@zaip-ai/cli 3.7.0 → 4.0.0

package/templates/.agents/runtime/checksums.sha256

@@ -1,11 +1,11 @@
 b146bd0c7c60b1ab43c4f71e0b1d2262c6df6da6f7053a0425f834ccb77a6b48  LICENSE
 bc02cba77e8d51e5c580f43668863dc868eda66f1ff663bfaa49fcf3ca16320e  THIRD_PARTY_NOTICES.md
-84746b20a3a72f6ff85a629706e50507c1bd200907456b76dd808a2a5ca0efba  VERSION
-5c911d434505e839d55d273fc275e0725dde425e2b4e91219d3cd28e3883c56b  bin/zaip.mjs
-38a97d3f4f2d30deb9bfe0308a62670c9302d6b6fba1b1173bc0c2d30cf12f0b  manifest.json
+e1d49c569ae09b2ede16e2d83820a3809b35eb6c44c13ba9b5330598d6b8f43c  VERSION
+239d00f5ff145dfddbdaee66fa94a286e3e80228bfec8f67919ea6f9099b16a0  bin/zaip.mjs
+57c1b270eed2ecf577dd3e0d13a951380aa96a5a4b5a7adf396f31a1df777e96  manifest.json
 7f89219d7c567c82a51679ad136d84364bded7ac659492537e125d33b1d58a7a  migrations/001-layout-v1.json
 5f8c48b286d0b44d8fbb57a9a5d009a8a500439aa3148d750b8f193f72995c9f  migrations/002-layout-v2.json
 33c98d5dc506bba4b8b3ca612706d9eb05ef13d9e03c33a4f9e65ca7804be9d1  pnpm-lock.sha256
-4ce32e7d7ecc19a30965b99d5242762015639d5890a647e4fbeda64c71d24b90  provenance.json
-77bb58427ab6dbb4cb721e834218b058a266ea94ae91ebc8853ce7e30418009b  sbom.cdx.json
+54fc0f67af77dba2941ab13c90eb77afcd61f3ec62b28c2c6a07961c79e540ff  provenance.json
+9bf5a95c277816679d424ff2fb9a99f2e41b4a32c442c95159c314e3c4efe04f  sbom.cdx.json
 b3ffedf9e146be802a15b4009f33e031dec3071ca1525e12c67606fd964a3067  schemas/contracts.schema.json

package/templates/.agents/runtime/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "name": "zaip-aios",
-  "version": "3.7.0",
+  "version": "4.0.0",
   "node": ">=22",
   "files": [
     "LICENSE",

package/templates/.agents/runtime/provenance.json

@@ -2,10 +2,10 @@
   "schema_version": 1,
   "statement_type": "self_reported_build_integrity",
   "authenticity": "unverified",
-  "version": "3.7.0",
+  "version": "4.0.0",
   "source_origin": "zaip-aios:local-build",
   "lockfile_sha256": "03d08e5bbb198d74014ea4a806fcdeb350db23ec2bf0c2886a2265066555d418",
-  "sbom_sha256": "77bb58427ab6dbb4cb721e834218b058a266ea94ae91ebc8853ce7e30418009b",
-  "runtime_sha256": "ab3104b23c8a07bfe1c1991ba7f12d40300248c54453ef4c88c71e033842b69a",
-  "statement_sha256": "02dc17045e38d3e808a848926a7d8074cccd812e2db0f376505b59d849de0d0b"
+  "sbom_sha256": "9bf5a95c277816679d424ff2fb9a99f2e41b4a32c442c95159c314e3c4efe04f",
+  "runtime_sha256": "3f08dd1f60c42934f982cf368df0610f852a96b19123c8771e85e92cccd24e6e",
+  "statement_sha256": "9c05251add6c72fd1fe61d5353ba239bc693e95a80a03d0389a38b1e6e6f413b"
 }

package/templates/.agents/runtime/sbom.cdx.json

@@ -6,7 +6,7 @@
     "component": {
       "type": "application",
       "name": "zaip-aios",
-      "version": "3.7.0"
+      "version": "4.0.0"
     }
   },
   "components": [

package/templates/.agents/skills/zaip-skill-adapters/SKILL.md

@@ -7,7 +7,7 @@ description: Generate and verify Codex and Claude guidance adapters from canonic
 
 Um `.codex/config.toml` existente sem cabeçalho `zaip-managed` é um overlay local: `adapters build` deve preservá-lo e `adapters check` não deve reportá-lo como drift. Arquivos ausentes ou gerenciados continuam sujeitos à projeção canônica; nenhum outro adapter recebe essa exceção.
 
-1. Trate `.agents/config`, `rules/` e skills como fontes; `AGENTS.md`, `CLAUDE.md` e wrappers são projeções geradas mínimas. A propriedade de cada Rule é definida pela presença no `framework.lock.yaml`.
+1. Trate `.agents/config`, `rules/` e skills como fontes; `AGENTS.md` e wrappers são projeções geradas mínimas. A propriedade de cada Rule é definida pela presença no `framework.lock.yaml`.
 2. Oriente o agente a começar por `project.yaml` e Rules críticas, depois carregar trabalho, Requirements e skills relevantes sob demanda.
 3. Não instrua a carregar todo o histórico, Runs JSONL ou raízes V1 por padrão.
 4. Gere com cabeçalho managed, versão, checksum e allowlist determinísticos; execute `adapters build` e depois `adapters check`.

package/templates/.agents/skills/zaip-skill-executar-fila-pronta/SKILL.md

@@ -1,18 +1,18 @@
 ---
 name: zaip-skill-executar-fila-pronta
-description: Execute the full eligible ready-work snapshot using the canonical queue order.
+description: Execute one eligible top-level ready item per scheduled Codex invocation.
 ---
 
 # Executar fila pronta
 
-Use esta skill para uma rodada idempotente que processa sequencialmente o snapshot elegível da fila. A seleção é estrita: PRD `ready`, depois SPEC `ready` independente, depois Task-first standalone elegível em `Pronto para Executar`.
+Use esta skill para uma rodada idempotente que reivindica e executa **um único item superior** da fila. A seleção é estrita: PRD `ready`, depois SPEC `ready` independente, depois Task-first standalone elegível em `Pronto para Executar`. Uma rodada jamais inicia um segundo item, mesmo quando o primeiro termina rapidamente, falha ou é pulado por disputa.
 
