aienvmp 0.1.67 → 0.1.69

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## Unreleased
+
+## 0.1.69
+
+- Added `aiBootstrap` to the shared preflight surfaces so AI agents can read the shortest first-read, next-command, and local-mode hint.
+- Mirrored `aiBootstrap` in the dashboard first-read area so humans see the same AI entry hint.
+- Added the same bootstrap hint to `summary.md` so Markdown-first AI agents can start from the compact artifact.
+- Added the bootstrap hint to `AIENV.md` so the main environment map matches the JSON, summary, and dashboard entry point.
+- Added `aiBootstrap` and `nextSafeCommand` to plan JSON and the same bootstrap hint to `plan.md`.
+- Added `aiBootstrap` and `nextSafeCommand` to the standalone light SBOM artifact so dependency review starts from the same AI loop.
+- Added `aienvmp:aiBootstrap:*` properties to CycloneDX-lite output so external SBOM consumers can find the same next-step hint.
+
+## 0.1.68
+
+- Added an `aienvmp AI loop` block to the GitHub Action Step Summary using `schema.aiLoop`.
+- Kept the Action summary advisory by default while showing the same loop documented in README and `schema --json`.
+- Updated the GitHub Action example and README CI notes to mention Step Summary strict-plan and AI-loop blocks.
+- Added `doctor --json` `nextSafeCommand` so AI agents can pick one advisory next command without parsing every warning.
+- Aligned the dashboard next-command fallback with `maintenanceLoop.nextCommand` so the visual surface follows the same advisory next-step chain.
+- Added `context --json` `nextSafeCommand` so AI agents get the same one-step advisory next command in the preflight payload.
+- Added `handoff --json` `nextSafeCommand` so the next AI can resume from one root-level advisory command.
+- Added `status --json` and `.aienvmp/status.json` `nextSafeCommand` as a stable alias for the preflight next command.
+
 ## 0.1.67
 
 - Added a dashboard `First read` strip with status, first file, review targets, and local operation mode.

package/README.md

@@ -73,10 +73,15 @@ AIENV.md                 # Markdown env map for AI agents
 ## AI Contract
 
 - `status`, `context`, `plan`, and `handoff` share one additive preflight contract.
+- `aiBootstrap` gives AI the shortest read-first, next-command, and local-mode hint.
+- `AIENV.md`, `summary.md`, and `plan.md` start with the same bootstrap hint for Markdown-first agents.
+- `sbom.json` and CycloneDX-lite properties include the same bootstrap hint for dependency and security review loops.
 - `maintenanceLoop` gives AI the recurring env-management loop.
 - `sbomRisk` and `sbomReview` connect light SBOM risk to safe dependency-change steps.
 - `collaboration`, `coordination`, and `agentActivity` show multi-agent conflicts and shared targets.
 - `strictDecision` separates local warn-only checks from optional CI strict gates.
+- `status --json`, `context --json`, `handoff --json`, and `doctor --json` include `nextSafeCommand` for one advisory next step.
+- The dashboard mirrors `aiBootstrap` so humans and AI see the same first-read and next-command hint.
 - `schema --json` prints the stable machine-readable contract without scanning.
 
 ## Agent Files
@@ -118,7 +123,7 @@ aienvmp doctor --strict security|policy|coordination|all
 ## CI
 
 The GitHub Action writes status, summary, schema, doctor, plan, SBOM, and dashboard artifacts. `strict: "off"` reports warnings without failing the job.
-The Step Summary includes an `aienvmp strict plan` block so humans and AI agents can pick the narrowest CI strict scope without parsing the full artifacts.
+The Step Summary includes `aienvmp strict plan` and `aienvmp AI loop` blocks so humans and AI agents can choose CI gates and continue the same workflow without parsing full artifacts.
