@semacode/cli 2.1.0 → 2.2.0

package/dist/pipelineConteudo/types.d.ts

@@ -0,0 +1,331 @@
+export type JsonPrimitivo = string | number | boolean | null;
+export type JsonValor = JsonPrimitivo | JsonObjeto | readonly JsonValor[];
+export interface JsonObjeto {
+    readonly [chave: string]: JsonValor;
+}
+export interface MetadataPublicaConteudo {
+    readonly [chave: string]: JsonPrimitivo;
+}
+export type VereditoConteudo = "NAO_AVALIADO" | "APROVADO" | "REPROVADO" | "INCONCLUSIVO";
+export type EstadoEvidenciaConteudo = "DECLARADA" | "ACEITA" | "REJEITADA" | "EXPIRADA" | "REVOGADA" | "SUPERADA";
+export type ModoAvaliacaoConteudo = "DETERMINISTICA" | "IA_ESPECIALIZADA" | "HIBRIDA";
+export type CondicaoOperacionalConteudo = "PENDENTE" | "PRONTA" | "EXECUTANDO" | "AGUARDANDO_EVIDENCIA" | "AGUARDANDO_EVENTO_EXTERNO" | "FERRAMENTA_INDISPONIVEL" | "CAPACIDADE_AUSENTE" | "AUTORIZACAO_AUSENTE" | "FALHA_TRANSITORIA" | "FALHA_TERMINAL" | "EXECUCAO_ENCERRADA";
+export type EscopoEtapaConteudo = "GLOBAL" | "POR_ALVO";
+export type ResultadoAvaliacaoConteudo = "APROVADO" | "REPROVADO" | "INCONCLUSIVO";
+export interface PrincipalConteudo {
+    readonly principalId: string;
+    readonly keyId: string;
+    readonly controlDomain: string;
+    readonly papeis: readonly string[];
+    readonly capabilities: readonly string[];
+    readonly scopes: readonly string[];
+    readonly publicKeyPem: string;
+}
+/**
+ * Raiz publica de confianca. Chaves privadas nunca pertencem a esta configuracao
+ * nem ao workspace canonico do pipeline.
+ */
+export interface ConfiguracaoConfiancaConteudo {
+    readonly trustDomainId: string;
+    readonly principals: readonly PrincipalConteudo[];
+    readonly revokedKeyIds: readonly string[];
+    readonly maxEnvelopeAgeMs?: number;
+    readonly maxFutureSkewMs?: number;
+    readonly schemaVersionsAceitas?: readonly string[];
+}
+export interface ResultadoValidacaoConfiguracaoConfiancaConteudo {
+    readonly valida: boolean;
+    readonly trustRootDigest: string;
+    readonly revocationDigest: string;
+    readonly fingerprints: readonly string[];
+    readonly bloqueios: readonly string[];
+}
+export interface EnvelopeAssinavelConteudo<TPayload = JsonValor> {
+    readonly schemaVersion: string;
+    readonly payloadType: string;
+    readonly payload: TPayload;
+    readonly principalId: string;
+    readonly keyId: string;
+    readonly issuedAt: string;
+    readonly nonce: string;
+    readonly signatureAlgorithm: "Ed25519";
+}
+export interface EnvelopeAssinadoConteudo<TPayload = JsonValor> extends EnvelopeAssinavelConteudo<TPayload> {
+    /** Assinatura Ed25519 em base64 do JSON canonico de EnvelopeAssinavelConteudo. */
+    readonly signature: string;
+}
+export interface OpcoesVerificacaoEnvelopeConteudo {
+    /** Pins fornecidos por uma fronteira externa; nunca podem ser derivados da configuracao recebida. */
+    readonly trustRootDigestEsperado: string;
+    readonly revocationDigestEsperado: string;
+    readonly payloadTypeEsperado: string;
+    readonly capabilityRequerida?: string;
+    readonly scopeRequerido?: string;
+    readonly papelRequerido?: string;
+    readonly papeisPermitidos?: readonly string[];
+    readonly agora?: string | Date | number;
+    readonly maxEnvelopeAgeMs?: number;
+    readonly maxFutureSkewMs?: number;
+    /** Nonces ja observados. A verificacao e pura e nao altera este conjunto. */
+    readonly noncesUsados?: ReadonlySet<string>;
+}
+export interface EnvelopeVerificadoConteudo<TPayload = JsonValor> {
