aienvmp 0.1.59 → 0.1.61

package/BUGFIXES.md

@@ -4,6 +4,12 @@ Short record of bugs, fixes, and follow-up checks.
 
 ## 2026-07-08
 
+### GitHub Action hid strict-plan guidance inside artifacts
+
+- Issue: the Action produced `doctor.json` and `summary.md`, but the recommended local/CI strict commands were not visible as a dedicated Step Summary block.
+- Fix: the Action now appends an `aienvmp strict plan` section sourced from advisory doctor metadata, using a temporary payload when `write-doctor-json` is disabled.
+- Verification: Action regression tests check the strict-plan block, `strictPlan` source, CI command, and temporary-file fallback.
+
 ### CLI version was hardcoded
 
 - Issue: `npm run smoke` printed `0.1.0` after the package version changed.
@@ -148,6 +154,12 @@ Short record of bugs, fixes, and follow-up checks.
 - Fix: `aiDependencyReview` now includes `statusReason` and `securityConfidence`, and generation reuses the computed risk summary instead of recalculating a weaker review signal.
 - Verification: regression tests cover scanner-off confidence, dashboard/summary rendering, schema metadata, and standalone SBOM fallback behavior; local sync smoke confirmed `scanner-off` appears in generated artifacts.
 
+### Strict mode guidance required too much inference
+
+- Issue: AI and CI consumers could see scoped strict results, but still had to infer which `doctor --strict` command should be used without disrupting local operation.
+- Fix: `strictPlan` now provides local advisory command, recommended strict scope, CI command, all-scope command, scope statuses, and the strict-use rule.
+- Verification: regression tests cover enforcement advice, doctor JSON, status/context, summary, dashboard, and schema outputs; local sync smoke confirmed summary emits the CI strict command.
+
 ## Template
 
 ### Title

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.1.61
+
+- Added an `aienvmp strict plan` block to the GitHub Action Step Summary.
+- Reused advisory `doctor --json` data so CI can show local and strict commands without forcing failure.
+- Preserved `write-doctor-json: false` by using a temporary advisory doctor payload when only the summary needs strict guidance.
+- Documented the Action Step Summary strict-plan surface in the README.
+- Added regression coverage for the Action strict-plan summary contract.
+
+## 0.1.60
+
+- Added `enforcement.strictPlan` to help AI agents and CI choose the narrowest explicit strict scope.
+- Added `preflight.enforcementProfile.strictPlan` so status/context consumers see the same strict guidance.
+- Added CI strict command output to `.aienvmp/summary.md`.
+- Added strict-plan CI command and rule display to the dashboard Enforcement Mode card.
+- Documented strict-plan consumption in `schema --json` and README.
+- Added regression tests for enforcement advice, doctor JSON, status/context, summary, dashboard, and schema outputs.
+
 ## 0.1.59
 
 - Added `aiDependencyReview.statusReason` so AI agents can distinguish actual review risk from scanner-off uncertainty.

package/README.md

@@ -98,6 +98,7 @@ aienvmp doctor --strict security|policy|coordination|all
 ## CI
 
