@semacode/cli 2.0.1 → 2.2.0

package/dist/pipelineConteudo/types.d.ts

@@ -0,0 +1,331 @@
+export type JsonPrimitivo = string | number | boolean | null;
+export type JsonValor = JsonPrimitivo | JsonObjeto | readonly JsonValor[];
+export interface JsonObjeto {
+    readonly [chave: string]: JsonValor;
+}
+export interface MetadataPublicaConteudo {
+    readonly [chave: string]: JsonPrimitivo;
+}
+export type VereditoConteudo = "NAO_AVALIADO" | "APROVADO" | "REPROVADO" | "INCONCLUSIVO";
+export type EstadoEvidenciaConteudo = "DECLARADA" | "ACEITA" | "REJEITADA" | "EXPIRADA" | "REVOGADA" | "SUPERADA";
+export type ModoAvaliacaoConteudo = "DETERMINISTICA" | "IA_ESPECIALIZADA" | "HIBRIDA";
+export type CondicaoOperacionalConteudo = "PENDENTE" | "PRONTA" | "EXECUTANDO" | "AGUARDANDO_EVIDENCIA" | "AGUARDANDO_EVENTO_EXTERNO" | "FERRAMENTA_INDISPONIVEL" | "CAPACIDADE_AUSENTE" | "AUTORIZACAO_AUSENTE" | "FALHA_TRANSITORIA" | "FALHA_TERMINAL" | "EXECUCAO_ENCERRADA";
+export type EscopoEtapaConteudo = "GLOBAL" | "POR_ALVO";
+export type ResultadoAvaliacaoConteudo = "APROVADO" | "REPROVADO" | "INCONCLUSIVO";
+export interface PrincipalConteudo {
+    readonly principalId: string;
+    readonly keyId: string;
+    readonly controlDomain: string;
+    readonly papeis: readonly string[];
+    readonly capabilities: readonly string[];
+    readonly scopes: readonly string[];
+    readonly publicKeyPem: string;
+}
+/**
+ * Raiz publica de confianca. Chaves privadas nunca pertencem a esta configuracao
+ * nem ao workspace canonico do pipeline.
+ */
+export interface ConfiguracaoConfiancaConteudo {
+    readonly trustDomainId: string;
+    readonly principals: readonly PrincipalConteudo[];
+    readonly revokedKeyIds: readonly string[];
+    readonly maxEnvelopeAgeMs?: number;
+    readonly maxFutureSkewMs?: number;
+    readonly schemaVersionsAceitas?: readonly string[];
+}
+export interface ResultadoValidacaoConfiguracaoConfiancaConteudo {
+    readonly valida: boolean;
+    readonly trustRootDigest: string;
+    readonly revocationDigest: string;
+    readonly fingerprints: readonly string[];
+    readonly bloqueios: readonly string[];
+}
+export interface EnvelopeAssinavelConteudo<TPayload = JsonValor> {
+    readonly schemaVersion: string;
+    readonly payloadType: string;
+    readonly payload: TPayload;
+    readonly principalId: string;
+    readonly keyId: string;
+    readonly issuedAt: string;
+    readonly nonce: string;
+    readonly signatureAlgorithm: "Ed25519";
+}
+export interface EnvelopeAssinadoConteudo<TPayload = JsonValor> extends EnvelopeAssinavelConteudo<TPayload> {
+    /** Assinatura Ed25519 em base64 do JSON canonico de EnvelopeAssinavelConteudo. */
+    readonly signature: string;
+}
+export interface OpcoesVerificacaoEnvelopeConteudo {
+    /** Pins fornecidos por uma fronteira externa; nunca podem ser derivados da configuracao recebida. */
+    readonly trustRootDigestEsperado: string;
+    readonly revocationDigestEsperado: string;
+    readonly payloadTypeEsperado: string;
+    readonly capabilityRequerida?: string;
+    readonly scopeRequerido?: string;
+    readonly papelRequerido?: string;
+    readonly papeisPermitidos?: readonly string[];
+    readonly agora?: string | Date | number;
+    readonly maxEnvelopeAgeMs?: number;
+    readonly maxFutureSkewMs?: number;
+    /** Nonces ja observados. A verificacao e pura e nao altera este conjunto. */
+    readonly noncesUsados?: ReadonlySet<string>;
+}
+export interface EnvelopeVerificadoConteudo<TPayload = JsonValor> {
+    readonly estado: "ACEITA";
+    readonly digest: string;
+    readonly principal: PrincipalConteudo;
+    readonly envelope: EnvelopeAssinadoConteudo<TPayload>;
+    readonly payload: TPayload;
+}
+export interface ResultadoVerificacaoEnvelopeConteudo<TPayload = JsonValor> {
+    readonly valido: boolean;
+    readonly digest: string;
+    readonly principal?: PrincipalConteudo;
+    readonly envelopeVerificado?: EnvelopeVerificadoConteudo<TPayload>;
+    readonly bloqueios: readonly string[];
+}
+/** Contexto anti-replay que faz parte do payload assinado de todo evento. */
+export interface ContextoAssinadoEventoConteudo {
+    readonly runId: string;
+    readonly trustDomainId: string;
+    readonly trustRootDigest: string;
+    readonly ledgerId: string;
+    readonly policyDigest: string;
+    readonly definitionDigest: string;
+}
+/** Eventos ligados a um alvo/conta carregam tambem o escopo derivado pelo planner. */
+export interface ContextoAutorizadoEventoConteudo extends ContextoAssinadoEventoConteudo {
+    readonly authorizationScope: string;
+}
+/** Declaracao do runner/produtor. So vira evidencia depois de um atestado confiavel. */