+    readonly estado: "ACEITA";
+    readonly digest: string;
+    readonly principal: PrincipalConteudo;
+    readonly envelope: EnvelopeAssinadoConteudo<TPayload>;
+    readonly payload: TPayload;
+}
+export interface ResultadoVerificacaoEnvelopeConteudo<TPayload = JsonValor> {
+    readonly valido: boolean;
+    readonly digest: string;
+    readonly principal?: PrincipalConteudo;
+    readonly envelopeVerificado?: EnvelopeVerificadoConteudo<TPayload>;
+    readonly bloqueios: readonly string[];
+}
+/** Contexto anti-replay que faz parte do payload assinado de todo evento. */
+export interface ContextoAssinadoEventoConteudo {
+    readonly runId: string;
+    readonly trustDomainId: string;
+    readonly trustRootDigest: string;
+    readonly ledgerId: string;
+    readonly policyDigest: string;
+    readonly definitionDigest: string;
+}
+/** Eventos ligados a um alvo/conta carregam tambem o escopo derivado pelo planner. */
+export interface ContextoAutorizadoEventoConteudo extends ContextoAssinadoEventoConteudo {
+    readonly authorizationScope: string;
+}
+/** Declaracao do runner/produtor. So vira evidencia depois de um atestado confiavel. */
+export interface AlegacaoEvidenciaConteudo extends ContextoAutorizadoEventoConteudo {
+    readonly kind: "EVIDENCE_CLAIMED";
+    readonly claimId: string;
+    readonly stageId: string;
+    readonly targetId?: string;
+    readonly artifactDigest: string;
+    readonly evidenceType: string;
+    readonly producerId: string;
+    readonly claimedAt: string;
+    readonly data?: JsonObjeto;
+}
+/** Observacao assinada por um verificador/adapter autorizado, nunca pelo recibo em si. */
+export interface AtestadoEvidenciaConteudo extends ContextoAutorizadoEventoConteudo {
+    readonly kind: "EVIDENCE_ATTESTED";
+    readonly evidenceId: string;
+    readonly claimId?: string;
+    readonly gateId: string;
+    readonly stageId: string;
+    readonly targetId?: string;
+    readonly artifactDigest: string;
+    readonly evidenceType: string;
+    readonly producerId: string;
+    readonly attesterId: string;
+    readonly result: ResultadoAvaliacaoConteudo;
+    readonly observedAt: string;
+    readonly data?: JsonObjeto;
+}
+export interface ParecerIAConteudo extends ContextoAutorizadoEventoConteudo {
+    readonly kind: "AI_ASSESSMENT";
+    readonly assessmentId: string;
+    readonly gateId: string;
+    readonly targetId?: string;
+    readonly artifactDigest: string;
+    readonly rubricDigest: string;
+    readonly evaluatorId: string;
+    /** Capability especializada concreta exercida neste parecer. */
+    readonly capability: string;
+    readonly result: ResultadoAvaliacaoConteudo;
+    readonly assessedAt: string;
+    readonly rationaleDigest?: string;
+    readonly data?: JsonObjeto;
+}
+export interface PoliticaGateConteudo {
+    readonly gateId: string;
+    readonly stageId: string;
+    readonly scope: EscopoEtapaConteudo;
+    readonly evaluationMode: ModoAvaliacaoConteudo;
+    readonly requiredEvidence: readonly string[];
+    readonly evaluatorCapabilities: readonly string[];
+    /** Quorum independente exigido para cada tipo de evidencia deterministica. */
+    readonly minAttestationsPerEvidence: number;
+    readonly minDistinctAttesterControlDomains: number;
+    readonly minApprovals: number;
+    readonly minDistinctControlDomains: number;
+    readonly producerDisjoint: boolean;
+    readonly rejectionIsBinding: boolean;
+    readonly rubricDigest: string;
+}
