@zaip-ai/cli 3.3.0 → 3.5.0

package/templates/.agents/runtime/checksums.sha256

@@ -1,11 +1,11 @@
 b146bd0c7c60b1ab43c4f71e0b1d2262c6df6da6f7053a0425f834ccb77a6b48  LICENSE
 bc02cba77e8d51e5c580f43668863dc868eda66f1ff663bfaa49fcf3ca16320e  THIRD_PARTY_NOTICES.md
-5eee6c0c5c6901f5e523f0a434bca4106e1ff7136deb451f982b0bb1a7b13716  VERSION
-4db3d63944b2c9f28019e705e4f125f6bcceb877e3efa5954cc7555a99b73536  bin/zaip.mjs
-dd2a7c216fd2c9d4f33164ae850af05db51b0b3ff885ddf03760d00fc1dcd491  manifest.json
+76120c1f2c4311c2154c22a6b58e00e411e0ebe76afae0daf608d9196c61f114  VERSION
+cbff3ad8c72113f0dc488435be4fc09422dc7917dff2aeb00916aa1d1a1a9015  bin/zaip.mjs
+a88665505d09788febe6df78f48803e84a6869dc14dcb84af6369c029ea95c96  manifest.json
 7f89219d7c567c82a51679ad136d84364bded7ac659492537e125d33b1d58a7a  migrations/001-layout-v1.json
 5f8c48b286d0b44d8fbb57a9a5d009a8a500439aa3148d750b8f193f72995c9f  migrations/002-layout-v2.json
 2d738247131a923ea6e3a32d0d1d6de763866fd96a8a8dc75d127a343809b0aa  pnpm-lock.sha256
-dd21d399e85ec0791965450a32fa13af51e71e17b86cc7ee11e8ce8072868c32  provenance.json
-cc111be184be67dd46cb46fb3f8fe75b192e33f3114d8c6c9cc0639a841962cf  sbom.cdx.json
+1a4556299d5ac62fe6e010a166697b772309543d2aefdb55c2f161dfc4e58016  provenance.json
+043030cee5e42466be7b771992b6a83d390babdfecdcc69f0babc329ac8a0def  sbom.cdx.json
 b3ffedf9e146be802a15b4009f33e031dec3071ca1525e12c67606fd964a3067  schemas/contracts.schema.json

package/templates/.agents/runtime/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "name": "zaip-aios",
-  "version": "3.3.0",
+  "version": "3.5.0",
   "node": ">=22",
   "files": [
     "LICENSE",

package/templates/.agents/runtime/provenance.json

@@ -2,10 +2,10 @@
   "schema_version": 1,
   "statement_type": "self_reported_build_integrity",
   "authenticity": "unverified",
-  "version": "3.3.0",
+  "version": "3.5.0",
   "source_origin": "zaip-aios:local-build",
   "lockfile_sha256": "f8557f3600849eb880b8f245b63b80fed9a3e9addf2c5f2c6d492547af900219",
-  "sbom_sha256": "cc111be184be67dd46cb46fb3f8fe75b192e33f3114d8c6c9cc0639a841962cf",
-  "runtime_sha256": "3925086e5b413bca4e23fc2f7bda7298ab11e28cb803b65e67492d1ef7a66f10",
-  "statement_sha256": "bb71d94b1a0092923e1480b2bced65a01ee0875f24740349155ad9bbff058039"
+  "sbom_sha256": "043030cee5e42466be7b771992b6a83d390babdfecdcc69f0babc329ac8a0def",
+  "runtime_sha256": "85e40f8049e1bd81b58ea491c44ea76471432a86c866a5820d15ce8e0a34a0ae",
+  "statement_sha256": "bf42821431565815e19d8f6f66f3a2450078322b38739ac707efbbb5c87e9ae9"
 }

package/templates/.agents/runtime/sbom.cdx.json

@@ -6,7 +6,7 @@
     "component": {
       "type": "application",
       "name": "zaip-aios",
-      "version": "3.3.0"
+      "version": "3.5.0"
     }
   },
   "components": [

package/templates/.agents/skills/zaip-skill-execution/SKILL.md

@@ -11,6 +11,19 @@ Carregue [a governança de execução e delegação](references/runtime-governan
 
 Use esta skill somente quando o usuário pedir execução. `prepare` não autoriza mutação nem promoção para `ready`; quando a execução foi pedida explicitamente, prepare o PRD/SPEC ainda em `draft`, se necessário, e então execute sem exigir outra confirmação intermediária.
 
+## Continuidade do pedido de execução
+
+“Execute esta SPEC/este PRD” autoriza finalizar a preparação necessária, materializar, ativar e executar toda a DAG selecionada até verificação e finalização. Essa autorização permanece durante a preparação e o rework necessário dentro do mesmo escopo; um sucessor canônico preserva o vínculo e a autorização existente. Pedido somente de planejamento ou de `ready` continua sem autorizar implementação.
+
+- Não encerre após criar/validar plano, sucessor, DAG ou Execution ativa. Não peça “continue execução” nem outra confirmação só porque a preparação consumiu tempo ou contexto; faça checkpoint/refresh e prossiga.
+- `spec execute`/`prd execute` ativam o macro e retornam `continuation.required`; isso é handoff obrigatório, não prova de implementação. Em runtime gerenciado, acione `execution run EXEC`; na colaboração nativa Codex, siga a seção de DAG nativa abaixo. Use somente um caminho de dispatch, com a mesma Execution e atribuição válida.
+- Depois de cada Task, execute as próximas elegíveis; ao terminar a DAG, realize os gates parentais e Gui. Só encerre com resultado observado ou impedimento concreto após recuperação permitida. Ramos independentes continuam somente quando a política de falha da DAG permitir.
+- Falta real de autoridade, informação essencial, capacidade do host ou gates continua sendo bloqueio. Informe a causa e a condição de retomada; não invente sucesso, nova autorização, identidade ou ancestralidade para continuar.
+
+Antes de encerrar com trabalho pendente ou responder a uma falha, aplique [continuidade automática e parada justificada](references/autonomous-continuation.md). O perfil congelado e seu ledger decidem recuperação; reparação elegível usa a autorização existente, sem pedir outro turno.
+
+## Passos de execução
+
 1. Carregue o PreparedPlan e valide hash, origem, Requirements/AC, DAG, write scopes e estado atual. Antes de selecionar executor, carregue as Rules aplicáveis; para decisão comercial, use `$RULE-SPECIALIST-ROUTING` como fonte única da matriz de roteamento. Ao construir ou diagnosticar o plano externo, leia [o contrato compacto](references/prepared-plan.md).
 2. Materialize idempotentemente Change, Tasks e Execution antes da primeira alteração do produto.
 3. A partir da tentativa explícita de `execute`, classifique uso como `execution`; inicie Execution, Changes, Tasks elegíveis e Runs com atribuição ao nível de entrada (`task`, `spec` ou `prd`). Ausência de diff não retroage a fase: registre `changed_files` vazio e o resultado real.