+export interface AlegacaoEvidenciaConteudo extends ContextoAutorizadoEventoConteudo {
+    readonly kind: "EVIDENCE_CLAIMED";
+    readonly claimId: string;
+    readonly stageId: string;
+    readonly targetId?: string;
+    readonly artifactDigest: string;
+    readonly evidenceType: string;
+    readonly producerId: string;
+    readonly claimedAt: string;
+    readonly data?: JsonObjeto;
+}
+/** Observacao assinada por um verificador/adapter autorizado, nunca pelo recibo em si. */
+export interface AtestadoEvidenciaConteudo extends ContextoAutorizadoEventoConteudo {
+    readonly kind: "EVIDENCE_ATTESTED";
+    readonly evidenceId: string;
+    readonly claimId?: string;
+    readonly gateId: string;
+    readonly stageId: string;
+    readonly targetId?: string;
+    readonly artifactDigest: string;
+    readonly evidenceType: string;
+    readonly producerId: string;
+    readonly attesterId: string;
+    readonly result: ResultadoAvaliacaoConteudo;
+    readonly observedAt: string;
+    readonly data?: JsonObjeto;
+}
+export interface ParecerIAConteudo extends ContextoAutorizadoEventoConteudo {
+    readonly kind: "AI_ASSESSMENT";
+    readonly assessmentId: string;
+    readonly gateId: string;
+    readonly targetId?: string;
+    readonly artifactDigest: string;
+    readonly rubricDigest: string;
+    readonly evaluatorId: string;
+    /** Capability especializada concreta exercida neste parecer. */
+    readonly capability: string;
+    readonly result: ResultadoAvaliacaoConteudo;
+    readonly assessedAt: string;
+    readonly rationaleDigest?: string;
+    readonly data?: JsonObjeto;
+}
+export interface PoliticaGateConteudo {
+    readonly gateId: string;
+    readonly stageId: string;
+    readonly scope: EscopoEtapaConteudo;
+    readonly evaluationMode: ModoAvaliacaoConteudo;
+    readonly requiredEvidence: readonly string[];
+    readonly evaluatorCapabilities: readonly string[];
+    /** Quorum independente exigido para cada tipo de evidencia deterministica. */
+    readonly minAttestationsPerEvidence: number;
+    readonly minDistinctAttesterControlDomains: number;
+    readonly minApprovals: number;
+    readonly minDistinctControlDomains: number;
+    readonly producerDisjoint: boolean;
+    readonly rejectionIsBinding: boolean;
+    readonly rubricDigest: string;
+}
+export interface PoliticaConfiancaConteudo {
+    readonly policyId: string;
+    readonly version: string;
+    readonly runId: string;
+    readonly trustDomainId: string;
+    readonly trustRootDigest: string;
+    readonly definitionDigest: string;
+    readonly targetSetDigest: string;
+    readonly ledgerId: string;
+    readonly gates: readonly PoliticaGateConteudo[];
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+}
+export interface EntradaAvaliacaoGateConteudo {
+    /** Politica assinada que vincula o gate base; requisitos adicionais so podem endurece-lo. */
+    readonly envelopePolitica: EnvelopeAssinadoConteudo<PoliticaConfiancaConteudo>;
+    readonly gate: PoliticaGateConteudo;
+    readonly requiredEvidenceAdicional?: readonly string[];
+    /** Requisitos adicionais derivados do adapter; so endurecem a policy assinada. */
+    readonly attesterCapabilitiesAdicionais?: Readonly<Record<string, string>>;
+    readonly artifactDigest: string;
+    readonly targetId?: string;
+    readonly runId: string;
+    readonly trustDomainId: string;
+    readonly trustRootDigest: string;
+    readonly revocationDigestEsperado: string;
+    readonly ledgerId: string;
+    readonly policyDigest: string;
+    readonly definitionDigest: string;
+    readonly authorizationScope: string;
+    readonly producerId: string;
+    readonly producerLineageIds: readonly string[];
+    readonly evidenciasAceitas: readonly EnvelopeVerificadoConteudo<AtestadoEvidenciaConteudo>[];
+    readonly pareceresIa: readonly EnvelopeVerificadoConteudo<ParecerIAConteudo>[];
+    readonly configuracaoConfianca: ConfiguracaoConfiancaConteudo;
+}
+export interface ResultadoAvaliacaoGateConteudo {
+    readonly veredito: VereditoConteudo;
+    readonly aprovacoesValidas: number;
+    readonly controlDomainsDistintos: number;
+    readonly evidenceIds: readonly string[];
+    readonly assessmentIds: readonly string[];
+    readonly bloqueios: readonly string[];
+}
+export interface RestricaoDeterministicaConteudo {
+    readonly constraintId: string;
+    readonly kind: string;
+    readonly config?: JsonObjeto;
+}
+export interface AdaptadorConteudo {
+    readonly adapterId: string;
+    readonly version: string;
+    readonly capabilities: readonly string[];
+    readonly acceptedMediaTypes: readonly string[];
