merge: integra develop local (RF05/RF14/RF18, QR, push, CI) com tema claro/escuro

.env.example

@@ -216,3 +216,12 @@ SMS_GATEWAY=
 # credencial do broker não pode viajar no app. A correção é credencial por
 # dispositivo / mTLS, registrada como lacuna conhecida.
 # ---------------------------------------------------------------------------
+
+# --- Avisos push (RF14) ----------------------------------------------------
+# Gorush é o relé para FCM/APNs e continua exigindo as credenciais dos
+# provedores (arquivos fora do repositório). Vazio desliga o envio de avisos.
+# Para ligar: `docker compose --profile push up` e GORUSH_URL=http://gorush:8088.
+GORUSH_URL=
+GORUSH_CREDENTIALS_DIR=
+GORUSH_IOS_KEY_ID=
+GORUSH_IOS_TEAM_ID=

.github/workflows/ci.yml

@@ -37,6 +37,11 @@ jobs:
         run: |
           python3 -c 'import yaml' 2>/dev/null || { sudo apt-get update && sudo apt-get install -y python3-yaml; }
           ./scripts/qa/ci_invariants.sh
+      - name: Testes dos scripts de CI
+        run: |
+          ./scripts/ci/decode_secret_file_test.sh
+          ./scripts/qa/ci_push_e2e_test.sh
+          ./scripts/qa/ci_invariants_fcm_test.sh
   serverpod-backend:
     runs-on: ubuntu-24.04
     defaults:
@@ -214,11 +219,6 @@ jobs:
       GOOGLE_MAPS_API_KEY: ${{ secrets.GOOGLE_MAPS_API_KEY }}
     steps:
       - uses: actions/checkout@v7
-      # Sem isto o emulador roda por emulação de CPU em software: medido, o log
-      # dizia "ProbeKVM: This user doesn't have permissions to use KVM", o boot
-      # levava ~12 min e cada `adb install` de 45 a 95 s. O runner tem
-      # /dev/kvm, só não para o usuário do job — a regra do udev abre o
-      # dispositivo. É o passo documentado pelo android-emulator-runner.
       - name: Habilita KVM
         run: |
           echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \
@@ -254,12 +254,15 @@ jobs:
           path: |
             ~/.android/avd/*
             ~/.android/adb*
-          key: avd-36-x86_64-pixel_7-ubuntu-24.04
+          # target no nome: o push e2e precisa de Play Services (a imagem padrão da action é
+          # AOSP, sem ele); trocar o target sem trocar a chave restauraria o AVD antigo.
+          key: avd-36-google_apis-x86_64-pixel_7-ubuntu-24.04
       - name: Gera o snapshot do AVD para o cache
         if: steps.avd-cache.outputs.cache-hit != 'true'
         uses: reactivecircus/android-emulator-runner@v2
         with:
           api-level: 36
+          target: google_apis
           arch: x86_64
           profile: pixel_7
           force-avd-creation: false
@@ -278,10 +281,39 @@ jobs:
           (cd apps/patient && flutter pub get) & p2=$!
           (cd apps/acs && flutter pub get) & p3=$!
           wait $p1 && wait $p2 && wait $p3
+      # Credenciais do FCM para o push e2e (Gorush e FCM reais). Cada secret é um arquivo em
+      # base64 (`base64 -w0 arquivo`). A chave da conta de serviço vai para um arquivo
+      # temporário (0600) e GOOGLE_APPLICATION_CREDENTIALS aponta para ele; o
+      # google-services.json vai para onde o build do paciente o procura (sem ele o APK
+      # compila e degrada para "sem push"). Sem os secrets (PR de fork) os passos só avisam
+      # e o job roda como sempre. Cada secret entra por `env:` do PASSO: nunca em `run:`
+      # (injeção de script) e nunca no `env:` do job (toda ação de terceiros o veria) —
+      # ci_invariants.sh vigia as duas coisas. Ficam LOGO ANTES do E2E (e depois do
+      # setup de Java/Flutter/caches/AVD): as credenciais só existem em disco quando quem as usa roda,
+      # e nenhuma ação de terceiros que não precisa delas as lê — o guarda também exige isso.
+      - name: Decodifica a credencial do FCM
+        env:
+          FCM_CREDENTIALS_BASE64: ${{ secrets.FCM_CREDENTIALS_BASE64 }}
+        run: |
+          ./scripts/ci/decode_secret_file.sh --env FCM_CREDENTIALS_BASE64 \
+            --kind service_account --temp-export GOOGLE_APPLICATION_CREDENTIALS
+      - name: Decodifica o google-services.json
+        env:
+          GOOGLE_SERVICES_JSON_BASE64: ${{ secrets.GOOGLE_SERVICES_JSON_BASE64 }}
+        run: |
+          ./scripts/ci/decode_secret_file.sh --env GOOGLE_SERVICES_JSON_BASE64 \
+            --kind google_services --package br.com.prismrr.sinalacs.patient \
+            --to apps/patient/android/app/google-services.json
+      # Sem isto o emulador roda por emulação de CPU em software: medido, o log
+      # dizia "ProbeKVM: This user doesn't have permissions to use KVM", o boot
+      # levava ~12 min e cada `adb install` de 45 a 95 s. O runner tem
+      # /dev/kvm, só não para o usuário do job — a regra do udev abre o
+      # dispositivo. É o passo documentado pelo android-emulator-runner.
       - name: E2E no emulador Android
         uses: reactivecircus/android-emulator-runner@v2
         with:
           api-level: 36
+          target: google_apis
           arch: x86_64
           profile: pixel_7
           force-avd-creation: false
@@ -296,6 +328,15 @@ jobs:
       # container. O pós-passo do flutter-action faz hashFiles('**/pubspec.lock')
       # sobre o workspace inteiro, não consegue ler pg_data/ e derruba o job
       # depois de o E2E ter passado — medido no run 36494654391.
+      # Apaga as credenciais mesmo se o E2E falhar. Num runner hospedado o disco é descartado
+      # ao fim do job, mas o passo mantém a regra verdadeira em qualquer runner (inclusive um
+      # autohospedado no futuro) e tira o google-services.json e a chave do Gorush do workspace.
+      - name: Remove as credenciais do FCM
+        if: always()
+        run: |
+          ./scripts/ci/decode_secret_file.sh --cleanup-temp GOOGLE_APPLICATION_CREDENTIALS
+          ./scripts/ci/decode_secret_file.sh --cleanup-file apps/patient/android/app/google-services.json
+          ./scripts/ci/decode_secret_file.sh --cleanup-file infra/docker/gorush/credentials/fcm-service-account.json
       - name: Remove pg_data/ do workspace
         if: always()
         run: sudo rm -rf pg_data

