aienvmp 0.1.68 → 0.1.69

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## Unreleased
 
+## 0.1.69
+
+- Added `aiBootstrap` to the shared preflight surfaces so AI agents can read the shortest first-read, next-command, and local-mode hint.
+- Mirrored `aiBootstrap` in the dashboard first-read area so humans see the same AI entry hint.
+- Added the same bootstrap hint to `summary.md` so Markdown-first AI agents can start from the compact artifact.
+- Added the bootstrap hint to `AIENV.md` so the main environment map matches the JSON, summary, and dashboard entry point.
+- Added `aiBootstrap` and `nextSafeCommand` to plan JSON and the same bootstrap hint to `plan.md`.
+- Added `aiBootstrap` and `nextSafeCommand` to the standalone light SBOM artifact so dependency review starts from the same AI loop.
+- Added `aienvmp:aiBootstrap:*` properties to CycloneDX-lite output so external SBOM consumers can find the same next-step hint.
+
 ## 0.1.68
 
 - Added an `aienvmp AI loop` block to the GitHub Action Step Summary using `schema.aiLoop`.

package/README.md

@@ -73,11 +73,15 @@ AIENV.md                 # Markdown env map for AI agents
 ## AI Contract
 
 - `status`, `context`, `plan`, and `handoff` share one additive preflight contract.
+- `aiBootstrap` gives AI the shortest read-first, next-command, and local-mode hint.
+- `AIENV.md`, `summary.md`, and `plan.md` start with the same bootstrap hint for Markdown-first agents.
+- `sbom.json` and CycloneDX-lite properties include the same bootstrap hint for dependency and security review loops.
 - `maintenanceLoop` gives AI the recurring env-management loop.
 - `sbomRisk` and `sbomReview` connect light SBOM risk to safe dependency-change steps.
 - `collaboration`, `coordination`, and `agentActivity` show multi-agent conflicts and shared targets.
 - `strictDecision` separates local warn-only checks from optional CI strict gates.
 - `status --json`, `context --json`, `handoff --json`, and `doctor --json` include `nextSafeCommand` for one advisory next step.
+- The dashboard mirrors `aiBootstrap` so humans and AI see the same first-read and next-command hint.
 - `schema --json` prints the stable machine-readable contract without scanning.
 
 ## Agent Files

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aienvmp",
-  "version": "0.1.68",
+  "version": "0.1.69",
   "description": "AI-first environment maps and lightweight runtime SBOMs for shared development machines.",
   "type": "module",
   "bin": {

package/src/commands/context.js

@@ -27,6 +27,7 @@ export async function contextWorkspace(args) {
     console.log(JSON.stringify({
       status: warnings.length ? "review-required" : "clear",
       nextSafeCommand,
+      aiBootstrap: preflight.aiBootstrap,
       preflight,
       aiReadiness: preflight.aiReadiness,
       collaboration: preflight.collaboration,

package/src/commands/handoff.js

@@ -50,6 +50,7 @@ export function buildHandoff(manifest, timeline = [], warnings = [], intents = [
   return {
     status: reviewRequired ? "review-required" : "clear",
     nextSafeCommand: preflight.nextCommand || preflight.maintenanceLoop?.nextCommand || "aienvmp status --json",
+    aiBootstrap: preflight.aiBootstrap,
     trust: manifest.trust || {},
     schemaVersion: manifest.schemaVersion || 1,
     preflight,

package/src/commands/plan.js

@@ -36,11 +36,14 @@ export async function planWorkspace(args) {
 export function buildPlan(manifest, warnings = [], intents = [], policy = {}, timeline = []) {
   const actions = recommendedActions(manifest, { warnings, intents });
   const status = warnings.length || intents.length ? "review-required" : "clear";
+  const preflight = buildPreflight(manifest, warnings, intents, timeline);
   return {
     schemaVersion: 1,
     generatedAt: new Date().toISOString(),
     status,
-    preflight: buildPreflight(manifest, warnings, intents, timeline),
+    aiBootstrap: preflight.aiBootstrap,
+    nextSafeCommand: preflight.nextSafeCommand || preflight.nextCommand,
+    preflight,
     workspace: manifest.workspace || {},
     trust: manifest.trust || {},
     decision: aiDecision(warnings, intents),