+export interface PoliticaConfiancaConteudo {
+    readonly policyId: string;
+    readonly version: string;
+    readonly runId: string;
+    readonly trustDomainId: string;
+    readonly trustRootDigest: string;
+    readonly definitionDigest: string;
+    readonly targetSetDigest: string;
+    readonly ledgerId: string;
+    readonly gates: readonly PoliticaGateConteudo[];
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+}
+export interface EntradaAvaliacaoGateConteudo {
+    /** Politica assinada que vincula o gate base; requisitos adicionais so podem endurece-lo. */
+    readonly envelopePolitica: EnvelopeAssinadoConteudo<PoliticaConfiancaConteudo>;
+    readonly gate: PoliticaGateConteudo;
+    readonly requiredEvidenceAdicional?: readonly string[];
+    /** Requisitos adicionais derivados do adapter; so endurecem a policy assinada. */
+    readonly attesterCapabilitiesAdicionais?: Readonly<Record<string, string>>;
+    readonly artifactDigest: string;
+    readonly targetId?: string;
+    readonly runId: string;
+    readonly trustDomainId: string;
+    readonly trustRootDigest: string;
+    readonly revocationDigestEsperado: string;
+    readonly ledgerId: string;
+    readonly policyDigest: string;
+    readonly definitionDigest: string;
+    readonly authorizationScope: string;
+    readonly producerId: string;
+    readonly producerLineageIds: readonly string[];
+    readonly evidenciasAceitas: readonly EnvelopeVerificadoConteudo<AtestadoEvidenciaConteudo>[];
+    readonly pareceresIa: readonly EnvelopeVerificadoConteudo<ParecerIAConteudo>[];
+    readonly configuracaoConfianca: ConfiguracaoConfiancaConteudo;
+}
+export interface ResultadoAvaliacaoGateConteudo {
+    readonly veredito: VereditoConteudo;
+    readonly aprovacoesValidas: number;
+    readonly controlDomainsDistintos: number;
+    readonly evidenceIds: readonly string[];
+    readonly assessmentIds: readonly string[];
+    readonly bloqueios: readonly string[];
+}
+export interface RestricaoDeterministicaConteudo {
+    readonly constraintId: string;
+    readonly kind: string;
+    readonly config?: JsonObjeto;
+}
+export interface AdaptadorConteudo {
+    readonly adapterId: string;
+    readonly version: string;
+    readonly capabilities: readonly string[];
+    readonly acceptedMediaTypes: readonly string[];
+    readonly formatProfiles: readonly string[];
+    readonly deterministicConstraints: readonly RestricaoDeterministicaConteudo[];
+    readonly requiredMetadata: readonly string[];
+    readonly optionalMetadata: readonly string[];
+    readonly confirmationPredicates: readonly string[];
+}
+export interface AlvoConteudo {
+    readonly targetId: string;
+    readonly adapterId: string;
+    readonly accountScope: string;
+    readonly formatProfileId: string;
+    readonly locale: string;
+    readonly metadata: MetadataPublicaConteudo;
+}
+export interface EtapaPipelineConteudo {
+    readonly stageId: string;
+    readonly capability: string;
+    readonly scope: EscopoEtapaConteudo;
+    readonly adapterPolicy: "NONE" | "CONSTRAINTS" | "CONFIRMATION";
+    readonly dependsOn: readonly string[];
+    readonly produces: readonly string[];
+    readonly gateIds: readonly string[];
+}
+export interface DefinicaoPipelineConteudo {
+    readonly schemaVersion: string;
+    readonly pipelineId: string;
+    readonly version: string;
+    readonly stages: readonly EtapaPipelineConteudo[];
+    readonly gates: readonly PoliticaGateConteudo[];
+    readonly adapters: readonly AdaptadorConteudo[];
