docs(dns): sincronizar Spec 037/035 com deploy V1–V3 e V4 pendente

Actualiza dns-viewer, exec/rollback, fichas VM112/122/123, API Console proxy, token interno wizard e verify script para evitar drift documental. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-25 16:42:07 +00:00 · 2026-06-25 16:42:07 +00:00 · 1f340ef924
commit 1f340ef924
parent 038fb8f7ce
14 changed files with 287 additions and 75 deletions
--- a/deploy/vm112-wizard/DNS-VIEWER-V4.md
+++ b/deploy/vm112-wizard/DNS-VIEWER-V4.md
@ -1,36 +1,90 @@
 # Spec 037 V4 — Wizard DNS Viewer

+**Spec:** [dns-viewer.md](../../specs/037-dns-multi-cloudflare-orchestration/dns-viewer.md) · **Rollback:** [DNS-VIEWER-ROLLBACK.md](../../specs/037-dns-multi-cloudflare-orchestration/deploy/DNS-VIEWER-ROLLBACK.md) § VM112
+
 Painel **read-only** no **passo DNS existente** (step 1) — **não** é menu nem página nova.

+**Estado:** 📋 patches versionados no monorepo · deploy VM112 **pendente** (SSH CT130 falha: LAN permission denied, WAN timeout).
+
+---
+
+## Pré-requisitos
+
+| Variável | Valor | Onde |
+|----------|-------|------|
+| `DESK_API_URL` | `http://10.10.10.122:8080` | env wizard backend |
+| `OPS_INTERNAL_TOKEN` | igual ao Desk | env wizard + Desk `.env` |
+
+Desk endpoint aceita `X-Ops-Internal-Token` via `require_internal_or_user` (`main.py`).
+
+---
+
 ## Backend

 ```bash
-# Na VM112
+# Na VM112 (paths locais após git pull / rsync monorepo)
 python3 /opt/ligbox-ops-platform/deploy/vm112-wizard/onboarding-dns-viewer-v4.patch.py
-# Requer OPS_INTERNAL_TOKEN + DESK_API_URL no env wizard
-systemctl restart ligbox-wizard  # ou docker compose restart backend
+systemctl restart ligbox-wizard 2>/dev/null || docker compose -f /opt/ligbox-wizard/docker-compose.yml restart backend
 ```

-Endpoint: `GET /api/onboarding/dns/viewer/{domain}`  
-Header: `X-Onboarding-Session` (sessão wizard)
+| Item | Valor |
+|------|-------|
+| Endpoint | `GET /api/onboarding/dns/viewer/{domain}` |
+| Auth sessão | Header `X-Onboarding-Session` |
+| Proxy | Desk `GET /api/v1/dns/viewer/{domain}?email_service=true` |
+| Resposta | Mesma shape Desk; `edit_links=[]`; `viewer_context=wizard_onboarding` |

-Proxy → Desk `GET /api/v1/dns/viewer/{domain}` (token interno).  
-`edit_links` removidos na resposta wizard (cliente).
+---

 ## Frontend

 ```bash
 python3 /opt/ligbox-ops-platform/deploy/vm112-wizard/frontend-dns-viewer-v4.patch.py
 cd /opt/ligbox-wizard/frontend && npm run build
+# Reiniciar serviço static/nginx conforme stack VM112
 ```

-## UI
+## UI (sem nova rota)

-Painel lateral abaixo das opções DNS:
- Modo (Ligbox / externo / OpenPanel)
+Painel lateral abaixo das opções DNS no step 1:
+
+- Badge modo (Ligbox / externo / OpenPanel)
 - Tabela registos (max 12 linhas)
 - Secção «Serão aplicados» se `planned_records`

+---
+
+## Validação
+
+```bash
+# Com sessão onboarding válida
+curl -sS -H "X-Onboarding-Session: <session>" \
+  "http://127.0.0.1:8090/api/onboarding/dns/viewer/exemplo.com.br" | jq .mode_label,.summary
+```
+
+Browser: `onboard.ligbox.com.br` → passo DNS → painel «Apontamentos DNS (visualização)» após escolher caminho.
+
+---
+
+## SSH / deploy a partir do CT130
+
+| Destino | Comando | Resultado conhecido |
+|---------|---------|---------------------|
+| LAN | `ssh root@10.10.10.112` | Permission denied (password `805353` não válida) |
+| WAN | `ssh -p 2512 root@95.216.14.146` | Timeout a partir CT130 |
+
+**Acção:** Roger aplica patches directamente na VM112 ou fornece credencial SSH correcta.
+
+---
+
 ## Rollback

