feat(vm123): deploy-vm123-full.sh + smoke FINANCE_RELEASE=GREEN

Mesmo nível Desk: sync finance+console, smoke 11 checks, rule Cursor
vm123-deploy-release.mdc e checklist unificado 12 passos.

Co-authored-by: Cursor <cursoragent@cursor.com>

.cursor/rules/desk-deploy-release.mdc

@@ -79,12 +79,16 @@ Ao encerrar sessão Desk: `git rev-parse --short HEAD` + resultado smoke no `SES
 | 3 | Push + PR → `main` | Forgejo: PR `develop` → `main`, merge |
 | 4 | Pull `main` local | `git checkout main && git pull origin main` |
 | 5 | **Deploy VM122** | `./deploy/desk-staging-modern/deploy-desk-full.sh` |
-| 6 | **Smoke GREEN** | `DESK_RELEASE=GREEN` |
+| 6 | **Smoke Desk GREEN** | `DESK_RELEASE=GREEN` |
-| 7 | **VM112** (se wizard) | `deploy/vm112-wizard/deploy-wizard-vm112-smoke.sh` |
+| 7 | **Deploy VM123** (se finance/console) | `./deploy/vm123-finance-modern/deploy-vm123-full.sh` |
-| 8 | Forgejo issues | `python3 scripts/sync-tasks-to-forgejo-issues.py` (se `tasks.md` mudou) |
+| 8 | **Smoke Finance GREEN** | `FINANCE_RELEASE=GREEN` |
-| 9 | Checkpoint | `SESSION-CHECKPOINT.md` + hash commit + smoke |
+| 9 | **VM112** (se wizard) | `deploy/vm112-wizard/deploy-wizard-vm112-smoke.sh` |
-| 10 | Portal | `./portal/refresh-spec-driver.sh` (CT130, se spec mudou) |
+| 10 | Forgejo issues | `python3 scripts/sync-tasks-to-forgejo-issues.py` (se `tasks.md` mudou) |
+| 11 | Checkpoint | `SESSION-CHECKPOINT.md` + hash commit + smoke |
+| 12 | Portal | `./portal/refresh-spec-driver.sh` (CT130, se spec mudou) |
 
 **Proibido:** `docker cp` parcial · push directo a `main` · declarar "feito" sem smoke · VM112 com senha `805353`.
 
-**Doc completa:** `docs/GIT_WORKFLOW.md` · `docs/vms/CT130.md`
+**Rules por VM:** `desk-deploy-release.mdc` (122) · `vm123-deploy-release.mdc` (123) · VM112 em desk rule.
+
+**Doc completa:** `docs/GIT_WORKFLOW.md` · `docs/vms/CT130.md` · `deploy/vm123-finance-modern/README.md`

.cursor/rules/vm123-deploy-release.mdc

@@ -0,0 +1,55 @@
+---
+description: VM123 Finance release — deploy atómico console+stack, smoke FINANCE_RELEASE=GREEN
+globs: projects/finance/**/*,specs/019-ops-console-active-operations/**/*,deploy/vm123-finance-modern/**/*
+alwaysApply: true
+---
+
+# VM123 Finance Release — Roger / Ligbox
+
+**Métrica única:** `FINANCE_RELEASE=GREEN` após `./deploy/vm123-finance-modern/smoke-vm123.sh`.
+
+## Definição: «Sincronizado VM123»
+
+| # | Critério | Verificação |
+|---|----------|-------------|
+| 1 | Commit em Forgejo `main` | `git rev-parse HEAD` |
+| 2 | Deploy VM123 | `./deploy/vm123-finance-modern/deploy-vm123-full.sh` |
+| 3 | Smoke GREEN | `FINANCE_RELEASE=GREEN` |
+| 4 | Checkpoint | `SESSION-CHECKPOINT.md` spec 019/024/035 |
+
+## Credenciais SSH (root)
+
+| VM | IP LAN | SSH WAN | Senha |
+|----|--------|---------|-------|
+| **VM123** Finance | `10.10.10.123` | `95.216.14.146:2523` | `805353` |
+
+## Regras obrigatórias
+
+1. **Nunca** editar `/opt/vm123-finance-stack` ou `/opt/ligbox-ops-console` só na VM sem commit no repo.
+2. **Sempre** `deploy-vm123-full.sh` — sync repo + console build + smoke.
+3. **Nunca** sobrescrever `.env` remoto (secrets locais VM123).
+4. **Nunca** `docker compose down` sem `-f` apontando stack isolado (console vs finance).
+5. Smoke GREEN antes de declarar feito.
+
+## Comandos canónicos
+
+```bash
+cd /opt/ligbox-spec-hub/repos/ligbox-ops-platform/deploy/vm123-finance-modern
+./deploy-vm123-full.sh
+./smoke-vm123.sh
+```
+
+## URLs produção
+
+| Serviço | URL |
+|---------|-----|
+| Console | https://console.ligbox.com.br |
+| FOSS | https://financeiro.ligbox.com.br/admin |
+| Odoo | https://financeiro.ligbox.com.br/odoo |
+| OpenPanel | https://openpanel.ligbox.com.br |
+
+## Integração Desk
+
+Console depende de VM122 API — smoke inclui `GET http://10.10.10.122:8080/api/health`.
+
+Deploy Desk + Finance no mesmo release → ambos GREEN.