+    readonly formatProfiles: readonly string[];
+    readonly deterministicConstraints: readonly RestricaoDeterministicaConteudo[];
+    readonly requiredMetadata: readonly string[];
+    readonly optionalMetadata: readonly string[];
+    readonly confirmationPredicates: readonly string[];
+}
+export interface AlvoConteudo {
+    readonly targetId: string;
+    readonly adapterId: string;
+    readonly accountScope: string;
+    readonly formatProfileId: string;
+    readonly locale: string;
+    readonly metadata: MetadataPublicaConteudo;
+}
+export interface EtapaPipelineConteudo {
+    readonly stageId: string;
+    readonly capability: string;
+    readonly scope: EscopoEtapaConteudo;
+    readonly adapterPolicy: "NONE" | "CONSTRAINTS" | "CONFIRMATION";
+    readonly dependsOn: readonly string[];
+    readonly produces: readonly string[];
+    readonly gateIds: readonly string[];
+}
+export interface DefinicaoPipelineConteudo {
+    readonly schemaVersion: string;
+    readonly pipelineId: string;
+    readonly version: string;
+    readonly stages: readonly EtapaPipelineConteudo[];
+    readonly gates: readonly PoliticaGateConteudo[];
+    readonly adapters: readonly AdaptadorConteudo[];
+    readonly requiredCompletionGates: readonly string[];
+}
+export interface InstanciaEtapaConteudo {
+    readonly stageInstanceId: string;
+    readonly stageId: string;
+    readonly targetId?: string;
+    readonly capability: string;
+    readonly dependsOn: readonly string[];
+    readonly produces: readonly string[];
+    readonly gateIds: readonly string[];
+}
+export interface SlotArtefatoConteudo {
+    readonly slotId: string;
+    readonly stageInstanceId: string;
+    readonly artifactType: string;
+    readonly targetId?: string;
+}
+export interface InstanciaGateConteudo {
+    readonly gateInstanceId: string;
+    readonly gateId: string;
+    readonly stageInstanceId: string;
+    readonly targetId?: string;
+}
+export interface PlanoPipelineConteudo {
+    readonly pipelineId: string;
+    readonly definitionDigest: string;
+    readonly targetIds: readonly string[];
+    readonly stageInstances: readonly InstanciaEtapaConteudo[];
+    readonly artifactSlots: readonly SlotArtefatoConteudo[];
+    readonly gateInstances: readonly InstanciaGateConteudo[];
+    readonly nextActions: readonly string[];
+}
+export interface ArtefatoConteudo extends ContextoAutorizadoEventoConteudo {
+    readonly kind: "ARTIFACT_REGISTERED";
+    readonly artifactId: string;
+    readonly stageId: string;
+    readonly targetId?: string;
+    readonly producerId: string;
+    readonly producerLineageIds: readonly string[];
+    readonly version: string;
+    readonly artifactType: string;
+    readonly mediaType: string;
+    readonly digest: string;
+    readonly lineageDigests: readonly string[];
+}
+export interface InicioExecucaoConteudo extends ContextoAssinadoEventoConteudo {
+    readonly kind: "RUN_STARTED";
+    readonly targets: readonly AlvoConteudo[];
+    readonly startedAt: string;
+}
+export interface CondicaoOperacionalReportadaConteudo extends ContextoAutorizadoEventoConteudo {
+    readonly kind: "OPERATIONAL_CONDITION";
+    readonly gateId: string;
+    readonly targetId?: string;
+    readonly condition: CondicaoOperacionalConteudo;
+    readonly reason: string;
+    readonly reportedAt: string;
+}
+export type EventoPayloadConteudo = InicioExecucaoConteudo | CondicaoOperacionalReportadaConteudo | ArtefatoConteudo | AlegacaoEvidenciaConteudo | AtestadoEvidenciaConteudo | ParecerIAConteudo;
+export interface EventoLedgerConteudo<TPayload = JsonValor> {
+    readonly schemaVersion: string;
+    readonly ledgerId: string;
+    readonly sequence: number;
+    readonly eventId: string;
+    readonly recordedAt: string;
+    readonly previousHash: string;
+    readonly envelope: EnvelopeAssinadoConteudo<TPayload>;
+    readonly hash: string;
+}
+export interface EstadoGateConteudo {
+    readonly gateId: string;
+    readonly targetId?: string;
+    readonly artifactDigest: string;
+    readonly veredito: VereditoConteudo;
+    readonly condition: CondicaoOperacionalConteudo;
+    readonly evidenceIds: readonly string[];
+    readonly assessmentIds: readonly string[];
+    readonly blockers: readonly string[];
+}
+export interface ProjecaoPipelineConteudo {
+    readonly authoritative: false;
+    readonly ledgerId: string;
+    readonly ledgerHead: string;
+    readonly runId: string;
+    readonly generatedAt: string;
+    readonly gates: readonly EstadoGateConteudo[];
+    readonly targets: readonly AlvoConteudo[];
+    readonly artifacts: readonly ArtefatoConteudo[];
+    readonly nextActions: readonly string[];
+}