+    readonly requiredCompletionGates: readonly string[];
+}
+export interface InstanciaEtapaConteudo {
+    readonly stageInstanceId: string;
+    readonly stageId: string;
+    readonly targetId?: string;
+    readonly capability: string;
+    readonly dependsOn: readonly string[];
+    readonly produces: readonly string[];
+    readonly gateIds: readonly string[];
+}
+export interface SlotArtefatoConteudo {
+    readonly slotId: string;
+    readonly stageInstanceId: string;
+    readonly artifactType: string;
+    readonly targetId?: string;
+}
+export interface InstanciaGateConteudo {
+    readonly gateInstanceId: string;
+    readonly gateId: string;
+    readonly stageInstanceId: string;
+    readonly targetId?: string;
+}
+export interface PlanoPipelineConteudo {
+    readonly pipelineId: string;
+    readonly definitionDigest: string;
+    readonly targetIds: readonly string[];
+    readonly stageInstances: readonly InstanciaEtapaConteudo[];
+    readonly artifactSlots: readonly SlotArtefatoConteudo[];
+    readonly gateInstances: readonly InstanciaGateConteudo[];
+    readonly nextActions: readonly string[];
+}
+export interface ArtefatoConteudo extends ContextoAutorizadoEventoConteudo {
+    readonly kind: "ARTIFACT_REGISTERED";
+    readonly artifactId: string;
+    readonly stageId: string;
+    readonly targetId?: string;
+    readonly producerId: string;
+    readonly producerLineageIds: readonly string[];
+    readonly version: string;
+    readonly artifactType: string;
+    readonly mediaType: string;
+    readonly digest: string;
+    readonly lineageDigests: readonly string[];
+}
+export interface InicioExecucaoConteudo extends ContextoAssinadoEventoConteudo {
+    readonly kind: "RUN_STARTED";
+    readonly targets: readonly AlvoConteudo[];
+    readonly startedAt: string;
+}
+export interface CondicaoOperacionalReportadaConteudo extends ContextoAutorizadoEventoConteudo {
+    readonly kind: "OPERATIONAL_CONDITION";
+    readonly gateId: string;
+    readonly targetId?: string;
+    readonly condition: CondicaoOperacionalConteudo;
+    readonly reason: string;
+    readonly reportedAt: string;
+}
+export type EventoPayloadConteudo = InicioExecucaoConteudo | CondicaoOperacionalReportadaConteudo | ArtefatoConteudo | AlegacaoEvidenciaConteudo | AtestadoEvidenciaConteudo | ParecerIAConteudo;
+export interface EventoLedgerConteudo<TPayload = JsonValor> {
+    readonly schemaVersion: string;
+    readonly ledgerId: string;
+    readonly sequence: number;
+    readonly eventId: string;
+    readonly recordedAt: string;
+    readonly previousHash: string;
+    readonly envelope: EnvelopeAssinadoConteudo<TPayload>;
+    readonly hash: string;
+}
+export interface EstadoGateConteudo {
+    readonly gateId: string;
+    readonly targetId?: string;
+    readonly artifactDigest: string;
+    readonly veredito: VereditoConteudo;
+    readonly condition: CondicaoOperacionalConteudo;
+    readonly evidenceIds: readonly string[];
+    readonly assessmentIds: readonly string[];
+    readonly blockers: readonly string[];
+}
+export interface ProjecaoPipelineConteudo {
+    readonly authoritative: false;
+    readonly ledgerId: string;
+    readonly ledgerHead: string;
+    readonly runId: string;
+    readonly generatedAt: string;
+    readonly gates: readonly EstadoGateConteudo[];
+    readonly targets: readonly AlvoConteudo[];
+    readonly artifacts: readonly ArtefatoConteudo[];
+    readonly nextActions: readonly string[];
+}