 1. A primeira ação da conversa agendada chama `codex_app set_thread_title` sem `threadId`, usando a hora local `America/Sao_Paulo` no formato exato `[YYYY-MM-DD-T-HH-mm] Tarefa Agendada`. Registre a falha de renomeação observada e continue para a fila; ela não bloqueia a rodada.
 2. Valide o checkout local, `zaip.enabled: true`, registros canônicos e runtime. Leia `.agents/dashboard/work-priority.json` quando existir; ausência ou conteúdo inválido equivale a nenhuma prioridade manual, nunca a uma ordem inventada.
-3. Antes de selecionar, crie atomicamente `.local/automation/ready-queue.lock.json` (diretório local não versionado) com `owner_token` aleatório, `fencing_token`, `acquired_at` e `expires_at`. O `fencing_token` é um inteiro monotônico: toda aquisição que substitui um lock expirado recebe valor maior que o último valor observado. Se existir lock válido de outra rodada, retorne sem efeito; nunca force a sobreposição. Renove o mesmo lock, com token e `owner_token` conferidos, antes de cada candidato. Antes de cada efeito (incluindo iniciar uma Execution), releia o lock e exija ambos os tokens atuais e prazo válido; se a renovação falhar ou o token não for atual, encerre a rodada sem executar mais efeitos. Libere somente ao terminar e apenas se o `owner_token` ainda corresponder; locks expirados podem ser substituídos atomicamente.
-4. Forme os candidatos nesta precedência: (a) PRDs `ready`; (b) SPECs `ready` que não descendem de PRD; (c) Tasks Task-first standalone `prepared`/`planned`, com dependências concluídas e exatamente um PreparedPlan resolvível: `prepared_plan` inline válido **ou** `plan_ref` válido, nunca ambos. A Task ainda não pode ter Execution vinculada e nunca pode ter sido iniciada ou tentada. Para cada candidata, exclua o registro sem `status: planned`, com `started_at`, `attempt_count` diferente de zero, Execution existente, estado de plano ambíguo, ou cujo próprio ID apareça em `task next` ou no conjunto materializado concorrente. Exclua também descendentes de PRD/SPEC e itens `active`, `blocked`, `failed`, `cancelled` ou terminais.
-5. Ordene cada classe por `.agents/dashboard/work-priority.json`: itens enumerados no Kanban vêm primeiro e mantêm a ordem de cima para baixo; os sem enumeração entram depois pelo fallback canônico determinístico. Congele o snapshot ordenado e processe todos os PRDs antes de SPECs, e todos os SPECs antes das Tasks; não misture classes.
-6. Execute cada unidade do snapshot, uma por vez, pelo comando explícito no menor grão (`prd execute`, `spec execute` ou `task execute`). Para uma Task-first elegível, use `task execute` para materializar sua Execution; não crie a Execution por outro atalho. Reavalie o estado antes de cada início e pule o item que deixou de ser elegível. Preserve os gates de write scope, dependências, evidências, testes e finalizador; uma seleção não é autorização para ignorar qualquer gate.
-7. Registre o resultado de cada unidade, as omissões e a ausência de candidatos, e solte o lease. Sem candidato, retorne `no_eligible_work`; com precondição ausente, conflito de lease ou estado ambíguo, falhe fechado e não altere registros.
+3. Antes de selecionar, chame `node .agents/skills/zaip-skill-executar-fila-pronta/scripts/ready-queue-lease.mjs acquire` na raiz do projeto. Ele cria atomicamente `.local/automation/ready-queue.lock.json` (diretório local não versionado) com `owner_token` aleatório, `fencing_token`, `acquired_at` e `expires_at`. Guarde o `owner_token` e `fencing_token` retornados; não os invente. O `fencing_token` é um inteiro monotônico: toda aquisição que substitui um lock expirado recebe valor maior que o último valor observado. Se existir lock válido de outra rodada, retorne sem efeito; nunca force a sobreposição. Renove o mesmo lock com `ready-queue-lease.mjs renew OWNER FENCE` antes de reivindicar o item selecionado e nos checkpoints de uma execução longa. Antes de cada efeito (incluindo iniciar uma Execution), chame `ready-queue-lease.mjs assert OWNER FENCE` e exija sucesso; se falhar, encerre a rodada sem executar mais efeitos. Libere com `ready-queue-lease.mjs release OWNER FENCE` somente ao terminar e apenas se o `owner_token` ainda corresponder; locks expirados podem ser substituídos atomicamente.
+4. Consulte `zaip task ready-next --json` para a seleção canônica e determinística: PRD `ready`; depois SPEC `ready` independente; depois Task-first standalone `prepared`/`planned`, com dependências concluídas e exatamente um PreparedPlan resolvível: `prepared_plan` inline válido **ou** `plan_ref` válido, nunca ambos. A Task ainda não pode ter Execution vinculada e nunca pode ter sido iniciada ou tentada. O comando exclui Task sem `status: planned`, com `started_at`, `attempt_count` diferente de zero, Execution existente, estado de plano ambíguo, ou cujo próprio ID apareça em `task next` ou no conjunto materializado concorrente. Exclui também descendentes de PRD/SPEC e itens `active`, `blocked`, `failed`, `cancelled` ou terminais. Falha de leitura/validação não é fila vazia: bloqueie a rodada.
+5. O seletor usa `.agents/dashboard/work-priority.json`: itens enumerados no Kanban vêm primeiro e mantêm a ordem de cima para baixo; os sem enumeração entram depois por `created_at` e ID. Um arquivo inválido equivale a nenhuma prioridade manual. Considere PRDs antes de SPECs, e SPECs antes de Tasks. Releia `zaip task ready-next --json` sob o lease e reivindique **somente o primeiro item superior elegível** com `ready-queue-lease.mjs claim OWNER FENCE ITEM_ID`. Uma segunda reivindicação de outro ID com o mesmo lease é rejeitada pelo código; não transforme os demais candidatos em execução nesta rodada. Depois do claim, repita `zaip task ready-next --json`: se o item mudou ou ficou inelegível, registre a disputa e não escolha outro.
+6. Execute somente o item reivindicado, pelo comando explícito no menor grão (`prd execute`, `spec execute` ou `task execute`). Para uma Task-first elegível, use `task execute` para materializar sua Execution; não crie a Execution por outro atalho. Se o item deixar de ser elegível antes do início, registre a disputa e termine a rodada sem selecionar o próximo. Preserve os gates de write scope, dependências, evidências, testes e finalizador; uma seleção não é autorização para ignorar qualquer gate.
+7. Registre o resultado do único item, a ausência de candidatos ou a disputa observada, e solte o lease. Sem candidato, retorne `no_eligible_work`; com precondição ausente, conflito de lease ou estado ambíguo, falhe fechado e não altere registros.
 
