changes.
 - `coordination.conflictTargets` shows where multiple agents are planning changes.
 - `handoff` carries dependency read-set and protocol guidance for the next AI.
-- Everything is advisory by default; strict failure is opt-in with `doctor --strict`.
+- Light SBOM includes source/confidence hints; verify security claims with dedicated scanners.
+- `enforcementProfile.gate` explains when checks warn, fail, and set exit codes.
+- Everything is advisory by default; strict failure is opt-in with `doctor --strict` or `--ci`.
 
 ## Agent Files
 
@@ -65,6 +70,7 @@ npx aienvmp snippet gemini
 aienvmp sync                    # update env map, status, ledger, dashboard
 aienvmp status --write          # refresh compact AI status
 aienvmp context --json          # AI decision contract
+aienvmp schema --json           # stable output contract for AI/CI consumers
 aienvmp plan --write            # read-only action plan
 aienvmp handoff --record        # next-agent summary
 aienvmp intent                  # record planned env change
@@ -74,6 +80,8 @@ aienvmp doctor --strict security|policy|coordination|all
 
 ## CI
 
+The GitHub Action writes status, schema, doctor, plan, and dashboard artifacts. `strict: "off"` reports warnings without failing the job.
+
 ```yaml
 - uses: soovwv/aienvmp@main
   with:

package/TROUBLESHOOTING.md

@@ -101,3 +101,33 @@ Then retry:
 ```bash
 npx aienvmp context
 ```
+
+## Doctor shows warnings but exits successfully
+
+Symptom:
+
+```text
+npx aienvmp doctor --json
+# status: warning
+# exit code: 0
+```
+
+Cause:
+
+- Local checks are advisory by default so shared machines are not blocked unexpectedly.
+
+Fail CI explicitly:
+
+```bash
+npx aienvmp doctor --strict policy
+npx aienvmp doctor --strict security
+npx aienvmp doctor --strict coordination
+```
+
+Check the machine-readable rule:
+
+```bash
+npx aienvmp doctor --json
+```
+
+Read `exitBehavior` and `strict.gate` to see when a failure exit code will be set.

package/action.yml

@@ -19,6 +19,14 @@ inputs:
     description: Write compact AI status artifact
     required: false
     default: "true"
+  write-schema:
+    description: Write stable AI output contract artifact
+    required: false
+    default: "true"
+  write-doctor-json:
+    description: Write doctor JSON with advisory/strict exit behavior
+    required: false
+    default: "true"
 
 runs:
   using: composite
@@ -41,6 +49,22 @@ runs:
           node "$GITHUB_ACTION_PATH/bin/aienvmp.js" status --dir "${{ inputs.directory }}" --write --quiet
         fi
 
+    - name: Write AI schema
+      shell: bash
+      run: |
+        if [ "${{ inputs.write-schema }}" = "true" ]; then
+          mkdir -p "${{ inputs.directory }}/.aienvmp"
+          node "$GITHUB_ACTION_PATH/bin/aienvmp.js" schema --json > "${{ inputs.directory }}/.aienvmp/schema.json"
+        fi
+
+    - name: Write doctor advisory JSON
+      shell: bash
+      run: |
+        if [ "${{ inputs.write-doctor-json }}" = "true" ]; then
+          mkdir -p "${{ inputs.directory }}/.aienvmp"
+          node "$GITHUB_ACTION_PATH/bin/aienvmp.js" doctor --dir "${{ inputs.directory }}" --json > "${{ inputs.directory }}/.aienvmp/doctor.json"
+        fi
+
     - name: Doctor
       shell: bash
       run: |

package/examples/github-action.yml

@@ -14,6 +14,8 @@ jobs:
         with:
           directory: "."