package/dist/pipelineConteudo/types.js

@@ -0,0 +1,4 @@
+// SEMA-GOVERNED: sema.produto.pipeline_conteudo + confianca + ledger + estado + adaptadores
+// Descricao: tipos abertos do pipeline AI-native de conteudo, sem enum de canal, marca ou formato.
+export {};
+//# sourceMappingURL=types.js.map

package/dist/projetoConfig.js

@@ -52,12 +52,18 @@ export function normalizarFrameworkGeracao(valor) {
     return "base";
 }
 export function normalizarAlvo(valor) {
-    if (valor === "typescript" || valor === "python" || valor === "dart" || valor === "lua" || valor === "javascript" || valor === "html" || valor === "css" || valor === "php") {
+    if (valor === "typescript" || valor === "python" || valor === "dart" || valor === "lua" || valor === "javascript" || valor === "html" || valor === "css" || valor === "php" || valor === "dotnet" || valor === "cpp") {
         return valor;
     }
     if (valor === "js") {
         return "javascript";
     }
+    if (valor === "cs" || valor === "csharp") {
+        return "dotnet";
+    }
+    if (valor === "c++" || valor === "cxx" || valor === "cc") {
+        return "cpp";
+    }
     return undefined;
 }
 export function normalizarFonteLegado(valor) {