package/templates/.agents/skills/zaip-skill-execution/references/autonomous-continuation.md

@@ -0,0 +1,17 @@
+# Continuidade automática e parada justificada
+
+O desenvolvimento autorizado continua automaticamente. Antes de terminar um turno com trabalho pendente, o orquestrador aplica esta sequência:
+
+1. Consulte o estado real, a autorização vigente, a política da DAG e o perfil congelado da Task. Use o ledger persistente existente; na ausência de autonomy-v1, respeite os limites legados. Configuração nova não renova tentativas antigas; valores desconhecidos não significam zero ou ilimitado.
+2. Havendo trabalho elegível, implemente, valide e continue as próximas Tasks. Agente ativo, lease ocupado, checkpoint de contexto e transição de fase exigem espera ou refresh, não uma mensagem “continue execução”. Não duplique invocações pendentes.
+3. Falha recuperável dentro do escopo aciona diagnóstico, retry operacional, reparação ou replanejamento permitido pelo perfil, sem nova confirmação. Registre cada tentativa e reserve o orçamento antes do dispatch. Os comandos explícitos de resume/rework são operações canônicas que o agente executa com a autorização já vigente; não significam exigir outro pedido humano.
+4. Pare quando houver cancelamento humano, impedimento de autoridade/segurança, dependência ou capacidade essencial indisponível após recuperação permitida, falha impeditiva ou esgotamento real da política. Nunca contorne esses motivos, apague contadores, aumente perfil, reabra completed/cancelled ou invente prova. Perfil Persistente não remove esses limites, embora não tenha teto numérico de tentativas.
+5. Respeite failure_policy: continue_independent permite ramos elegíveis independentes; stop_on_terminal_failure impede novo dispatch enquanto o motivo terminal permanecer. Nenhuma política autoriza executar dependentes sem aceite da dependência.
+6. Após a última Task, avance para gates parentais e finalização. A resposta terminal deve ser conclusão comprovada ou parada justificada; quantidade de trabalho, duração e tamanho de contexto não são falhas do produto.
+
+## Saídas e papéis
+
+- Em progresso, informe o resultado observado e a próxima ação que está executando. Não termine com “envie continue”, “posso prosseguir?” ou “aguardo autorização” quando a autorização e a recuperação aplicável já existem.
+- Em parada real, informe Task/Execution afetada, motivo comprovado, perfil e consumo observado quando disponíveis, recuperação tentada, condição objetiva de retomada e a única ação humana necessária, se houver. Não sugira uma nova tentativa que ultrapasse o perfil.
+- Executor termina sua unidade e devolve evidências ao orquestrador; reviewer/finalizer devolvem sua decisão e não implementam nem criam filhos. O término de um filho não autoriza o orquestrador a abandonar a entrega.
+- Stop do host é sinal de término físico, não autorização para fabricar dispatch, reabrir registros ou aprovar trabalho. Preserve recibos, idempotência e a proteção contra loops do hook. Continuidade é realizada pela invocação viva ou pelo coordenador autorizado.

package/templates/.agents/skills/zaip-skill-execution/references/correction-cycle.md

@@ -1,7 +1,7 @@
 # Ciclo de correção e bloqueio
 
-Carregue esta referência somente antes de uma nova correção. Falha operacional transitória, cuja recuperação é esperada, recebe retry limitado; impedimento essencial deixa a Task `blocked`; falha lógica exige correção localizada ou repair/rework explícito.
+Carregue esta referência somente antes de uma nova correção. Falha operacional transitória, cuja recuperação é esperada, recebe retry limitado; impedimento essencial deixa a Task `blocked`; falha lógica exige correção localizada ou comando canônico de repair/rework dentro da autorização vigente. Operação explícita não exige nova autorização humana quando escopo, perfil e ledger permitem recuperação automática.
 
 Registre nos findings, Change ou Run existentes somente resultados observáveis: falha, tentativa e resultado, aprendizado ou hipótese nova, e próxima ação e teste discriminante; não registre raciocínio privado. Se a mesma falha reaparecer após uma correção, revise a hipótese antes de editar novamente. Evidência pode refutá-la mesmo quando o teste não passa. Diff, ID cosmético ou mera ausência de erro não demonstram avanço.
 
-Preserve escopo e critérios de aceite; evite melhorias opcionais e valide primeiro a hipótese específica, repetindo validação ampla somente por mudança relevante ou gate exigido. Respeite os limites e contadores existentes, sem criar paralelos; um replanejamento não os reinicia nem cria identidades novas para ganhar tentativas. Sem rota fundada, ou quando o limite aplicável se esgota, marque `blocked` com a condição objetiva de retomada no lifecycle. Astra só é usado onde a política atual permite; Task avulsa preserva modelo e effort selecionados pelo host.
+Preserve escopo e critérios de aceite; evite melhorias opcionais e valide primeiro a hipótese específica, repetindo validação ampla somente por mudança relevante ou gate exigido. Respeite os limites e contadores existentes, sem criar paralelos; um replanejamento não os reinicia nem cria identidades novas para ganhar tentativas. Esgotada a recuperação, use `failed` somente para impedimento técnico comprovado; falta de acesso, prova, autoridade ou conclusão segura usa `blocked`, com a condição objetiva de retomada. Não peça “continue execução” para repetir uma tentativa vedada. Antes de uma parada, aplique [o contrato de continuidade](autonomous-continuation.md). Astra só é usado onde a política atual permite; Task avulsa preserva modelo e effort selecionados pelo host.

package/templates/.agents/skills/zaip-skill-github-deploy/SKILL.md

@@ -13,6 +13,7 @@ Read [the deployment workflow](references/deployment-workflow.md) for the detail
 
 - The exact command “faça deploy” authorizes commits covering all versionable pending changes in the selected worktree, followed by push and Release, after secret, size and ignore checks. The selected worktree is the complete publication scope; other worktrees remain outside it.
 - Resolve dirty state, untracked files, generated projections, branch divergence and repairable local/remote failures automatically within that scope. Limit repairs to the evidenced cause, with up to five repair cycles; stop when the same root cause remains after two repairs.
+- Treat the selected worktree's local branch, recovery branch or detached state as the source candidate only. The configured deploy branch is the remote target; a mismatch between source and target is not a blocker and never requires checking out the target locally.
 - Stop only for an unresolved index conflict after bounded repair, secrets, files at or above GitHub's 100 MB limit, unavailable authentication/authority, external outage, destructive requirement, or ambiguous scope expansion.
 - Never force push, rewrite history, replace remotes, change credentials or Git/SSH configuration, bypass checks, or deploy to another service.
 - Git-only publication of existing commits needs no artificial Task. Product edits or new product commits require real Task ownership; materialize missing authorized work before editing. Records/local-only snapshots are exempt.
@@ -24,9 +25,9 @@ Before the first Git mutation, retain sanitized authority in progress and the te
 ## Prepare the selected worktree
 