 Esta skill não cria um agendamento. Ela só pode ser chamada pela automação nativa do Codex Desktop ou por um usuário com autoridade explícita para executar o trabalho selecionado.

package/templates/.agents/skills/zaip-skill-executar-fila-pronta/scripts/ready-queue-fence.mjs

@@ -1,5 +1,6 @@
 import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
 
 export async function acquireReadyQueueFence(lockPath, input) {
   return withMutex(lockPath, async () => {
@@ -19,11 +20,25 @@ export async function acquireReadyQueueFence(lockPath, input) {
 export async function renewReadyQueueFence(lockPath, lease, now, expiresAt) {
   return withMutex(lockPath, async () => {
     if (!(await assertReadyQueueFence(lockPath, lease, now))) return null;
-    const renewed = { ...lease, expires_at: expiresAt };
+    const renewed = { ...(await readLease(lockPath)), expires_at: expiresAt };
     await writeLease(lockPath, renewed);
     return renewed;
   });
 }
+/** A scheduled invocation may claim exactly one canonical top-level item. */
+export async function claimReadyQueueItem(lockPath, lease, itemId, now) {
+  if (!/^(PRD|SPEC|TASK)-[A-Z0-9-]+$/.test(itemId))
+    throw new Error("Ready queue claim requires one canonical item ID");
+  return withMutex(lockPath, async () => {
+    if (!(await assertReadyQueueFence(lockPath, lease, now))) return null;
+    const current = await readLease(lockPath);
+    if (current.claimed_item_id !== undefined && current.claimed_item_id !== itemId) return null;
+    if (current.claimed_item_id === itemId) return current;
+    const claimed = { ...current, claimed_item_id: itemId, claimed_at: now };
+    await writeLease(lockPath, claimed);
+    return claimed;
+  });
+}
 export async function assertReadyQueueFence(lockPath, lease, now) {
   const current = await readLease(lockPath);
   return (
@@ -37,19 +52,29 @@ export async function assertReadyQueueFence(lockPath, lease, now) {
 export async function releaseReadyQueueFence(lockPath, lease, now) {
   return withMutex(lockPath, async () => {
     if (!(await assertReadyQueueFence(lockPath, lease, now))) return false;
-    await writeLease(lockPath, { ...lease, expires_at: now, released_at: now });
+    await writeLease(lockPath, {
+      ...(await readLease(lockPath)),
+      expires_at: now,
+      released_at: now,
+    });
     return true;
   });
 }
 async function withMutex(lockPath, operation) {
   const mutex = `${lockPath}.mutex`;
   await mkdir(dirname(lockPath), { recursive: true });
-  try {
-    await mkdir(mutex);
-  } catch (error) {
-    if (error?.code === "EEXIST") return null;
-    throw error;
+  let acquired = false;
+  for (let attempt = 0; attempt < 25; attempt += 1) {
+    try {
+      await mkdir(mutex);
+      acquired = true;
+      break;
+    } catch (error) {
+      if (error?.code !== "EEXIST") throw error;
+      if (attempt < 24) await delay(40);
+    }
   }
+  if (!acquired) throw new Error(`Ready queue mutex remains held: ${mutex}`);
   try {
     return await operation();
   } finally {

package/templates/.agents/skills/zaip-skill-executar-fila-pronta/scripts/ready-queue-fence.test.mjs