-Ver `specs/037-dns-multi-cloudflare-orchestration/deploy/DNS-VIEWER-ROLLBACK.md` § VM112.
+```bash
+ssh root@10.10.10.112
+cd /opt/ligbox-wizard
+BACKUP=$(ls -td .backups/dns-viewer-* 2>/dev/null | head -1)
+[ -n "$BACKUP" ] && cp -a "$BACKUP"/backend/. backend/
+systemctl restart ligbox-wizard 2>/dev/null || docker compose restart backend
+```
+
+Ver também rollback completo em `DNS-VIEWER-ROLLBACK.md`.
--- a/docs/vms/README.md
+++ b/docs/vms/README.md
@ -30,7 +30,8 @@ ligbox-ops-platform/
 | **123** | 10.10.10.123 | :2523 | FOSSBilling + Odoo + OpenPanel + Console UI | `projects/finance/` |
 | **104** | 10.10.10.104 | :2504 | Wazuh SIEM | integração Spec 002, 019 |
 | **114** | 10.10.10.114 | — | Traefik (CT) | `docs/network/TRAEFIK_*` |
-| **116** | 10.10.10.116 | :2516 | Nextcloud Hub — ampliar storage mail (Spec 034) | `deploy/vm116-nextcloud/` |
+| **116** | 10.10.10.116 | :2516 | RustDesk relay + portal remoto | — |
+| **124** | 10.10.10.124 | :2524 | **Nextcloud Hub** — storage mail (Spec 034) | `deploy/vm116-nextcloud/` |
 | **130** | 10.10.10.130 | :2530 | **Spec Hub** Git + Obsidian + Portal | CT130 local |

 ---
@ -46,6 +47,7 @@ ligbox-ops-platform/
 | 025 | wizard-onboarding-continuity |
 | 026 | purge-traefik-validation |
 | 034 | nextcloud-carbonio-vm112-integration |
+| 037 | dns-viewer **V4 wizard** (painel step DNS — deploy pendente) |
 | 010 | desk-assist-takeover (fases VM112) |

 → [Ficha VM112](VM112.md)
@ -53,6 +55,7 @@ ligbox-ops-platform/
 ### VM122 — Ops Desk (motor)
 | Spec | Nome |
 |------|------|
+| 035 | ligbox-watchman (vigilância + alertas) |
 | 003 | desk-auth-rbac |
 | 004 | desk-account-management |
 | 009 | ops-audit-overview |
@ -61,6 +64,7 @@ ligbox-ops-platform/
 | 015 | desk-module-registry |
 | 027 | desk-rbac-function-matrix |
 | 029 | agentic ops |
+| 037 | dns-viewer **V1–V2** API + Desk UI |

 → [Ficha VM122](VM122.md)

@ -71,6 +75,8 @@ ligbox-ops-platform/
 | 023 | billing-recurrence-desk-visibility |
 | 024 | openpanel-fossbilling |
 | 027 | desk-rbac (matriz VM123) |
+| 035 | ligbox-mail-bundles `/admin` gerente |
+| 037 | dns-viewer **V3** `/admin/dominio` |

 → [Ficha VM123](VM123.md)

--- a/docs/vms/VM112.md
+++ b/docs/vms/VM112.md
@ -18,6 +18,7 @@

 ```
 deploy/vm112-spec022/          # Carbonio account scripts
+deploy/vm112-wizard/           # Patches wizard (Spec 037 V4 DNS Viewer)
 deploy/vm112-wizard-security/  # CSP, webhooks, audit
 docs/EMAIL_LIGBOX_VM112.md
 specs/001-webhook-vm112-integration/
@ -26,6 +27,7 @@ specs/022-carbonio-account-exists-release/
 specs/025-wizard-onboarding-continuity/
 specs/026-purge-traefik-validation/
 specs/034-nextcloud-carbonio-vm112-integration/
+specs/037-dns-multi-cloudflare-orchestration/  # DNS Viewer V4 wizard
 ```