 
 ```yaml
 - uses: soovwv/aienvmp@main

package/action.yml

@@ -123,6 +123,36 @@ runs:
         NODE
         fi
 
+    - name: Append AI loop summary
+      shell: bash
+      run: |
+        if [ "${{ inputs.write-summary }}" = "true" ] && [ -n "$GITHUB_STEP_SUMMARY" ]; then
+          mkdir -p "${{ inputs.directory }}/.aienvmp"
+          schema_source="${{ inputs.directory }}/.aienvmp/schema.json"
+          if [ ! -f "$schema_source" ]; then
+            schema_source="$(mktemp)"
+            node "$GITHUB_ACTION_PATH/bin/aienvmp.js" schema --json > "$schema_source"
+          fi
+          node - "$schema_source" "$GITHUB_STEP_SUMMARY" <<'NODE'
+        const fs = require("node:fs");
+
+        const [schemaPath, summaryPath] = process.argv.slice(2);
+        const schema = JSON.parse(fs.readFileSync(schemaPath, "utf8"));
+        const loop = schema.aiLoop || {};
+        const steps = (loop.steps || []).slice(0, 6).map((item) => item.command).join(" -> ");
+
+        fs.appendFileSync(summaryPath, [
+          "",
+          "## aienvmp AI loop",
+          "",
+          `- mode: ${loop.localMode || "warn-only"}`,
+          `- steps: \`${steps || "aienvmp sync -> aienvmp status -> aienvmp handoff"}\``,
+          `- rule: ${loop.strictRule || "Local checks are warn-only; strict gates are explicit."}`,
+          ""
+        ].join("\n"));
+        NODE
+        fi
+
     - name: Doctor
       shell: bash
       run: |

package/examples/github-action.yml

@@ -17,7 +17,7 @@ jobs:
           write-schema: "true"
           write-doctor-json: "true"
           write-sbom: "true"
-          write-summary: "true"
+          write-summary: "true" # appends summary, strict plan, and AI loop to GitHub Step Summary
           strict: "off" # security, policy, coordination, all, or off
 
       - uses: actions/upload-artifact@v4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aienvmp",
-  "version": "0.1.67",
+  "version": "0.1.69",
   "description": "AI-first environment maps and lightweight runtime SBOMs for shared development machines.",
   "type": "module",
   "bin": {

package/src/commands/context.js

@@ -22,9 +22,12 @@ export async function contextWorkspace(args) {
   const actions = recommendedActions(manifest, { warnings, intents });
   const stepSummary = compactStepSummary(buildPlan(manifest, warnings, intents, policy));
   const preflight = buildPreflight(manifest, warnings, intents, timeline);
+  const nextSafeCommand = contextNextSafeCommand(actions, warnings, preflight);
   if (args.json) {
     console.log(JSON.stringify({
       status: warnings.length ? "review-required" : "clear",
+      nextSafeCommand,
+      aiBootstrap: preflight.aiBootstrap,
       preflight,
       aiReadiness: preflight.aiReadiness,
       collaboration: preflight.collaboration,
@@ -59,6 +62,14 @@ export async function contextWorkspace(args) {
   console.log(renderContext({ ...manifest, preflight }, timeline, warnings, intents, policy, actions));
 }
 
+function contextNextSafeCommand(actions = [], warnings = [], preflight = {}) {
+  const actionCommand = actions.find((item) => item.command)?.command;
+  return preflight.nextCommand
+    || preflight.maintenanceLoop?.nextCommand
+    || actionCommand
+    || (warnings.length ? "aienvmp plan --write" : "aienvmp status --json");
+}
+
 function lightSbomSummary(lightSbom = {}) {
   return {
     mode: lightSbom.mode || "light-sbom",

package/src/commands/doctor.js

@@ -20,6 +20,7 @@ export async function doctorWorkspace(args) {
   const actions = recommendedActions(manifest, { warnings, intents });
   const preflight = buildPreflight(manifest, warnings, intents, timeline);
   const strict = strictResult(warnings, args);
+  const nextSafeCommand = doctorNextSafeCommand(actions, warnings);
   const exitBehavior = {
     mode: strict.enabled ? "strict" : "advisory",
     willSetFailureExitCode: strict.fail,
@@ -37,6 +38,7 @@ export async function doctorWorkspace(args) {
       aiReadiness: preflight.aiReadiness,
       agentPointers: preflight.agentPointers,
       openIntentCount: intents.length,
+      nextSafeCommand,
       warnings,
       recommendedActions: actions,
       enforcement: enforcementAdvice(warnings),
@@ -63,3 +65,10 @@ export async function doctorWorkspace(args) {
     process.exitCode = 1;
   }
 }
+
+function doctorNextSafeCommand(actions = [], warnings = []) {
+  const command = actions.find((item) => item.command)?.command;
+  if (command) return command;
+  if (warnings.length) return "aienvmp plan --write";
+  return "aienvmp status --json";