           write-plan: "true"
+          write-schema: "true"
+          write-doctor-json: "true"
           strict: "off" # security, policy, coordination, all, or off
 
       - uses: actions/upload-artifact@v4
@@ -24,6 +26,8 @@ jobs:
             AIENV.md
             .aienvmp/manifest.json
             .aienvmp/status.json
+            .aienvmp/schema.json
+            .aienvmp/doctor.json
             .aienvmp/plan.json
             .aienvmp/plan.md
             .aienvmp/dashboard.html

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aienvmp",
-  "version": "0.1.40",
+  "version": "0.1.42",
   "description": "AI-first environment maps and lightweight runtime SBOMs for shared development machines.",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -13,6 +13,7 @@ import { snippetWorkspace } from "./commands/snippet.js";
 import { handoffWorkspace } from "./commands/handoff.js";
 import { planWorkspace } from "./commands/plan.js";
 import { statusWorkspace } from "./commands/status.js";
+import { schemaWorkspace } from "./commands/schema.js";
 import { readFileSync } from "node:fs";
 
 const commands = new Map([
@@ -30,7 +31,8 @@ const commands = new Map([
   ["snippet", snippetWorkspace],
   ["handoff", handoffWorkspace],
   ["plan", planWorkspace],
-  ["status", statusWorkspace]
+  ["status", statusWorkspace],
+  ["schema", schemaWorkspace]
 ]);
 
 const version = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
@@ -107,6 +109,7 @@ Usage:
   aienvmp status [--dir .] [--json] [--write] [--quiet]
   aienvmp handoff [--dir .] [--json] [--record --actor agent:id]
   aienvmp plan [--dir .] [--json] [--write]
+  aienvmp schema [--json]
 
 Common:
   aienvmp sync      update AIENV.md, manifest, status, ledger, intents, and dashboard
@@ -114,6 +117,7 @@ Common:
   aienvmp context   print the AI preflight brief
   aienvmp handoff   print the next-agent handoff summary
   aienvmp plan      print a read-only AI environment action plan
+  aienvmp schema    print the stable AI-readable output contract
   aienvmp snippet   print an AGENTS.md pointer snippet
   aienvmp dash      regenerate/open the lightweight dashboard
 

package/src/commands/context.js

@@ -26,6 +26,7 @@ export async function contextWorkspace(args) {
     console.log(JSON.stringify({
       status: warnings.length ? "review-required" : "clear",
       preflight,
+      coordination: preflight.coordination,
       decision,
       enforcement: enforcementAdvice(warnings),
       recommendedActions: actions,
@@ -49,7 +50,7 @@ export async function contextWorkspace(args) {
     }, null, 2));
     return;
   }
-  console.log(renderContext(manifest, timeline, warnings, intents, policy, actions));
+  console.log(renderContext({ ...manifest, preflight }, timeline, warnings, intents, policy, actions));
 }
 
 function lightSbomSummary(lightSbom = {}) {
@@ -73,6 +74,9 @@ function lightSbomSummary(lightSbom = {}) {
       guidance: "No lockfile policy detected."
     },
     dependencyChangeHints: (lightSbom.dependencyChangeHints || []).slice(0, 8),
+    source: lightSbom.source || {},
+    confidence: lightSbom.confidence || {},
+    limitations: lightSbom.limitations || [],
     aiUse: lightSbom.aiUse || {}
   };
 }

package/src/commands/doctor.js

@@ -18,9 +18,18 @@ export async function doctorWorkspace(args) {
   const warnings = [...diagnose(manifest, { timeline, intents }), ...policyWarnings(manifest, policy)];
   const actions = recommendedActions(manifest, { warnings, intents });
   const strict = strictResult(warnings, args);
+  const exitBehavior = {
+    mode: strict.enabled ? "strict" : "advisory",
+    willSetFailureExitCode: strict.fail,
+    reason: strict.enabled
+      ? `strict scope ${strict.scope} is enabled`
+      : "strict mode is off; warnings are reported without failing local operation",
+    gate: strict.gate
+  };
   if (args.json) {
     console.log(JSON.stringify({
       status: strict.fail ? "fail" : warnings.length ? "warning" : "ok",
+      exitBehavior,
       trust: manifest.trust || {},
       policy,
       openIntentCount: intents.length,

package/src/commands/handoff.js

@@ -62,6 +62,7 @@ export function buildHandoff(manifest, timeline = [], warnings = [], intents = [
     inventory: inventorySummary(manifest.inventory),
