fix: address governance PR review feedback

.claude/commands/AIOX/stories/story-7.1.1.md

@@ -0,0 +1,78 @@
+# Story 7.1.1: Bootstrap /dev Workspace — aiox-dashboard Clone
+
+**Story ID:** 7.1.1  
+**Epic:** Epic-7 - Dashboard Workspace Integration  
+**Wave:** Wave 1 (Foundation)  
+**Status:** ⌛ In Progress
+**Priority:** 🔴 High  
+**Owner:** Architect (Aria) → Dev (Dex)  
+**Created:** 2026-05-05  
+**Updated:** 2026-05-05
+
+---
+
+## 📋 Objective
+
+Configurar `/dev` como monorepo pai com `aiox-core` e `aiox-dashboard` como projetos irmãos.  
+O dashboard observa dados do aiox-core via Supabase (read-only). Sem workspace hoisting — projetos independentes.
+
+---
+
+## 🎯 Story
+
+**As a** desenvolvedor AIOX,  
+**I want** o `aiox-dashboard` clonado em `C:\dev\aiox-dashboard` com um root `package.json` de conveniência em `C:\dev\`,  
+**So that** posso rodar e desenvolver CLI + Dashboard em paralelo no mesmo workspace.
+
+---
+
+## ✅ Acceptance Criteria
+
+- [x] `C:\dev\aiox-dashboard\` existe com clone do repositório `SynkraAI/aiox-dashboard`
+- [x] `C:\dev\package.json` existe com scripts de conveniência (`dev`, `dev:core`, `dev:dashboard`, `lint`, `test`)
+- [x] `C:\dev\.gitignore` existe cobrindo `node_modules`, `.env`, lock files dos dois projetos
+- [x] `C:\dev\aiox-dashboard\.env.local` criado a partir do `.env.example` do dashboard
+- [ ] Variáveis Supabase alinhadas entre `aiox-core` e `aiox-dashboard` — **pendente: preencher credenciais**
+- [x] `cd C:\dev\aiox-dashboard && npm install` completa sem erros (bun não instalado, npm usado como fallback)
+- [ ] Dashboard roda localmente (`npm run dev`) com acesso ao Supabase configurado — **pendente: credenciais Supabase**
+
+---
+
+## 📐 Scope
+
+**IN:**
+- Clone do repositório aiox-dashboard
+- Root `package.json` com scripts only (sem workspace hoisting)
+- Alinhamento de variáveis de ambiente Supabase
+- `.gitignore` raiz
+
+**OUT:**
+- Unificação de workspaces npm (risco CJS/ESM)
+- Rename de namespace `@aios/` → `@aiox/` (Story 7.1.2)
+- Integração de dados Supabase (Story 7.1.3)
+- CI/CD para o dashboard (Story 7.1.4)
+
+---
+
+## 🔗 Dependencies
+
+- `aiox-core` já configurado em `C:\dev\aiox-core\`
+- Bun não instalado; npm usado como fallback
+- Credenciais Supabase disponíveis em `C:\dev\aiox-core\.env`
+
+---
+
+## 📁 File List
+
+- [x] `C:\dev\package.json` — root workspace scripts
+- [x] `C:\dev\.gitignore` — root gitignore
+- [x] `C:\dev\aiox-dashboard\` — clone do repositório (1358 arquivos)
+- [x] `C:\dev\aiox-dashboard\.env.local` — env local do dashboard (Supabase vars aguardando preenchimento)
+
+---
+
+## 📝 Change Log
+
+| Date | Author | Change |
+|------|--------|--------|
+| 2026-05-05 | Aria (@architect) | Story criada em YOLO mode |