 ## Deploy na VM112
@ -35,9 +37,21 @@ git clone https://git.spec.ligbox.com.br/ligbox/ligbox-ops-platform.git
 # Copiar deploy/vm112-* para paths locais — ver README em cada pasta
 ```

+### DNS Viewer V4 (Spec 037 — pendente)
+
+Painel read-only no passo DNS — **sem página nova**. Runbook:
+
+```
+deploy/vm112-wizard/DNS-VIEWER-V4.md
+deploy/vm112-wizard/onboarding-dns-viewer-v4.patch.py
+deploy/vm112-wizard/frontend-dns-viewer-v4.patch.py
+```
+
+Env obrigatório: `DESK_API_URL`, `OPS_INTERNAL_TOKEN` (igual Desk VM122).
+
 ## Integração

 - **→ VM122:** webhooks `onboarding.*` · Assist/takeover API
 - **→ CT114:** Traefik routers mail/onboard · `files.{dom}` (Spec 034)
- **→ VM116:** IMAP/SMTP (Nextcloud Mail app) · OCS provisioning (Spec 034)
+- **→ VM124:** IMAP/SMTP (Nextcloud Mail app) · OCS provisioning (Spec 034)
 - **← Desk:** purge, DNS revalidate, assist actions
--- a/docs/vms/VM122.md
+++ b/docs/vms/VM122.md
@ -33,6 +33,20 @@ deploy/vm122-fossbilling/       # Stack legado (se activo)
 - 015 desk-module-registry
 - 027 desk-rbac-function-matrix
 - 029 agentic
+- **037** dns-viewer (V1–V2 API + Desk UI — `dns_viewer.py`, `dns-viewer.js`)
+
+## DNS Viewer (Spec 037)
+
+| Fase | Estado | Path runtime |
+|------|--------|--------------|
+| V1 API | ✅ | `/opt/ligbox-ops-platform/api/app/dns_viewer.py` |
+| V1b Desk UI | ✅ | `frontend/assets/dns-viewer.js` |
+| V2 OpenPanel | ✅ | `api/app/openpanel_dns.py` |
+| V3 proxy Console | ✅ | `api/app/domain_console_routes.py` |
+
+Feature flag: `DNS_VIEWER_ENABLED=1` em `.env`. Rollback: `specs/037-.../deploy/DNS-VIEWER-ROLLBACK.md`.
+
+**Deploy API:** container Docker — após rsync, `docker cp api/app/. ligbox-ops-platform_api_1:/app/app/` + restart.

 ## Deploy

--- a/docs/vms/VM123.md
+++ b/docs/vms/VM123.md
@ -21,6 +21,8 @@ deploy/vm123-finance-stack/     # docker-compose FOSS/Odoo/OpenPanel
 specs/019-ops-console-active-operations/deploy/  # Template Console UI
 specs/023-billing-recurrence-desk-visibility/
 specs/024-openpanel-fossbilling/
+specs/035-ligbox-mail-bundles-foss-openpanel/   # `/admin` gerente
+specs/037-dns-multi-cloudflare-orchestration/    # DNS Viewer V3
 docs/network/VM123_INVENTARIO.md
 docs/VM123_OPS_CONSOLE_HANDOFF.md
 ```
@ -32,7 +34,18 @@ docs/VM123_OPS_CONSOLE_HANDOFF.md
 | fossbilling | 8092 | FOSSBilling |
 | odoo | 8069 | Odoo 16 |
 | openpanel | 2083 | OpenPanel |
-| ligbox-ops-console-ui | 8100 | Console Spec 019 |
+| ligbox-ops-console-ui | 8100 | Console Spec 019 + `/admin/dominio` (037) |
+
+## DNS Viewer Console (Spec 037 V3)
+
+| Item | Valor |
+|------|-------|
+| URL | `https://console.ligbox.com.br/admin/dominio` |
+| Frontend | `AdminDominio.jsx` + `DnsViewerPanel.jsx` |
+| API | Proxy Desk `GET /api/v1/domain-console/dns/viewer/{domain}` (VM122) |
+| Auth | Login Desk → JWT em `localStorage` |
+
+Deploy: build em `specs/019-.../deploy/frontend` → `/opt/ligbox-ops-console/frontend`.

 ## Deploy

--- a/specs/035-ligbox-mail-bundles-foss-openpanel/domain-manager-console-ui.md
+++ b/specs/035-ligbox-mail-bundles-foss-openpanel/domain-manager-console-ui.md
@ -243,12 +243,26 @@ Secção **read-only** — gerente **vê** apontamentos; **não edita** na Conso

 #### API

+**Desk (staff directo):**
+
 ```http
 GET /api/v1/dns/viewer/{domain}
-Authorization: Bearer <domain-admin JWT>
+Authorization: Bearer <staff JWT>
+Query: ?email_service=true&include_public=true
 ```

-Proxy Desk → agrega CF / OpenPanel / público conforme `dns_mode`. Ver [dns-viewer.md](../037-dns-multi-cloudflare-orchestration/dns-viewer.md).
+**Console gerente (proxy Desk — implementado V3):**
+
+```http
+GET /api/v1/domain-console/dns/viewer/{domain}
+Authorization: Bearer <domain-admin JWT>
+Query: ?email_service=true&include_public=true
+```
+
+Frontend Console (`AdminDominio.jsx`) chama o proxy acima via API Desk (`console.ligbox.com.br` → VM122).  
+Implementação: `domain_console_routes.py` — filtra links CF Ligbox para gerente.
+
+Agrega CF / OpenPanel / público conforme `dns_mode`. Ver [dns-viewer.md](../037-dns-multi-cloudflare-orchestration/dns-viewer.md).