@@ -1,11 +1,13 @@
 import assert from "node:assert/strict";
-import { mkdtemp, rm } from "node:fs/promises";
+import { execFileSync } from "node:child_process";
+import { mkdir, mkdtemp, rm, stat, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import test from "node:test";
 import {
   acquireReadyQueueFence,
   assertReadyQueueFence,
+  claimReadyQueueItem,
   releaseReadyQueueFence,
   renewReadyQueueFence,
 } from "./ready-queue-fence.mjs";
@@ -58,3 +60,134 @@ test("fence is exclusive, monotonic, and rejects a stale owner", async () => {
     await rm(directory, { recursive: true, force: true });
   }
 });
+
+test("Windows-compatible lease command allows only one claimed item", async () => {
+  const directory = await mkdtemp(join(tmpdir(), "zaip-ready-cli-"));
+  const script = join(import.meta.dirname, "ready-queue-lease.mjs");
+  const call = (...args) =>
+    JSON.parse(
+      execFileSync(process.execPath, [script, ...args], { cwd: directory, encoding: "utf8" }),
+    );
+  try {
+    await mkdir(join(directory, ".agents", "config"), { recursive: true });
+    await writeFile(
+      join(directory, ".agents", "config", "project.yaml"),
+      "zaip:\n  enabled: true\n",
+    );
+    const lease = call("acquire").result;
+    assert.equal(
+      call("claim", lease.owner_token, String(lease.fencing_token), "TASK-2026-09-24-READY-AAAA")
+        .result.claimed_item_id,
+      "TASK-2026-09-24-READY-AAAA",
+    );
+    assert.equal(
+      call("renew", lease.owner_token, String(lease.fencing_token)).result.claimed_item_id,
+      "TASK-2026-09-24-READY-AAAA",
+    );
+    assert.throws(
+      () =>
+        call("claim", lease.owner_token, String(lease.fencing_token), "TASK-2026-09-24-READY-BBBB"),
+      /Command failed/,
+    );
+    assert.equal(call("release", lease.owner_token, String(lease.fencing_token)).ok, true);
+  } finally {
+    await rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("one lease cannot claim a second ready item, including after renewal", async () => {
+  const directory = await mkdtemp(join(tmpdir(), "zaip-ready-single-"));
+  const lock = join(directory, "ready-queue.lock.json");
+  try {
+    const lease = await acquireReadyQueueFence(lock, {
+      owner_token: "owner-a",
+      now: "2026-09-24T12:00:00.000Z",
+      expires_at: "2026-09-24T12:01:00.000Z",
+    });
+    const claimed = await claimReadyQueueItem(
+      lock,
+      lease,
+      "PRD-2026-09-24-READY-AAAA",
+      "2026-09-24T12:00:01.000Z",
+    );
+    assert.equal(claimed.claimed_item_id, "PRD-2026-09-24-READY-AAAA");
+    const renewed = await renewReadyQueueFence(
+      lock,
+      lease,
+      "2026-09-24T12:00:02.000Z",
+      "2026-09-24T12:02:00.000Z",
+    );
+    assert.equal(renewed.claimed_item_id, "PRD-2026-09-24-READY-AAAA");
+    assert.equal(
+      await claimReadyQueueItem(
+        lock,
+        renewed,
+        "SPEC-2026-09-24-READY-BBBB",
+        "2026-09-24T12:00:03.000Z",
+      ),
+      null,
+    );
+    assert.equal(
+      (
+        await claimReadyQueueItem(
+          lock,
+          lease,
+          "PRD-2026-09-24-READY-AAAA",
+          "2026-09-24T12:00:04.000Z",
+        )
+      ).claimed_item_id,
+      "PRD-2026-09-24-READY-AAAA",
+    );
+    assert.equal(await releaseReadyQueueFence(lock, lease, "2026-09-24T12:00:05.000Z"), true);
+    assert.equal(
+      await claimReadyQueueItem(
+        lock,
+        lease,
+        "PRD-2026-09-24-READY-AAAA",
+        "2026-09-24T12:00:06.000Z",
+      ),
+      null,
+    );
+  } finally {
+    await rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("transient mutex contention waits instead of pretending the queue is locked", async () => {
+  const directory = await mkdtemp(join(tmpdir(), "zaip-ready-contention-"));
+  const lock = join(directory, "ready-queue.lock.json");
+  const mutex = `${lock}.mutex`;
+  try {
+    await mkdir(mutex);
+    const pending = acquireReadyQueueFence(lock, {
+      owner_token: "owner-a",
+      now: "2026-09-24T12:00:00.000Z",
+      expires_at: "2026-09-24T12:01:00.000Z",
+    });
+    await new Promise((resolve) => setTimeout(resolve, 80));
+    await rm(mutex, { recursive: true });
+    assert.equal((await pending)?.owner_token, "owner-a");
+  } finally {
+    await rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("orphaned mutex fails visibly without deleting another owner's lock", async () => {
+  const directory = await mkdtemp(join(tmpdir(), "zaip-ready-orphan-"));
+  const lock = join(directory, "ready-queue.lock.json");
+  const mutex = `${lock}.mutex`;
+  try {
+    await mkdir(mutex);
+    await assert.rejects(
+      acquireReadyQueueFence(lock, {
+        owner_token: "owner-a",
+        now: "2026-09-24T12:00:00.000Z",
+        expires_at: "2026-09-24T12:01:00.000Z",
+      }),
+      /mutex remains held/,
+    );
+    assert.equal((await stat(mutex)).isDirectory(), true);
+  } finally {
+    await rm(directory, { recursive: true, force: true });
+  }
+});

package/templates/.agents/skills/zaip-skill-executar-fila-pronta/scripts/ready-queue-lease.mjs

@@ -0,0 +1,57 @@
+import { randomUUID } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import {
+  acquireReadyQueueFence,
+  assertReadyQueueFence,
+  claimReadyQueueItem,
+  releaseReadyQueueFence,
+  renewReadyQueueFence,
+} from "./ready-queue-fence.mjs";
+
+const root = process.cwd();
+const lockPath = resolve(root, ".local/automation/ready-queue.lock.json");
+const [action, ...args] = process.argv.slice(2);
+const now = new Date().toISOString();
+const expiry = new Date(Date.now() + 4 * 60 * 60 * 1000).toISOString();
+
+try {
+  const config = await readFile(resolve(root, ".agents/config/project.yaml"), "utf8");
+  if (!/^zaip:\s*\r?\n\s+enabled: true\s*$/m.test(config)) {
+    throw new Error("ZAIP must be enabled in this checkout");
+  }
+  let result;
+  if (action === "acquire" && args.length === 0) {
+    result = await acquireReadyQueueFence(lockPath, {
+      owner_token: randomUUID(),
+      now,
+      expires_at: expiry,
+    });
+  } else if (["claim", "renew", "assert", "release"].includes(action)) {
+    const [owner, rawFence, itemId] = args;
+    if (!owner || !/^[1-9]\d*$/.test(rawFence ?? "")) {
+      throw new Error("owner_token and positive fencing_token are required");
+    }
+    const lease = { owner_token: owner, fencing_token: Number(rawFence) };
+    if (action === "claim" && args.length === 3) {
+      result = await claimReadyQueueItem(lockPath, lease, itemId, now);
+    } else if (action === "renew" && args.length === 2) {
+      result = await renewReadyQueueFence(lockPath, lease, now, expiry);
+    } else if (action === "assert" && args.length === 2) {
+      result = await assertReadyQueueFence(lockPath, lease, now);
+    } else if (action === "release" && args.length === 2) {
+      result = await releaseReadyQueueFence(lockPath, lease, now);
+    } else {
+      throw new Error("Invalid ready-queue lease arguments");
+    }
+  } else {
+    throw new Error(
+      "Usage: ready-queue-lease.mjs acquire|claim OWNER FENCE ITEM|renew OWNER FENCE|assert OWNER FENCE|release OWNER FENCE",
+    );
+  }
+  process.stdout.write(`${JSON.stringify({ ok: result !== null && result !== false, result })}\n`);
+  if (result === null || result === false) process.exitCode = 2;
+} catch (error) {
+  process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+  process.exitCode = 1;
+}

package/templates/.agents/skills/zaip-skill-executar-fila-pronta/scripts/scheduled-ready-queue-contract.test.mjs