.gitignore

@@ -39,3 +39,17 @@ graphify-out/
 apps/acs/assets/certs/
 apps/patient/assets/certs/
 .worktrees/
+
+# Estado local do proxy headroom (PID e timestamps), reescrito a cada sessão
+.claude/.headroom_wrap_*.json
+infra/docker/gorush/credentials/
+
+# Google services
+google-services.json
+fcm-service-account.json
+
+# Fixtures e segredos da stack de e2e (gerados por scripts/qa/e2e_stack.sh seed)
+.e2e/
+
+__pycache__/
+*.pyc

CLAUDE.md

@@ -12,7 +12,7 @@ Two core flows:
 
 A third app, `apps/admin`, is a read-only backoffice (Indicadores, Microáreas, Alertas, Auditoria) on mock data.
 
-Main RPC endpoints (`backend/sinalacs_server/lib/src/endpoints/`): `auth` (`loginInstitutional`, `requestOtp`, `verifyOtp`, `developmentLogin` — the last only with `ENABLE_DEV_LOGIN`), `onboarding`, `triage.evaluate`, `alerts` (`createRedAlert`, `acknowledge`, `statusFor`), `patients` (`listMicroArea`, `myData`, chronic conditions), `visits` (`sync`, `pull`), `health.check`.
+Main RPC endpoints (`backend/sinalacs_server/lib/src/endpoints/`): `auth` (`loginInstitutional`, `requestOtp`, `verifyOtp`, `developmentLogin` — the last only with `ENABLE_DEV_LOGIN`), `onboarding`, `triage.evaluate`, `alerts` (`createRedAlert`, `acknowledge`, `statusFor`), `patients` (`listMicroArea`, `myData`, chronic conditions, `updateConsent`, `requestDataDeletion`, `requestDataCorrection`), `visits` (`sync`, `pull`), `health.check`.
 
 `PROGRESS.md` holds milestone status and the open items with owners. `spec/validation_report.md` is stale in both directions (items it lists as open are closed, and its test counts are far below the real ones) — verify against the code before trusting it.
 