package/src/commands/sbom.js

@@ -22,6 +22,11 @@ export async function sbomWorkspace(args = {}) {
 
 export function buildSbomArtifact(manifest = {}) {
   const lightSbom = manifest.lightSbom || {};
+  const dependencyReview = lightSbom.aiDependencyReview || aiDependencyReview(lightSbom);
+  const nextSafeCommand = dependencyReview.beforeDependencyChange?.[0]
+    || lightSbom.riskSummary?.commands?.[0]
+    || "aienvmp context --json";
+  const aiBootstrap = sbomBootstrap(nextSafeCommand, dependencyReview);
   return {
     schemaVersion: 1,
     schemaName: "aienvmp.light-sbom",
@@ -36,16 +41,31 @@ export function buildSbomArtifact(manifest = {}) {
     topRisk: (lightSbom.topRisk || []).slice(0, 20),
     packageManagerPolicy: lightSbom.packageManagerPolicy || {},
     dependencyChangeHints: (lightSbom.dependencyChangeHints || []).slice(0, 20),
-    aiDependencyReview: lightSbom.aiDependencyReview || aiDependencyReview(lightSbom),
+    aiBootstrap,
+    nextSafeCommand,
+    aiDependencyReview: dependencyReview,
     aiUse: {
       purpose: "Standalone AI-readable light SBOM artifact.",
       readBefore: "Dependency changes, vulnerability remediation, release review, or shared AI handoff.",
-      nextCommand: lightSbom.riskSummary?.commands?.[0] || "aienvmp context --json",
+      nextCommand: nextSafeCommand,
       rule: "Use as a lightweight planning map; verify security claims with dedicated scanners."
     }
   };
 }
 
+function sbomBootstrap(nextSafeCommand, review = {}) {
+  return {
+    purpose: "Shortest AI entry point for dependency and SBOM review.",
+    readFirst: ".aienvmp/sbom.json",
+    detailCommand: "aienvmp context --json",
+    nextSafeCommand,
+    localMode: "advisory",
+    projectLocalWork: "allowed",
+    environmentChanges: review.status === "review" ? "review-first" : "intent-first",
+    rule: review.rule || "Read SBOM risk first; record intent before dependency or lockfile changes."
+  };
+}
+
 function aiDependencyReview(lightSbom = {}) {
   const risk = lightSbom.riskSummary || {};
   const hints = lightSbom.dependencyChangeHints || [];
@@ -97,6 +117,11 @@ export function buildCycloneDxLite(manifest = {}) {
   const snapshot = manifest.dependencySnapshot || {};
   const packages = snapshot.packages || [];
   const lightSbom = manifest.lightSbom || {};
+  const dependencyReview = lightSbom.aiDependencyReview || aiDependencyReview(lightSbom);
+  const nextSafeCommand = dependencyReview.beforeDependencyChange?.[0]
+    || lightSbom.riskSummary?.commands?.[0]
+    || "aienvmp context --json";
+  const aiBootstrap = sbomBootstrap(nextSafeCommand, dependencyReview);
   return {
     bomFormat: "CycloneDX",
     specVersion: "1.6",
@@ -121,14 +146,20 @@ export function buildCycloneDxLite(manifest = {}) {
         { name: "aienvmp:source", value: lightSbom.source?.dependencies || "project manifests" },
         { name: "aienvmp:confidence:transitiveDependencies", value: lightSbom.confidence?.transitiveDependencies || "not-resolved" },
         { name: "aienvmp:risk:level", value: lightSbom.riskSummary?.level || "clear" },
-        { name: "aienvmp:risk:score", value: String(lightSbom.riskSummary?.score || 0) }
+        { name: "aienvmp:risk:score", value: String(lightSbom.riskSummary?.score || 0) },
+        { name: "aienvmp:aiBootstrap:readFirst", value: aiBootstrap.readFirst },
+        { name: "aienvmp:aiBootstrap:detailCommand", value: aiBootstrap.detailCommand },
+        { name: "aienvmp:aiBootstrap:nextSafeCommand", value: aiBootstrap.nextSafeCommand },
+        { name: "aienvmp:aiBootstrap:localMode", value: aiBootstrap.localMode },
+        { name: "aienvmp:aiBootstrap:environmentChanges", value: aiBootstrap.environmentChanges }
       ]
     },
     components: packages.slice(0, 200).map(cycloneComponent),
     vulnerabilities: (lightSbom.topRisk || []).slice(0, 50).map(cycloneVulnerability),
     properties: [
       { name: "aienvmp:limitation", value: "Light SBOM from project manifests only; no install or dependency resolver was run." },
-      { name: "aienvmp:verifyWith", value: "CycloneDX, Syft, Trivy, npm audit, pip-audit, or another dedicated scanner before security claims." }
+      { name: "aienvmp:verifyWith", value: "CycloneDX, Syft, Trivy, npm audit, pip-audit, or another dedicated scanner before security claims." },
+      { name: "aienvmp:aiBootstrap:rule", value: aiBootstrap.rule }
     ]
   };
 }