 #### Elementos UI

--- a/specs/035-ligbox-mail-bundles-foss-openpanel/spec.md
+++ b/specs/035-ligbox-mail-bundles-foss-openpanel/spec.md
@ -609,6 +609,8 @@ Roger (2026-06-25): gerente e staff precisam **ver todos os apontamentos** sem a
 Documento técnico: [037 dns-viewer.md](../037-dns-multi-cloudflare-orchestration/dns-viewer.md)  
 UI gerente: [domain-manager-console-ui.md §5.5](./domain-manager-console-ui.md#55-domínio--dns-dns-viewer--spec-037-dns-viewer)

+**Deploy (2026-06-25):** Console `/admin/dominio` ✅ VM123 · API proxy `GET /api/v1/domain-console/dns/viewer/{domain}` ✅ VM122 · Wizard V4 📋 patches prontos.
+
 ---

 ## 10. Add-ons FOSS (venda separada)
--- a/specs/035-ligbox-mail-bundles-foss-openpanel/tasks.md
+++ b/specs/035-ligbox-mail-bundles-foss-openpanel/tasks.md
@ -32,10 +32,12 @@ Shell: [ligbox-console-shell.md](./ligbox-console-shell.md) · Detalhe: [domain-
 - [ ] UX-A2: `/admin/contas` CRUD inline
 - [ ] UX-A3: `/admin/files` quotas + toggle Mail NC
 - [ ] UX-A4: `/admin/certificacao` + `/admin/dominio` **DNS Viewer** (037 dns-viewer.md)
-  - [x] `/admin/dominio` V3 deploy VM123 2026-06-25
+  - [x] `/admin/dominio` V3 deploy VM123 2026-06-25 (`AdminDominio.jsx`, `DnsViewerPanel.jsx`)
+  - [ ] `/admin/certificacao` EasyDMARC card
 - [ ] UX-A4b: `/admin/plano` boleto/PIX
 - [ ] SSO FOSS → `/admin?sso=TOKEN`
 - [ ] API Desk `/api/v1/domain-console/*`
+  - [x] `GET /api/v1/domain-console/dns/viewer/{domain}` (VM122 2026-06-25)

 ## Fase 2b — OpenPanel (backend only)

@ -89,4 +91,4 @@ Ver placeholder: [user-self-service-ui.md](./user-self-service-ui.md)
 - [ ] Actualizar `docs/vms/README.md`
 - [ ] Publicar Spec Hub Portal
 - [x] Spec 037-DNS-VIEWER `dns-viewer.md` + §5.5 domain-manager actualizado
- [ ] Implementar `GET /api/v1/dns/viewer/{domain}` (Desk + Console)
+- [x] Implementar `GET /api/v1/dns/viewer/{domain}` (Desk VM122 + proxy Console VM123 2026-06-25)
--- a/specs/037-dns-multi-cloudflare-orchestration/deploy/DNS-VIEWER-EXEC-20260625.md
+++ b/specs/037-dns-multi-cloudflare-orchestration/deploy/DNS-VIEWER-EXEC-20260625.md
@ -1,72 +1,111 @@
-# DNS Viewer V1 — Execução e versionamento
+# DNS Viewer — Execução e versionamento

 **Responsável:** Cursor Agent · **Aprovado por:** Roger  
-**Data:** 2026-06-25  
+**Data início:** 2026-06-25 · **Última actualização:** 2026-06-25  
 **Spec:** [dns-viewer.md](../dns-viewer.md) · Rollback: [DNS-VIEWER-ROLLBACK.md](./DNS-VIEWER-ROLLBACK.md)

 ---

 ## Escopo desta execução

-| Fase | Incluída agora | Entregável |
-|------|----------------|------------|
-| V0 | ✅ baseline | `cloudflare_dns.py` + modal Desk (já existe) |
-| V1 | 📋 próximo deploy | API `GET /api/v1/dns/viewer/{domain}` |
-| V1b | 📋 | `dns-viewer.js` + migrar modal Desk |
-| V2–V4 | ⏳ futuro | OpenPanel, Console, Wizard |
+| Fase | Estado | VM | Entregável |
+|------|--------|-----|------------|
+| V0 | ✅ baseline | VM122 | `cloudflare_dns.py` + modal Desk CF |
+| V1 | ✅ deploy OK | VM122 | `GET /api/v1/dns/viewer/{domain}` |
+| V1b | ✅ deploy OK | VM122 | `dns-viewer.js` + modais Overview/IaaS |
+| V2 | ✅ deploy OK | VM122 | `openpanel_dns.py` + `GET /api/v1/dns/openpanel/records` |
+| V3 | ✅ deploy OK | VM123 | `/admin/dominio` + `DnsViewerPanel.jsx` |
+| V4 | 📋 patches no repo | VM112 | Painel wizard — **deploy pendente** (SSH) |

 ---

 ## Checklist pré-deploy (obrigatório)

 ```bash
-# CT130 — tag git (usar SSHPASS se preflight/rollback a partir do Spec Hub)
+# CT130 — tag git
 cd /opt/ligbox-spec-hub/repos/ligbox-ops-platform
 git tag -a dns-viewer-pre-v1-$(date +%Y%m%d) -m "Antes DNS Viewer V1"

 # VM122 — backup (CT130: export SSHPASS=805353)
-export SSHPASS='805353'   # opcional — só se SSH key falhar
+export SSHPASS='805353'
 bash specs/037-dns-multi-cloudflare-orchestration/deploy/scripts/preflight-dns-viewer.sh \
  --host root@10.10.10.122
 ```