 1. Inspect Git status, pending paths and diff summary. Review every inventoried versionable file for secrets, size and ignore policy.
-2. Read `.agents/config/project.yaml`. Resolve the explicit frontend/backend scope from `deploy.frontend.branch` or `deploy.backend.branch`; configured `main` is permitted. `deploy.database.branch` must remain literal `beta`. The legacy `deploy.branch` fallback remains non-production.
-3. Prove folder-scoped SSH using `scripts/preflight.mjs --repository . --remote origin --scope frontend` (or the actual authorized scope). Run at most once per cycle; recheck only after an evidenced repair or changed target. Require SSH origin, configured key, Git identity and successful `ls-remote`; no process overrides or credential/config edits.
-4. Fetch once per cycle and compute ahead/behind. Before reconciliation, create a recoverable branch reference and preserve tracked plus untracked changes in a named stash. Use bounded rebase by default. Restore with `git stash apply`; verify preservation, retain the stash until success, and combine conflicts from observed intent. Never reset or force.
+2. Read `.agents/config/project.yaml`. Resolve the explicit frontend/backend target from `deploy.frontend.branch` or `deploy.backend.branch`; configured `main` is permitted. `deploy.database.branch` must remain literal `beta`. The legacy `deploy.branch` fallback remains non-production. Record the local source branch or detached state separately from this target.
+3. Prove folder-scoped SSH using `scripts/preflight.mjs --repository . --remote origin --scope frontend` (or the actual authorized scope). Run at most once per cycle; recheck only after an evidenced repair or changed target. Require SSH origin, configured key, Git identity and successful `ls-remote`; no process overrides or credential/config edits. Preflight accepts a named recovery branch or detached source and returns it separately from the configured target.
+4. Fetch once per cycle and compute ahead/behind between the source candidate and configured remote target. Before reconciliation, create and verify a recoverable branch reference, including for detached HEAD, and preserve tracked plus untracked changes in a named stash. Use bounded rebase by default without switching to the target branch. Restore with `git stash apply`; verify preservation, retain the stash until success, and combine conflicts from observed intent. Never reset or force.
 5. Re-inventory after reconciliation. Stage the reviewed paths with `git add -- <explicit-pathspecs>`; never use `git add -A`, `git add -u`, broad globs or ignored files. Explicit deploy permits the whole inventoried selected worktree, without mandatory functional partitioning.
 6. Run required or evidenced gates only. Reuse unchanged valid evidence; bypass Turbo cache for the failed remote gate when repairing CI. A failed gate starts a new cycle only after a concrete repair or new remote evidence.
 
@@ -42,15 +43,17 @@ Every product commit requires causal Task/Change/Execution records and matching
 
 1. Compose `$zaip-skill-release-qualification` and follow [local preparation](../zaip-skill-release-qualification/references/local-preparation.md). Synchronize and commit before preparing the clean exact SHA. Failed or stale evidence is not qualification.
 2. Resolve the previous Release, next canonical version and package identity using [release identity](references/release-identity.md). For the framework, `vN.N` maps to package `N.N.0`; only GitHub Actions publishes `@zaip-ai/cli` to npm.
-3. For `zaip-ai/zaip-aios`, use `scripts/local-release-deploy.mjs`. It prepares/verifies, pushes the exact SHA to configured `main`, uploads verified assets to a draft, then publishes the Release. Enable the thin publisher only after explicit rollout authority, public trust enrollment and signed full local qualification. It validates published assets and runs one read-only installation smoke before npm; no private-draft pilot or write token is needed. GitHub Release publication and npm completion remain separate.
+3. For `zaip-ai/zaip-aios`, use `scripts/local-release-deploy.mjs`. It prepares/verifies, pushes the exact SHA to configured `main`, uploads verified assets to a draft, then publishes the Release. Enable the thin publisher only after explicit rollout authority, public trust enrollment and signed local qualification. It validates published assets and runs one read-only installation smoke before npm; no private-draft pilot or write token is needed. GitHub Release publication and npm completion remain separate.
 4. Consumers use `scripts/consumer-release-preparation.mjs guarded-push` with their own policy and explicit branch, SHA and trusted receipt. They have no framework npm/TGZ requirement. See the preparation guide for bootstrap and guarded commands.
-5. Immediately before delivery, reread the configured target; if changed, restart preparation. Helpers bind the exact candidate to `HEAD:refs/heads/<configured branch>` (or its equivalent immutable-SHA refspec); do not bypass them with a manual push.
+5. Immediately before delivery, reread the configured target; if changed, restart preparation. Helpers bind the exact candidate to `HEAD:refs/heads/<configured branch>` (or its equivalent immutable-SHA refspec) independently of the local source branch; do not bypass them with a manual push.
 6. After qualification, a missing Release is normal. Unless explicitly push-only, automatically create the draft for that SHA or resume a verified draft for the same SHA. Verify an already-published exact Release as a no-op; an API/authentication error never proves absence. Refuse conflicting tags/assets without overwrite.
 7. Review complete categorized UTF-8 notes and their exact-range inventory under [release notes](references/release-notes.md). Never use `--generate-notes` as the Release body. Validate the notes, publish with the reviewed notes file, and compare the published body byte-for-byte on readback. Preserve a configured human-only review policy where applicable.
 