package/dist/pipelineConteudo/types.js

@@ -0,0 +1,4 @@
+// SEMA-GOVERNED: sema.produto.pipeline_conteudo + confianca + ledger + estado + adaptadores
+// Descricao: tipos abertos do pipeline AI-native de conteudo, sem enum de canal, marca ou formato.
+export {};
+//# sourceMappingURL=types.js.map

package/docs/README.md

@@ -17,6 +17,9 @@ Start here:
 - [Commands](./commands.md)
 - [Syntax](./syntax.md)
 - [Profiles](./profiles.md)
+- [AI-native Content Pipeline](./pipeline-conteudo.md) — signed-policy,
+  multi-channel and multi-format orchestration for external AI runners, with
+  canonical ledger replay and no native human-review path.
 - [Documentation Governance](./documentation.md)
 - [Repository Boundary](./repositories.md)
 - [Security](./security.md)

package/docs/pipeline-conteudo.md

@@ -0,0 +1,246 @@
+# AI-native Content Pipeline
+
+Sema Content Pipeline is a contract-first control plane for creating content
+with AI agents across arbitrary destinations and formats. It plans work,
+verifies signed evidence, evaluates policy, derives canonical state, and tells
+an external runner what can happen next. It does not execute agents, call
+creative tools, publish content, or provide a native human-review path.
+
+Brands, channels, accounts, and formats are configuration. They are never
+closed enums in the pipeline core. A video channel, a site, a newsletter, an
+RSS feed, or a future destination all use the same target and adapter model.
+
+## Architecture
+
+```text
+.sema contracts, target set, and signed policy
+  -> Sema creates a declarative plan
+  -> external runner invokes producer agents and tools
+  -> producers submit signed claims and immutable artifacts
+  -> independent adapters/verifiers attest observable facts
+  -> specialized AI evaluators submit signed semantic assessments
+  -> Sema verifies identity, scope, independence, quorum, and deterministic rules
+  -> state is replayed from the canonical ledger
+  -> the external runner receives nextActions
+  -> manifests and dashboards are regenerated projections
+```
+
+Existing Author, research, writing, copy, image, video, creative-QA, and
+publication profiles are optional capabilities used by a pipeline definition.
+They are not the pipeline state machine and they do not become universal
+requirements for every kind of content.
+
+## Trust boundary
+
+A hash proves the identity and integrity of bytes. It does not prove that a
+claim is true. A JSON receipt produced by the runner therefore remains a claim.
+It becomes accepted evidence only when an authorized, independent principal
+attests it with an Ed25519 signature and the attestation matches the exact run,
+artifact digest, target, evidence type, policy, and validity window.
+
+The trust configuration accepts only Ed25519 SPKI public material
+(`-----BEGIN PUBLIC KEY-----`). PKCS#8 private PEM is rejected even though the
+crypto runtime could derive a public key from it. Private keys must stay in the
+producer, evaluator, adapter, or independent verification service that owns
+them. If the executor controls every private key and the canonical store, the
+signatures provide no meaningful separation.
+
+For high assurance, keep trust anchors outside the runner workspace and store
+the ledger in an independently controlled append-only service, WORM store, or
+transparency log. Every trusted operation requires a canonical trust-root digest
+retained by that external boundary; reading `trust.json` and trusting a digest
+from the same file would merely let the executor nominate its own authority.
+
+The signed policy is bound to the exact execution, pipeline definition, trust
+root, ledger, and complete target set through `runId`, `definitionDigest`,
+`trustRootDigest`, `ledgerId`, and `targetSetDigest`. Its `issuedAt` and
+`expiresAt` define the complete authorization window: the trusted `recordedAt`
+of `RUN_STARTED` must satisfy the configured maximum envelope age, and every
+event must be recorded inclusively between those policy bounds. Once
+`expiresAt` passes, the policy cannot authorize another append. It cannot be
+replayed as authorization for another run, and a controller cannot silently
+remove a channel to make a run appear complete.
+
+The trust-root digest and revocation digest are separate external pins. The
+trust root identifies the immutable authority set and its verification rules;
+`revocationDigest` identifies the current revocation overlay. Rotating that
+overlay must not redefine historical signatures, while revoked credentials no
+longer count as active evidence, authorization, or quorum.
+An authority key in the current revocation overlay cannot authorize a policy;
+historical ledger verification remains a separate operation.
+
