diff --git a/.cursor/rules/desk-deploy-release.mdc b/.cursor/rules/desk-deploy-release.mdc
index 308ccc9..73e7e43 100644
--- a/.cursor/rules/desk-deploy-release.mdc
+++ b/.cursor/rules/desk-deploy-release.mdc
@@ -65,3 +65,26 @@ cd /opt/ligbox-spec-hub/repos/ligbox-ops-platform/deploy/desk-staging-modern
 ## Checkpoint
 
 Ao encerrar sessão Desk: `git rev-parse --short HEAD` + resultado smoke no `SESSION-CHECKPOINT.md` da spec activa.
+
+---
+
+## Checklist único — qualquer deploy novo
+
+**Ordem obrigatória.** Saltar um passo = NÃO sincronizado.
+
+| # | Passo | Comando / acção |
+|---|-------|-----------------|
+| 1 | Código em `develop` | `git checkout develop && git pull` |
+| 2 | Commit | `git commit` (UI + API juntos se Desk) |
+| 3 | Push + PR → `main` | Forgejo: PR `develop` → `main`, merge |
+| 4 | Pull `main` local | `git checkout main && git pull origin main` |
+| 5 | **Deploy VM122** | `./deploy/desk-staging-modern/deploy-desk-full.sh` |
+| 6 | **Smoke GREEN** | `DESK_RELEASE=GREEN` |
+| 7 | **VM112** (se wizard) | `deploy/vm112-wizard/deploy-wizard-vm112-smoke.sh` |
+| 8 | Forgejo issues | `python3 scripts/sync-tasks-to-forgejo-issues.py` (se `tasks.md` mudou) |
+| 9 | Checkpoint | `SESSION-CHECKPOINT.md` + hash commit + smoke |
+| 10 | Portal | `./portal/refresh-spec-driver.sh` (CT130, se spec mudou) |
+
+**Proibido:** `docker cp` parcial · push directo a `main` · declarar "feito" sem smoke · VM112 com senha `805353`.
+
+**Doc completa:** `docs/GIT_WORKFLOW.md` · `docs/vms/CT130.md`
diff --git a/.cursor/rules/spec-driver-sync.mdc b/.cursor/rules/spec-driver-sync.mdc
index 7fd3afc..1a4198a 100644
--- a/.cursor/rules/spec-driver-sync.mdc
+++ b/.cursor/rules/spec-driver-sync.mdc
@@ -65,7 +65,8 @@ Incluir no commit (quando aplicável):
 ```bash
 git add specs/ chat-bruto/ contracts/ docs/vms/ _sidebar.md portal/html/specs/index.html
 git commit -m "spec NNN: <resumo da decisão>"
-git push origin main
+git push origin develop
+# PR develop → main (main bloqueada — ver docs/GIT_WORKFLOW.md)
 ```
 
 Esta regra **autoriza commit automático** para mudanças de spec (exceção à regra geral de só commitar quando pedido).