@@ -23,7 +23,7 @@ Read these before making product/architecture decisions — when project docs co
 - [spec/stack.md](spec/stack.md) — stack/infra architecture decisions.
 - [spec/ui_design.md](spec/ui_design.md) — visual language and UX behavior.
 - [spec/lgpd_design.md](spec/lgpd_design.md) — privacy/LGPD design.
-- [spec/lgpd_data_audit.md](spec/lgpd_data_audit.md) — field-by-field LGPD sensitivity classification for every persisted table (16 domain tables plus Serverpod's own; the count changes with every migration — re-measure it in the `definition.sql` of the latest `backend/sinalacs_server/migrations/*/`, and see L-17 of `spec/validation_report.md` for the drift this line has already accumulated).
+- [spec/lgpd_data_audit.md](spec/lgpd_data_audit.md) — field-by-field LGPD sensitivity classification for every persisted table (18 domain tables plus Serverpod's own; the count changes with every migration — re-measure it in the `definition.sql` of the latest `backend/sinalacs_server/migrations/*/`, and see L-17 of `spec/validation_report.md` for the drift this line has already accumulated).
 - [spec/ux_accessibility_assessment.md](spec/ux_accessibility_assessment.md) — WCAG 2.2 AA audit (contrast, touch targets, semantics) for the ACS/patient/admin apps; read before touching any color used as text/icon, not just fill.
 - [spec/ux_ui_test_plan.md](spec/ux_ui_test_plan.md) — UX/UI test plan derived from `spec/ui_design.md` (visual/interaction behavior, complementary to the accessibility assessment).
 - [AGENTS.md](AGENTS.md) — full agent working rules (Portuguese), summarized below.
@@ -105,7 +105,7 @@ Product/architecture source of truth (PRD, UX flows, LGPD design, stack decision
 - Keep triage/prioritization logic deterministic and consistent with the Manchester Protocol model referenced in the PRD — do not make risk classification probabilistic or user-overridable.
 - When touching sync behavior (backend `SyncFsm` or the ACS `offline_visit_queue.dart`), preserve retry/queue/conflict semantics — offline-first correctness is the primary architectural risk called out in `AGENTS.md`.
 - When reusing a clinical fill color (`red`/`accent`/`danger`/`yellow`/`green`) as text or icon color in the Flutter apps, use the `*OnSurface` token and measure contrast against the surface it actually renders on (commonly `Card`/`surfaceRaised`), not the Scaffold background — see the WCAG contrast tokens section in [apps/CLAUDE.md](apps/CLAUDE.md), `spec/ux_accessibility_assessment.md` and each app's `test/contrast_tokens_test.dart`.
-- CI lives in [.github/workflows/ci.yml](.github/workflows/ci.yml) and runs on every PR, on pushes to `main`/`develop`, and by hand (`gh workflow run CI --ref <branch>`). 9 jobs: `workflow-lint`, `serverpod-backend`, `backend-docker-build`, `patient-app`, `acs-app`, `admin-app`, `coverage-report`, `android-e2e` (the only one that boots a real emulator against the stack), `admin-android-build`. `workflow-lint` runs actionlint plus `scripts/qa/ci_invariants.sh`, which fails when: this job list drifts from `JOBS_DOCUMENTADOS`; a job leaves the pinned runner (`RUNNER = 'ubuntu-24.04'`, never `ubuntu-latest`); an action drops below its node24 major (`checkout@v7`, `setup-java@v6`, `cache@v6`, `upload-artifact@v7`); the workflow gains a `paths` filter or loses the per-PR/per-SHA `concurrency` group; `android-e2e` loses its `pg_data/` cleanup step; or the AVD cache key does not end in `-<RUNNER>`.