+Public-key fingerprints, principal IDs, and key IDs must be unique, so one key
+cannot masquerade as several independent voters.
+
+The local file backend is useful for development and portable replay, but it is
+not advertised as a strong append-only root. A trusted external checkpoint
+(`expectedHead`) is required on ledger reads and writes to detect a truncated
+or concurrently replaced local ledger. A trust file
+inside the current workspace is rejected unless
+`--development-local-trust` is explicit; that flag relaxes file placement only
+and never removes digest pinning.
+
+## Evidence and semantic evaluation
+
+The pipeline separates three things:
+
+- a producer or runner claim (`EVIDENCE_CLAIMED`);
+- an independently signed observation (`EVIDENCE_ATTESTED`);
+- a specialized AI assessment (`AI_ASSESSMENT`).
+
+Sema evaluates deterministic constraints directly. Artifact metadata and
+producer claims never prove those constraints by themselves: observable facts
+must come from independently signed adapter/verifier observations bound to the
+artifact digest, run, target, policy, and trust context. This includes
+`observedMediaType`, obtained through independent sniffing; an artifact's
+producer-declared `mediaType` cannot satisfy adapter acceptance on its own.
+Semantic questions such as
+factual quality, narrative quality, channel fit, brand voice, accessibility,
+or audiovisual coherence require assessments from principals with the declared
+capability. Sema verifies those assessments against policy; it does not invent
+their semantic judgment.
+
+Critical gates can require multiple approvals, distinct principals, distinct
+control domains, and producer/evaluator separation. Deterministic attestations
+use `minAttestationsPerEvidence` and
+`minDistinctAttesterControlDomains` for every required evidence type; semantic
+AI opinions use `minApprovals` and `minDistinctControlDomains`. Multiple agent
+names under one credential or control domain do not create an independent
+quorum.
+Every gate that contributes to canonical completion must set
+`producerDisjoint: true`; self-approval cannot be configured as a completion
+shortcut.
+
+A generic `content.evidence.attest` capability never authorizes evidence. Base
+evidence requires `content.evidence.attest:<evidenceType>`. Adapter evidence is
+stricter: the externally pinned trust root must grant
+`content.adapter.attest:<adapterId>@<version>:<evidenceType>`, and the signed
+data must name the exact adapter and version. Delivery confirmation also carries
+an `observationDigest`; it is not a bare success receipt from the runner.
+
+## Canonical state
+
+Ledger events are hash-chained and carry signed envelopes. The state engine
+replays the ledger deterministically. It never reads `concluido`, `approved`, or
+similar fields from a hand-edited manifest.
+
+Event and envelope wrappers are exact schemas: unsigned extra fields are
+rejected. Every append requires the signed policy envelope and a complete
+expected context derived from it. The genesis event is anchored to the
+externally pinned trust domain, trust root, ledger ID, policy, definition, and
+complete target set; none of those values are accepted merely because
+`RUN_STARTED` declared them. During append, envelope freshness is measured
+against the platform clock; caller-controlled `recordedAt` cannot backdate an
+expired signature.
+
+Gate verdicts are independent from operational conditions:
+
+- verdict: `NAO_AVALIADO`, `APROVADO`, `REPROVADO`, `INCONCLUSIVO`;
+- condition: `PENDENTE`, `PRONTA`, `EXECUTANDO`,
+  `AGUARDANDO_EVIDENCIA`, `AGUARDANDO_EVENTO_EXTERNO`,
+  `FERRAMENTA_INDISPONIVEL`, `CAPACIDADE_AUSENTE`,
+  `AUTORIZACAO_AUSENTE`, `FALHA_TRANSITORIA`, `FALHA_TERMINAL`, or
+  `EXECUCAO_ENCERRADA`.
+
+For example, a content-quality gate may be `APROVADO` while a publication gate
+is `NAO_AVALIADO` and its operational condition is
+`AGUARDANDO_EVENTO_EXTERNO`. Tool unavailability never approves or rejects a
+gate. Missing semantic capacity becomes `CAPACIDADE_AUSENTE`; the runner can
+route the task to another authorized AI evaluator.
+
+Changing an artifact creates a new digest. Evidence and assessments bound to
+the previous digest become superseded for gate calculation. Targets also evolve
+independently: failure for one destination does not invalidate another.
+
+Every generated manifest declares:
+
+```json
+{
+  "authoritative": false,
+  "ledgerHead": "sha256:..."
+}
+```
+
+It is a read model, not an input to canonical state.
+
+The isolated gate calculator is internal. The public authoritative surface is
+canonical state derivation after the ledger replay has independently derived
+the producer, authorization scope, target, and complete producer lineage.
+The npm package exposes only its root entrypoint; `dist/pipelineConteudo/*`