 ## Proportional validation
 
-Guarded local framework delivery requires a valid `full-v2` receipt with the mandatory full gate.
+Guarded local framework delivery requires a valid `essential-v3` receipt for the exact candidate.
+It runs the fixed essential integrity, build/type, package and clean-consumer doctor/SQLite/API
+smoke checks. Dashboard-per-tab and XLSX certification are reserved for explicit `--profile full`.
 Without explicit thin-path activation, the default GitHub publisher separately requires the legacy workflow's
 exact-candidate qualification receipt after its full gate and TGZ matrix.
 Rapid impact checks have no test-count ceiling and cannot substitute for release evidence.

package/templates/.agents/skills/zaip-skill-github-deploy/agents/openai.yaml

@@ -1,6 +1,6 @@
 interface:
   display_name: "ZAIP GitHub Deploy"
   short_description: "Publicacao GitHub explicita, Git-only e verificavel"
-  default_prompt: "Use $zaip-skill-github-deploy para pedidos explicitos de deploy, push, publicar ou publicacao GitHub; quando o usuario disser 'faca deploy', trate o worktree selecionado inteiro como escopo autorizado, incluindo arquivos novos, apos os gates de segredos, tamanho, conflitos e SSH; publique via SSH da pasta sem force push nem reescrita de historico."
+  default_prompt: "Use $zaip-skill-github-deploy para pedidos explicitos de deploy, push, publicar ou publicacao GitHub; quando o usuario disser 'faca deploy', trate o worktree selecionado inteiro como escopo autorizado, incluindo arquivos novos, apos os gates de segredos, tamanho, conflitos e SSH; trate a branch local ou detached como origem e a branch configurada como alvo remoto, publicando por refspec explicito via SSH da pasta sem force push nem reescrita de historico."
 policy:
   allow_implicit_invocation: true

package/templates/.agents/skills/zaip-skill-github-deploy/references/deployment-workflow.md

@@ -30,12 +30,12 @@ For publication of existing commits, the conversation and terminal deploy report
 ## Multiple worktrees and divergent history
 
 1. Resolve the selected publishing worktree and inspect its `git status --porcelain`; use `git worktree list --porcelain` only to detect a path collision, never to scan every worktree.
-2. Select exactly one publishing worktree. A clean worktree on another branch or a detached verification worktree does not join the deploy. The selected worktree is the complete publication scope.
-3. Report a detected path collision, but do not block solely because the selected worktree is dirty or contains mixed changes; the explicit “faça deploy” authorization includes those changes. Stop only for an unresolved index conflict, secret/oversize file, authentication failure, or destructive/rewrite requirement.
-4. Prunable or missing worktrees are reported but never pruned automatically. Dirty detached or temporary worktrees are never deleted, reset, stashed or copied into the publishing worktree implicitly.
-5. Fetch once and compute ahead/behind for the publishing branch. If it is behind or diverged, automatically reconcile only the selected branch under this deploy authorization and continue; divergence is not a blocker by itself.
+2. Select exactly one publishing worktree. Its named branch, recovery branch or detached HEAD is the source candidate; `deploy.<scope>.branch` is the remote target. A different local branch or detached source does not join another worktree and is not a blocker. The selected worktree is the complete publication scope.
+3. Report a detected path collision, but do not block solely because the selected worktree is dirty, detached, on a recovery branch or contains mixed changes; the explicit “faça deploy” authorization includes those changes. Stop only for an unresolved index conflict, secret/oversize file, authentication failure, or destructive/rewrite requirement.
+4. Prunable or missing worktrees are reported but never pruned automatically. Unselected dirty detached or temporary worktrees are never deleted, reset, stashed or copied into the publishing worktree implicitly.
+5. Fetch once and compute ahead/behind between the source candidate and the configured remote target. If it is behind or diverged, automatically reconcile only the selected source under this deploy authorization and continue; divergence is not a blocker by itself.
 6. Before reconciliation, create a recoverable branch reference and preserve tracked plus untracked changes in a named stash. Verify both references before proceeding. Use `rebase` unless the user explicitly selected `merge`.
-7. Apply the bounded reconciliation without force. Restore with `git stash apply`, retain the stash until publication succeeds, and resolve generated aggregate conflicts by regenerating them from canonical sources. For ordinary textual conflicts, combine both sides when safe; use the selected worktree's intended version only when the diff and commit history establish that it supersedes the remote version.
+7. Apply the bounded reconciliation without force and without checking out the configured target branch locally. Restore with `git stash apply`, retain the stash until publication succeeds, and resolve generated aggregate conflicts by regenerating them from canonical sources. For ordinary textual conflicts, combine both sides when safe; use the selected worktree's intended version only when the diff and commit history establish that it supersedes the remote version.
 8. After restoration, prove that no unmerged paths remain, re-inventory the diff, and only then begin functional partitioning. Continue automatically through recoverable conflicts and pending repairs; stop only for a genuine terminal blocker defined below.
 
 ## Repair-loop integrity
@@ -49,7 +49,7 @@ For publication of existing commits, the conversation and terminal deploy report
 
 ## Prove folder-scoped SSH first
 
-From the repository root, read `.agents/config/project.yaml` immediately before deployment. `deploy.frontend.branch` and `deploy.backend.branch` are persistent authorization and may be `main`; pass their explicit `--scope`. `deploy.database.branch` is literal `beta`, never falls back to `main`, and requires `--scope database`. The internal `--scope framework` and a legacy preflight without `--scope` use `deploy.branch`, which must remain non-production. A malformed config is a terminal preflight failure. Preflight never creates, renames, or switches a branch.
+From the repository root, read `.agents/config/project.yaml` immediately before deployment. `deploy.frontend.branch` and `deploy.backend.branch` are persistent authorization and may be `main`; pass their explicit `--scope`. `deploy.database.branch` is literal `beta`, never falls back to `main`, and requires `--scope database`. The internal `--scope framework` and a legacy preflight without `--scope` use `deploy.branch`, which must remain non-production. A malformed config is a terminal preflight failure. Preflight reports the local source branch or detached state separately, treats the configured branch only as the remote target, and never creates, renames or switches a branch.
 
 For a database migration request, the database worktree may push only `HEAD:refs/heads/request/<id>` to open its PR against `beta`. That route never targets `main`, never applies SQL, and does not provision a beta branch or Supabase resource.
 
@@ -70,9 +70,11 @@ Run preflight once at the start of the authorized deployment. Classify a failure
 
 ## Validation budget
 
-Guarded local framework preparation requires `full-v2` and its mandatory full gate.
+Guarded local framework preparation requires the signed `essential-v3` receipt. It excludes
+dashboard-tab and XLSX certification; select `--profile full` explicitly when that extended
+coverage is required.
 The default legacy GitHub publisher accepts its separate exact-candidate qualification
-receipt only after the remote full gate and TGZ matrix. Explicit administrator activation after signed full local qualification switches the
+receipt only after the remote full gate and TGZ matrix. Explicit administrator activation after signed local qualification switches the
 publisher to the verified local receipt. One read-only install smoke then gates npm;
 no private-draft pilot is required. Activation is never implicit.
 Follow [local preparation](../../zaip-skill-release-qualification/references/local-preparation.md)
@@ -103,7 +105,7 @@ For a consumer repository, bootstrap its own Ed25519 trust store and define `con
 
 ## Synchronize and publish each cycle
 
-Fetch the selected remote and configured branch once per publication cycle, without SSH overrides. Compute ahead/behind against `<selected remote>/<configured branch>`. When local is behind or diverged, apply the recorded bounded reconciliation strategy and continue after successful verification; stop only if it cannot be completed safely within the bounded repair cycles. Never reset or force.
+Fetch the selected remote and configured target branch once per publication cycle, without SSH overrides. Compute ahead/behind from the selected source candidate against `<selected remote>/<configured branch>`. When the source is behind or diverged, apply the recorded bounded reconciliation strategy in place and continue after successful verification; do not switch to the target branch merely to satisfy publication. Stop only if reconciliation cannot be completed safely within the bounded repair cycles. Never reset or force.
 