deploy/vm123-finance-modern/README.md

@@ -0,0 +1,49 @@
+# VM123 Finance — deploy atómico + smoke GREEN
+
+Mesmo nível que Desk (VM122) e Wizard (VM112).
+
+## Comandos
+
+```bash
+cd /opt/ligbox-spec-hub/repos/ligbox-ops-platform/deploy/vm123-finance-modern
+
+# Deploy completo (sync + console build + smoke)
+./deploy-vm123-full.sh
+
+# Só smoke
+./smoke-vm123.sh
+```
+
+## Métrica
+
+`FINANCE_RELEASE=GREEN` após smoke — obrigatório antes de declarar feito.
+
+## O que sincroniza
+
+| Destino VM123 | Origem repo |
+|---------------|-------------|
+| `/opt/vm123-finance-stack` | `projects/finance/deploy/vm123-finance-stack/` |
+| `/opt/ligbox-ops-console` | `specs/019-ops-console-active-operations/deploy/` |
+
+`.env` remoto **nunca** sobrescrito.
+
+## Serviços validados
+
+- Ops Console `:8100` + `console.ligbox.com.br`
+- FOSSBilling `:8092` + `financeiro.ligbox.com.br`
+- Odoo `:8069`
+- OpenPanel + OpenAdmin (HTTPS)
+- Bridge OpenPanel `:18087`
+- Desk VM122 upstream health
+
+## Credenciais SSH
+
+| VM | IP | WAN | Senha |
+|----|-----|-----|-------|
+| VM123 | 10.10.10.123 | :2523 | `805353` |
+
+Ver `projects/finance/deploy/vm123-finance-stack/CREDENCIAIS_SERVICOS_VM123.txt` para apps.
+
+## Rule Cursor
+
+`.cursor/rules/vm123-deploy-release.mdc`