+deep imports are blocked by the package `exports` map, including in the
+generated public tarball.
+
+## Open adapters and targets
+
+An adapter declares an opaque `adapterId`, immutable version, accepted media
+types, format profiles, deterministic constraints, required public metadata,
+optional public metadata, and externally verifiable confirmation predicates.
+`requiredMetadata + optionalMetadata` is the exact top-level allowlist signed
+through the definition digest. Target metadata accepts only declared keys and
+scalar public values. `accountScope` is a strict `account:<alias>` reference;
+credentials and tokens remain outside the ledger and are resolved by the
+external runner from that alias. Artifact metadata is prohibited in v1 until a
+separate signed schema exists. Recursive DLP checks additionally reject common
+secret key names, private-key material, JWTs, provider-token prefixes, and
+authorization headers without echoing the detected value.
+Deterministic-constraint configuration has an exact one-field numeric schema;
+extra, ambiguous, or sensitive fields block the adapter before its constraints
+can be copied into a public plan. Free-form operational `reason` text passes
+the same credential detector before it can enter the signed ledger.
+
+Public CLI failures expose static error codes and a sanitized command label;
+filesystem exceptions, unknown subcommands, rejected schema field names, and
+invalid trust identifiers are not echoed. Domain identifiers that belong to a
+valid definition or signed ledger (such as stage, target, evidence, and
+assessment IDs) remain public because they are required for planning,
+traceability, and remediation; they are never credential storage.
+
+Each stage declares an `adapterPolicy`:
+
+- `NONE`: no adapter gate is introduced by the stage;
+- `CONSTRAINTS`: require independently signed observations for the adapter's
+  deterministic format constraints;
+- `CONFIRMATION`: require the target adapter's externally verifiable
+  confirmation predicates.
+
+Pipeline definition v1 requires exactly one declared output per stage. A stage
+that needs several artifacts must split them into semantically distinct stages,
+preserving explicit lineage and dependency edges.
+
+No platform literal is required by the core. A project-specific experience is
+just a pipeline definition plus target configuration and can coexist with any
+number of other channels and formats.
+
+## CLI
+
+The public surface is `sema conteudo`:
+
+```bash
+sema conteudo capabilities --json
+sema conteudo validar <definition.json> --json
+sema conteudo planejar <definition.json> --alvos-arquivo <targets.json> --json
+sema conteudo validar-envelope --envelope-arquivo <envelope.json> --confianca-arquivo <trust.json> --trust-root-digest <sha256:...> --revocation-digest <sha256:...> --payload-type <type> --json
+sema conteudo registrar <ledger.ndjson> --envelope-arquivo <envelope.json> --politica-arquivo <policy-envelope.json> --confianca-arquivo <trust.json> --trust-root-digest <sha256:...> --revocation-digest <sha256:...> --ledger-id <id> --expected-head <sha256:...> --json
+sema conteudo status <definition.json> --politica-arquivo <policy-envelope.json> --confianca-arquivo <trust.json> --trust-root-digest <sha256:...> --revocation-digest <sha256:...> --ledger-arquivo <ledger.ndjson> --expected-head <sha256:...> --json
+sema conteudo projetar <definition.json> --politica-arquivo <policy-envelope.json> --confianca-arquivo <trust.json> --trust-root-digest <sha256:...> --revocation-digest <sha256:...> --ledger-arquivo <ledger.ndjson> --expected-head <sha256:...> --saida <manifest.json> --json
+```
+
+`--trust-root-digest` and `--revocation-digest` may also come from the
+externally controlled `SEMA_CONTENT_TRUST_ROOT_DIGEST` and
+`SEMA_CONTENT_REVOCATION_DIGEST` environment variables. If a value is present
+in both sources, the values must match. `registrar`, `status`, and `projetar` also require the
+externally retained `expectedHead`, including the genesis head for a new
+ledger. This protects against stale concurrent append and detects truncation;
+it does not turn a runner-controlled file into protected storage.
+
+## External runner protocol
+
+The runner may schedule, execute, retry, resume, and request more AI capacity.
+It may submit signed envelopes and report operational conditions. It may not
+write calculated verdicts, mark an execution complete, edit canonical history,
+or promote its own claim to accepted evidence.
+
+The runner advances only from `nextActions` derived by Sema. There is no native
+human-approval transition. Organizations may build an external policy adapter
+for human input if they need one, but that is outside this AI-native pipeline
+and never a hidden fallback.