     security: securitySummary(manifest.security),
     dependencyHandoff: dependencyHandoffSummary(preflight),
+    coordination: preflight.coordination,
     policy: {
       node: policy.node || "not set",
       python: policy.python || "not set",

package/src/commands/schema.js

@@ -0,0 +1,16 @@
+import { schemaContract } from "../contract.js";
+
+export async function schemaWorkspace(args = {}) {
+  const schema = schemaContract();
+  if (args.json) {
+    console.log(JSON.stringify(schema, null, 2));
+  } else {
+    console.log("aienvmp contract");
+    console.log(`schema: ${schema.name} v${schema.schemaVersion}`);
+    console.log(`status: ${schema.outputs.status.command}`);
+    console.log(`context: ${schema.outputs.context.command}`);
+    console.log(`handoff: ${schema.outputs.handoff.command}`);
+    console.log(`rule: ${schema.compatibility.consumerRule}`);
+  }
+  return schema;
+}

package/src/contract.js

@@ -0,0 +1,42 @@
+export function preflightContract() {
+  return {
+    name: "aienvmp-preflight",
+    version: 1,
+    stability: "additive",
+    requiredFields: ["schemaVersion", "state", "decision", "quickstart", "commands", "artifacts"],
+    aiEntryFields: ["state", "summary", "nextAgent", "coordination", "dependencyReadSet", "dependencyChangeProtocol"],
+    rule: "Consumers should ignore unknown fields and treat missing optional fields as unavailable."
+  };
+}
+
+export function schemaContract() {
+  return {
+    schemaVersion: 1,
+    name: "aienvmp-contract",
+    purpose: "Stable AI-readable contract for aienvmp outputs.",
+    outputs: {
+      status: {
+        file: ".aienvmp/status.json",
+        command: "aienvmp status --json",
+        contract: preflightContract()
+      },
+      context: {
+        command: "aienvmp context --json",
+        rootFields: ["status", "preflight", "coordination", "decision", "recommendedActions", "workspace", "dependencySnapshot", "lightSbom", "warnings"]
+      },
+      handoff: {
+        command: "aienvmp handoff --json",
+        rootFields: ["status", "decision", "preflight", "coordination", "dependencyHandoff", "openIntents", "warnings", "recommendedActions", "recentChanges"]
+      },
+      manifest: {
+        file: ".aienvmp/manifest.json",
+        rootFields: ["schemaVersion", "workspace", "runtimes", "packageManagers", "dependencySnapshot", "lightSbom", "security", "trust"]
+      }
+    },
+    compatibility: {
+      stability: "additive",
+      consumerRule: "Ignore unknown fields. Do not require optional fields unless listed in requiredFields.",
+      localBehavior: "read-only; this command does not scan, install, update, or lock anything."
+    }
+  };
+}

package/src/dependencies.js

@@ -79,6 +79,23 @@ export function buildLightSbom(snapshot = {}, security = {}) {
     schemaVersion: 1,
     mode: "light-sbom",
     note: "AI-ready package and vulnerability summary from read-only project files and optional scanners.",
+    source: {
+      dependencies: "project manifests",
+      lockfiles: "file presence only",
+      vulnerabilities: security.enabled ? "optional scanner summary" : "not scanned",
+      resolver: "not run"
+    },
+    confidence: {
+      directDependencies: "high",
+      lockfileManager: snapshot.lockfiles?.length ? "medium" : "none",
+      transitiveDependencies: "not-resolved",
+      vulnerabilities: security.enabled ? "scanner-provided" : "not-scanned"
+    },
+    limitations: [
+      "Does not install packages.",
+      "Does not resolve full transitive dependency graphs.",
+      "Does not replace CycloneDX, SPDX, Syft, Trivy, npm audit, or pip-audit outputs."
+    ],
     summary: {
       ecosystems: countBy(packages, "ecosystem"),
       managers: countBy(packages, "manager"),
@@ -96,7 +113,8 @@ export function buildLightSbom(snapshot = {}, security = {}) {
     aiUse: {
       beforeDependencyChanges: "Read lightSbom.summary and lightSbom.topRisk before changing dependencies.",
       securityMode: security.enabled ? "scanner-summary" : "scanner-off",
-      dependencySource: "project manifests only; no install or resolver is run"
+      dependencySource: "project manifests only; no install or resolver is run",
+      trustRule: "Use lightSbom as a fast AI planning map; verify with dedicated scanners before security claims."