.claude/rules/handoff-consolidation.md

@@ -0,0 +1,140 @@
+# Handoff Consolidation — Rule
+
+## Purpose
+
+Prevent proliferation of individual handoff YAMLs in long-running pipelines (epics that span 5+ sessions). Consolidate older handoffs into a single `RUN-LOG.md` per epic/pipeline to maintain readability while preserving full history.
+
+## When This Applies
+
+- Any pipeline (epic, multi-wave initiative) accumulating handoffs in `.aiox/handoffs/`
+- Triggered when **5 or more** handoff YAMLs exist for the same pipeline
+- Applies regardless of agent (any agent generating handoffs must observe)
+
+## Trigger Threshold
+
+| Handoff count for pipeline | Action |
+|---|---|
+| 1-4 | Keep as individual YAMLs |
+| **5+** | **MUST consolidate** older handoffs into `RUN-LOG.md` |
+| 5+ recurrente | Reconsolidar a cada 5 novos handoffs |
+
+## Consolidation Procedure
+
+### Step 1 — Identify pipeline handoffs
+
+Pipelines are grouped by:
+- `pipeline_id` field in handoff YAML, OR
+- Filename pattern `handoff-{date}-{pipeline-slug}-{wave}.yaml`, OR
+- `INDEX-{pipeline-slug}.md` file referencing them
+
+### Step 2 — Create RUN-LOG.md (if not exists)
+
+Location options (in priority order):
+1. `business-ai-first/docs/stories/epics/{epic-folder}/RUN-LOG.md` (preferred for epic-bound pipelines)
+2. `business-ai-first/docs/runlogs/{pipeline-slug}-RUN-LOG.md` (for cross-epic pipelines)
+3. `.aiox/run-logs/{pipeline-slug}-RUN-LOG.md` (for framework-level pipelines)
+
+### Step 3 — Append summarized waves
+
+For each handoff being consolidated, append a section to `RUN-LOG.md`:
+
+```markdown
+## Wave {N}: {wave_goal} — {date}
+
+**Status:** ✅ DONE | ⚠️ BLOCKED | 🔄 PARTIAL
+**Session:** {session_id or hash}
+**Agent:** {primary agent}
+**Effort:** {actual hours}
+
+### Delivered
+- {bullet list of files created/modified}
+- {ACs completed with IDs}
+
+### Decisions
+- {key architectural/process decisions, link to ADR if applicable}
+
+### Blockers Resolved
+- {what got unblocked this wave}
+
+### Carry-forward to next wave
+- {open items, not blockers}
+
+### Original handoff
+Archived: `.aiox/handoffs/_archive/{filename}.yaml` (or deleted if redundant)
+```
+
+### Step 4 — Archive or delete originals
+
+Two options:
+- **Archive** (safer): move YAMLs to `.aiox/handoffs/_archive/{pipeline-slug}/` — preserves audit trail
+- **Delete** (cleaner): only if RUN-LOG.md captures everything materially relevant — reduces clutter
+
+**Default: archive**, unless pipeline owner explicitly authorizes deletion.
+
+### Step 5 — Update INDEX
+
+Update the pipeline's `INDEX-*.md` (or epic README) to reference RUN-LOG.md instead of individual handoffs.
+
+## What MUST be Preserved
+
+In RUN-LOG.md, never lose:
+- ❗ Strategic context (why this pipeline exists)
+- ❗ Architectural decisions (link to ADRs)
+- ❗ Resolved blockers (so they don't get re-investigated)
+- ❗ Schema/migration changes applied to prod
+- ❗ Open items that next session must address
+- ❗ Files created/modified per wave (path list, not content)
+
+## What CAN be Discarded
+
+In consolidation, drop:
+- Verbose investigation steps (kept the conclusion, not the search)
+- Rejected alternatives that were already decided
+- Tool call sequences (kept the outcome, not the recipe)
+- Repeated context that lives in the master plan or ADRs
+
+## Latest Handoff Stays Individual
+
+The **most recent** handoff for an active pipeline stays as `handoff-{latest}.yaml` even after consolidation. RUN-LOG.md is for closed waves. The active handoff is what the next session reads first.
+
+## Example Structure (after consolidation)
+
+```text
+.aiox/handoffs/
+├── INDEX-meta-messaging-pipeline.md       (refs RUN-LOG)
+├── handoff-2026-05-15-wave6-current.yaml  (latest, active)
+└── _archive/
+    └── meta-messaging/
+        ├── handoff-2026-05-06-wave1.yaml
+        ├── handoff-2026-05-08-wave2.yaml
+        ├── handoff-2026-05-10-wave3.yaml
+        ├── handoff-2026-05-12-wave4.yaml
+        └── handoff-2026-05-14-wave5.yaml
+
+business-ai-first/docs/stories/epics/epic-013-portal-replacement/
+└── RUN-LOG.md   (waves 1-5 consolidated, narrative form)
+```
+
+## Authority
+
+- **Any agent** can consolidate when threshold hit
+- **No agent** may delete originals without explicit pipeline owner authorization
+- **@devops** owns enforcement during git push reviews
+
+## Anti-patterns (DO NOT)
+
+- ❌ Consolidate active handoff (the one next session must read)
+- ❌ Lose blocker resolutions in summarization
+- ❌ Skip ADR cross-references
+- ❌ Consolidate before threshold (premature)
+- ❌ Mix multiple pipelines in one RUN-LOG (each pipeline = own log)
+
+## Migration of Existing Handoffs
+
+Existing handoff YAMLs that predate this rule should be consolidated retroactively when they cross the 5+ threshold for their pipeline. No need to consolidate orphaned/standalone handoffs.
+
+---
+
+**Established:** 2026-05-06 (during meta-messaging pipeline Wave 1 → Wave 2 transition)
+**Owner:** @aiox-master (Orion)
+**Enforced by:** all agents during handoff generation; @devops during PR review

.claude/settings.json

@@ -34,5 +34,6 @@
         ]
       }
     ]
-  }
+  },
+  "language": "portuguese"
 }

.env.example

@@ -1,53 +1,101 @@
-# AIOX Framework Environment Variables
-# Copy this file to .env and fill in your values
-# NEVER commit .env files to version control
+# ============================================
+# Synkra AIOX Environment Configuration
+# ============================================
+# Copy this file to .env and fill in your actual values
+# DO NOT commit .env with real credentials
+# ============================================
 
-# =============================================================================
-# AI Provider Configuration
-# =============================================================================
+# --------------------------------------------
+# LLM Providers
+# --------------------------------------------
 