deploy/vm123-finance-modern/deploy-vm123-full.sh

@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+# Deploy COMPLETO VM123 — Finance stack + Ops Console + smoke GREEN
+#
+# Sincroniza repo → /opt/vm123-finance-stack + /opt/ligbox-ops-console
+# Rebuild console UI; restart finance compose se necessário.
+#
+# Uso: ./deploy-vm123-full.sh [root@10.10.10.123]
+# Env: VM123_SSH_PASS (default 805353), SKIP_SMOKE=1
+
+set -euo pipefail
+
+HOST="${1:-root@10.10.10.123}"
+PASS="${VM123_SSH_PASS:-805353}"
+REPO="$(cd "$(dirname "$0")/../.." && pwd)"
+FINANCE_SRC="${REPO}/projects/finance/deploy/vm123-finance-stack"
+CONSOLE_SRC="${REPO}/specs/019-ops-console-active-operations/deploy"
+REMOTE_FIN="/opt/vm123-finance-stack"
+REMOTE_CONSOLE="/opt/ligbox-ops-console"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+echo "==> Deploy VM123 FULL → ${HOST}"
+echo "==> Repo: ${REPO}"
+
+for d in "$FINANCE_SRC" "$CONSOLE_SRC"; do
+  [[ -d "$d" ]] || { echo "ERRO: falta $d" >&2; exit 1; }
+done
+
+sync_dir() {
+  local src="$1" dest="$2" excludes="${3:-}"
+  local tar_ex=()
+  [[ -n "$excludes" ]] && tar_ex=(--exclude "$excludes")
+  tar czf - -C "$src" "${tar_ex[@]}" . | \
+    sshpass -p "${PASS}" ssh -o StrictHostKeyChecking=no "${HOST}" "mkdir -p ${dest} && tar xzf - -C ${dest}"
+}
+
+echo "==> Sync finance stack → ${REMOTE_FIN}"
+sync_dir "${FINANCE_SRC}" "${REMOTE_FIN}" ".env"
+
+echo "==> Sync Ops Console → ${REMOTE_CONSOLE}"
+( cd "${CONSOLE_SRC}" && tar czf - --exclude node_modules --exclude frontend/dist . ) | \
+  sshpass -p "${PASS}" ssh -o StrictHostKeyChecking=no "${HOST}" "mkdir -p ${REMOTE_CONSOLE} && tar xzf - -C ${REMOTE_CONSOLE}"
+
+sshpass -p "${PASS}" ssh -o StrictHostKeyChecking=no "${HOST}" bash -s <<'REMOTE'
+set -e
+FIN=/opt/vm123-finance-stack
+CON=/opt/ligbox-ops-console
+
+# Finance compose — up sem down global
+if [[ -f "$FIN/.env" ]]; then
+  cd "$FIN"
+  docker compose pull --ignore-pull-failures 2>/dev/null || true
+  docker compose up -d
+  docker compose ps
+else
+  echo "AVISO: $FIN/.env ausente — compose finance não alterado (criar .env manualmente)"
+fi
+
+# Console — build + up (stack isolado; redeploy com porta 8100 já em uso OK)
+cd "$CON"
+if [[ ! -f .env ]]; then
+  cp .env.example .env 2>/dev/null || true
+fi
+export CONSOLE_BIND="${CONSOLE_BIND:-0.0.0.0}"
+export CONSOLE_HOST_PORT="${CONSOLE_HOST_PORT:-8100}"
+docker compose -f "$CON/docker-compose.yml" build
+docker compose -f "$CON/docker-compose.yml" up -d
+sleep 4
+curl -sf "http://127.0.0.1:${CONSOLE_HOST_PORT}/health" && echo
+REMOTE
+
+if [[ "${SKIP_SMOKE:-}" != "1" ]]; then
+  echo ""
+  echo "==> Smoke tests"
+  "${SCRIPT_DIR}/smoke-vm123.sh"
+fi
+
+echo ""
+echo "Deploy VM123 completo"
+echo "Commit: $(cd "${REPO}" && git rev-parse --short HEAD 2>/dev/null || echo unknown)"
+echo "Console: https://console.ligbox.com.br"
+echo "FOSS:    https://financeiro.ligbox.com.br/admin"