+Para V3 Console:
+
+```bash
+bash specs/037-dns-multi-cloudflare-orchestration/deploy/scripts/preflight-dns-viewer.sh \
+  --host root@10.10.10.123 --console
+```
+
 ---

 ## Ficheiros versionados (monorepo)

 | Ficheiro | Fase | Notas |
 |----------|------|-------|
-| `projects/ops-desk/api/app/cloudflare_dns.py` | V0 | Não remover — provider CF |
-| `projects/ops-desk/api/app/dns_viewer.py` | V1 | **Novo** orquestrador |
-| `projects/ops-desk/api/app/openpanel_dns.py` | V2 | Novo — opcional |
-| `projects/ops-desk/api/app/main.py` | V1 | Rota viewer + flag |
+| `projects/ops-desk/api/app/cloudflare_dns.py` | V0 | Provider CF — manter |
+| `projects/ops-desk/api/app/dns_viewer.py` | V1 | Orquestrador |
+| `projects/ops-desk/api/app/openpanel_dns.py` | V2 | BIND via `dig @10.10.10.123` |
+| `projects/ops-desk/api/app/domain_console_routes.py` | V3 | Proxy Console |
+| `projects/ops-desk/api/app/main.py` | V1+ | Rotas + `require_internal_or_user` |
 | `projects/ops-desk/api/app/permissions.py` | V1 | `can_read_dns_viewer` |
-| `projects/ops-desk/frontend/assets/dns-viewer.js` | V1b | **Novo** componente |
-| `projects/ops-desk/frontend/assets/app.js` | V1b | Integrar viewer |
-| `projects/ops-desk/frontend/index.html` | V1b | Cache bust `?v=` |
-| `projects/wizard/backend/app/services/dns_viewer.py` | V4 | Wizard variant |
+| `projects/ops-desk/frontend/assets/dns-viewer.js` | V1b | Componente Desk |
+| `projects/ops-desk/frontend/assets/app.js` | V1b | Integração modais |
+| `specs/019-.../deploy/frontend/src/views/admin/AdminDominio.jsx` | V3 | Página Console |
+| `specs/019-.../deploy/frontend/src/components/DnsViewerPanel.jsx` | V3 | Componente partilhado |
+| `deploy/vm112-wizard/onboarding-dns-viewer-v4.patch.py` | V4 | Backend wizard |
+| `deploy/vm112-wizard/frontend-dns-viewer-v4.patch.py` | V4 | Frontend wizard |
+| `deploy/vm112-wizard/DNS-VIEWER-V4.md` | V4 | Runbook |

 ---

-## Deploy VM122 (após implementação V1/V1b)
+## Deploy VM122 (V1/V1b/V2)

 ```bash
-# CT130 ou laptop com rsync
 REPO=/opt/ligbox-spec-hub/repos/ligbox-ops-platform
-rsync -av --delete \
-  "$REPO/projects/ops-desk/api/app/" \
-  root@10.10.10.122:/opt/ligbox-ops-platform/api/app/
-
-rsync -av \
-  "$REPO/projects/ops-desk/frontend/assets/" \
-  root@10.10.10.122:/opt/ligbox-ops-platform/frontend/assets/
+rsync -av "$REPO/projects/ops-desk/api/app/" root@10.10.10.122:/opt/ligbox-ops-platform/api/app/
+rsync -av "$REPO/projects/ops-desk/frontend/assets/" root@10.10.10.122:/opt/ligbox-ops-platform/frontend/assets/

 ssh root@10.10.10.122 'cd /opt/ligbox-ops-platform && \
  grep -q DNS_VIEWER_ENABLED .env || echo DNS_VIEWER_ENABLED=1 >> .env && \
-  docker compose -f docker-compose.mvp.yml build api frontend && \
-  docker compose -f docker-compose.mvp.yml up -d api frontend'
+  docker cp api/app/. ligbox-ops-platform_api_1:/app/app/ && \
+  docker restart ligbox-ops-platform_api_1 && \
+  docker compose -f docker-compose.mvp.yml up -d frontend'
 ```