     }
   };
 }

package/src/enforcement.js

@@ -3,12 +3,14 @@ const STRICT_SCOPES = ["security", "policy", "coordination", "all"];
 export function strictResult(warnings = [], args = {}) {
   const scope = normalizeStrictScope(args.strict || (args.ci ? "all" : ""));
   const matchedWarnings = scope ? warnings.filter((warning) => warningMatchesScope(warning, scope)) : [];
+  const gate = enforcementGate(scope);
   return {
     enabled: Boolean(scope),
     scope: scope || "off",
     fail: matchedWarnings.length > 0,
     matchedWarningCodes: matchedWarnings.map((warning) => warning.code),
-    availableScopes: STRICT_SCOPES
+    availableScopes: STRICT_SCOPES,
+    gate
   };
 }
 
@@ -28,6 +30,7 @@ export function enforcementAdvice(warnings = []) {
     mode: "advisory-by-default",
     localBehavior: "non-blocking",
     ciBehavior: "strict-only-when-requested",
+    gate: enforcementGate(""),
     suggestedStrictScopes,
     scopes: scopeResults,
     recommendedCommand: suggestedStrictScopes.length
@@ -37,6 +40,18 @@ export function enforcementAdvice(warnings = []) {
   };
 }
 
+export function enforcementGate(scope = "") {
+  const strictScope = normalizeStrictScope(scope);
+  return {
+    defaultMode: "advisory",
+    strictMode: strictScope || "off",
+    localDefault: "warn-only",
+    failCondition: strictScope ? `matching warnings in ${strictScope}` : "never in default mode",
+    exitCode: strictScope ? "1 when matching warnings exist" : "0 unless the command itself errors",
+    rule: "Do not block local or shared machine operation unless --strict or --ci is explicitly requested."
+  };
+}
+
 function normalizeStrictScope(value) {
   if (value === true) return "all";
   const scope = String(value || "").trim().toLowerCase();

package/src/preflight.js

@@ -1,6 +1,7 @@
 import { recommendedActions } from "./actions.js";
 import { aiDecision } from "./decision.js";
-import { enforcementAdvice } from "./enforcement.js";
+import { enforcementAdvice, enforcementGate } from "./enforcement.js";
+import { preflightContract } from "./contract.js";
 
 export function buildPreflight(manifest = {}, warnings = [], intents = []) {
   const decision = aiDecision(warnings, intents);
@@ -14,6 +15,7 @@ export function buildPreflight(manifest = {}, warnings = [], intents = []) {
   const coordination = coordinationSummary(intents);
   return {
     schemaVersion: 1,
+    contract: preflightContract(),
     state,
     summary: state === "clear"
       ? "Project-local work can continue. Record intent before environment changes."