deploy/vm123-finance-modern/smoke-vm123.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# Smoke VM123 Finance + Ops Console — semáforo FINANCE_RELEASE=GREEN/RED
+# Uso: ./smoke-vm123.sh
+
+set -euo pipefail
+
+LAN="${VM123_LAN:-http://10.10.10.123}"
+FAIL=0
+pass() { echo "  OK  $1"; }
+fail() { echo "  FAIL $1"; FAIL=$((FAIL + 1)); }
+
+check_code() {
+  local name="$1" url="$2" expect="${3:-200}"
+  local code
+  code=$(curl -sk -o /dev/null -w "%{http_code}" --connect-timeout 15 "$url" 2>/dev/null || echo "000")
+  if [[ "$expect" == *"|"* ]]; then
+    IFS='|' read -ra codes <<< "$expect"
+    for c in "${codes[@]}"; do
+      [[ "$code" == "$c" ]] && { pass "$name ($code)"; return; }
+    done
+    fail "$name ($code, esperado $expect)"
+  else
+    [[ "$code" == "$expect" ]] && pass "$name ($code)" || fail "$name ($code, esperado $expect)"
+  fi
+}
+
+echo "==> Smoke VM123 Finance — $(date -Iseconds)"
+
+# --- Console (Spec 019) — health canónico ---
+body=$(curl -sk --connect-timeout 10 "${LAN}:8100/health" 2>/dev/null || true)
+if echo "$body" | grep -qiE 'ok|healthy'; then
+  pass "Console LAN /health"
+else
+  fail "Console LAN /health ($(echo "$body" | head -c 40))"
+fi
+
+check_code "Console public /health" "https://console.ligbox.com.br/health" "200"
+check_code "Console public SPA" "https://console.ligbox.com.br/" "200"
+
+# --- FOSS + Odoo (Docker) ---
+check_code "FOSSBilling LAN :8092" "${LAN}:8092/" "200|301|302|403"
+check_code "FOSSBilling public /admin" "https://financeiro.ligbox.com.br/admin" "200|301|302|403"
+check_code "Odoo LAN /web/login" "${LAN}:8069/web/login" "200|301|302"
+check_code "Odoo public login" "https://financeiro.ligbox.com.br/odoo/web/login?db=ligbox" "200|301|302"
+
+# --- OpenPanel (host) ---
+check_code "OpenPanel public" "https://openpanel.ligbox.com.br/" "200|301|302|403"
+check_code "OpenAdmin public" "https://admin.openpanel.ligbox.com.br/" "200|301|302|403"
+
+# --- Bridge FOSS ↔ OpenPanel (localhost VM123 — porta não exposta LAN) ---
+BRIDGE_CODE=$(sshpass -p "${VM123_SSH_PASS:-805353}" ssh -o StrictHostKeyChecking=no -o ConnectTimeout=8 \
+  root@10.10.10.123 'curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:18087/api' 2>/dev/null || echo "000")
+[[ "$BRIDGE_CODE" =~ ^(200|401|403)$ ]] && pass "OpenPanel bridge :18087 ($BRIDGE_CODE)" || fail "OpenPanel bridge ($BRIDGE_CODE)"
+
+# --- Desk upstream (VM122) — Console depende ---
+check_code "Desk API VM122 (upstream)" "http://10.10.10.122:8080/api/health" "200"
+
+echo ""
+if [[ "$FAIL" -eq 0 ]]; then
+  echo "FINANCE_RELEASE=GREEN"
+  exit 0
+fi
+echo "FINANCE_RELEASE=RED ($FAIL falhas)"
+exit 1

docs/GIT_WORKFLOW.md

@@ -67,11 +67,17 @@ Board: https://git.spec.ligbox.com.br/ligbox/ligbox-ops-platform/issues
 ## Deploy após merge em `main`
 
 ```bash
-cd deploy/desk-staging-modern
+# Desk VM122
-./deploy-desk-full.sh   # DESK_RELEASE=GREEN
+cd deploy/desk-staging-modern && ./deploy-desk-full.sh   # DESK_RELEASE=GREEN
+
+# Finance VM123
+cd deploy/vm123-finance-modern && ./deploy-vm123-full.sh # FINANCE_RELEASE=GREEN
+
+# Wizard VM112 (se aplicável)
+cd deploy/vm112-wizard && ./deploy-wizard-vm112-smoke.sh
 ```
 
-**Sincronizado** = commit em `main` + deploy VM122/112 + smoke GREEN + checkpoint.
+**Sincronizado** = commit em `main` + deploys VM122/123/112 + smoke GREEN + checkpoint.
 
 ---
 

docs/vms/VM123.md

@@ -50,11 +50,15 @@ Deploy: build em `specs/019-.../deploy/frontend` → `/opt/ligbox-ops-console/fr
 ## Deploy
 
 ```bash
-git clone https://git.spec.ligbox.com.br/ligbox/ligbox-ops-platform.git
+# Canónico (repo CT130)
-cd deploy/vm123-finance-stack && docker compose up -d
+cd /opt/ligbox-spec-hub/repos/ligbox-ops-platform/deploy/vm123-finance-modern
-# Console: specs/019-.../deploy/ → /opt/ligbox-ops-console/
+./deploy-vm123-full.sh    # sync + console build + FINANCE_RELEASE=GREEN
+./smoke-vm123.sh          # só validação
 ```
 
+Runtime VM123: `/opt/vm123-finance-stack` · `/opt/ligbox-ops-console`  
+Rule Cursor: `.cursor/rules/vm123-deploy-release.mdc`
+
 ## Integração
 
 - **← VM122:** API `api.ops.ligbox.com.br` (motor chamados)