package/docs/testing.md

@@ -26,7 +26,7 @@ encoding in every published document. The plugin smoke must validate the repo
 marketplace, manifest version, installed skill copy, and absence of Sema MCP.
 After push and npm publication, `npm run release:verificar-distribuicao` must
 repeat that installation from the remote `gerlanss/Sema` marketplace and prove
-that GitHub HEAD, the installed skill, and npm 2.1.0 all describe the same
+that GitHub HEAD, the installed skill, and npm 2.2.0 all describe the same
 release.
 
 Native generator evidence is mandatory when changing C#/.NET or C++ support.

package/exemplos/pipeline-conteudo/README.md

@@ -0,0 +1,44 @@
+# Content pipeline example
+
+This fixture proves that the pipeline core is independent from a platform,
+brand, or media type. One definition creates a global editorial core and two
+isolated target branches: a long-form document and a spoken audio episode.
+The same AI-native plan can add any number of channels and formats without
+making this experience the only delivery path.
+
+Definition v1 declares exactly one output per stage. Each stage also selects an
+  `adapterPolicy`: `NONE`, `CONSTRAINTS`, or `CONFIRMATION`. Constraint gates are
+  satisfied only by independently signed observations bound to the produced
+  artifact, including an independently observed media type; producer metadata
+  is not evidence of its own correctness.
+
+```bash
+sema conteudo validar exemplos/pipeline-conteudo/definicao.json --json
+sema conteudo planejar exemplos/pipeline-conteudo/definicao.json --alvos-arquivo exemplos/pipeline-conteudo/alvos.json --json
+```
+
+The example intentionally contains no private keys, signed policy, trust pins,
+ledger checkpoint, or signed events. In a live run, an authorized policy
+  authority must sign a policy bound to the execution and complete target set
+  through `runId` and `targetSetDigest`, with explicit `issuedAt` and `expiresAt`
+  authorization bounds. Every event must be recorded within that interval, and
+  every append also supplies that policy envelope. Keep the
+  trust-root digest, current `revocationDigest`, and
+required `expectedHead` outside the runner-controlled workspace. Generate
+events in independently controlled producer, evaluator, and adapter processes;
+  never commit production private keys to a Sema workspace. The adapter's
+  `requiredMetadata + optionalMetadata` is the exact scalar public allowlist;
+  artifact metadata is unavailable in v1. The runner resolves credentials
+  externally from a strict `account:<alias>` reference.
+
+Every gate declares separate deterministic-attester and semantic-AI quorums.
+Use `content.evidence.attest:<evidenceType>` for ordinary attestations. Adapter
+observations use the stricter
+`content.adapter.attest:<adapterId>@<version>:<evidenceType>` capability and
+signed adapter/version binding; a generic receipt capability is intentionally
+insufficient.
+
+The runner executes and resumes work from Sema's derived `nextActions`. It does
+not calculate verdicts or edit completion state. Operational conditions remain
+separate from gate verdicts, and every generated manifest is a non-authoritative
+projection of the canonical ledger. There is no native human-review fallback.

package/exemplos/pipeline-conteudo/alvos.json

@@ -0,0 +1,23 @@
+[
+  {
+    "targetId": "documento-principal",
+    "adapterId": "destination.document",
+    "accountScope": "account:publisher.site-a",
+    "formatProfileId": "long-form",
+    "locale": "pt-BR",
+    "metadata": {
+      "title": "Exemplo de conteúdo multiformato"
+    }
+  },
+  {
+    "targetId": "episodio-audio",
+    "adapterId": "destination.audio-feed",
+    "accountScope": "account:publisher.feed-a",
+    "formatProfileId": "spoken-episode",
+    "locale": "pt-BR",
+    "metadata": {
+      "title": "Exemplo de conteúdo multiformato",
+      "description": "A mesma intenção editorial em um destino de áudio independente."
+    }
+  }
+]