+}

package/src/commands/handoff.js

@@ -49,6 +49,8 @@ export function buildHandoff(manifest, timeline = [], warnings = [], intents = [
   const preflight = buildPreflight(manifest, warnings, intents, timeline);
   return {
     status: reviewRequired ? "review-required" : "clear",
+    nextSafeCommand: preflight.nextCommand || preflight.maintenanceLoop?.nextCommand || "aienvmp status --json",
+    aiBootstrap: preflight.aiBootstrap,
     trust: manifest.trust || {},
     schemaVersion: manifest.schemaVersion || 1,
     preflight,

package/src/commands/plan.js

@@ -36,11 +36,14 @@ export async function planWorkspace(args) {
 export function buildPlan(manifest, warnings = [], intents = [], policy = {}, timeline = []) {
   const actions = recommendedActions(manifest, { warnings, intents });
   const status = warnings.length || intents.length ? "review-required" : "clear";
+  const preflight = buildPreflight(manifest, warnings, intents, timeline);
   return {
     schemaVersion: 1,
     generatedAt: new Date().toISOString(),
     status,
-    preflight: buildPreflight(manifest, warnings, intents, timeline),
+    aiBootstrap: preflight.aiBootstrap,
+    nextSafeCommand: preflight.nextSafeCommand || preflight.nextCommand,
+    preflight,
     workspace: manifest.workspace || {},
     trust: manifest.trust || {},
     decision: aiDecision(warnings, intents),

package/src/commands/sbom.js

@@ -22,6 +22,11 @@ export async function sbomWorkspace(args = {}) {
 
 export function buildSbomArtifact(manifest = {}) {
   const lightSbom = manifest.lightSbom || {};
+  const dependencyReview = lightSbom.aiDependencyReview || aiDependencyReview(lightSbom);
+  const nextSafeCommand = dependencyReview.beforeDependencyChange?.[0]
+    || lightSbom.riskSummary?.commands?.[0]
+    || "aienvmp context --json";
+  const aiBootstrap = sbomBootstrap(nextSafeCommand, dependencyReview);
   return {
     schemaVersion: 1,
     schemaName: "aienvmp.light-sbom",
@@ -36,16 +41,31 @@ export function buildSbomArtifact(manifest = {}) {
     topRisk: (lightSbom.topRisk || []).slice(0, 20),
     packageManagerPolicy: lightSbom.packageManagerPolicy || {},
     dependencyChangeHints: (lightSbom.dependencyChangeHints || []).slice(0, 20),
-    aiDependencyReview: lightSbom.aiDependencyReview || aiDependencyReview(lightSbom),
+    aiBootstrap,
+    nextSafeCommand,
+    aiDependencyReview: dependencyReview,
     aiUse: {
       purpose: "Standalone AI-readable light SBOM artifact.",
       readBefore: "Dependency changes, vulnerability remediation, release review, or shared AI handoff.",
-      nextCommand: lightSbom.riskSummary?.commands?.[0] || "aienvmp context --json",
+      nextCommand: nextSafeCommand,
       rule: "Use as a lightweight planning map; verify security claims with dedicated scanners."
     }
   };
 }
 
+function sbomBootstrap(nextSafeCommand, review = {}) {
+  return {
+    purpose: "Shortest AI entry point for dependency and SBOM review.",
+    readFirst: ".aienvmp/sbom.json",
+    detailCommand: "aienvmp context --json",
+    nextSafeCommand,
+    localMode: "advisory",
+    projectLocalWork: "allowed",
+    environmentChanges: review.status === "review" ? "review-first" : "intent-first",
+    rule: review.rule || "Read SBOM risk first; record intent before dependency or lockfile changes."
+  };
+}
+
 function aiDependencyReview(lightSbom = {}) {
   const risk = lightSbom.riskSummary || {};
   const hints = lightSbom.dependencyChangeHints || [];
@@ -97,6 +117,11 @@ export function buildCycloneDxLite(manifest = {}) {
   const snapshot = manifest.dependencySnapshot || {};
   const packages = snapshot.packages || [];
   const lightSbom = manifest.lightSbom || {};
+  const dependencyReview = lightSbom.aiDependencyReview || aiDependencyReview(lightSbom);
+  const nextSafeCommand = dependencyReview.beforeDependencyChange?.[0]
+    || lightSbom.riskSummary?.commands?.[0]
+    || "aienvmp context --json";
+  const aiBootstrap = sbomBootstrap(nextSafeCommand, dependencyReview);
   return {
     bomFormat: "CycloneDX",
     specVersion: "1.6",
@@ -121,14 +146,20 @@ export function buildCycloneDxLite(manifest = {}) {
         { name: "aienvmp:source", value: lightSbom.source?.dependencies || "project manifests" },
         { name: "aienvmp:confidence:transitiveDependencies", value: lightSbom.confidence?.transitiveDependencies || "not-resolved" },
         { name: "aienvmp:risk:level", value: lightSbom.riskSummary?.level || "clear" },
-        { name: "aienvmp:risk:score", value: String(lightSbom.riskSummary?.score || 0) }