package/dist/projetoResolucao.js

@@ -2,11 +2,24 @@
 // Descrição: resolve alvo, framework, estrutura e diret?rios de sa?da para gera??o/verifica??o.
 import path from 'node:path';
 import { normalizarAlvo, normalizarEstruturaSaida, normalizarFrameworkGeracao } from './projetoConfig.js';
+function normalizarAlvoObrigatorio(valor, origem) {
+    const normalizado = normalizarAlvo(valor);
+    if (!normalizado) {
+        throw new Error(`Alvo de geração inválido em ${origem}: ${valor}`);
+    }
+    return normalizado;
+}
 export function resolverAlvoPadrao(alvoExplicito, configCarregada) {
-    return normalizarAlvo(alvoExplicito)
-        ?? configCarregada?.config.alvoPadrao
-        ?? configCarregada?.config.alvos?.[0]
-        ?? "typescript";
+    if (alvoExplicito !== undefined) {
+        return normalizarAlvoObrigatorio(alvoExplicito, "--alvo");
+    }
+    if (configCarregada?.config.alvoPadrao !== undefined) {
+        return normalizarAlvoObrigatorio(configCarregada.config.alvoPadrao, `alvoPadrao de ${configCarregada.caminho}`);
+    }
+    const primeiroAlvo = configCarregada?.config.alvos?.[0];
+    return primeiroAlvo !== undefined
+        ? normalizarAlvoObrigatorio(primeiroAlvo, `alvos[0] de ${configCarregada.caminho}`)
+        : "typescript";
 }
 export function resolverFrameworkPadrao(frameworkExplicito, configCarregada) {
     return normalizarFrameworkGeracao(frameworkExplicito ?? configCarregada?.config.framework);
@@ -35,8 +48,10 @@ export function resolverSaidaPadrao(saidaExplicita, alvo, configCarregada) {
     return path.resolve("./saida");
 }
 export function resolverAlvosVerificacao(configCarregada) {
-    const alvos = configCarregada?.config.alvos?.length
-        ? configCarregada.config.alvos
+    const configurados = configCarregada?.config.alvos;
+    const origemConfig = configCarregada?.caminho ?? "sema.config.json";
+    const alvos = configurados?.length
+        ? configurados.map((alvo, indice) => normalizarAlvoObrigatorio(alvo, `alvos[${indice}] de ${origemConfig}`))
         : ["typescript", "python"];
     return [...new Set(alvos)];
 }

package/dist/sync/index.js

@@ -46,25 +46,25 @@ export async function gerarSchemaPrisma(pastaContratos, saidaSchema, datasourceP
     for (const contrato of contratos) {
         const nomeModel = path.basename(contrato, '.sema').replace(/\./g, '_');
         // Schema simplificado - em producao, fazer parsing real do contrato
-        models += `\nmodel ${nomeModel.charAt(0).toUpperCase() + nomeModel.slice(1)} {
-  id        String   @id @default(uuid())
-  criadoEm  DateTime @default(now())
-  // Gerado a partir de: ${contrato}
-  // TODO: Adicionar campos do contrato Sema
+        models += `\nmodel ${nomeModel.charAt(0).toUpperCase() + nomeModel.slice(1)} {
+  id        String   @id @default(uuid())
+  criadoEm  DateTime @default(now())
+  // Gerado a partir de: ${contrato}
+  // TODO: Adicionar campos do contrato Sema
 }\n`;
         modelCount++;
     }
-    const schema = `// Gerado automaticamente pelo Sema
-// Fonte: ${pastaContratos}
-
-generator client {
-  provider = "prisma-client-js"
-}
-
-datasource db {
-  provider = "${datasourceProvider}"
-  url      = env("SEMA_PRISMA_URL")
-}
+    const schema = `// Gerado automaticamente pelo Sema
+// Fonte: ${pastaContratos}
+
+generator client {
+  provider = "prisma-client-js"
+}
+
+datasource db {
+  provider = "${datasourceProvider}"
+  url      = env("SEMA_PRISMA_URL")
+}
 ${models}`;
     // Salvar
     fs.writeFileSync(saidaSchema, schema, 'utf-8');
@@ -90,25 +90,25 @@ export async function importarSchemaPrisma(caminhoSchema, pastaSaida, nomeModulo
         const nomeContrato = `${nomeModel.toLowerCase()}.sema`;
         const caminhoContrato = path.join(pastaSaida, nomeContrato);
         // Gerar contrato basico
-        const conteudo = `module ${nomeModulo}.${nomeModel.toLowerCase()} {
-  entity ${nomeModel} {
-    fields {
-      id: Id
-      // TODO: Mapear campos do schema Prisma
-    }
-  }
-
-  task criar_${nomeModel.toLowerCase()} {
-    input {
-      // TODO: Definir inputs
-    }
-    output {
-      ${nomeModel.toLowerCase()}: ${nomeModel}
-    }
-    effects {
-      persistencia ${nomeModel}
-    }
-  }
+        const conteudo = `module ${nomeModulo}.${nomeModel.toLowerCase()} {
+  entity ${nomeModel} {
+    fields {
+      id: Id
+      // TODO: Mapear campos do schema Prisma
+    }
+  }
+
+  task criar_${nomeModel.toLowerCase()} {
+    input {
+      // TODO: Definir inputs
+    }
+    output {
+      ${nomeModel.toLowerCase()}: ${nomeModel}
+    }
+    effects {
+      persistencia ${nomeModel}
+    }
+  }
 }`;
         fs.writeFileSync(caminhoContrato, conteudo, 'utf-8');
         contratos.push(caminhoContrato);