package/src/commands/summary.js

@@ -40,10 +40,11 @@ export function renderSummary(status = {}, manifest = {}) {
   const collaboration = status.collaboration || {};
   const maintenanceLoop = status.maintenanceLoop || {};
   const sbomReview = maintenanceLoop.sbomReview || {};
+  const aiBootstrap = status.aiBootstrap || {};
   const workspace = manifest.workspace?.root || manifest.workspace?.name || ".";
-  const next = status.nextCommand || status.decision?.nextCommand || "aienvmp status";
-  const readFirst = status.nextAgent?.readFirst || ".aienvmp/status.json";
-  const detail = status.quickstart?.detailCommand || "aienvmp context --json";
+  const next = aiBootstrap.nextSafeCommand || status.nextSafeCommand || status.nextCommand || status.decision?.nextCommand || "aienvmp status";
+  const readFirst = aiBootstrap.readFirst || status.nextAgent?.readFirst || ".aienvmp/status.json";
+  const detail = aiBootstrap.detailCommand || status.quickstart?.detailCommand || "aienvmp context --json";
   const strict = status.enforcement?.recommendedCommand || "aienvmp doctor --strict all";
   const riskLevel = sbomRisk.level || "unknown";
   const riskScore = valueOrZero(sbomRisk.score);
@@ -67,11 +68,13 @@ export function renderSummary(status = {}, manifest = {}) {
     "",
     `- AI readiness: ${aiReadiness.level || "unknown"}`,
     `- AI signals: ${aiSignals.length ? aiSignals.join("; ") : "none"}`,
-    `- AI next: ${aiNext}`,
+    `- AI bootstrap: ${aiBootstrap.projectLocalWork || "allowed"} / ${aiBootstrap.environmentChanges || status.agentUse?.environmentChanges || "intent-first"} / ${aiBootstrap.localMode || "advisory"}`,
+    `- AI next: ${next} (${aiNext})`,
     `- AI collaboration: ${collaboration.status || "unknown"} / ${toList(collaboration.activeTargets).join(", ") || "none"} / ${collaboration.nextCommand || "aienvmp status --json"}`,
     `- AI maintenance loop: ${maintenanceLoop.nextCommand || next}`,
     `- AI safe local work: ${toList(aiReadiness.safeProjectLocalActions)[0] || "read artifacts and avoid environment changes until reviewed"}`,
     `- AI read first: ${readFirst}, then ${detail}`,
+    `- AI bootstrap rule: ${aiBootstrap.rule || "Read status first, use context for details, and keep local checks advisory."}`,
     `- mode: advisory by default; strict is opt-in with ${strict}`,
     `- local check: ${strictDecision.localCommand || "aienvmp doctor --json"} (${strictDecision.local || "warn-only"})`,
     `- CI strict: ${strictPlan.ciCommand || `${strict} --json`}`,