@@ -25,6 +27,7 @@ export function buildPreflight(manifest = {}, warnings = [], intents = []) {
       localOperation: "non-blocking",
       strictMode: "optional",
       strictUse: "CI or explicit human-requested checks only",
+      gate: enforcementGate(""),
       reason: "Avoid disrupting shared servers or developer machines while still making drift visible.",
       recommendedStrictCommand: enforcement.recommendedCommand,
       strictCommands: [

package/src/render.js

@@ -170,6 +170,9 @@ export function renderContext(manifest, timeline = [], warnings = [], intents =
     "Recommended actions:",
     ...(recommendedActions.length ? recommendedActions.map((item) => `- [${item.priority}] ${item.summary}${item.command ? ` (${item.command})` : ""}`) : ["- none"]),
     "",
+    "Enforcement gate:",
+    ...enforcementGateLines(manifest.preflight?.enforcementProfile?.gate),
+    "",
     "Open intents:",
     ...(intents.length ? intents.slice(-5).reverse().map((i) => `- ${i.actor}: ${i.action}`) : ["- none"]),
     "",
@@ -199,6 +202,9 @@ export function renderHandoff(handoff) {
     "Open intents:",
     ...(handoff.openIntents.length ? handoff.openIntents.map((i) => `- ${i.actor}: ${i.action}${i.target ? ` (${i.target})` : ""}`) : ["- none"]),
     "",
+    "Coordination:",
+    ...coordinationHandoffLines(handoff.coordination),
+    "",
     "Warnings:",
     ...(handoff.warnings.length ? handoff.warnings.map((w) => `- ${w.message}`) : ["- none"]),
     "",
@@ -220,6 +226,12 @@ export function renderHandoff(handoff) {
   return lines.join("\n");
 }
 
+function coordinationHandoffLines(coordination = {}) {
+  const conflicts = coordination.conflictTargets || [];
+  if (conflicts.length) return [`- Conflicts: ${conflicts.join(", ")}`, `- Next: ${coordination.next || "review open intents"}`];
+  return [`- Open intents: ${coordination.openIntentCount || 0}`, `- Next: ${coordination.next || "no open environment intents"}`];
+}
+
 function dependencyHandoffLines(dependencyHandoff = {}) {
   const readSet = dependencyHandoff.readSet || [];
   const protocol = dependencyHandoff.protocol || {};
@@ -258,6 +270,9 @@ export function renderPlan(plan) {
     "Review gates:",
     ...plan.reviewGates.map((item) => `- ${item}`),
     "",
+    "Enforcement gate:",
+    ...enforcementGateLines(plan.preflight?.enforcementProfile?.gate),
+    "",
     "Dependency protocol:",
     ...dependencyProtocolPlanLines(plan.preflight?.dependencyChangeProtocol),
     "",
@@ -285,6 +300,15 @@ function dependencyProtocolPlanLines(protocol = {}) {
   ];
 }
 
+function enforcementGateLines(gate = {}) {
+  return [
+    `- Default: ${gate.defaultMode || "advisory"} (${gate.localDefault || "warn-only"})`,
+    `- Strict: ${gate.strictMode || "off"}`,
+    `- Fail condition: ${gate.failCondition || "never in default mode"}`,
+    `- Exit code: ${gate.exitCode || "0 unless the command itself errors"}`
+  ];
+}
+
 function environmentLines(item) {
   return [
     `- ${item.category}: ${item.summary}`,
@@ -405,7 +429,10 @@ const ciHasFailure=ciReadiness.some(s=>s.status==='fail');
 const ciReadinessHtml=ciReadiness.length?'<table>'+ciReadiness.map(s=>\`<tr><th>\${esc(s.scope)}</th><td><code>\${esc(s.status)}</code>\${s.matchedWarningCodes?.length?\` \${esc(s.matchedWarningCodes.join(', '))}\`:''}</td></tr>\`).join('')+'</table>':'<div class="okline">Run <code>aienvmp doctor --strict security|policy|coordination|all</code> to choose CI enforcement scope.</div>';
 const enforcementProfile=manifest.preflight?.enforcementProfile||{};
 const strictCommands=enforcementProfile.strictCommands||[];
-const enforcementHtml=\`<table><tr><th>Default</th><td><code>\${esc(enforcementProfile.defaultMode||'advisory')}</code></td></tr><tr><th>Local</th><td>\${esc(enforcementProfile.localOperation||'non-blocking')}</td></tr><tr><th>Strict</th><td>\${esc(enforcementProfile.strictUse||'CI or explicit checks only')}</td></tr><tr><th>Recommended</th><td><code>\${esc(enforcementProfile.recommendedStrictCommand||'aienvmp doctor --strict all')}</code></td></tr></table><div class="timeline">\${strictCommands.slice(0,4).map(cmd=>\`<div class="event"><time>CI</time><div><code>\${esc(cmd)}</code></div></div>\`).join('')}</div><div class="path">\${esc(enforcementProfile.reason||'Warnings stay advisory unless strict mode is requested.')}</div>\`;