+        { name: "aienvmp:risk:score", value: String(lightSbom.riskSummary?.score || 0) },
+        { name: "aienvmp:aiBootstrap:readFirst", value: aiBootstrap.readFirst },
+        { name: "aienvmp:aiBootstrap:detailCommand", value: aiBootstrap.detailCommand },
+        { name: "aienvmp:aiBootstrap:nextSafeCommand", value: aiBootstrap.nextSafeCommand },
+        { name: "aienvmp:aiBootstrap:localMode", value: aiBootstrap.localMode },
+        { name: "aienvmp:aiBootstrap:environmentChanges", value: aiBootstrap.environmentChanges }
       ]
     },
     components: packages.slice(0, 200).map(cycloneComponent),
     vulnerabilities: (lightSbom.topRisk || []).slice(0, 50).map(cycloneVulnerability),
     properties: [
       { name: "aienvmp:limitation", value: "Light SBOM from project manifests only; no install or dependency resolver was run." },
-      { name: "aienvmp:verifyWith", value: "CycloneDX, Syft, Trivy, npm audit, pip-audit, or another dedicated scanner before security claims." }
+      { name: "aienvmp:verifyWith", value: "CycloneDX, Syft, Trivy, npm audit, pip-audit, or another dedicated scanner before security claims." },
+      { name: "aienvmp:aiBootstrap:rule", value: aiBootstrap.rule }
     ]
   };
 }

package/src/commands/summary.js

@@ -40,10 +40,11 @@ export function renderSummary(status = {}, manifest = {}) {
   const collaboration = status.collaboration || {};
   const maintenanceLoop = status.maintenanceLoop || {};
   const sbomReview = maintenanceLoop.sbomReview || {};
+  const aiBootstrap = status.aiBootstrap || {};
   const workspace = manifest.workspace?.root || manifest.workspace?.name || ".";
-  const next = status.nextCommand || status.decision?.nextCommand || "aienvmp status";
-  const readFirst = status.nextAgent?.readFirst || ".aienvmp/status.json";
-  const detail = status.quickstart?.detailCommand || "aienvmp context --json";
+  const next = aiBootstrap.nextSafeCommand || status.nextSafeCommand || status.nextCommand || status.decision?.nextCommand || "aienvmp status";
+  const readFirst = aiBootstrap.readFirst || status.nextAgent?.readFirst || ".aienvmp/status.json";
+  const detail = aiBootstrap.detailCommand || status.quickstart?.detailCommand || "aienvmp context --json";
   const strict = status.enforcement?.recommendedCommand || "aienvmp doctor --strict all";
   const riskLevel = sbomRisk.level || "unknown";
   const riskScore = valueOrZero(sbomRisk.score);
@@ -67,11 +68,13 @@ export function renderSummary(status = {}, manifest = {}) {
     "",
     `- AI readiness: ${aiReadiness.level || "unknown"}`,
     `- AI signals: ${aiSignals.length ? aiSignals.join("; ") : "none"}`,
-    `- AI next: ${aiNext}`,
+    `- AI bootstrap: ${aiBootstrap.projectLocalWork || "allowed"} / ${aiBootstrap.environmentChanges || status.agentUse?.environmentChanges || "intent-first"} / ${aiBootstrap.localMode || "advisory"}`,
+    `- AI next: ${next} (${aiNext})`,
     `- AI collaboration: ${collaboration.status || "unknown"} / ${toList(collaboration.activeTargets).join(", ") || "none"} / ${collaboration.nextCommand || "aienvmp status --json"}`,
     `- AI maintenance loop: ${maintenanceLoop.nextCommand || next}`,
     `- AI safe local work: ${toList(aiReadiness.safeProjectLocalActions)[0] || "read artifacts and avoid environment changes until reviewed"}`,
     `- AI read first: ${readFirst}, then ${detail}`,
+    `- AI bootstrap rule: ${aiBootstrap.rule || "Read status first, use context for details, and keep local checks advisory."}`,
     `- mode: advisory by default; strict is opt-in with ${strict}`,
     `- local check: ${strictDecision.localCommand || "aienvmp doctor --json"} (${strictDecision.local || "warn-only"})`,
     `- CI strict: ${strictPlan.ciCommand || `${strict} --json`}`,

package/src/contract.js

@@ -4,7 +4,7 @@ export function preflightContract() {
     version: 1,
     stability: "additive",
     requiredFields: ["schemaVersion", "state", "decision", "quickstart", "commands", "artifacts"],
-    aiEntryFields: ["state", "summary", "aiReadiness", "collaboration", "maintenanceLoop", "nextAgent", "coordination", "agentActivity", "agentPointers", "sbomRisk", "followUps", "dependencyReadSet", "dependencyChangeProtocol"],
+    aiEntryFields: ["state", "summary", "aiBootstrap", "nextSafeCommand", "aiReadiness", "collaboration", "maintenanceLoop", "nextAgent", "coordination", "agentActivity", "agentPointers", "sbomRisk", "followUps", "dependencyReadSet", "dependencyChangeProtocol"],
     rule: "Consumers should ignore unknown fields and treat missing optional fields as unavailable."