@@ -7,7 +7,7 @@ const root = resolve(import.meta.dirname, "../..");
 const read = (path) => readFile(resolve(root, path), "utf8");
 const repositoryReadme = resolve(root, "../../README.md");
 
-test("hourly ready queue contracts the native Codex scheduler and full ordered snapshot", async () => {
+test("hourly ready queue contracts the native Codex scheduler and one ordered item", async () => {
   const [installer, executor] = await Promise.all([
     read("zaip-skill-instalar-agendamento/SKILL.md"),
     read("zaip-skill-executar-fila-pronta/SKILL.md"),
@@ -35,7 +35,7 @@ test("hourly ready queue contracts the native Codex scheduler and full ordered s
   assert.match(installer, /standalone/);
   assert.match(installer, /sem duplicar/);
   assert.match(installer, /Nunca use o Agendador do Windows/);
-  assert.match(installer, /authorizes only canonically ready\/eligible items/);
+  assert.match(installer, /execute at most one top-level eligible item/);
   assert.match(installer, /a cada hora, no minuto 0/);
   assert.match(installer, /nova conversa/);
   assert.match(installer, /\.agents\/dashboard\/work-priority\.json/);
@@ -44,9 +44,12 @@ test("hourly ready queue contracts the native Codex scheduler and full ordered s
   assert.match(installer, /set_thread_title without threadId/);
   assert.match(installer, /\[YYYY-MM-DD-T-HH-mm\] Tarefa Agendada/);
 
-  assert.match(executor, /snapshot elegível/);
-  assert.match(executor, /todos os PRDs antes de SPECs, e todos os SPECs antes das Tasks/);
-  assert.match(executor, /descendem de PRD/);
+  assert.match(executor, /um único item superior/);
+  assert.match(executor, /zaip task ready-next --json/);
+  assert.match(executor, /somente o primeiro item superior elegível/);
+  assert.match(executor, /sem selecionar o próximo/);
+  assert.doesNotMatch(executor, /processe todos os PRDs/);
+  assert.match(executor, /descendentes de PRD\/SPEC/);
   assert.match(executor, /`active`, `blocked`, `failed`, `cancelled` ou terminais/);
   assert.match(executor, /\.agents\/dashboard\/work-priority\.json/);
   assert.match(executor, /\.local\/automation\/ready-queue\.lock\.json/);
@@ -64,7 +67,7 @@ test("hourly ready queue contracts the native Codex scheduler and full ordered s
   assert.match(executor, /`prepared_plan` inline válido \*\*ou\*\* `plan_ref` válido, nunca ambos/);
   assert.match(executor, /não pode ter Execution vinculada/);
   assert.match(executor, /nunca pode ter sido iniciada ou tentada/);
-  assert.match(executor, /Para cada candidata/);
+  assert.match(executor, /Falha de leitura\/validação não é fila vazia/);
   assert.match(
     executor,
     /cujo próprio ID apareça em `task next` ou no conjunto materializado concorrente/,

package/templates/.agents/skills/zaip-skill-execution/SKILL.md

@@ -71,7 +71,7 @@ Antes de encerrar com trabalho pendente ou responder a uma falha, aplique [conti
 
 ## Runtime gerenciado e compatibilidade
 
-1. Leia `execution.runtime`. Novo padrão `managed` despacha PRD/SPEC pelo provider, mantendo avulsas diretas. Ausente/manual preserva execução tradicional; `autonomous` também permite Task gerenciada explícita. Legados já tentados exigem `task migrate-autonomy` revisado; nenhum consumo é zerado.
+1. Leia `execution.runtime`. O padrão novo `codex_native` mantém o despacho no host Codex e exige subagentes nativos também para Task avulsa; `managed` é compatibilidade explícita de provider para PRD/SPEC, mantendo avulsas diretas nesse contrato legado. Ausente/manual preserva execução tradicional; `autonomous` também permite Task gerenciada explícita. Legados já tentados exigem `task migrate-autonomy` revisado; nenhum consumo é zerado.
 2. Com `autonomy.version: 1`, aplique `RULE-AUTONOMY-DECISION` e seu ledger estável por Task. A seleção manual fica no principal avulso; subagentes seguem política automática com aviso. Sem esse bloco, preserve `automatic_sources` legado (`spec`,`prd`). Não alegue enforcement de orçamento/modelo em ferramenta nativa que não passou pelo dispatch gerenciado.
 3. Em autonomia, exija raiz Git limpa, worktree registrada por Task, commit final canônico sem alterações pendentes, diff dentro dos write scopes e merge abortável em conflito. A integração cria outro commit canônico por Task no histórico first-parent e referencia o SHA do candidato em `ZAIP-Product-Commit`.
 4. Use o menor paralelismo entre projeto, plano, provider e squad. Em `autonomy-v1`, orçamento por Task vem exclusivamente do preset congelado: Essencial 4/1, Equilibrado 10/3, Persistente ilimitado (execuções/replans); tempo não encerra Task. Risco/domain definem assurance, não esse orçamento. Só no contrato legado use as quotas anteriores por risco.

package/templates/.agents/skills/zaip-skill-execution/references/runtime-governance.md