+**Importante:** API corre em container — `rsync` ao host **não** actualiza runtime sem `docker cp` ou rebuild.
+
+---
+
+## Deploy VM123 (V3 Console)
+
+```bash
+REPO=/opt/ligbox-spec-hub/repos/ligbox-ops-platform
+cd "$REPO/specs/019-ops-console-active-operations/deploy/frontend"
+npm run build
+tar cf - dist | ssh root@10.10.10.123 'cd /opt/ligbox-ops-console && rm -rf frontend/* && tar xf - --strip-components=1 -C frontend'
+ssh root@10.10.10.123 'cd /opt/ligbox-ops-console && docker compose up -d --build'
+```
+
+URL: `https://console.ligbox.com.br/admin/dominio`
+
+---
+
+## Deploy VM112 (V4 — pendente)
+
+Ver **[deploy/vm112-wizard/DNS-VIEWER-V4.md](../../../deploy/vm112-wizard/DNS-VIEWER-V4.md)**.
+
+Pré-requisitos env wizard:
+
+```bash
+DESK_API_URL=http://10.10.10.122:8080
+OPS_INTERNAL_TOKEN=<mesmo token Desk>
+```
+
+SSH VM112: LAN `10.10.10.112` ou WAN `95.216.14.146:2512` (credencial distinta de VM122/123).
+
 ---

 ## Validação pós-deploy
@ -75,36 +114,40 @@ ssh root@10.10.10.122 'cd /opt/ligbox-ops-platform && \
 bash specs/037-dns-multi-cloudflare-orchestration/deploy/scripts/verify-dns-viewer.sh \
  --host 10.10.10.122

+# Console
+curl -sS -o /dev/null -w '%{http_code}\n' https://console.ligbox.com.br/admin/dominio
+
 # Manual UI
-# Desk → Overview → tenant VM112 → domínio → secção DNS unificada
-# Browser devtools: zero SyntaxError em app.js / dns-viewer.js
+# Desk → Overview → domínio → secção DNS unificada
+# Console → Admin → Domínio & DNS
 ```

 ---

 ## Rollback

-Ver **[DNS-VIEWER-ROLLBACK.md](./DNS-VIEWER-ROLLBACK.md)** — ordem recomendada:
+Ver **[DNS-VIEWER-ROLLBACK.md](./DNS-VIEWER-ROLLBACK.md)** — ordem:

-1. `DNS_VIEWER_ENABLED=0` (30 segundos)
+1. `DNS_VIEWER_ENABLED=0` (30 s)
 2. Rollback frontend se UI partida
 3. Rollback API se 500
 4. `git revert` CT130 se necessário

 ---

-## Registo de versões (preencher após cada deploy)
+## Registo de versões

-| Data | Tag git | VM122 backup dir | Commit | Notas |
-|------|---------|------------------|--------|-------|
-| 2026-06-25 | `dns-viewer-pre-v1-20260625` | `.backups/dns-viewer-20260625-161839` | `7e4920a` | Pré-deploy |
-| 2026-06-25 | — | tag Docker `post-dns-viewer-v1-20260625` | _(working tree)_ | **V1+V1b deploy OK** · verify PASSED |
+| Data | Tag git | VM backup / Docker | Commit | Notas |
+|------|---------|-------------------|--------|-------|
+| 2026-06-25 | `dns-viewer-pre-v1-20260625` | `.backups/dns-viewer-20260625-161839` | `7e4920a` | Pré-deploy V1 |
+| 2026-06-25 | — | Docker `post-dns-viewer-v1-20260625` | — | V1+V1b VM122 · verify PASSED |
+| 2026-06-25 | — | VM123 frontend tar deploy | — | V3 Console `/admin/dominio` |
+| 2026-06-25 | — | — | `038fb8f` | **Commit monorepo** — Spec 037 entrega V1–V3 + patches V4 |

 ---

-## Pendente V2+
+## Pendente

- OpenPanel BIND provider
- Console `console.ligbox.com.br/admin/dominio`
- Wizard `GET /api/onboarding/dns/viewer/{domain}`
- Formalizar `dns.viewer.read` em Spec 027
+- [ ] Deploy V4 VM112 (patches prontos; SSH bloqueado CT130→112)
+- [ ] Formalizar `dns.viewer.read` em Spec 027
+- [ ] Actualizar `verify-dns-viewer.sh` com smoke Console `/admin/dominio`
--- a/specs/037-dns-multi-cloudflare-orchestration/deploy/DNS-VIEWER-ROLLBACK.md
+++ b/specs/037-dns-multi-cloudflare-orchestration/deploy/DNS-VIEWER-ROLLBACK.md
@ -43,6 +43,8 @@ ssh root@10.10.10.122
 cd /opt/ligbox-ops-platform
 sed -i 's/^DNS_VIEWER_ENABLED=.*/DNS_VIEWER_ENABLED=0/' .env
 docker compose -f docker-compose.mvp.yml up -d api frontend
+# Se alterou ficheiros no host: docker cp api/app/. ligbox-ops-platform_api_1:/app/app/
+docker restart ligbox-ops-platform_api_1
 ```

 ---
--- a/specs/037-dns-multi-cloudflare-orchestration/deploy/scripts/verify-dns-viewer.sh
+++ b/specs/037-dns-multi-cloudflare-orchestration/deploy/scripts/verify-dns-viewer.sh
@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 # Spec 037-DNS-VIEWER — smoke tests pós-deploy ou pós-rollback
+# VM122: API corre em container Docker — após rsync host, docker cp + restart (ver DNS-VIEWER-EXEC)
 set -euo pipefail