package/docs/README.md

@@ -1,25 +1,28 @@
-# Sema Documentation
-
-These docs describe the public Codex-native local CLI distribution of Sema.
-
-Sema is local-first: Codex runs the CLI inside a project folder, reads `.sema`
-contracts, checks drift, maps impact, and closes changes with documentation
-evidence. `AGENTS.md` is the official Codex entrypoint. Public docs are written
-in English.
-
-Sema is an independent product and is not affiliated with or endorsed by
-OpenAI. Codex-native describes Sema's product direction, not an official OpenAI
-program or submission.
-
-Start here:
-
-- [CLI](./cli.md)
-- [Commands](./commands.md)
-- [Syntax](./syntax.md)
-- [Profiles](./profiles.md)
-- [Documentation Governance](./documentation.md)
-- [Repository Boundary](./repositories.md)
-- [Security](./security.md)
-- [Codex Integration](./ai-integration.md)
-
-Official support: [suporte@otimitare.online](mailto:suporte@otimitare.online)
+# Sema Documentation
+
+These docs describe the public Codex-native local CLI distribution of Sema.
+
+Sema is local-first: Codex runs the CLI inside a project folder, reads `.sema`
+contracts, checks drift, maps impact, and closes changes with documentation
+evidence. `AGENTS.md` is the official Codex entrypoint. Public docs are written
+in English.
+
+Sema is an independent product and is not affiliated with or endorsed by
+OpenAI. Codex-native describes Sema's product direction, not an official OpenAI
+program or submission.
+
+Start here:
+
+- [CLI](./cli.md)
+- [Commands](./commands.md)
+- [Syntax](./syntax.md)
+- [Profiles](./profiles.md)
+- [AI-native Content Pipeline](./pipeline-conteudo.md) — signed-policy,
+  multi-channel and multi-format orchestration for external AI runners, with
+  canonical ledger replay and no native human-review path.
+- [Documentation Governance](./documentation.md)
+- [Repository Boundary](./repositories.md)
+- [Security](./security.md)
+- [Codex Integration](./ai-integration.md)
+
+Official support: [suporte@otimitare.online](mailto:suporte@otimitare.online)