@@ -7,8 +7,8 @@ Carregue antes de executar uma entrega ou delegar. Este contrato detalha o kerne
 - Para delegação Codex, Sub-Run ZAIP é somente subagente nativo de colaboração (`spawn_agent`). `create_thread` e `fork_thread` criam chats independentes e exigem pedido explícito do usuário; nunca são Sub-Run, fallback, retry ou prova de delegação. Se delegação nativa estiver indisponível, relate a limitação em vez de criar chat independente. Nome de catálogo, `task_name`, título ou prompt não prova ancestralidade nativa. Antes de repetir a mesma delegação limitada, aguarde ou reutilize seu filho pendente e capture somente ancestralidade/metadados observados em resultados nativos de spawn/terminal do host ou eventos SubagentStart/SubagentStop.
 - Cada `client_turn_id` observável tem uma Execution idempotente/claim atômico; sem ele use identidade local sem prometer idempotência. `interaction` read-only sem descendentes é conversa sem Task artificial e termina após a resposta entregue, sem executor ou finalizador; interaction com trabalho delegado e `delivery` exigem executor/finalizador. `delivery` é trabalho materializado e reuso exige kind/origem compatíveis. A raiz é `zaip-agent-orchestrator`; quando a barreira é exigida escolha executor por capacidade, permita reviewer/auditor/integrator e termine com `zaip-agent-finalizer` em `finalization`, após descendentes, bloqueando novas chamadas.
 - Hooks são best-effort: após cada spawn/terminal, o host autorizado a serviço do orquestrador executa `zaip subagent capture` idempotente com metadados reais. Na captura rica, preserve session/turn observados, `agent-id` com a identidade nativa retornada e `parent-agent-id`/`parent-run-id` do pai imediato exato; cada invocação preserva seu turn. Quando um evento terminal observado expõe somente agent_path, status, identidade catalogada e pai exato, `capture-terminal` aceita apenas `zaip-agent-finalizer` ou executor elegível para delivery com capacidade `task-delivery`; exige também `parent-run-id` igual ao `run_id` da raiz ativa exata, pois um client thread pode conter raízes concorrentes. O último segmento do agent_path deve ser seu `codex_task_name` canônico. O propósito deriva da identidade validada e session/turn/model/provider/usage permanecem indisponíveis; o fallback nunca substitui captura rica nem inventa modelo, effort, tokens ou custo.
-- Em `autonomy-v1`, carregue `RULE-AUTONOMY-DECISION`. Task avulsa preserva seleção manual do principal, evita subagentes e só delega por necessidade concreta; quando delegar, informe que modelo/esforço dos filhos seguem a política ZAIP, sem obrigação de herdar o principal. Fixe configuração por chamada e registre seleção efetivamente observada. Sem `autonomy`, preserve o contrato legado de `automatic_sources` (`spec`,`prd`).
-- Escaladas seguem o perfil congelado: Essencial nunca Astra automático; Equilibrado Sol/high, Astra/high, Astra/high, com execução Astra/high elegível no terceiro bloco; Persistente sem quota total. `RULE-ASTRA-DIAGNOSTIC` descreve também compatibilidade legada. Não use título/volume como prova nem alegue mudança de modelo apenas pelo prompt.
+- Em `autonomy-v1`, carregue `RULE-AUTONOMY-DECISION`. Conversation sem entrega responde diretamente; Task avulsa no padrão `codex_native` usa executor e Gui nativos. O principal preserva a seleção manual do host; cada filho segue a seleção ZAIP por papel/risco/fase, registrada conforme o modelo/esforço efetivamente observados. Capacidade ausente bloqueia a tentativa, nunca é substituída por prompt. Sem `autonomy`, preserve o contrato legado de `automatic_sources` (`spec`,`prd`).
+- Escaladas seguem o perfil congelado: Essencial nunca Astra automático; Equilibrado Sol/high, Sol/high, Astra/high, com execução Astra/high elegível no terceiro bloco; Persistente sem quota total. `RULE-ASTRA-DIAGNOSTIC` descreve também compatibilidade legada. Não use título/volume como prova nem alegue mudança de modelo apenas pelo prompt.
 - Todo PreparedPlan PRD/SPEC traz `model_signals` por Task; o framework persiste `model_profile`, `task-risk-v1` e motivos, usando `runtime_defaults`, `runtime`, política/defaults sem `standard` silencioso. Não infira fase/complexidade/transversalidade/ambiguidade/rework/custo/capacidade por contagem de arquivos; use sinais, fase/agente e capacidades. Cabeçalho e `model.selection.recorded` repetem a seleção enviada.
 - Plano visível: `DEFINE:`, `PLAN:`, `EXECUTE:` ou `VERIFY:`, 3–4 passos (máximo 5); omita fase sem ação e combine trivialidades.
 

package/templates/.agents/skills/zaip-skill-github-deploy/SKILL.md

@@ -1,17 +1,17 @@
 ---
 name: zaip-skill-github-deploy
-description: Use only when the user explicitly asks in the current turn to deploy, push, publish, or make a GitHub publication with folder-scoped SSH; it is Git-only and never grants publication automatically.
+description: Use only when the user explicitly asks to deploy, push or publish to GitHub; in the zaip-aios builder, a full deploy includes a GitHub Release and npm publication through GitHub Actions.
 ---
 
 # Deploy and repair GitHub publication
 
-Treat deploy as Git-only publication. An explicit current-turn request to `deploy`, `push`, `publicar`, `publicação` or GitHub publication selects this skill. It never authorizes provider deployment.
+An explicit current-turn request to `deploy`, `push`, `publicar`, `publicação` or GitHub publication selects this skill; discussing or editing deployment does not authorize publication. In the `zaip-ai/zaip-aios` builder, “faça deploy” means the guarded push, GitHub Release and observation of the GitHub Actions npm publication. Consumer repositories follow their own GitHub-only policy. Neither route authorizes a hosting-provider deployment.
 
 Read [the deployment workflow](references/deployment-workflow.md) for the detailed operational contract before publication. The steps below retain its authority, identity and completion boundaries.
 