 Commits created during Task execution use `[CODEX|CLAUDE] [P:XXXX] [S:XXXX] [T:XXXX] <Task title>`: the effective executing-agent prefix followed by compact lineage.
 

package/templates/.agents/skills/zaip-skill-github-deploy/references/release-identity.md

@@ -34,10 +34,10 @@ current head `sha` and matching `npm_channel`. This extended path qualifies sour
 and the runtime matrix; it does not publish npm or create a Release.
 
 With explicitly enabled `ZAIP_LOCAL_RELEASE_ENABLED=true`, guarded delivery uses
-the signed local `full-v2` receipt and enrolled public trust. It does not require a
+the signed local `essential-v3` receipt and enrolled public trust. It does not require a
 legacy `qualify-cli.yml` receipt or a private-draft pilot. GitHub verifies the
 published assets and runs one read-only exact-TGZ installation/doctor smoke before
-the separate npm publication job. Source tests and full qualification remain local.
+the separate npm publication job. Extended full qualification remains an explicit local option.
 
 Only when the reduced path is disabled does the legacy publisher require
 `github-readiness.mjs` with `--workflow-path .github/workflows/qualify-cli.yml`

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/consumer-release-preparation.mjs

@@ -185,8 +185,7 @@ export async function prepare(input) {
     fail("SHA and GitHub version vN.N are required");
   const repository = resolve(input.repository),
     branch = await configuredBranch(repository, input.scope ?? "frontend");
-  if (branch !== input.branch || git(repository, ["branch", "--show-current"]) !== branch)
-    fail("checked out branch does not match configured branch");
+  if (branch !== input.branch) fail("requested target branch does not match configured branch");
   const policyDigest = await hash(input.policy),
     before = identity(repository, input.sha),
     required = policyFor(await json(input.policy), input);

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/consumer-release-preparation.test.mjs

@@ -46,7 +46,7 @@ test("resolves only the selected application scope from nested deploy configurat
   }
 });
 
-test("GitHub-only guard binds parsed config, policy, receipt expiry and fixed refspec", async () => {
+test("GitHub-only guard binds target config and fixed refspec independently of source branch", async () => {
   const root = await mkdtemp(join(tmpdir(), "zaip-consumer-"));
   try {
     const repo = join(root, "repo");
@@ -96,6 +96,10 @@ test("GitHub-only guard binds parsed config, policy, receipt expiry and fixed re
       }),
     );
     await bootstrap({ trustStore: trust, publicKey: pub, keyId: "consumer" });
+    git(repo, "checkout", "-qb", "codex/recovery");
+    const recoveryPrepared = await prepare(input);
+    await verifyPreparation({ ...input, receipt: recoveryPrepared.receiptPath });
+    git(repo, "checkout", "--detach", sha);
     const prepared = await prepare(input);
     await verifyPreparation({ ...input, receipt: prepared.receiptPath });
     const calls = [];
@@ -105,6 +109,10 @@ test("GitHub-only guard binds parsed config, policy, receipt expiry and fixed re
       ["preflight", "push"],
     );
     assert.equal(calls[1].refspec, sha + ":refs/heads/main");
+    await assert.rejects(
+      () => prepare({ ...input, branch: "beta" }),
+      /requested target branch does not match configured branch/,
+    );
     await assert.rejects(
       () => prepare({ ...input, commands: [{ command: "node", args: ["-e", "process.exit(2)"] }] }),
       /differ/,

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/github-deploy-contract.test.mjs

@@ -1,10 +1,30 @@
 import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import test from "node:test";
 
 const root = resolve(import.meta.dirname, "..", "..", "..");
 const skillRoot = resolve(root, "skills", "zaip-skill-github-deploy");
+const managedDeployFiles = [
+  "rules/workflow.md",
+  "skills/zaip-skill-github-deploy/SKILL.md",
+  "skills/zaip-skill-github-deploy/agents/openai.yaml",
+  "skills/zaip-skill-github-deploy/references/deployment-workflow.md",
+  "skills/zaip-skill-github-deploy/scripts/consumer-release-preparation.mjs",
+  "skills/zaip-skill-github-deploy/scripts/consumer-release-preparation.test.mjs",
+  "skills/zaip-skill-github-deploy/scripts/github-deploy-contract.test.mjs",
+  "skills/zaip-skill-github-deploy/scripts/preflight.mjs",
+  "skills/zaip-skill-github-deploy/scripts/preflight.test.mjs",
+];
+
+test("framework lock matches the deploy guidance and executable contract", async () => {
+  const lock = await readFile(resolve(root, "config", "framework.lock.yaml"), "utf8");
+  for (const path of managedDeployFiles) {
+    const digest = createHash("sha256").update(await readFile(resolve(root, path))).digest("hex");
+    assert.ok(lock.includes(`  .agents/${path}: ${digest}\n`), `${path} lock hash is stale`);
+  }
+});
 
 test("explicit Git publication verbs select the guarded deploy skill", async () => {
   const [skill, openai, core] = await Promise.all([
@@ -49,7 +69,10 @@ test("deploy permission and reconciliation remain explicit and recoverable", asy
   assert.match(skill, /recoverable branch reference/);
   assert.match(skill, /preserve tracked plus untracked changes in a named stash/);
   assert.match(skill, /Restore with `git stash apply`/);
+  assert.match(skill, /local branch, recovery branch or detached state as the source candidate/);
+  assert.match(skill, /configured deploy branch is the remote target/);
   assert.match(openai, /worktree selecionado inteiro como escopo autorizado/);
+  assert.match(openai, /branch local ou detached como origem/);
 });
 
 test("workflow retains the explicit publication routing contract", async () => {

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/preflight.mjs

@@ -31,12 +31,7 @@ try {
     );
     process.exit(0);
   }
-  const checkedOutBranch = git(repository, ["branch", "--show-current"]).trim();
-  if (checkedOutBranch === "") fail("detached HEAD is not deployable");
-  if (checkedOutBranch !== configuredBranch)
-    fail(
-      `checked out branch ${checkedOutBranch} does not match validation deploy.branch ${configuredBranch}; switch or create the configured validation branch manually before publishing`,
-    );
+  const checkedOutBranch = git(repository, ["branch", "--show-current"]).trim() || null;
 
   for (const variable of ["GIT_SSH", "GIT_SSH_COMMAND"]) {
     if (process.env[variable]?.trim()) fail(`${variable} overrides folder-scoped Git SSH config`);
@@ -90,6 +85,7 @@ try {
         configured_branch: configuredBranch,
         production_branch: deployment.productionBranch,
         checked_out_branch: checkedOutBranch,
+        source_detached: checkedOutBranch === null,
         caller_branch: options.branch,
         upstream: upstream || null,
         remote: {