+const gate=enforcementProfile.gate||{};
+const enforcementHtml=\`<table><tr><th>Default</th><td><code>\${esc(gate.defaultMode||enforcementProfile.defaultMode||'advisory')}</code> \${esc(gate.localDefault||'warn-only')}</td></tr><tr><th>Strict</th><td><code>\${esc(gate.strictMode||'off')}</code></td></tr><tr><th>Fail</th><td>\${esc(gate.failCondition||'never in default mode')}</td></tr><tr><th>Exit</th><td>\${esc(gate.exitCode||'0 unless the command itself errors')}</td></tr><tr><th>Recommended</th><td><code>\${esc(enforcementProfile.recommendedStrictCommand||'aienvmp doctor --strict all')}</code></td></tr></table><div class="timeline">\${strictCommands.slice(0,4).map(cmd=>\`<div class="event"><time>CI</time><div><code>\${esc(cmd)}</code></div></div>\`).join('')}</div><div class="path">\${esc(gate.rule||enforcementProfile.reason||'Warnings stay advisory unless strict mode is requested.')}</div>\`;
+const contract=manifest.preflight?.contract||{};
+const contractHtml=contract.name?\`<table><tr><th>Name</th><td><code>\${esc(contract.name)}</code></td></tr><tr><th>Version</th><td><code>\${esc(contract.version||1)}</code></td></tr><tr><th>Stability</th><td><code>\${esc(contract.stability||'additive')}</code></td></tr><tr><th>AI fields</th><td>\${esc((contract.aiEntryFields||[]).join(', ')||'none')}</td></tr></table><div class="path">\${esc(contract.rule||'Ignore unknown fields.')}</div>\`:'<div class="okline">Run <code>aienvmp status --write</code> to include AI contract metadata.</div>';
 const intentTargets=manifest.preflight?.intentTargets||[];
 const intentTargetsHtml=intentTargets.length?'<div class="timeline">'+intentTargets.slice(0,5).map(t=>\`<div class="event"><time>\${esc(t.target)}</time><div><b>\${esc(t.target)}</b> \${esc(t.reason||'Record this target before environment changes.')}\${t.command?\`<div class="path">\${esc(t.command)}</div>\`:''}</div></div>\`).join('')+'</div>':'<div class="okline">No specific target recommendation. Use <code>aienvmp intent --actor agent:id --action planned-change</code>.</div>';
 const dependencyReadSet=manifest.preflight?.dependencyReadSet||[];
@@ -462,6 +489,8 @@ document.getElementById('app').innerHTML=\`
     <div style="height:14px"></div>
     \${card('AI Intent Targets','<span class="pill">'+intentTargets.length+' targets</span>',intentTargetsHtml)}
     <div style="height:14px"></div>
+    \${card('AI Contract','<span class="pill">'+(contract.stability||'additive')+'</span>',contractHtml)}
+    <div style="height:14px"></div>
     \${card('Dependency Read Set','<span class="pill">'+dependencyReadSet.length+' files</span>',dependencyReadSetHtml)}
     <div style="height:14px"></div>
     \${card('Dependency Protocol','<span class="pill">'+(dependencyProtocol.mode||'advisory')+'</span>',dependencyProtocolHtml)}
@@ -569,6 +598,10 @@ function lightSbomLines(lightSbom = {}) {
     `- Transitive or unmatched vulnerable packages: ${summary.transitiveOrUnmatchedVulnerablePackages || 0}`,
     `- Lockfiles: ${(summary.lockfiles || []).map((item) => item.file).join(", ") || "none"}`
   ];
+  if (lightSbom.source || lightSbom.confidence) {
+    lines.push(`- Source: ${lightSbom.source?.dependencies || "project manifests"}; vulnerabilities: ${lightSbom.source?.vulnerabilities || "not scanned"}`);
+    lines.push(`- Confidence: direct ${lightSbom.confidence?.directDependencies || "unknown"}; transitive ${lightSbom.confidence?.transitiveDependencies || "unknown"}`);
+  }
   if (lightSbom.packageManagerPolicy) {
     lines.push(`- Package manager policy: ${lightSbom.packageManagerPolicy.status}`);
     lines.push(`- Package manager guidance: ${lightSbom.packageManagerPolicy.guidance}`);