package/docs/ai-onboarding.md

@@ -1,62 +1,62 @@
-# Codex Onboarding
-
-The official Sema skill is required for Codex to recognize and initialize Sema
-before a project has its own protocol:
-
-```bash
-codex plugin marketplace add gerlanss/Sema
-codex plugin add sema@sema
-```
-
-Open a new Codex task in the target repository after installation. Codex loads
-the plugin/skill catalog at task start, so `$sema` is not added retroactively to
-an already-open task. Invoke `$sema` in the new task; it bootstraps the project,
-reads the generated `AGENTS.md`, and later tasks load that protocol
-automatically.
-
-`AGENTS.md` is the official Sema entrypoint for Codex. It gives Codex the durable
-repository rule that contracts come first and the local CLI is the source of
-truth. Once the file exists, the skill delegates to it instead of carrying a
-second copy of the governed workflow.
-
-Create or refresh the entrypoint with:
-
-```bash
-sema sync-codex --json
-```
-
-## Minimal Prompt
-
-```text
-This workspace is governed by Sema. Before editing code, contracts, docs,
-workflows, profiles, or release scripts, run:
-
-1. sema --version
-2. sema resumo
-3. sema docs-impacto --intencao "<change>" --json
-4. sema inspecionar on the applicable .sema contract
-5. sema drift before editing existing code
-6. sema impacto before changing behavior
-7. sema finalizar-mudanca before closing
-
-If the CLI is unavailable, stop and install or repair @semacode/cli. There is
-no separate Sema login, license activation, or authorization gate. Do not
-replace Sema with manual search or guessed contracts.
-```
-
-## What Codex Should Not Do
-
-- Do not invent `.sema` contracts.
-- Do not implement code without an applicable contract.
-- Do not ignore severity 4+ warnings.
-- Do not publish private or sensitive operational material.
-- Do not replace the local CLI when the local workspace is available.
-
-Other AI clients can invoke the public CLI manually, but Sema does not ship or
-manage an official repository entrypoint for them. The supported product path
-is Codex plus `AGENTS.md`.
-
-Sema is an independent product and is not affiliated with or endorsed by
-OpenAI.
-
-Support: suporte@otimitare.online
+# Codex Onboarding
+
+The official Sema skill is required for Codex to recognize and initialize Sema
+before a project has its own protocol:
+
+```bash
+codex plugin marketplace add gerlanss/Sema
+codex plugin add sema@sema
+```
+
+Open a new Codex task in the target repository after installation. Codex loads
+the plugin/skill catalog at task start, so `$sema` is not added retroactively to
+an already-open task. Invoke `$sema` in the new task; it bootstraps the project,
+reads the generated `AGENTS.md`, and later tasks load that protocol
+automatically.
+
+`AGENTS.md` is the official Sema entrypoint for Codex. It gives Codex the durable
+repository rule that contracts come first and the local CLI is the source of
+truth. Once the file exists, the skill delegates to it instead of carrying a
+second copy of the governed workflow.
+
+Create or refresh the entrypoint with:
+
+```bash
+sema sync-codex --json
+```
+
+## Minimal Prompt
+
+```text
+This workspace is governed by Sema. Before editing code, contracts, docs,
+workflows, profiles, or release scripts, run:
+
+1. sema --version
+2. sema resumo
+3. sema docs-impacto --intencao "<change>" --json
+4. sema inspecionar on the applicable .sema contract
+5. sema drift before editing existing code
+6. sema impacto before changing behavior
+7. sema finalizar-mudanca before closing
+
+If the CLI is unavailable, stop and install or repair @semacode/cli. There is
+no separate Sema login, license activation, or authorization gate. Do not
+replace Sema with manual search or guessed contracts.
+```
+
+## What Codex Should Not Do
+
+- Do not invent `.sema` contracts.
+- Do not implement code without an applicable contract.
+- Do not ignore severity 4+ warnings.
+- Do not publish private or sensitive operational material.
+- Do not replace the local CLI when the local workspace is available.
+
+Other AI clients can invoke the public CLI manually, but Sema does not ship or
+manage an official repository entrypoint for them. The supported product path
+is Codex plus `AGENTS.md`.
+
+Sema is an independent product and is not affiliated with or endorsed by
+OpenAI.
+
+Support: suporte@otimitare.online

package/docs/ai-workflow.md

@@ -34,7 +34,7 @@ If the delivery includes code derived from a contract, run `sema compilar`.
 sema compilar contratos/orders.sema --alvo javascript --saida ./generated/javascript
 ```
 
-Replace `javascript` with `typescript`, `python`, `php`, `dart`, `lua`, `html`, or `css` when appropriate.
+Replace `javascript` with `typescript`, `python`, `php`, `dart`, `lua`, `html`, `css`, `dotnet`, or `cpp` when appropriate.
 
 ## Fail Closed