 ## Authorization and scope
 
-- The exact command “faça deploy” authorizes commits covering all versionable pending changes in the selected worktree, followed by push and Release, after secret, size and ignore checks. The selected worktree is the complete publication scope; other worktrees remain outside it.
+- The exact command “faça deploy” authorizes commits covering all versionable pending changes in the selected worktree, followed by push and Release, after secret, size and ignore checks. In the verified framework source, publishing that Release triggers the npm workflow; follow it to terminal status and verify the registry. The selected worktree is the complete publication scope; other worktrees remain outside it. An explicit push-only request stops after the verified push and does not create a Release or publish npm.
 - Resolve dirty state, untracked files, generated projections, branch divergence and repairable local/remote failures automatically within that scope. Limit repairs to the evidenced cause, with up to five repair cycles; stop when the same root cause remains after two repairs.
 - Treat the selected worktree's local branch, recovery branch or detached state as the source candidate only. The configured deploy branch is the remote target; a mismatch between source and target is not a blocker and never requires checking out the target locally.
 - Stop only for an unresolved index conflict after bounded repair, secrets, files at or above GitHub's 100 MB limit, unavailable authentication/authority, external outage, destructive requirement, or ambiguous scope expansion.
@@ -43,7 +43,7 @@ Every product commit requires causal Task/Change/Execution records and matching
 
 1. Compose `$zaip-skill-release-qualification` and follow [local preparation](../zaip-skill-release-qualification/references/local-preparation.md). Synchronize and commit before preparing the clean exact SHA. Failed or stale evidence is not qualification.
 2. Resolve the previous Release, next canonical version and package identity using [release identity](references/release-identity.md). For the framework, `vN.N` maps to package `N.N.0`; only GitHub Actions publishes `@zaip-ai/cli` to npm.
-3. For `zaip-ai/zaip-aios`, use `scripts/local-release-deploy.mjs`. It prepares/verifies, pushes the exact SHA to configured `main`, uploads verified assets to a draft, then publishes the Release. Enable the thin publisher only after explicit rollout authority, public trust enrollment and signed local qualification. It validates published assets and runs one read-only installation smoke before npm; no private-draft pilot or write token is needed. GitHub Release publication and npm completion remain separate.
+3. For the verified `zaip-ai/zaip-aios` source, use `scripts/local-release-deploy.mjs`. It prepares/verifies, pushes the exact SHA to configured `main`, uploads verified assets to a draft, then publishes the Release. The `publish-cli.yml` workflow is triggered by `release: published` and alone performs npm publication. Enable the thin publisher only after explicit rollout authority, public trust enrollment and signed local qualification. It validates published assets and runs one read-only installation smoke before npm; no private-draft pilot or local npm write token is needed. Inspect the configured signing key, trust store, policy and protected workflow settings before reporting a missing credential; do not confuse the release-signing private key with the Git SSH key or npm token in a local `.env`, and never rotate trust or bypass a gate without separate authorization. The user authorized routine per-version updates of **only** `ZAIP_LOCAL_RELEASE_POLICY_B64` for this builder on 2026-09-23. Prepare a reviewed version-matched policy, qualify the exact SHA, enroll those exact public policy bytes and verify readback before publishing the Release; do not ask again merely because the previous version is still enrolled. This standing authorization never covers trust-key rotation, other protected variables, or weaker gates. GitHub Release publication and npm completion remain separate.
 4. Consumers use `scripts/consumer-release-preparation.mjs guarded-push` with their own policy and explicit branch, SHA and trusted receipt. They have no framework npm/TGZ requirement. See the preparation guide for bootstrap and guarded commands.
 5. Immediately before delivery, reread the configured target; if changed, restart preparation. Helpers bind the exact candidate to `HEAD:refs/heads/<configured branch>` (or its equivalent immutable-SHA refspec) independently of the local source branch; do not bypass them with a manual push.
 6. After qualification, a missing Release is normal. Unless explicitly push-only, automatically create the draft for that SHA or resume a verified draft for the same SHA. Verify an already-published exact Release as a no-op; an API/authentication error never proves absence. Refuse conflicting tags/assets without overwrite.
@@ -66,7 +66,7 @@ publication separately; neither preparation nor this policy grants publication a
 - After push, compare the local SHA with the configured remote ref. If the push result is uncertain, read remote state first; only one documented transient transport retry is allowed per cycle.
 - Observe required GitHub checks for that exact SHA, waiting up to 20 minutes with concise progress at least once per minute. Read the exact failed step before repairing. Never repeat an unchanged failing command or disable a gate for green status.
 - Reconcile recoverable prerequisites and continue through the same bounded repair policy; do not stop merely because a Release or generated file was absent.
-- Success requires matching local/remote hashes, successful required observable checks, verified Release identity/body and a clean intended worktree. Distinguish GitHub publication, npm availability and formal lifecycle closure. If checks cannot be observed, report CI as unconfirmed.
+- Full framework deploy success requires matching local/remote hashes, successful required checks, verified Release identity/body, a clean intended worktree, terminal success of the exact `publish-cli.yml` run, and registry confirmation of `@zaip-ai/cli@N.N.0` with the intended dist-tag and artifact integrity. The local `.env` does not automatically provide GitHub Actions credentials; use only the workflow's configured secret/environment. If npm fails or cannot be observed, report the GitHub Release as published but the deploy as partial or blocked, with the exact failed/pending gate. Consumer deploys have no framework npm gate. Formal lifecycle closure remains separate.
 - Retain terminal evidence and close every owned Task/Change/Execution correctly through the finalizer. Never finish with an owned Task executing/verifying; use completed, blocked, cancelled or failed according to observed outcome.
 
 Database request-branch PRs retain their separate policy. This Git-only skill never applies SQL, provisions paid resources or publishes database production. Read-only identities cannot substitute for deploy credentials.

package/templates/.agents/skills/zaip-skill-github-deploy/agents/openai.yaml

@@ -1,6 +1,6 @@
 interface:
   display_name: "ZAIP GitHub Deploy"
-  short_description: "Publicacao GitHub explicita, Git-only e verificavel"
-  default_prompt: "Use $zaip-skill-github-deploy para pedidos explicitos de deploy, push, publicar ou publicacao GitHub; quando o usuario disser 'faca deploy', trate o worktree selecionado inteiro como escopo autorizado, incluindo arquivos novos, apos os gates de segredos, tamanho, conflitos e SSH; trate a branch local ou detached como origem e a branch configurada como alvo remoto, publicando por refspec explicito via SSH da pasta sem force push nem reescrita de historico."
+  short_description: "Deploy GitHub; npm via Actions no builder ZAIP"
+  default_prompt: "Use $zaip-skill-github-deploy para o pedido explicito 'faca deploy': no builder zaip-aios, publique a Release pelo fluxo protegido e confirme o workflow npm e o registro; em consumidores, siga a politica GitHub-only, respeitando pedidos push-only."
 policy:
   allow_implicit_invocation: true

package/templates/.agents/skills/zaip-skill-github-deploy/references/deployment-workflow.md

@@ -3,7 +3,7 @@
 
 The exact command “faça deploy” authorizes publication of everything versionable in the selected worktree, including tracked and untracked files, after the safety gates below. It does not authorize provider deployment.
 