   };
 }
@@ -32,6 +32,7 @@ export function schemaContract() {
       status: {
         file: ".aienvmp/status.json",
         command: "aienvmp status --json",
+        rootFields: ["state", "aiBootstrap", "nextCommand", "nextSafeCommand", "decision", "counts", "aiReadiness", "collaboration", "maintenanceLoop", "coordination", "agentPointers", "sbomRisk"],
         contract: preflightContract()
       },
       summary: {
@@ -41,13 +42,18 @@ export function schemaContract() {
         purpose: "Compact AI and CI step summary for quick review.",
         startsWith: ["AI readiness", "AI signals", "AI next"]
       },
+      plan: {
+        file: ".aienvmp/plan.json",
+        command: "aienvmp plan --json",
+        rootFields: ["schemaVersion", "status", "aiBootstrap", "nextSafeCommand", "preflight", "decision", "enforcement", "recommendedActions", "reviewGates", "remediationSteps", "environmentSteps"]
+      },
       context: {
         command: "aienvmp context --json",
-        rootFields: ["status", "preflight", "aiReadiness", "collaboration", "maintenanceLoop", "coordination", "agentPointers", "decision", "enforcement", "recommendedActions", "workspace", "dependencySnapshot", "lightSbom", "warnings"]
+        rootFields: ["status", "aiBootstrap", "nextSafeCommand", "preflight", "aiReadiness", "collaboration", "maintenanceLoop", "coordination", "agentPointers", "decision", "enforcement", "recommendedActions", "workspace", "dependencySnapshot", "lightSbom", "warnings"]
       },
       handoff: {
         command: "aienvmp handoff --json",
-        rootFields: ["status", "decision", "preflight", "continuation", "coordination", "dependencyHandoff", "openIntents", "warnings", "recommendedActions", "recentChanges"]
+        rootFields: ["status", "aiBootstrap", "nextSafeCommand", "decision", "preflight", "continuation", "coordination", "dependencyHandoff", "openIntents", "warnings", "recommendedActions", "recentChanges"]
       },
       manifest: {
         file: ".aienvmp/manifest.json",
@@ -56,7 +62,7 @@ export function schemaContract() {
       sbom: {
         file: ".aienvmp/sbom.json",
         command: "aienvmp sbom --json",
-        rootFields: ["schemaVersion", "schemaName", "workspace", "summary", "riskSummary", "topRisk", "packageManagerPolicy", "dependencyChangeHints", "aiDependencyReview"],
+        rootFields: ["schemaVersion", "schemaName", "workspace", "aiBootstrap", "nextSafeCommand", "summary", "riskSummary", "topRisk", "packageManagerPolicy", "dependencyChangeHints", "aiDependencyReview"],
         aiDependencyReviewFields: ["status", "statusReason", "securityConfidence", "readFirst", "reviewTargets", "beforeDependencyChange", "afterDependencyChange", "rule"]
       },
       cyclonedxLite: {

package/src/preflight.js

@@ -30,6 +30,8 @@ export function buildPreflight(manifest = {}, warnings = [], intents = [], timel
     dependencyReadSet,
     collaboration
   });
+  const nextCommand = maintenanceLoop.nextCommand || topAction?.command || decision.nextCommand;
+  const aiBootstrap = aiBootstrapSummary({ state, decision, nextCommand });
   return {
     schemaVersion: 1,
     contract: preflightContract(),
@@ -69,6 +71,7 @@ export function buildPreflight(manifest = {}, warnings = [], intents = [], timel
       projectLocalWork: decision.canContinueProjectLocalWork ? "allowed" : "review-first",
       environmentChanges: decision.canChangeEnvironmentWithoutReview ? "allowed" : "intent-and-review-first"
     },
+    aiBootstrap,
     quickstart: agentQuickstart(decision.reviewRequired),
     nextAgent: nextAgentHint(state, dependencyReadSet, dependencyChangeProtocol),
     coordination,
@@ -102,7 +105,23 @@ export function buildPreflight(manifest = {}, warnings = [], intents = [], timel
       recordIntent: intentTargets[0]?.command || "aienvmp intent --actor agent:id --action planned-change"
     },
     topAction,
-    nextCommand: maintenanceLoop.nextCommand || topAction?.command || decision.nextCommand
+    nextCommand,
+    nextSafeCommand: nextCommand
+  };
+}
+
+function aiBootstrapSummary({ state, decision, nextCommand }) {
+  return {
+    purpose: "Shortest AI entry point for this workspace environment.",
+    readFirst: ".aienvmp/status.json",
+    detailCommand: "aienvmp context --json",
+    nextSafeCommand: nextCommand || "aienvmp status --json",
+    localMode: "advisory",
+    projectLocalWork: decision.canContinueProjectLocalWork ? "allowed" : "review-first",
+    environmentChanges: decision.canChangeEnvironmentWithoutReview ? "intent-first" : "review-first",
+    rule: state === "clear"
+      ? "Continue project-local work; record intent before shared environment changes."