package/src/contract.js

@@ -4,7 +4,7 @@ export function preflightContract() {
     version: 1,
     stability: "additive",
     requiredFields: ["schemaVersion", "state", "decision", "quickstart", "commands", "artifacts"],
-    aiEntryFields: ["state", "summary", "nextSafeCommand", "aiReadiness", "collaboration", "maintenanceLoop", "nextAgent", "coordination", "agentActivity", "agentPointers", "sbomRisk", "followUps", "dependencyReadSet", "dependencyChangeProtocol"],
+    aiEntryFields: ["state", "summary", "aiBootstrap", "nextSafeCommand", "aiReadiness", "collaboration", "maintenanceLoop", "nextAgent", "coordination", "agentActivity", "agentPointers", "sbomRisk", "followUps", "dependencyReadSet", "dependencyChangeProtocol"],
     rule: "Consumers should ignore unknown fields and treat missing optional fields as unavailable."
   };
 }
@@ -32,7 +32,7 @@ export function schemaContract() {
       status: {
         file: ".aienvmp/status.json",
         command: "aienvmp status --json",
-        rootFields: ["state", "nextCommand", "nextSafeCommand", "decision", "counts", "aiReadiness", "collaboration", "maintenanceLoop", "coordination", "agentPointers", "sbomRisk"],
+        rootFields: ["state", "aiBootstrap", "nextCommand", "nextSafeCommand", "decision", "counts", "aiReadiness", "collaboration", "maintenanceLoop", "coordination", "agentPointers", "sbomRisk"],
         contract: preflightContract()
       },
       summary: {
@@ -42,13 +42,18 @@ export function schemaContract() {
         purpose: "Compact AI and CI step summary for quick review.",
         startsWith: ["AI readiness", "AI signals", "AI next"]
       },
+      plan: {
+        file: ".aienvmp/plan.json",
+        command: "aienvmp plan --json",
+        rootFields: ["schemaVersion", "status", "aiBootstrap", "nextSafeCommand", "preflight", "decision", "enforcement", "recommendedActions", "reviewGates", "remediationSteps", "environmentSteps"]
+      },
       context: {
         command: "aienvmp context --json",
-        rootFields: ["status", "nextSafeCommand", "preflight", "aiReadiness", "collaboration", "maintenanceLoop", "coordination", "agentPointers", "decision", "enforcement", "recommendedActions", "workspace", "dependencySnapshot", "lightSbom", "warnings"]
+        rootFields: ["status", "aiBootstrap", "nextSafeCommand", "preflight", "aiReadiness", "collaboration", "maintenanceLoop", "coordination", "agentPointers", "decision", "enforcement", "recommendedActions", "workspace", "dependencySnapshot", "lightSbom", "warnings"]
       },
       handoff: {
         command: "aienvmp handoff --json",
-        rootFields: ["status", "nextSafeCommand", "decision", "preflight", "continuation", "coordination", "dependencyHandoff", "openIntents", "warnings", "recommendedActions", "recentChanges"]
+        rootFields: ["status", "aiBootstrap", "nextSafeCommand", "decision", "preflight", "continuation", "coordination", "dependencyHandoff", "openIntents", "warnings", "recommendedActions", "recentChanges"]
       },
       manifest: {
         file: ".aienvmp/manifest.json",
@@ -57,7 +62,7 @@ export function schemaContract() {
       sbom: {
         file: ".aienvmp/sbom.json",
         command: "aienvmp sbom --json",
-        rootFields: ["schemaVersion", "schemaName", "workspace", "summary", "riskSummary", "topRisk", "packageManagerPolicy", "dependencyChangeHints", "aiDependencyReview"],
+        rootFields: ["schemaVersion", "schemaName", "workspace", "aiBootstrap", "nextSafeCommand", "summary", "riskSummary", "topRisk", "packageManagerPolicy", "dependencyChangeHints", "aiDependencyReview"],
         aiDependencyReviewFields: ["status", "statusReason", "securityConfidence", "readFirst", "reviewTargets", "beforeDependencyChange", "afterDependencyChange", "rule"]
       },
       cyclonedxLite: {

package/src/preflight.js

@@ -31,6 +31,7 @@ export function buildPreflight(manifest = {}, warnings = [], intents = [], timel
     collaboration
   });
   const nextCommand = maintenanceLoop.nextCommand || topAction?.command || decision.nextCommand;
+  const aiBootstrap = aiBootstrapSummary({ state, decision, nextCommand });
   return {
     schemaVersion: 1,
     contract: preflightContract(),
@@ -70,6 +71,7 @@ export function buildPreflight(manifest = {}, warnings = [], intents = [], timel
       projectLocalWork: decision.canContinueProjectLocalWork ? "allowed" : "review-first",
       environmentChanges: decision.canChangeEnvironmentWithoutReview ? "allowed" : "intent-and-review-first"
     },
+    aiBootstrap,
     quickstart: agentQuickstart(decision.reviewRequired),
     nextAgent: nextAgentHint(state, dependencyReadSet, dependencyChangeProtocol),
     coordination,
@@ -108,6 +110,21 @@ export function buildPreflight(manifest = {}, warnings = [], intents = [], timel
   };
 }
 