 The GitHub Action writes status, summary, schema, doctor, plan, SBOM, and dashboard artifacts. `strict: "off"` reports warnings without failing the job.
+The Step Summary includes an `aienvmp strict plan` block so humans and AI agents can pick the narrowest CI strict scope without parsing the full artifacts.
 
 ```yaml
 - uses: soovwv/aienvmp@main

package/action.yml

@@ -91,6 +91,38 @@ runs:
           fi
         fi
 
+    - name: Append strict plan summary
+      shell: bash
+      run: |
+        if [ "${{ inputs.write-summary }}" = "true" ] && [ -n "$GITHUB_STEP_SUMMARY" ]; then
+          mkdir -p "${{ inputs.directory }}/.aienvmp"
+          plan_source="${{ inputs.directory }}/.aienvmp/doctor.json"
+          if [ ! -f "$plan_source" ]; then
+            plan_source="$(mktemp)"
+            node "$GITHUB_ACTION_PATH/bin/aienvmp.js" doctor --dir "${{ inputs.directory }}" --json > "$plan_source"
+          fi
+          node - "$plan_source" "$GITHUB_STEP_SUMMARY" <<'NODE'
+        const fs = require("node:fs");
+
+        const [doctorPath, summaryPath] = process.argv.slice(2);
+        const doctor = JSON.parse(fs.readFileSync(doctorPath, "utf8"));
+        const plan = doctor.enforcement?.strictPlan || {};
+        const local = plan.localDefault || "aienvmp doctor --json";
+        const ci = plan.ciCommand || "aienvmp doctor --strict all --json";
+        const rule = plan.rule || "Strict failure is explicit only.";
+
+        fs.appendFileSync(summaryPath, [
+          "",
+          "## aienvmp strict plan",
+          "",
+          `- local: \`${local}\``,
+          `- ci: \`${ci}\``,
+          `- rule: ${rule}`,
+          ""
+        ].join("\n"));
+        NODE
+        fi
+
     - name: Doctor
       shell: bash
       run: |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aienvmp",
-  "version": "0.1.59",
+  "version": "0.1.61",
   "description": "AI-first environment maps and lightweight runtime SBOMs for shared development machines.",
   "type": "module",
   "bin": {

package/src/commands/summary.js

@@ -56,6 +56,7 @@ export function renderSummary(status = {}, manifest = {}) {
   const aiSignals = toList(aiReadiness.signals).slice(0, 5);
   const aiNext = aiReadiness.next || "Run aienvmp context --json for details.";
   const aiDependencyReview = manifest.lightSbom?.aiDependencyReview || {};
+  const strictPlan = status.enforcementProfile?.strictPlan || status.enforcement?.strictPlan || {};
 
   return [
     "# aienvmp summary",
@@ -66,6 +67,7 @@ export function renderSummary(status = {}, manifest = {}) {
     `- AI safe local work: ${toList(aiReadiness.safeProjectLocalActions)[0] || "read artifacts and avoid environment changes until reviewed"}`,
     `- AI read first: ${readFirst}, then ${detail}`,
     `- mode: advisory by default; strict is opt-in with ${strict}`,
+    `- CI strict: ${strictPlan.ciCommand || `${strict} --json`}`,
     "",
     `- state: ${status.state || "unknown"}`,
     `- workspace: ${workspace}`,

package/src/contract.js

@@ -29,7 +29,7 @@ export function schemaContract() {
       },
       context: {
         command: "aienvmp context --json",
-        rootFields: ["status", "preflight", "aiReadiness", "coordination", "agentPointers", "decision", "recommendedActions", "workspace", "dependencySnapshot", "lightSbom", "warnings"]
+        rootFields: ["status", "preflight", "aiReadiness", "coordination", "agentPointers", "decision", "enforcement", "recommendedActions", "workspace", "dependencySnapshot", "lightSbom", "warnings"]
       },
       handoff: {
         command: "aienvmp handoff --json",
@@ -55,7 +55,8 @@ export function schemaContract() {
       stability: "additive",
       consumerRule: "Ignore unknown fields. Do not require optional fields unless listed in requiredFields.",
       localBehavior: "read-only; this command does not scan, install, update, or lock anything.",
-      aiReadinessRule: "When aiReadiness.level is review, project-local code work may still continue if aiReadiness.projectLocalWork is allowed; environment changes should follow intent/review guidance."
+      aiReadinessRule: "When aiReadiness.level is review, project-local code work may still continue if aiReadiness.projectLocalWork is allowed; environment changes should follow intent/review guidance.",
+      strictPlanRule: "Use enforcement.strictPlan or preflight.enforcementProfile.strictPlan to choose the narrowest explicit strict scope for CI."
     }
   };
 }

package/src/enforcement.js

@@ -33,6 +33,7 @@ export function enforcementAdvice(warnings = []) {
     gate: enforcementGate(""),
     suggestedStrictScopes,
     scopes: scopeResults,