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/preflight.test.mjs

@@ -23,6 +23,8 @@ test("standalone consumer resolves fresh project targets without node_modules",
         windowsHide: true,
         env: { ...process.env, NODE_PATH: "" },
       });
+    const git = (...args) =>
+      spawnSync("git", args, { cwd: root, encoding: "utf8", windowsHide: true });
     const target = () => {
       const result = run("--resolve-branch");
       assert.equal(result.status, 0, result.stderr);
@@ -90,7 +92,19 @@ test("standalone consumer resolves fresh project targets without node_modules",
       assert.match(run("--resolve-branch").stderr, /non-empty|unsupported keys|malformed/);
     }
     config("deploy: { branch: staging, production_branch: production }\n");
-    assert.match(run().stderr, /checked out branch codex\/working does not match/);
+    const recoveryBranch = run();
+    assert.notEqual(recoveryBranch.status, 0);
+    assert.doesNotMatch(recoveryBranch.stderr, /checked out branch|detached HEAD/i);
+    assert.match(recoveryBranch.stderr, /No such remote|remote get-url|push URL|core\.sshCommand/i);
+    assert.equal(git("config", "user.email", "x@y.invalid").status, 0);
+    assert.equal(git("config", "user.name", "x").status, 0);
+    assert.equal(git("add", ".").status, 0);
+    assert.equal(git("commit", "--quiet", "-m", "fixture").status, 0);
+    assert.equal(git("checkout", "--detach", "HEAD").status, 0);
+    const detached = run();
+    assert.notEqual(detached.status, 0);
+    assert.doesNotMatch(detached.stderr, /checked out branch|detached HEAD/i);
+    assert.match(detached.stderr, /No such remote|remote get-url|push URL|core\.sshCommand/i);
     for (const branch of [
       "bad..branch",
       "bad.lock/child",

package/templates/.agents/skills/zaip-skill-move-prd/SKILL.md

@@ -33,6 +33,10 @@ Use apenas comandos canônicos ZAIP. Não edite status diretamente no frontmatte
 - `desenvolva|melhore|aprimore` sempre cria refinamento ou rework e nunca executa automaticamente. Preserve snapshots e tentativas; depois do novo plano, exija nova promoção.
 - PRD `cancelled` é imutável. Use `prd rework <ID-CANCELADO>` para criar sucessor `draft` com tag `rework` e vínculo `rework_of_prd_id`; nunca reabra ou reescreva o cancelado.
 
+## Continuidade após execute
+
+Após ativar, siga imediatamente o contrato de continuidade de `$zaip-skill-execution`: execute as Tasks elegíveis e os gates parentais no mesmo fluxo. A resposta `continuation.required` da CLI indica trabalho pendente; ativação e materialização não comprovam implementação. Não solicite “continue execução” nem encerre por ter consumido o turno preparando o plano. Preserve bloqueios reais, escopo e autoridade.
+
 ## Verificar
 
 Na continuação de um PRD preparado, reutilize a Execution de `plan_ref`/PreparedPlan. Para `blocked` ou `paused`, inspecione a causa e use a retomada canônica autorizada antes da captura; não repita `prd execute` contra um macro já materializado. `conversation start --intent continue --prd ID --execution EXEC` deve resolver a mesma Execution e fase `execution`, rejeitando divergências antes de escrever. Para colaboração nativa Codex, siga a seção de DAG nativa da skill de execução; `native-next` prepara envelopes e não substitui o spawn/capture observado nem os gates de entrega.

package/templates/.agents/skills/zaip-skill-move-spec/SKILL.md

@@ -32,6 +32,10 @@ Use apenas comandos canônicos ZAIP. Não edite status diretamente no frontmatte
 - `implemente` em `draft` finaliza o plano sem executar; em `ready` autoriza `execute`; em `active` continua; em `blocked|failed` usa resume/rework.
 - `desenvolva|melhore|aprimore` sempre cria refinamento ou rework, preserva snapshots/tentativas e nunca executa automaticamente.
 
+## Continuidade após execute
+
+Após ativar, siga imediatamente o contrato de continuidade de `$zaip-skill-execution`: execute as Tasks elegíveis e os gates parentais no mesmo fluxo. A resposta `continuation.required` da CLI indica trabalho pendente; ativação e materialização não comprovam implementação. Não solicite “continue execução” nem encerre por ter consumido o turno preparando o plano. Preserve bloqueios reais, escopo e autoridade.
+
 ## Verificar
 
 1. Leia novamente a SPEC após o comando.

package/templates/.agents/skills/zaip-skill-prd/SKILL.md

@@ -46,13 +46,13 @@ Durante essa etapa, a Execution universal `interaction` e sua Run raiz continuam
 1. Bloqueie PRD sem SPEC, SPEC de outro PRD, referência quebrada, AC vago, DAG cíclica, dependência entre SPECs ou write scopes concorrentes.
 2. Construa uma DAG por SPEC; dependências nunca atravessam SPECs. Mantenha integração e outcomes como gates parentais do PRD.
 3. Gere e valide o PreparedPlan conforme [o contrato compacto](../zaip-skill-execution/references/prepared-plan.md), persista-o e pré-aloque IDs sem materializar trabalho executável nem mudar `draft` para `ready`. Um pedido explícito posterior de `prd ready` materializa, na mesma operação idempotente, a DAG selecionada em Execution, Changes e Tasks `planned`, sem iniciar a execução.
-4. Após `prepare`, mostre que o PRD continua em Definição e pare; não encadeie `prd ready` ou `prd execute` sem a solicitação explícita correspondente.
+4. Após `prepare`, pare em Definição somente quando o pedido se limitar a planejamento. Se o usuário já pediu execução, essa autorização cobre a preparação necessária: prossiga imediatamente com $zaip-skill-execution, sem nova confirmação.
 
 ## Handoff e analyze
 
-Ao receber “execute esse PRD” em outro turno, reutilize o ID canônico e delegue à skill de execução a captura inicial como continuação desse PRD. Não repita o intake `conversation --definition prd,spec` da autoria anterior e não recrie o pacote. Se o documento citado existir apenas como rascunho local, informe essa diferença: a existência de um arquivo de planejamento não comprova PRD canônico nem Run de delivery.
+Ao receber “execute esse PRD”, inclusive no mesmo turno da preparação, reutilize o ID canônico e delegue à skill de execução a captura inicial como continuação desse PRD. Não repita o intake `conversation --definition prd,spec` da autoria anterior e não recrie o pacote. Se o documento citado existir apenas como rascunho local, informe essa diferença: a existência de um arquivo de planejamento não comprova PRD canônico nem Run de delivery.
 