+function aiBootstrapSummary({ state, decision, nextCommand }) {
+  return {
+    purpose: "Shortest AI entry point for this workspace environment.",
+    readFirst: ".aienvmp/status.json",
+    detailCommand: "aienvmp context --json",
+    nextSafeCommand: nextCommand || "aienvmp status --json",
+    localMode: "advisory",
+    projectLocalWork: decision.canContinueProjectLocalWork ? "allowed" : "review-first",
+    environmentChanges: decision.canChangeEnvironmentWithoutReview ? "intent-first" : "review-first",
+    rule: state === "clear"
+      ? "Continue project-local work; record intent before shared environment changes."
+      : "Review context before shared environment changes; local checks remain non-blocking."
+  };
+}
+
 function maintenanceLoopSummary({ state, decision, topAction, followUps, sbomRisk, aiDependencyReview = {}, dependencyReadSet, collaboration }) {
   const followUpCommand = firstFollowUpCommand(followUps);
   const dependencyAware = dependencyReadSet.length > 0;

package/src/render.js

@@ -70,10 +70,17 @@ export function renderAIEnv(manifest, timeline = [], warnings = [], intents = []
 
 function preflightLines(preflight = {}) {
   const quickstart = preflight.quickstart;
+  const aiBootstrap = preflight.aiBootstrap || {};
   const targets = preflight.intentTargets || [];
   const maintenanceLoop = preflight.maintenanceLoop || {};
   const lines = ["## 10-Second AI Flow", ""];
-  if (quickstart) {
+  if (aiBootstrap.nextSafeCommand || aiBootstrap.readFirst) {
+    lines.push(`- AI bootstrap: ${aiBootstrap.projectLocalWork || "allowed"} / ${aiBootstrap.environmentChanges || "intent-first"} / ${aiBootstrap.localMode || "advisory"}`);
+    lines.push(`- Next safe command: \`${aiBootstrap.nextSafeCommand || preflight.nextSafeCommand || preflight.nextCommand || "aienvmp status --json"}\``);
+    lines.push(`- Read first: \`${aiBootstrap.readFirst || ".aienvmp/status.json"}\``);
+    lines.push(`- Detail: \`${aiBootstrap.detailCommand || "aienvmp context --json"}\``);
+    lines.push(`- Rule: ${aiBootstrap.rule || "Read status first, use context for details, and keep local checks advisory."}`);
+  } else if (quickstart) {
     lines.push(`- Read first: \`${quickstart.readFirst}\``);
     lines.push(`- Detail: \`${quickstart.detailCommand}\``);
     lines.push(`- Before env change: \`${quickstart.beforeEnvironmentChange}\``);
@@ -288,10 +295,16 @@ function dependencyHandoffLines(dependencyHandoff = {}) {
 }
 