-# Anthropic API (Claude)
-# Get your key from: https://console.anthropic.com/
-ANTHROPIC_API_KEY=your_anthropic_api_key_here
+# DeepSeek API (for claude-free command)
+# Get your key at: https://platform.deepseek.com/api_keys
+# Cost: ~$0.14/M tokens with tool calling support
+DEEPSEEK_API_KEY=
 
-# OpenAI API (optional, for GPT models)
-# Get your key from: https://platform.openai.com/api-keys
-OPENAI_API_KEY=your_openai_api_key_here
+# OpenRouter API (for multi-model routing)
+# Get your key at: https://openrouter.ai/keys
+OPENROUTER_API_KEY=
 
-# =============================================================================
-# GitHub Integration
-# =============================================================================
+# Anthropic API (direct, if not using Claude Max subscription)
+# Get your key at: https://console.anthropic.com/
+ANTHROPIC_API_KEY=
 
-# GitHub Personal Access Token (for API operations)
+# OpenAI API Key - Get yours at: https://platform.openai.com/api-keys
+OPENAI_API_KEY=
+
+# --------------------------------------------
+# Search & Research Tools
+# --------------------------------------------
+
+# Exa Search API (web search for agents)
+# Get your key at: https://exa.ai/
+EXA_API_KEY=
+
+# Context7 (library documentation lookup)
+# Usually free, no key required for basic usage
+CONTEXT7_API_KEY=
+
+# --------------------------------------------
+# Database & Backend
+# --------------------------------------------
+
+# Supabase (database, auth, storage)
+# Get from your Supabase project settings
+SUPABASE_ANON_KEY=
+SUPABASE_SERVICE_ROLE_KEY=
+SUPABASE_URL=
+
+# --------------------------------------------
+# Version Control & CI/CD
+# --------------------------------------------
+
+# GitHub Token (for GitHub CLI and API access)
 # Create at: https://github.com/settings/tokens
-GITHUB_TOKEN=your_github_token_here
+GITHUB_TOKEN=
 
-# =============================================================================
-# AIOX Framework Settings
-# =============================================================================
+# --------------------------------------------
+# Project Management
+# --------------------------------------------
 
-# Enable debug mode for verbose logging
-AIOX_DEBUG=false
+# ClickUp API (if using ClickUp integration)
+# Get from: ClickUp Settings > Apps > API Token
+CLICKUP_API_KEY=
 
-# Default AI model to use
-AIOX_DEFAULT_MODEL=claude-3-5-sonnet-20241022
+# --------------------------------------------
+# Automation & Workflows
+# --------------------------------------------
 
-# MCP Server settings
-AIOX_MCP_ENABLED=true
+# N8N (workflow automation)
+# From your N8N instance settings
+N8N_API_KEY=
+N8N_WEBHOOK_URL=
 
-# =============================================================================
-# Development Settings (Optional)
-# =============================================================================
+# --------------------------------------------
+# Monitoring & Analytics
+# --------------------------------------------
 
-# Node environment
-NODE_ENV=development
+# Sentry (error tracking)
+SENTRY_DSN=
+
+# --------------------------------------------
+# Cloud Providers
+# --------------------------------------------
 
-# Log level (debug, info, warn, error)
-LOG_LEVEL=info
+# Railway (deployment)
+RAILWAY_TOKEN=
 
-# =============================================================================
-# Testing (CI/CD)
-# =============================================================================
+# Vercel (deployment)
+VERCEL_TOKEN=
+
+# --------------------------------------------
+# AIOX Core Configuration
+# --------------------------------------------
+AIOX_VERSION=2.2.0
+NODE_ENV=development
 
-# CI environment flag (set by GitHub Actions)
-# CI=true
+# --------------------------------------------
+# Custom Configuration
+# --------------------------------------------
+# Add your custom API keys below

audits/README.md

@@ -0,0 +1,31 @@
+# aiox-core/audits/
+
+Cross-project audit reports and AuditFinding artifacts. Part of the AIOX Framework Evolution Pipeline.
+
+See [`../governance/evolution-pipeline.md`](../governance/evolution-pipeline.md) for the full pipeline spec.
+
+## Layout
+
+```text
+audits/
+├── README.md                              # this file
+├── <audit-narrative>.md                   # human-readable audit reports (e.g., c-dev-organization-2026-05-07.md)
+├── promoted/                              # AuditFindings flagged framework_candidate: true
+│   └── AF-<YYYYMMDD>-<slug>.yaml
+└── archived/                              # AuditFindings that stayed scope-bound (project-only)
+    └── AF-<YYYYMMDD>-<slug>.yaml
+```
+
+## When to write an audit here
+
+Write a narrative `.md` audit report at this folder root when:
+- Scope crosses 2+ projects, or
+- Topic is workspace-level (e.g., `C:/dev/` organization, cross-cutting tooling)
+
+Write a structured AuditFinding YAML in `promoted/` when:
+- A specific finding may evolve into framework changes
+- See template at `../governance/templates/audit-finding-tmpl.yaml`
+
+## Authority
+
+Any agent may author an audit. Promotion to a framework proposal requires Eliel's approval (see pipeline doc).