 HOST="10.10.10.122"
@ -70,6 +71,19 @@ if [[ "$LEGACY_ONLY" -eq 0 ]]; then
    echo "  FAIL dns/viewer → HTTP $CODE"
    FAIL=1
  fi
+
+  CODE=$(curl -sS -o /dev/null -w '%{http_code}' \
+    "${API}/api/v1/domain-console/dns/viewer/${DOMAIN}" 2>/dev/null || echo "000")
+  if [[ "$CODE" == "401" || "$CODE" == "403" ]]; then
+    echo "  OK  domain-console/dns/viewer (no auth) → HTTP $CODE"
+  elif [[ "$CODE" == "200" ]]; then
+    echo "  OK  domain-console/dns/viewer → HTTP 200"
+  elif [[ "$CODE" == "404" ]]; then
+    echo "  WARN domain-console/dns/viewer → 404 (router não deployado)"
+  else
+    echo "  FAIL domain-console/dns/viewer → HTTP $CODE"
+    FAIL=1
+  fi
 fi

 # JS assets existem
--- a/specs/037-dns-multi-cloudflare-orchestration/dns-viewer.md
+++ b/specs/037-dns-multi-cloudflare-orchestration/dns-viewer.md
@ -2,7 +2,7 @@

 **Criado:** 2026-06-25  
 **Solicitado por:** Roger  
-**Status:** 📋 Especificado — implementação Fase 1 parcial (Desk CF only)  
+**Status:** 🏗️ V1–V3 em produção (VM122/VM123) · V4 patches prontos · deploy VM112 pendente  
 **Prioridade:** P1  
 **Depende de:** [spec.md](./spec.md) · [004 cloudflare-zone-provision](../004-onboard-funnel-events/cloudflare-zone-provision.md) · [009](../009-ops-audit-overview/spec.md) · [028](../028-openpanel-ce-ligbox-reengineering/DNS53_OPENPANEL_PORTA53.md) · [035 §5.5](../035-ligbox-mail-bundles-foss-openpanel/domain-manager-console-ui.md) · [027 RBAC](../027-desk-rbac-function-matrix/spec.md)

@ -101,9 +101,30 @@ flowchart TD
 ```http
 GET /api/v1/dns/viewer/{domain}
 Authorization: Bearer <JWT staff ou domain-admin>
-Query: ?include_public=true&include_planned=true
+# OU (wizard / workers internos):
+X-Ops-Internal-Token: <OPS_INTERNAL_TOKEN>
+Query: ?include_public=true&email_service=true
 ```