-1. Pare em Definição após `prepare`. Somente após pedido explícito de promoção, use `$zaip-skill-move-prd`: `prd ready` deixa PRD/SPECs selecionadas em `ready` e materializa a DAG sem executá-la; cada Task materializada `planned` e nunca iniciada aparece em Pronto para Executar, mesmo vinculada a SPEC. Somente após pedido explícito de execução, delegue a persistência da continuação, ativação e orquestração para `$zaip-skill-execution`.
+1. Pare em Definição após `prepare` somente sem autorização de execução vigente. Somente após pedido explícito de promoção, use `$zaip-skill-move-prd`: `prd ready` deixa PRD/SPECs selecionadas em `ready` e materializa a DAG sem executá-la; cada Task materializada `planned` e nunca iniciada aparece em Pronto para Executar, mesmo vinculada a SPEC. Somente após pedido explícito de execução, delegue a persistência da continuação, ativação e orquestração para `$zaip-skill-execution`.
 2. Na análise, mostre visão macro por PRD: SPECs, Tasks, Executions, Runs, outcomes, AC/evidência, retrabalho, tokens e custo por fase/total.
 
 ## Assurance de outcomes

package/templates/.agents/skills/zaip-skill-release-qualification/SKILL.md

@@ -21,7 +21,7 @@ their configured branch (default `beta`) and no framework npm requirements.
 The deployment skill must call the guarded helper, which prepares and verifies before sending.
 A changed candidate or invalid evidence requires new qualification.
 Full source qualification runs locally. Extended GitHub qualification is manual;
-the reduced publisher requires enrolled public trust and signed full local qualification.
+the reduced publisher requires enrolled public trust and signed local qualification.
 
 The only public npm package is `@zaip-ai/cli`; the installation entry point is
 `npx @zaip-ai/cli@latest init`. Verify that release automation, manifests, and
@@ -29,19 +29,22 @@ registry checks target only this package before qualifying the next publication.
 
 ## Proportional validation
 
-Local framework preparation receipts require `full-v2`, including the mandatory `pnpm qualify:full`
-gate. The default legacy GitHub path retains its own qualification receipt after the full gate
-and exact-TGZ matrix; it does not use the local receipt format. Neither path accepts rapid-only
-evidence. A rapid check is diagnostic preparation, not release certification. Select rapid tests
-by impact without a count ceiling; a deadline must fail visibly, never truncate coverage.
+Local framework preparation defaults to signed `essential-v3`: deterministic source, lock,
+build/type checks, package/SBOM/TGZ integrity, dependency audit and one clean installed-consumer
+doctor/SQLite/API smoke. It deliberately does not certify every dashboard tab or XLSX export.
+Use `--profile full` only for an explicit extended `full-v2` qualification; it retains
+`pnpm qualify:full`, browser and XLSX coverage. The profile, fixed gate list and artifact digests
+are signed, so an old `full-v2` or rapid receipt cannot satisfy the new default by accident.
+The default legacy GitHub path retains its separate full receipt and exact-TGZ matrix. Rapid
+checks remain diagnostics, never release receipts; timeouts fail visibly.
 Follow [local preparation](references/local-preparation.md) for budgets, exact-candidate
 evidence and cache validity. A failed or timed-out gate emits no success receipt.
 Report local qualification, runtime matrix, GitHub and publication outcomes separately.
 
 ## Guarded local qualification and single remote smoke
 
-An administrator explicitly enables `ZAIP_LOCAL_RELEASE_ENABLED=true` after full local
-qualification and public trust enrollment. The guarded helper publishes the exact signed
+An administrator explicitly enables `ZAIP_LOCAL_RELEASE_ENABLED=true` after signed essential
+local qualification and public trust enrollment. The guarded helper publishes the exact signed
 GitHub Release assets. The read-only verifier validates receipt, policy, SHA and TGZ,
 then runs one Linux installation/doctor smoke before the isolated npm job receives
 publication credentials. No private-draft pilot or contents-write token is required.

package/templates/.agents/skills/zaip-skill-release-qualification/references/local-preparation.md

@@ -13,18 +13,19 @@ to tag `vN.N` and package version `N.N.0`.
 ```text
 node scripts/local-release-preparation.mjs keygen --output-dir <new-key-directory>
 node scripts/local-release-preparation.mjs bootstrap --trust-store <trust-directory> --public-key <public-key.pem> --key-id maintainer --channels latest
-node scripts/local-release-preparation.mjs prepare --repository <absolute-repository> --expected-repository zaip-ai/zaip-aios --sha <40-character-sha> --output-dir <candidate-artifacts> --policy <policy.json> --private-key <private-key.pem> --key-id maintainer --channel latest --version <N.N> --expires-at <future-ISO-within-seven-days> --trust-store <trust-directory>
+node scripts/local-release-preparation.mjs prepare --repository <absolute-repository> --expected-repository zaip-ai/zaip-aios --sha <40-character-sha> --output-dir <candidate-artifacts> --policy <policy.json> --private-key <private-key.pem> --key-id maintainer --channel latest --version <N.N> --expires-at <future-ISO-within-seven-days> --trust-store <trust-directory> --profile essential
 ```
 
 The framework policy is an administrator-reviewed file whose bytes must match the protected
 GitHub policy. Gates are fixed in the versioned helper, not supplied by the caller. Preparation
-fails at the first failed gate. It validates source size before dependency installation; then runs
-the `full-v2` profile: static integrity checks, dependency audit, package validation,
-mandatory `pnpm qualify:full` and exact-TGZ consumer identity. Preparation commands share
-a 60-minute deadline, with process-tree termination and cleanup after expiry. A failure
-never produces a successful receipt. Full qualification includes coverage, skill tests,
-cleanroom/rollback and Dashboard E2E; these gates are not optional for a release receipt.
-Former rapid-only receipts are invalid for this policy and require requalification.
+fails at the first failed gate. The default `essential-v3` profile validates source size, locks,
+build/type integrity, package/SBOM/TGZ binding, dependency audit and one clean installed-consumer
+doctor/SQLite/API smoke. It does not run browser navigation across every dashboard tab or XLSX
+exports. `--profile full` explicitly selects `full-v2`, which also runs the full source suite,
+browser and XLSX qualification. Essential preparation has a 15-minute deadline; full preparation
+has a 60-minute deadline. Both use process-tree
+termination and cleanup after expiry. A failure never produces a successful receipt. Receipts bind
+the selected profile and its fixed gate list, so former receipts require requalification.
 Successful preparation emits receipt, manifest, SBOM and TGZ.
 