-Treat deploy as Git-only publication. An explicit current-turn request to `deploy`, `push`, `publicar`, `publicação` or GitHub publication selects this skill; it authorizes only the bounded Git publication described below, never a provider deployment or automatic publication.
+An explicit current-turn request to `deploy`, `push`, `publicar`, `publicação` or GitHub publication selects this skill. For the verified `zaip-ai/zaip-aios` source, a default “faça deploy” includes the guarded Git push, GitHub Release and terminal observation of the npm workflow it triggers. Consumer repositories remain GitHub-only. Discussing or editing deployment does not authorize publication, and neither route authorizes provider deployment.
 
 ## Authorization
 
@@ -11,7 +11,7 @@ Treat deploy as Git-only publication. An explicit current-turn request to `deplo
 - The request authorizes the initial publication, automatic reconciliation needed to publish the selected branch, commits covering all versionable pending changes in the selected worktree, and up to five repair cycles needed to make required local and remote GitHub checks pass. Do not stop merely because the worktree is dirty, history is behind/diverged, generated files are pending, or a local gate has a repairable failure.
 - Limit repairs to the intended repository state and the evidenced failure. Do not add unrelated features or broaden product scope.
 - Never force push, rewrite history, replace remotes, change credentials or Git/SSH configuration, bypass checks, or deploy to another service.
-- Do not create lifecycle artifacts for an explicit Git-only publication request. The deploy authorization permits staging every inventoried versionable path in the selected worktree after secret, size, and ignore checks; it never authorizes changes outside that worktree.
+- Do not create lifecycle artifacts merely to publish already-existing commits. The deploy authorization permits staging every inventoried versionable path in the selected worktree after secret, size, and ignore checks; it never authorizes changes outside that worktree.
 - Every product commit needs its evidenced Task and canonical Task title, including Task-first. If ownership is missing, materialize the authorized work before editing/committing; never borrow the latest global Task. Only records/local-only snapshots are exempt. Omit nonexistent PRD/SPEC lineage. Explicit deploy authorizes reviewed path staging, never force, destructive reset, history rewrite, or credential changes.
 
 ## Mandatory authorization record
@@ -99,6 +99,8 @@ Every authorized deploy must first compose `$zaip-skill-release-qualification` a
 
 For `zaip-ai/zaip-aios` framework releases, use `scripts/local-release-deploy.mjs`: it prepares and verifies the candidate, pushes the exact SHA to `main`, uploads the verified assets to a draft release, and publishes that release. npm publication remains exclusively in GitHub Actions. Run the folder-scoped SSH preflight with the explicitly configured frontend scope before this entrypoint.
 
+Before classifying a missing signer as a blocker, inspect the configured external signing-key path, trust store, policy and protected GitHub release variables without exposing secret contents. The private Ed25519 release key is distinct from the Git SSH key and a local `.env` npm token; the latter does not automatically reach Actions. If a required key or protected setting truly is absent, stop with its exact name and recovery action. Do not generate a replacement, rotate public trust or publish locally without separate authority. The user's 2026-09-23 standing authorization permits routine version-specific updates of **only** `ZAIP_LOCAL_RELEASE_POLICY_B64` in the verified `zaip-ai/zaip-aios` repository. When the enrolled policy names an older release, prepare a reviewed policy for the exact new version and fixed qualification profile; preserve repository, branch, channel, publication mode, non-force/non-replacement controls and trusted key. After successful signed local qualification and before Release publication, set that one variable to the exact UTF-8 policy bytes encoded in base64 and read it back byte-for-byte. A missing key, changed trust, weaker policy, failed readback or insufficient GitHub permission remains a blocker, not a reason to ask again for the already-authorized routine version update.
+
 After exact-candidate qualification, a missing GitHub Release is normal. Unless the request is explicitly push-only, use the configured entrypoint to create a draft for that SHA or resume a verified draft for the same SHA; do not recreate an existing Release. A published Release for the exact SHA is verified as a no-op, or its failed checks are repaired within the bounded cycle. An authentication or API error does not prove that a Release is absent.
 
 For a consumer repository, bootstrap its own Ed25519 trust store and define `configured_branch`, GitHub version `vN.N`, and `required_commands` in its project policy. `prepare` runs only those policy commands and signs a receipt after the Git identity is unchanged before and after them. `verify` checks the configured branch, exact SHA/tree, policy digest and trusted key. `guarded-push` runs prepare and verify before its explicit push command; a failed required command, dirty checkout, changed SHA/policy, or unavailable key prevents that command from running. This consumer flow is GitHub-only: it has no npm channel, package manifest version, or TGZ contract.
@@ -134,4 +136,4 @@ Unless the request is push-only, resolve the release identity before mutation us
 
 ## Success condition
 
-Finish only when the local and remote hashes match, every required observable check is successful, and the intended worktree is clean. Otherwise report the exact terminal blocker and the repair cycles consumed.
+For a full framework deploy, finish only when the local and remote hashes match, the intended worktree is clean, the exact Release identity/assets/body are verified, the associated `publish-cli.yml` run reaches success, and the npm registry confirms the intended `@zaip-ai/cli@N.N.0` version, dist-tag and artifact integrity. The workflow uses its configured GitHub credential/environment; a local `.env` does not publish the package. A published Release with failed or unobserved npm is partial, never a completed deploy. For a consumer or an explicit push-only request, apply only its authorized GitHub scope. Otherwise report the exact terminal blocker and repair cycles consumed.