+**Variante Console gerente (Spec 035 V3):**
+
+```http
+GET /api/v1/domain-console/dns/viewer/{domain}
+Authorization: Bearer <JWT domain-admin ou staff>
+Query: ?email_service=true&include_public=true
+```
+
+Implementação: `domain_console_routes.py` — proxy para `fetch_dns_viewer()`; filtra `edit_links` CF Ligbox para roles não-staff.
+
+**Autenticação interna (V4 wizard → Desk):**
+
+| Header | Quem usa | Função |
+|--------|----------|--------|
+| `Authorization: Bearer …` | Desk UI, Console `/admin` | JWT staff ou domain-admin |
+| `X-Ops-Internal-Token` | VM112 wizard backend | `require_internal_or_user` em `main.py` — evita duplicar lógica DNS no wizard |
+
+Variáveis VM112: `DESK_API_URL=http://10.10.10.122:8080`, `OPS_INTERNAL_TOKEN` (mesmo valor Desk).
+
 **Response:**

 ```json
@ -284,7 +305,7 @@ Resolver ordem:
 | **V1b** | Desk UI unificada (`dns-viewer.js`) | ✅ VM122 2026-06-25 |
 | **V2** | OpenPanel BIND records no viewer | ✅ VM122 2026-06-25 |
 | **V3** | Console `/admin/dominio` | ✅ VM123 2026-06-25 |
-| **V4** | Wizard painel lateral + diff planned vs actual | 📋 |
+| **V4** | Wizard painel lateral + diff planned vs actual | 📋 patches no repo · deploy VM112 pendente (SSH) |

 ---

@ -301,16 +322,23 @@ Resolver ordem:

 ---

-## 11. Código (alvo monorepo)
+## 11. Código (monorepo + deploy)

-| Caminho | Função |
-|---------|--------|
-| `projects/ops-desk/api/app/dns_viewer.py` | Orquestrador providers |
-| `projects/ops-desk/api/app/cloudflare_dns.py` | Provider CF (existente) |
-| `projects/ops-desk/api/app/openpanel_dns.py` | Provider BIND (novo) |
-| `projects/wizard/backend/app/services/dns_viewer.py` | Wizard session variant |
-| `projects/ops-desk/frontend/assets/dns-viewer.js` | Componente partilhado Desk |
-| `projects/console/frontend/.../DnsSection.tsx` | Console `/admin` |
+| Caminho | Função | Deploy |
+|---------|--------|--------|
+| `projects/ops-desk/api/app/dns_viewer.py` | Orquestrador providers | VM122 API |
+| `projects/ops-desk/api/app/cloudflare_dns.py` | Provider CF | VM122 API |
+| `projects/ops-desk/api/app/openpanel_dns.py` | Provider BIND (`dig @10.10.10.123`) | VM122 API |
+| `projects/ops-desk/api/app/domain_console_routes.py` | Proxy Console `/admin/dominio` | VM122 API |
+| `projects/ops-desk/api/app/main.py` | Rotas viewer + `require_internal_or_user` | VM122 API |
+| `projects/ops-desk/frontend/assets/dns-viewer.js` | Componente Desk | VM122 frontend |
+| `specs/019-.../deploy/frontend/src/components/DnsViewerPanel.jsx` | Componente Console | VM123 |
+| `specs/019-.../deploy/frontend/src/views/admin/AdminDominio.jsx` | Página `/admin/dominio` | VM123 |
+| `deploy/vm112-wizard/onboarding-dns-viewer-v4.patch.py` | Endpoint wizard proxy Desk | VM112 backend |
+| `deploy/vm112-wizard/frontend-dns-viewer-v4.patch.py` | Painel lateral step DNS | VM112 frontend |
+| `deploy/vm112-wizard/DNS-VIEWER-V4.md` | Runbook deploy V4 | — |
+
+**Nota deploy VM122:** código API corre em container Docker — após `rsync` ao host, copiar para o container (`docker cp …/main.py …_api_1:/app/app/`) ou rebuild imagem.

 ---

@ -324,6 +352,8 @@ Resolver ordem:
 | [009 spec](../009-ops-audit-overview/spec.md) | Checks públicos |
 | [027 spec](../027-desk-rbac-function-matrix/spec.md) | Deep-links CF / OP |
 | [DNS-VIEWER-ROLLBACK](./deploy/DNS-VIEWER-ROLLBACK.md) | Rollback e feature flag |
+| [DNS-VIEWER-EXEC-20260625](./deploy/DNS-VIEWER-EXEC-20260625.md) | Registo deploys e commits |
+| [deploy/vm112-wizard/DNS-VIEWER-V4.md](../../../deploy/vm112-wizard/DNS-VIEWER-V4.md) | Runbook V4 wizard |

 ---

@ -364,6 +394,8 @@ DNS_VIEWER_ENABLED=0   # fallback legado /dns/cloudflare/records + UI V0
 git tag -a dns-viewer-pre-v1-YYYYMMDD -m "Antes DNS Viewer V1"
 ```

+Entrega monorepo V1–V3 + patches V4: commit **`038fb8f`** (2026-06-25).
+
 ### Endpoint legado (mantido até cutover)

 `GET /api/v1/dns/cloudflare/records` — **não remover** enquanto rollback não estiver validado em produção ≥7 dias.
--- a/specs/037-dns-multi-cloudflare-orchestration/spec.md
+++ b/specs/037-dns-multi-cloudflare-orchestration/spec.md
@ -131,7 +131,9 @@ Painel unificado para **exibir** apontamentos (staff Desk + gerente Console) **s
 | **Cloudflare Ligbox** | Registos **planeados** (pré-NS) ou **aplicados** (pós-apply) + NS CF |
 | **BYO / Registrador / externo** | DNS **actual** (público + instructions) — **não** preview Ligbox |

-Documento completo: **[dns-viewer.md](./dns-viewer.md)** — endpoint `GET /api/v1/dns/viewer/{domain}`, links editar (CF / OpenPanel / registrador), fases V0–V4.
+Documento completo: **[dns-viewer.md](./dns-viewer.md)** — endpoints, links editar, fases V0–V4.
+
+**Estado deploy (2026-06-25):** V1–V3 produção (VM122/123) · commit `038fb8f` · V4 wizard patches prontos · deploy VM112 pendente.

 ---

--- a/specs/037-dns-multi-cloudflare-orchestration/tasks.md
+++ b/specs/037-dns-multi-cloudflare-orchestration/tasks.md
@ -53,5 +53,5 @@
 - [x] V1b Desk UI unificada (`dns-viewer.js` + Overview/IaaS modal)
 - [x] V2 OpenPanel BIND records (`openpanel_dns.py`) — VM122 2026-06-25
 - [x] V3 Console `/admin/dominio` consume viewer API — VM123 2026-06-25
- [ ] V4 Wizard painel lateral + diff planned vs actual
+- [ ] V4 Wizard painel lateral — patches em `deploy/vm112-wizard/*-v4.patch.py` · deploy VM112 pendente
 - [ ] RBAC `dns.viewer.read` formalizar Spec 027