 The separate rapid preparation helper has an eight-minute deadline and emits no signed
@@ -41,7 +42,7 @@ is refused. Choose a new output path after repair instead of deleting or overwri
 For an authorized release, call this command with the same arguments and paths:
 
 ```text
-node scripts/local-release-deploy.mjs --repository <absolute-repository> --expected-repository zaip-ai/zaip-aios --sha <40-character-sha> --branch main --output-dir <candidate-artifacts> --policy <policy.json> --private-key <private-key.pem> --key-id maintainer --channel latest --version <N.N> --expires-at <future-ISO-within-seven-days> --trust-store <trust-directory> --notes-file <reviewed-notes.md> --inventory-file <release-inventory.json> --from <previous-release-tag>
+node scripts/local-release-deploy.mjs --repository <absolute-repository> --expected-repository zaip-ai/zaip-aios --sha <40-character-sha> --branch main --output-dir <candidate-artifacts> --policy <policy.json> --private-key <private-key.pem> --key-id maintainer --channel latest --version <N.N> --expires-at <future-ISO-within-seven-days> --trust-store <trust-directory> --notes-file <reviewed-notes.md> --inventory-file <release-inventory.json> --from <previous-release-tag> --profile essential
 ```
 
 `--dry-run` prepares and verifies without sending. The live command verifies again around
@@ -86,7 +87,7 @@ verified SHA. This flow does not require a TGZ, npm version, npm channel or npm
 
 ## Activate the reduced GitHub path
 
-After explicit rollout authority, complete signed full-v2 local preparation and enroll
+After explicit rollout authority, complete signed essential-v3 local preparation and enroll
 only the reviewed public key, exact policy and key ID. Then explicitly enable
 `ZAIP_LOCAL_RELEASE_ENABLED=true` and use guarded delivery. The GitHub Release is published
 with its four signed assets before Actions validates them; the verifier needs only
@@ -99,8 +100,8 @@ The registry digest and channel are always verified by the isolated publisher.
 The default legacy publisher validates `qualification-receipt.json` from the successful
 GitHub qualification run, bound to candidate SHA, run/attempt, channel and exact TGZ. That
 workflow requires the full gate and runtime matrix before issuing its receipt. This is a
-separate accepted remote policy, not a `full-v2` local receipt or a rapid-only exemption.
-The guarded local helper still requires `full-v2` even while legacy remote checks are enabled.
+separate accepted remote policy, not an `essential-v3` local receipt or a rapid-only exemption.
+The guarded local helper requires `essential-v3` even while legacy remote checks are enabled.
 
 An administrator enrolls the public key, exact policy bytes and key ID in protected repository
 variables `ZAIP_LOCAL_RELEASE_TRUSTED_PUBLIC_KEY_B64`, `ZAIP_LOCAL_RELEASE_POLICY_B64` and

package/templates/.agents/skills/zaip-skill-setup/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: zaip-skill-setup
-description: Install ZAIP-AIOS and format the final chat response after init, including installations started before this skill was available.
+description: Install or update ZAIP-AIOS and format the final chat response after init, including installations started before this skill was available.
 ---
 
 # Instalar ZAIP-AIOS
@@ -12,11 +12,26 @@ Para Supabase, a instalação nunca cria branch, preview ou custo hospedado. O f
 Use somente o pacote público `@zaip-ai/cli`: `npx @zaip-ai/cli@latest init`.
 Para escolher o perfil, acrescente `--profile full|dev-lite|lite` ao comando `init`.
 
+## Atualização solicitada
+
+Pedido simples de “update”, “atualize o ZAIP” ou equivalente em projeto instalado usa, por padrão,
+`npx --yes @zaip-ai/cli@latest init --force --yes --profile full` (Windows: `npx.cmd`).
+O pedido autoriza a reinstalação com backup automático e a instalação das dependências e
+pré-requisitos do perfil completo, sem nova confirmação ou dry-run obrigatório. Versão, perfil,
+dry-run ou restrições explícitas prevalecem. O primeiro `--yes` aceita baixar a CLI; o segundo
+confirma o force. Preserve as proteções transacionais e de ownership do instalador.
+Se houver falha, diagnostique o erro concreto; não apague arquivos para contorná-la.
+Valide pelo resultado do init e `doctor --json` do runtime instalado, sem auditar abas do
+Dashboard ou exportações XLSX. Informe versão, backup, dependências e pendências observadas.
+Esse fluxo instala dependências ausentes e preserva as já instaladas; não executa `npm update`.
+
+## Instalação inicial
+
 For the isolated SQLite dashboard, also discover and use `$zaip-skill-sqlite-read-model`.
 Create the disposable dashboard database only from canonical `.agents/records` and
 `.agents/config` sources.
 
-1. Se o `init` acabou de concluir neste turno, vá diretamente ao modelo obrigatório de resposta abaixo; não reinstale nem inicie configuração. Para uma nova instalação, confirme que o usuário quer instalar ZAIP-AIOS em um workspace que ainda não o possui. Se já houver `.agents/config/project.yaml`, não reinstale: encaminhe configuração, personalização, primeiros passos ou edição para `$zaip-skill-config`.
+1. Se o `init` acabou de concluir neste turno, vá diretamente ao modelo obrigatório de resposta abaixo; não reinstale nem inicie configuração. Para uma nova instalação, use o pedido explícito de instalação como autorização. Se já houver `.agents/config/project.yaml` e o pedido for atualização, aplique o fluxo acima; encaminhe configuração, personalização ou primeiros passos para `$zaip-skill-config`.
 2. Faça dry-run e detecte apenas conflitos que impeçam a instalação inicial, como checksum, ownership ou arquivos do usuário que seriam sobrescritos.
 3. Verifique Node.js 22+; instale a versão LTS com `winget` somente quando o usuário tiver autorizado a instalação automática do pré-requisito.
 4. Instale e valide o conteúdo do release: `config/project.yaml`, `config/framework.lock.yaml`, Rules core, Requirements e skills gerenciados pelo manifest, raízes V3 de `records` e, quando distribuído, o dashboard frontend-only em `.agents/dashboard`. Preserve arquivos e Rules locais do projeto.

package/templates/.agents/skills/zaip-skill-setup/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
   display_name: "ZAIP Setup"
-  short_description: "Install ZAIP-AIOS and format the installation reply."
+  short_description: "Install or update ZAIP-AIOS and report the result."
   default_prompt: "Use $zaip-skill-setup to install ZAIP-AIOS or format the final reply after init with Markdown bullets, the installed-version npm link and the final setup question."