+      : "Review context before shared environment changes; local checks remain non-blocking."
   };
 }
 

package/src/render.js

@@ -70,10 +70,17 @@ export function renderAIEnv(manifest, timeline = [], warnings = [], intents = []
 
 function preflightLines(preflight = {}) {
   const quickstart = preflight.quickstart;
+  const aiBootstrap = preflight.aiBootstrap || {};
   const targets = preflight.intentTargets || [];
   const maintenanceLoop = preflight.maintenanceLoop || {};
   const lines = ["## 10-Second AI Flow", ""];
-  if (quickstart) {
+  if (aiBootstrap.nextSafeCommand || aiBootstrap.readFirst) {
+    lines.push(`- AI bootstrap: ${aiBootstrap.projectLocalWork || "allowed"} / ${aiBootstrap.environmentChanges || "intent-first"} / ${aiBootstrap.localMode || "advisory"}`);
+    lines.push(`- Next safe command: \`${aiBootstrap.nextSafeCommand || preflight.nextSafeCommand || preflight.nextCommand || "aienvmp status --json"}\``);
+    lines.push(`- Read first: \`${aiBootstrap.readFirst || ".aienvmp/status.json"}\``);
+    lines.push(`- Detail: \`${aiBootstrap.detailCommand || "aienvmp context --json"}\``);
+    lines.push(`- Rule: ${aiBootstrap.rule || "Read status first, use context for details, and keep local checks advisory."}`);
+  } else if (quickstart) {
     lines.push(`- Read first: \`${quickstart.readFirst}\``);
     lines.push(`- Detail: \`${quickstart.detailCommand}\``);
     lines.push(`- Before env change: \`${quickstart.beforeEnvironmentChange}\``);
@@ -288,10 +295,16 @@ function dependencyHandoffLines(dependencyHandoff = {}) {
 }
 
 export function renderPlan(plan) {
+  const aiBootstrap = plan.aiBootstrap || plan.preflight?.aiBootstrap || {};
+  const nextSafeCommand = plan.nextSafeCommand || aiBootstrap.nextSafeCommand || plan.preflight?.nextSafeCommand || plan.preflight?.nextCommand || "aienvmp status --json";
   const lines = [
     "# AI Environment Plan",
     "",
     `Status: ${plan.status}`,
+    `AI bootstrap: ${aiBootstrap.projectLocalWork || "allowed"} / ${aiBootstrap.environmentChanges || "intent-first"} / ${aiBootstrap.localMode || "advisory"}`,
+    `Next safe command: ${nextSafeCommand}`,
+    `Read first: ${aiBootstrap.readFirst || ".aienvmp/status.json"} -> ${aiBootstrap.detailCommand || "aienvmp context --json"}`,
+    `Bootstrap rule: ${aiBootstrap.rule || "Read status first, use context for details, and keep local checks advisory."}`,
     `Decision: ${plan.decision?.mode || plan.status}`,
     `Enforcement: ${plan.enforcement?.mode || "advisory-by-default"} (${plan.enforcement?.localBehavior || "non-blocking"})`,
     `Generated: ${plan.generatedAt}`,
@@ -413,7 +426,7 @@ h1,h2,h3,p{margin:0}h1{font-size:clamp(28px,4vw,46px);line-height:1.02;margin-to
 .nextbar b{color:var(--green);font-size:12px;text-transform:uppercase;letter-spacing:.08em}
 .nextbar code{display:inline-block;max-width:100%;white-space:normal;overflow-wrap:anywhere}
 .nextbar span{color:var(--muted);font-size:12px;overflow-wrap:anywhere}
-.brief{display:grid;grid-template-columns:1fr 1fr 1fr 1fr;gap:8px;margin:0 0 14px}
+.brief{display:grid;grid-template-columns:repeat(auto-fit,minmax(150px,1fr));gap:8px;margin:0 0 14px}
 .brief-item{border:1px solid var(--line2);background:rgba(9,19,16,.9);border-radius:8px;padding:10px;min-width:0}
 .brief-k{color:var(--muted);font-size:11px;font-weight:800;text-transform:uppercase;letter-spacing:.08em}
 .brief-v{margin-top:5px;font-size:13px;font-weight:700;color:var(--text);overflow-wrap:anywhere}
@@ -528,6 +541,7 @@ const activityTargets=agentActivity.targets||[];
 const activityHtml=activityTargets.length?'<div class="timeline">'+activityTargets.slice(0,5).map(a=>\`<div class="event"><time>\${esc(a.target||'env')}</time><div><b>\${esc((a.actors||[]).join(', ')||'unknown')}</b> \${esc(a.count||0)} record(s) \${a.multiActor?'<code>multi-agent</code>':'<code>single-agent</code>'}\${a.latestSummary?\`<div class="path">\${esc(a.latestSummary)}</div>\`:''}</div></div>\`).join('')+'</div><div class="path">'+esc(agentActivity.next||'Review activity before environment changes.')+'</div>':'<div class="okline">No recorded environment activity needs coordination.</div>';