+    strictPlan: strictScopePlan(suggestedStrictScopes, scopeResults),
     recommendedCommand: suggestedStrictScopes.length
       ? `aienvmp doctor --strict ${suggestedStrictScopes[0]}`
       : "aienvmp doctor --strict all",
@@ -40,6 +41,26 @@ export function enforcementAdvice(warnings = []) {
   };
 }
 
+export function strictScopePlan(suggestedStrictScopes = [], scopeResults = []) {
+  const firstScope = suggestedStrictScopes[0] || "all";
+  return {
+    mode: "advisory-local-strict-ci",
+    localDefault: "aienvmp doctor --json",
+    recommendedStrictScope: firstScope,
+    recommendedStrictCommand: `aienvmp doctor --strict ${firstScope}`,
+    ciCommand: `aienvmp doctor --strict ${firstScope} --json`,
+    allScopesCommand: "aienvmp doctor --strict all --json",
+    scopeStatuses: scopeResults.map((item) => ({
+      scope: item.scope,
+      status: item.status,
+      matchedWarningCodes: item.matchedWarningCodes || []
+    })),
+    rule: suggestedStrictScopes.length
+      ? "Use the narrowest failing strict scope first; keep local operation advisory unless CI or the user explicitly requests failure."
+      : "No scope currently fails; use --strict all only for explicit CI health checks."
+  };
+}
+
 export function enforcementGate(scope = "") {
   const strictScope = normalizeStrictScope(scope);
   return {

package/src/preflight.js

@@ -36,6 +36,7 @@ export function buildPreflight(manifest = {}, warnings = [], intents = [], timel
       gate: enforcementGate(""),
       reason: "Avoid disrupting shared servers or developer machines while still making drift visible.",
       recommendedStrictCommand: enforcement.recommendedCommand,
+      strictPlan: enforcement.strictPlan,
       strictCommands: [
         "aienvmp doctor --strict security",
         "aienvmp doctor --strict policy",

package/src/render.js

@@ -473,7 +473,8 @@ const ciReadinessHtml=ciReadiness.length?'<table>'+ciReadiness.map(s=>\`<tr><th>
 const enforcementProfile=manifest.preflight?.enforcementProfile||{};
 const strictCommands=enforcementProfile.strictCommands||[];
 const gate=enforcementProfile.gate||{};
-const enforcementHtml=\`<table><tr><th>Default</th><td><code>\${esc(gate.defaultMode||enforcementProfile.defaultMode||'advisory')}</code> \${esc(gate.localDefault||'warn-only')}</td></tr><tr><th>Strict</th><td><code>\${esc(gate.strictMode||'off')}</code></td></tr><tr><th>Fail</th><td>\${esc(gate.failCondition||'never in default mode')}</td></tr><tr><th>Exit</th><td>\${esc(gate.exitCode||'0 unless the command itself errors')}</td></tr><tr><th>Recommended</th><td><code>\${esc(enforcementProfile.recommendedStrictCommand||'aienvmp doctor --strict all')}</code></td></tr></table><div class="timeline">\${strictCommands.slice(0,4).map(cmd=>\`<div class="event"><time>CI</time><div><code>\${esc(cmd)}</code></div></div>\`).join('')}</div><div class="path">\${esc(gate.rule||enforcementProfile.reason||'Warnings stay advisory unless strict mode is requested.')}</div>\`;
+const strictPlan=enforcementProfile.strictPlan||{};
+const enforcementHtml=\`<table><tr><th>Default</th><td><code>\${esc(gate.defaultMode||enforcementProfile.defaultMode||'advisory')}</code> \${esc(gate.localDefault||'warn-only')}</td></tr><tr><th>Strict</th><td><code>\${esc(gate.strictMode||'off')}</code></td></tr><tr><th>Fail</th><td>\${esc(gate.failCondition||'never in default mode')}</td></tr><tr><th>Exit</th><td>\${esc(gate.exitCode||'0 unless the command itself errors')}</td></tr><tr><th>Recommended</th><td><code>\${esc(strictPlan.recommendedStrictCommand||enforcementProfile.recommendedStrictCommand||'aienvmp doctor --strict all')}</code></td></tr><tr><th>CI</th><td><code>\${esc(strictPlan.ciCommand||'aienvmp doctor --strict all --json')}</code></td></tr></table><div class="timeline">\${strictCommands.slice(0,4).map(cmd=>\`<div class="event"><time>CI</time><div><code>\${esc(cmd)}</code></div></div>\`).join('')}</div><div class="path">\${esc(strictPlan.rule||gate.rule||enforcementProfile.reason||'Warnings stay advisory unless strict mode is requested.')}</div>\`;
 const contract=manifest.preflight?.contract||{};
 const contractHtml=contract.name?\`<table><tr><th>Name</th><td><code>\${esc(contract.name)}</code></td></tr><tr><th>Version</th><td><code>\${esc(contract.version||1)}</code></td></tr><tr><th>Stability</th><td><code>\${esc(contract.stability||'additive')}</code></td></tr><tr><th>AI fields</th><td>\${esc((contract.aiEntryFields||[]).join(', ')||'none')}</td></tr></table><div class="path">\${esc(contract.rule||'Ignore unknown fields.')}</div>\`:'<div class="okline">Run <code>aienvmp status --write</code> to include AI contract metadata.</div>';
 const intentTargets=manifest.preflight?.intentTargets||[];