 export function renderPlan(plan) {
+  const aiBootstrap = plan.aiBootstrap || plan.preflight?.aiBootstrap || {};
+  const nextSafeCommand = plan.nextSafeCommand || aiBootstrap.nextSafeCommand || plan.preflight?.nextSafeCommand || plan.preflight?.nextCommand || "aienvmp status --json";
   const lines = [
     "# AI Environment Plan",
     "",
     `Status: ${plan.status}`,
+    `AI bootstrap: ${aiBootstrap.projectLocalWork || "allowed"} / ${aiBootstrap.environmentChanges || "intent-first"} / ${aiBootstrap.localMode || "advisory"}`,
+    `Next safe command: ${nextSafeCommand}`,
+    `Read first: ${aiBootstrap.readFirst || ".aienvmp/status.json"} -> ${aiBootstrap.detailCommand || "aienvmp context --json"}`,
+    `Bootstrap rule: ${aiBootstrap.rule || "Read status first, use context for details, and keep local checks advisory."}`,
     `Decision: ${plan.decision?.mode || plan.status}`,
     `Enforcement: ${plan.enforcement?.mode || "advisory-by-default"} (${plan.enforcement?.localBehavior || "non-blocking"})`,
     `Generated: ${plan.generatedAt}`,
@@ -413,7 +426,7 @@ h1,h2,h3,p{margin:0}h1{font-size:clamp(28px,4vw,46px);line-height:1.02;margin-to
 .nextbar b{color:var(--green);font-size:12px;text-transform:uppercase;letter-spacing:.08em}
 .nextbar code{display:inline-block;max-width:100%;white-space:normal;overflow-wrap:anywhere}
 .nextbar span{color:var(--muted);font-size:12px;overflow-wrap:anywhere}
-.brief{display:grid;grid-template-columns:1fr 1fr 1fr 1fr;gap:8px;margin:0 0 14px}
+.brief{display:grid;grid-template-columns:repeat(auto-fit,minmax(150px,1fr));gap:8px;margin:0 0 14px}
 .brief-item{border:1px solid var(--line2);background:rgba(9,19,16,.9);border-radius:8px;padding:10px;min-width:0}
 .brief-k{color:var(--muted);font-size:11px;font-weight:800;text-transform:uppercase;letter-spacing:.08em}
 .brief-v{margin-top:5px;font-size:13px;font-weight:700;color:var(--text);overflow-wrap:anywhere}
@@ -541,6 +554,7 @@ const nextAction=reviewRequired?'Review before environment changes':'Proceed wit
 const auditItem=(key,value,hint,klass='')=>\`<div class="audit-item \${klass}"><div class="audit-k">\${key}</div><div class="audit-v">\${value}</div><div class="audit-hint">\${hint}</div></div>\`;
 const controlCard=(label,value,next,klass='')=>\`<div class="control-card \${klass}"><div class="control-label">\${label}</div><div class="control-value">\${esc(value)}</div><div class="control-next">\${esc(next)}</div></div>\`;
 const driftLabel=warnings.length?'detected':'none';
+const aiBootstrap=manifest.preflight?.aiBootstrap||{};
 const nextAgent=manifest.preflight?.nextAgent||{};
 const aiReadiness=manifest.preflight?.aiReadiness||{};
 const aiReadinessSignals=(aiReadiness.signals||[]).slice(0,3);
@@ -553,17 +567,18 @@ const sbomRiskValue=riskSummary.level||'unknown';
 const sbomRiskClass=['urgent','high','medium'].includes(sbomRiskValue)?'review':'ready';
 const sbomRiskScore=riskSummary.score!==undefined?' ('+riskSummary.score+')':'';
 const sbomRiskNext=riskSummary.next||aiDependencyReview.beforeDependencyChange?.[0]||'Run aienvmp sbom --json for dependency context.';
-const nextCommand=manifest.preflight?.nextCommand||maintenanceLoop.nextCommand||topAction.command||collaboration.nextCommand||'aienvmp status --json';
-const nextReason=topAction.summary||maintenanceLoop.rule||collaboration.rule||riskSummary.next||'Read status/context before changing shared environment state.';
+const nextCommand=aiBootstrap.nextSafeCommand||manifest.preflight?.nextSafeCommand||manifest.preflight?.nextCommand||maintenanceLoop.nextCommand||topAction.command||collaboration.nextCommand||'aienvmp status --json';
+const nextReason=topAction.summary||aiBootstrap.rule||maintenanceLoop.rule||collaboration.rule||riskSummary.next||'Read status/context before changing shared environment state.';
 const coordination=manifest.preflight?.coordination||{};