+- CI lives in [.github/workflows/ci.yml](.github/workflows/ci.yml) and runs on every PR, on pushes to `main`/`develop`, and by hand (`gh workflow run CI --ref <branch>`). 9 jobs: `workflow-lint`, `serverpod-backend`, `backend-docker-build`, `patient-app`, `acs-app`, `admin-app`, `coverage-report`, `android-e2e` (the only one that boots a real emulator against the stack), `admin-android-build`. `workflow-lint` runs actionlint plus `scripts/qa/ci_invariants.sh`, which fails when: this job list drifts from `JOBS_DOCUMENTADOS`; a job leaves the pinned runner (`RUNNER = 'ubuntu-24.04'`, never `ubuntu-latest`); an action drops below its node24 major (`checkout@v7`, `setup-java@v6`, `cache@v6`, `upload-artifact@v7`); the workflow gains a `paths` filter or loses the per-PR/per-SHA `concurrency` group; `android-e2e` loses its `pg_data/` cleanup step; or the AVD cache key does not end in `-<RUNNER>`. `workflow-lint` also runs `scripts/ci/decode_secret_file_test.sh`, `scripts/qa/ci_push_e2e_test.sh` and `scripts/qa/ci_invariants_fcm_test.sh`, and `ci_invariants.sh` additionally fails when the secrets `FCM_CREDENTIALS_BASE64`/`GOOGLE_SERVICES_JSON_BASE64` appear inside a `run:` or in the job-level `env:`, when a decode step comes after the E2E step, when the `if: always()` cleanup step is missing, when the emulator loses `target: google_apis` (Play Services; the action's default image is AOSP and FCM returns no token) or when the AVD cache key does not contain it. `android-e2e` decodes both secrets (service-account key to a temp file + `GOOGLE_APPLICATION_CREDENTIALS`, `google-services.json` into `apps/patient/android/app/`) and, when they exist, ends with `scripts/qa/ci_push_e2e.sh` (real Gorush and FCM); without them (fork PRs) it skips.
 - `main` and `develop` are protected: the 8 checks from `./scripts/qa/ci_invariants.sh --checks-obrigatorios` (every job except `android-e2e`, tied to GitHub Actions app 15368) must pass to merge, and `main` also requires a PR; admins can still push directly. `android-e2e` has been green since the fixes of 2026-09-28 but stays informational until it builds a longer history. The script does not read the live protection: after renaming or adding a job, re-apply it (see `CONTRIBUTING.md` › CI e merge) or PRs wait forever for a check that no longer exists. Moving to Ubuntu 26.04 (`ubuntu-latest` migrates on 2026-10-19; a rehearsal ran 9/9 green) is a PR that changes `runs-on`, `RUNNER` and the AVD key suffix together, and needs an actionlint that knows the `ubuntu-26.04` label. History in `docs/ci-audit/2026-09-28-avaliacao-ci-develop.md`; known gaps in the guard are issues #19–#21, #23–#24 (#22 fixed — `on:` as a string/list is normalized instead of crashing, and an unrecognized flag exits 2 with a usage message instead of silently exiting 0).
 - Never commit real patient data, credentials, or the dev Docker Compose secrets into anything beyond local development.