diff --git a/.cursor/rules/desk-deploy-release.mdc b/.cursor/rules/desk-deploy-release.mdc
index 725c75b..308ccc9 100644
--- a/.cursor/rules/desk-deploy-release.mdc
+++ b/.cursor/rules/desk-deploy-release.mdc
@@ -38,7 +38,7 @@ alwaysApply: true
 1. **Nunca** `docker cp` parcial (só `index.html` ou só `app.staging.js`).
 2. **Sempre** `deploy/desk-staging-modern/deploy-desk-full.sh` para produção Desk (API + frontend + catálogo RBAC).
 3. **Sempre** smoke GREEN antes de declarar "feito" ou actualizar checkpoint.
-4. **Git `main` em VM130** = fonte de verdade; commit antes de deploy.
+4. **Git `develop` → PR → `main`** = fonte de verdade; ver `docs/GIT_WORKFLOW.md`.
 5. Alterações VM112 wizard → `deploy/vm112-wizard/deploy-wizard-vm112-smoke.sh` (carbonio `list_all_domains`).
 
 ## Comandos canónicos
diff --git a/.cursor/rules/spec-driver-sync.mdc b/.cursor/rules/spec-driver-sync.mdc
index 635ece6..57838ed 100644
--- a/.cursor/rules/spec-driver-sync.mdc
+++ b/.cursor/rules/spec-driver-sync.mdc
@@ -44,6 +44,16 @@ O script deve:
 