 const conflictTargets=coordination.conflictTargets||[];
 const handoffFiles=nextAgent.dependencyFiles?.length?nextAgent.dependencyFiles:(dependencyReadSet[0]?[dependencyReadSet[0].manifest,...(dependencyReadSet[0].lockfiles||[])].filter(Boolean):[]);
 const handoffNext=nextAgent.rule||(reviewRequired?'Review warnings and open intents':'Continue project-local work');
-const firstRead=nextAgent.readFirst||'.aienvmp/status.json';
+const firstRead=aiBootstrap.readFirst||nextAgent.readFirst||'.aienvmp/status.json';
 const reviewTargets=[...new Set([...(conflictTargets||[]),...(collaboration.activeTargets||[]),...(riskSummary.reviewTargets||[])].filter(Boolean))];
-const safeMode=enforcementProfile.gate?.localDefault||enforcementProfile.localOperation||'warn-only';
+const safeMode=aiBootstrap.localMode||enforcementProfile.gate?.localDefault||enforcementProfile.localOperation||'warn-only';
+const bootstrapState=[aiBootstrap.projectLocalWork||'allowed',aiBootstrap.environmentChanges||'intent-first'].join(' / ');
 const briefItem=(key,value)=>\`<div class="brief-item"><div class="brief-k">\${key}</div><div class="brief-v">\${esc(value)}</div></div>\`;
-const handoffHtml=\`<table><tr><th>Status</th><td>\${reviewRequired?'review-required':'clear'}</td></tr><tr><th>Trust</th><td><code>\${esc(trustState)}</code></td></tr><tr><th>Read first</th><td><code>\${esc(nextAgent.readFirst||'.aienvmp/status.json')}</code></td></tr><tr><th>Dependency files</th><td>\${handoffFiles.length?'<code>'+esc(handoffFiles.join(', '))+'</code>':'none'}</td></tr><tr><th>Conflicts</th><td>\${conflictTargets.length?'<code>'+esc(conflictTargets.join(', '))+'</code>':'none'}</td></tr><tr><th>Next</th><td>\${esc(handoffNext)}</td></tr></table>\`;
+const handoffHtml=\`<table><tr><th>Status</th><td>\${reviewRequired?'review-required':'clear'}</td></tr><tr><th>Trust</th><td><code>\${esc(trustState)}</code></td></tr><tr><th>Read first</th><td><code>\${esc(firstRead)}</code></td></tr><tr><th>Dependency files</th><td>\${handoffFiles.length?'<code>'+esc(handoffFiles.join(', '))+'</code>':'none'}</td></tr><tr><th>Conflicts</th><td>\${conflictTargets.length?'<code>'+esc(conflictTargets.join(', '))+'</code>':'none'}</td></tr><tr><th>Next</th><td>\${esc(handoffNext)}</td></tr></table>\`;
 document.getElementById('app').innerHTML=\`
 <header>
   <div>
@@ -584,6 +599,7 @@ document.getElementById('app').innerHTML=\`
   <span>\${esc(nextReason)}</span>
 </section>
 <section class="brief" aria-label="First read">
+  \${briefItem('AI bootstrap',bootstrapState)}
   \${briefItem('Status',reviewRequired?'review required':'clear')}
   \${briefItem('Read first',firstRead)}
   \${briefItem('Review targets',reviewTargets.length?reviewTargets.slice(0,4).join(', '):'none')}
@@ -688,9 +704,13 @@ function formatTimeline(item) {
 }
 
 function contextLines(manifest, warnings, intents) {
+  const preflight = manifest.preflight || {};
+  const aiBootstrap = preflight.aiBootstrap || {};
   return [
     `- Status: ${warnings.length ? "review-required" : "clear"}`,
-    `- Next: ${warnings.length ? "review warnings before environment changes" : "continue with project-local work"}`,
+    `- Next: ${aiBootstrap.nextSafeCommand || preflight.nextSafeCommand || preflight.nextCommand || (warnings.length ? "review warnings before environment changes" : "continue with project-local work")}`,
+    `- Bootstrap: ${aiBootstrap.projectLocalWork || "allowed"} / ${aiBootstrap.environmentChanges || "intent-first"} / ${aiBootstrap.localMode || "advisory"}`,
+    `- Read first: ${aiBootstrap.readFirst || ".aienvmp/status.json"} -> ${aiBootstrap.detailCommand || "aienvmp context --json"}`,
     `- Node: ${manifest.runtimes.node || "not detected"}`,
     `- Python: ${manifest.runtimes.python || manifest.runtimes.python3 || "not detected"}`,
     `- Docker: ${manifest.containers.docker ? "available" : "not detected"}`,