 const collaboration=manifest.preflight?.collaboration||{};
 const collaborationHtml=\`<table><tr><th>Status</th><td><code>\${esc(collaboration.status||'unknown')}</code> \${esc(collaboration.mode||'advisory')}</td></tr><tr><th>Targets</th><td>\${esc((collaboration.activeTargets||[]).join(', ')||'none')}</td></tr><tr><th>Project work</th><td><code>\${esc(collaboration.projectLocalWork||'allowed')}</code></td></tr><tr><th>Env changes</th><td><code>\${esc(collaboration.environmentChanges||'intent-first')}</code></td></tr><tr><th>Next</th><td><code>\${esc(collaboration.nextCommand||'aienvmp status --json')}</code></td></tr></table><div class="timeline">\${(collaboration.reviewSignals||[]).slice(0,4).map(signal=>\`<div class="event"><time>review</time><div>\${esc(signal)}</div></div>\`).join('')}</div><div class="path">\${esc(collaboration.rule||'Record intent before shared environment changes.')}</div>\`;
+const maintenanceLoop=manifest.preflight?.maintenanceLoop||{};
 const dependencyReadSet=manifest.preflight?.dependencyReadSet||[];
 const dependencyReadSetHtml=dependencyReadSet.length?'<div class="timeline">'+dependencyReadSet.slice(0,5).map(d=>\`<div class="event"><time>\${esc(d.ecosystem||'deps')}</time><div><b>\${esc(d.manifest||'dependency files')}</b> <code>\${esc(d.manager||'unknown')}</code><div class="path">\${esc([d.manifest,...(d.lockfiles||[])].filter(Boolean).join(', '))}</div>\${d.riskPackages?.length?\`<div class="path">risk: \${esc(d.riskPackages.join(', '))}</div>\`:''}</div></div>\`).join('')+'</div>':'<div class="okline">No dependency files detected.</div>';
 const dependencyProtocol=manifest.preflight?.dependencyChangeProtocol||{};
@@ -540,6 +554,7 @@ const nextAction=reviewRequired?'Review before environment changes':'Proceed wit
 const auditItem=(key,value,hint,klass='')=>\`<div class="audit-item \${klass}"><div class="audit-k">\${key}</div><div class="audit-v">\${value}</div><div class="audit-hint">\${hint}</div></div>\`;
 const controlCard=(label,value,next,klass='')=>\`<div class="control-card \${klass}"><div class="control-label">\${label}</div><div class="control-value">\${esc(value)}</div><div class="control-next">\${esc(next)}</div></div>\`;
 const driftLabel=warnings.length?'detected':'none';
+const aiBootstrap=manifest.preflight?.aiBootstrap||{};
 const nextAgent=manifest.preflight?.nextAgent||{};
 const aiReadiness=manifest.preflight?.aiReadiness||{};
 const aiReadinessSignals=(aiReadiness.signals||[]).slice(0,3);
@@ -552,17 +567,18 @@ const sbomRiskValue=riskSummary.level||'unknown';
 const sbomRiskClass=['urgent','high','medium'].includes(sbomRiskValue)?'review':'ready';
 const sbomRiskScore=riskSummary.score!==undefined?' ('+riskSummary.score+')':'';
 const sbomRiskNext=riskSummary.next||aiDependencyReview.beforeDependencyChange?.[0]||'Run aienvmp sbom --json for dependency context.';
-const nextCommand=manifest.preflight?.nextCommand||topAction.command||collaboration.nextCommand||'aienvmp status --json';
-const nextReason=topAction.summary||collaboration.rule||riskSummary.next||'Read status/context before changing shared environment state.';
+const nextCommand=aiBootstrap.nextSafeCommand||manifest.preflight?.nextSafeCommand||manifest.preflight?.nextCommand||maintenanceLoop.nextCommand||topAction.command||collaboration.nextCommand||'aienvmp status --json';
+const nextReason=topAction.summary||aiBootstrap.rule||maintenanceLoop.rule||collaboration.rule||riskSummary.next||'Read status/context before changing shared environment state.';
 const coordination=manifest.preflight?.coordination||{};