 Repositório: `https://git.spec.ligbox.com.br/ligbox/ligbox-ops-platform`
 
+**Branches:** trabalho em `develop` · release via **PR → `main`** (push directo a `main` bloqueado).  
+Ver `docs/GIT_WORKFLOW.md`.
+
+```bash
+git checkout develop && git pull origin develop
+# ... commits ...
+git push origin develop
+# PR develop → main no Forgejo após smoke GREEN
+```
+
 Incluir no commit (quando aplicável):
 - `specs/NNN-*/`
 - `chat-bruto/`
diff --git a/docs/GIT_WORKFLOW.md b/docs/GIT_WORKFLOW.md
new file mode 100644
index 0000000..b992d9f
--- /dev/null
+++ b/docs/GIT_WORKFLOW.md
@@ -0,0 +1,85 @@
+# Git Workflow — Ligbox Ops Platform
+
+**Forgejo:** https://git.spec.ligbox.com.br/ligbox/ligbox-ops-platform  
+**Org:** `ligbox` · **Repo:** `ligbox-ops-platform`
+
+---
+
+## Branches
+
+| Branch | Papel | Push directo |
+|--------|-------|--------------|
+| **`develop`** | Integração diária — specs, Desk, Wizard | ✅ Sim |
+| **`main`** | Produção / release — só via **Pull Request** | ❌ Bloqueado |
+
+**Default branch:** `develop` (clone e PRs partem daqui).
+
+---
+
+## Fluxo obrigatório
+
+```bash
+# 1. Trabalhar sempre em develop
+git checkout develop
+git pull origin develop
+
+# 2. Feature branch (opcional, recomendado para mudanças grandes)
+git checkout -b feature/spec-040-wizard-gate
+# ... commits ...
+git push origin feature/spec-040-wizard-gate
+# Abrir PR → develop
+
+# 3. Release para produção (main)
+# Abrir PR: develop → main no Forgejo
+# URL: https://git.spec.ligbox.com.br/ligbox/ligbox-ops-platform/compare/main...develop
+# Merge após smoke GREEN (deploy-desk-full.sh)
+
+# 4. Após merge em main — tag opcional
+git checkout main && git pull origin main
+git tag -a v20260702 -m "Release: descrição"
+git push origin v20260702
+```
+
+---
+
+## Proteção `main`
+
+- **Push directo:** bloqueado (`enable_push: false`, `apply_to_admins: true`)
+- **Merge:** apenas via Pull Request
+- **Aprovações:** 0 (Roger pode auto-merge; PR ainda obrigatório)
+
+Configurado via API Forgejo em 2026-07-02.
+
+---
+
+## Issues + tasks.md
+
+Tarefas vivem em `specs/*/tasks.md` **e** em Forgejo Issues (sync):
+
+```bash
+python3 scripts/sync-tasks-to-forgejo-issues.py
+```
+
+Board: https://git.spec.ligbox.com.br/ligbox/ligbox-ops-platform/issues
+
+---
+
+## Deploy após merge em `main`
+
+```bash
+cd deploy/desk-staging-modern
+./deploy-desk-full.sh   # DESK_RELEASE=GREEN
+```
+
+**Sincronizado** = commit em `main` + deploy VM122/112 + smoke GREEN + checkpoint.
+
+---
+
+## Credenciais Forgejo
+
+| User | Uso |
+|------|-----|
+| `roger` | Admin, push develop, merge PRs |
+| `ligboxadmin` | Admin backup |
+
+Senha: ver `docs/vms/CT130.md` (não commitar).
diff --git a/scripts/setup-forgejo-pr-workflow.sh b/scripts/setup-forgejo-pr-workflow.sh
new file mode 100755
index 0000000..c324bf6
--- /dev/null
+++ b/scripts/setup-forgejo-pr-workflow.sh
@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# Configura branch develop + proteção main (PR obrigatório) no Forgejo.
+# Executar no CT130 com acesso à API Forgejo.
+set -euo pipefail
+
+FORGEJO_URL="${FORGEJO_URL:-http://10.10.10.130:3000}"
+USER="${FORGEJO_USER:-roger}"
+PASS="${FORGEJO_TOKEN:-805353}"
+OWNER="${FORGEJO_OWNER:-ligbox}"
+REPO="${FORGEJO_REPO:-ligbox-ops-platform}"
+REPO_DIR="${REPO_DIR:-/opt/ligbox-spec-hub/repos/ligbox-ops-platform}"
+
+auth() { echo -n "${USER}:${PASS}" | base64 -w0 2>/dev/null || echo -n "${USER}:${PASS}" | base64; }
+
+api() {
+  local method="$1" path="$2" data="${3:-}"
+  if [[ -n "$data" ]]; then
+    curl -sk -X "$method" -H "Authorization: Basic $(auth)" -H "Content-Type: application/json" \
+      "${FORGEJO_URL}/api/v1${path}" -d "$data"
+  else
+    curl -sk -X "$method" -H "Authorization: Basic $(auth)" \
+      "${FORGEJO_URL}/api/v1${path}"
+  fi
+}
+
+echo "==> 1. Branch develop"
+cd "$REPO_DIR"
+git fetch origin
+if git show-ref --verify --quiet refs/heads/develop; then
+  git checkout develop
+  git pull origin develop
+else
+  git checkout -b develop origin/main
+fi
+git push -u origin develop
+
+echo "==> 2. Default branch = develop"
+api PATCH "/repos/${OWNER}/${REPO}" '{"default_branch":"develop"}' | python3 -c "import sys,json; d=json.load(sys.stdin); print('default:', d.get('default_branch'))"
+
+echo "==> 3. Proteção main (PR only)"
+existing=$(api GET "/repos/${OWNER}/${REPO}/branch_protections" | python3 -c "import sys,json; print('main' in [x.get('branch_name') for x in json.load(sys.stdin)])")
+if [[ "$existing" == "False" ]]; then
+  api POST "/repos/${OWNER}/${REPO}/branch_protections" '{
+    "branch_name":"main",
+    "enable_push":false,
+    "enable_push_whitelist":false,
+    "required_approvals":0,
+    "apply_to_admins":true
+  }' | python3 -c "import sys,json; d=json.load(sys.stdin); print('protected:', d.get('branch_name'))"
+else
+  echo "main já protegida"
+fi
+
+echo "==> 4. Verificação"
+api GET "/repos/${OWNER}/${REPO}/branches/main" | python3 -c "
+import sys,json
+d=json.load(sys.stdin)
+print('main protected:', d.get('protected'))
+print('can_push:', d.get('user_can_push'))
+print('can_merge:', d.get('user_can_merge'))
+"
+
+echo ""
+echo "OK — develop ativo, main só via PR"
+echo "PR template: ${FORGEJO_URL/https:\/\//https://git.spec.ligbox.com.br/}/ligbox/${REPO}/compare/main...develop"