 const conflictTargets=coordination.conflictTargets||[];
 const handoffFiles=nextAgent.dependencyFiles?.length?nextAgent.dependencyFiles:(dependencyReadSet[0]?[dependencyReadSet[0].manifest,...(dependencyReadSet[0].lockfiles||[])].filter(Boolean):[]);
 const handoffNext=nextAgent.rule||(reviewRequired?'Review warnings and open intents':'Continue project-local work');
-const firstRead=nextAgent.readFirst||'.aienvmp/status.json';
+const firstRead=aiBootstrap.readFirst||nextAgent.readFirst||'.aienvmp/status.json';
 const reviewTargets=[...new Set([...(conflictTargets||[]),...(collaboration.activeTargets||[]),...(riskSummary.reviewTargets||[])].filter(Boolean))];
-const safeMode=enforcementProfile.gate?.localDefault||enforcementProfile.localOperation||'warn-only';
+const safeMode=aiBootstrap.localMode||enforcementProfile.gate?.localDefault||enforcementProfile.localOperation||'warn-only';
+const bootstrapState=[aiBootstrap.projectLocalWork||'allowed',aiBootstrap.environmentChanges||'intent-first'].join(' / ');
 const briefItem=(key,value)=>\`<div class="brief-item"><div class="brief-k">\${key}</div><div class="brief-v">\${esc(value)}</div></div>\`;
-const handoffHtml=\`<table><tr><th>Status</th><td>\${reviewRequired?'review-required':'clear'}</td></tr><tr><th>Trust</th><td><code>\${esc(trustState)}</code></td></tr><tr><th>Read first</th><td><code>\${esc(nextAgent.readFirst||'.aienvmp/status.json')}</code></td></tr><tr><th>Dependency files</th><td>\${handoffFiles.length?'<code>'+esc(handoffFiles.join(', '))+'</code>':'none'}</td></tr><tr><th>Conflicts</th><td>\${conflictTargets.length?'<code>'+esc(conflictTargets.join(', '))+'</code>':'none'}</td></tr><tr><th>Next</th><td>\${esc(handoffNext)}</td></tr></table>\`;
+const handoffHtml=\`<table><tr><th>Status</th><td>\${reviewRequired?'review-required':'clear'}</td></tr><tr><th>Trust</th><td><code>\${esc(trustState)}</code></td></tr><tr><th>Read first</th><td><code>\${esc(firstRead)}</code></td></tr><tr><th>Dependency files</th><td>\${handoffFiles.length?'<code>'+esc(handoffFiles.join(', '))+'</code>':'none'}</td></tr><tr><th>Conflicts</th><td>\${conflictTargets.length?'<code>'+esc(conflictTargets.join(', '))+'</code>':'none'}</td></tr><tr><th>Next</th><td>\${esc(handoffNext)}</td></tr></table>\`;
 document.getElementById('app').innerHTML=\`
 <header>
   <div>
@@ -583,6 +599,7 @@ document.getElementById('app').innerHTML=\`
   <span>\${esc(nextReason)}</span>
 </section>
 <section class="brief" aria-label="First read">
+  \${briefItem('AI bootstrap',bootstrapState)}
   \${briefItem('Status',reviewRequired?'review required':'clear')}
   \${briefItem('Read first',firstRead)}
   \${briefItem('Review targets',reviewTargets.length?reviewTargets.slice(0,4).join(', '):'none')}
@@ -687,9 +704,13 @@ function formatTimeline(item) {
 }
 
 function contextLines(manifest, warnings, intents) {
+  const preflight = manifest.preflight || {};
+  const aiBootstrap = preflight.aiBootstrap || {};
   return [
     `- Status: ${warnings.length ? "review-required" : "clear"}`,
-    `- Next: ${warnings.length ? "review warnings before environment changes" : "continue with project-local work"}`,
+    `- Next: ${aiBootstrap.nextSafeCommand || preflight.nextSafeCommand || preflight.nextCommand || (warnings.length ? "review warnings before environment changes" : "continue with project-local work")}`,
+    `- Bootstrap: ${aiBootstrap.projectLocalWork || "allowed"} / ${aiBootstrap.environmentChanges || "intent-first"} / ${aiBootstrap.localMode || "advisory"}`,
+    `- Read first: ${aiBootstrap.readFirst || ".aienvmp/status.json"} -> ${aiBootstrap.detailCommand || "aienvmp context --json"}`,
     `- Node: ${manifest.runtimes.node || "not detected"}`,
     `- Python: ${manifest.runtimes.python || manifest.runtimes.python3 || "not detected"}`,
     `- Docker: ${manifest.containers.docker ? "available" : "not detected"}`,