ACS: FLAG_SECURE, release assinado, botão da UBS, RF08, MFA (TOTP) e mTLS no broker

.env.example

@@ -67,6 +67,15 @@ MQTT_ACS_PASSWORD=
 #   MQTT_CERT_SAN_EXTRA=IP:192.168.0.10
 MQTT_CERT_SAN_EXTRA=
 
+# mTLS do broker: o backend apresenta um certificado de cliente (CN = usuário
+# MQTT, emitido pelo mosquitto-init com a CA de desenvolvimento). O
+# docker-compose.yml já define as duas variáveis para o container do servidor
+# (/app/certs/backend.crt e backend.key); só precisam vir aqui para rodar o
+# servidor fora do Compose. Vêm sempre juntas; fora de development com
+# MQTT_USE_TLS=true são obrigatórias. A senha MQTT continua valendo.
+#   MQTT_CLIENT_CERT_PATH=infra/docker/mosquitto/runtime/certs/backend.crt
+#   MQTT_CLIENT_KEY_PATH=infra/docker/mosquitto/runtime/certs/backend.key
+
 # SANs adicionais no certificado do RPC, que o Traefik apresenta em :443
 # (RNF04). Mesma necessidade e mesmo formato do MQTT_CERT_SAN_EXTRA acima, mas
 # para a outra CA: a do RPC é SEPARADA da do broker — ver docs/README.md.
@@ -173,6 +182,12 @@ APP_ENV=development
 # autenticação institucional.
 ENABLE_DEV_LOGIN=true
 
+# MFA por TOTP (RFC 6238) no login institucional do ACS (RF07). Com true, o ACS
+# sem MFA ativa não entra: precisa ativá-la antes (auth.beginTotpEnrollment).
+# Em produção o padrão é `true` (variável ausente = ligada fora de development);
+# este default é só da stack local.
+REQUIRE_ACS_MFA=false
+
 # Gateway de SMS do login passwordless. `log` (padrão em development) escreve o
 # código no log do processo em vez de enviar SMS. Em produção é obrigatório
 # apontar para um gateway real — nenhum provedor está escolhido ainda, então

CLAUDE.md

@@ -4,7 +4,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## Project overview
 
-SinalACS is a platform that prioritizes Primary Health Care visits in Brazil by turning structured clinical signals into a risk-ranked work queue for the Community Health Agent (ACS). Project documentation, code comments, and UI copy are in Portuguese — match that language for anything user-facing or spec-related. Current state: functional prototype, validated locally via Docker Compose; not production-ready. Already delivered: ACS institutional login (RF07, matrícula + senha/Argon2id, credentials kept locally — no integration with a real identity provider), patient passwordless login (RF01, CPF + birth date + OTP), RBAC per micro-area (RNF06), TLS on the RPC via Traefik (RNF04) and on the broker (password + ACL). Still missing: MFA and refresh token (deliberately deferred — see `PROGRESS.md`), mTLS on the broker (no client certificates), a backend for the admin backoffice (`apps/admin` still runs on `MockAdminDataSource`), and a production deploy (`backend/DEPLOY.md` is only a free-tier demo path).
+SinalACS is a platform that prioritizes Primary Health Care visits in Brazil by turning structured clinical signals into a risk-ranked work queue for the Community Health Agent (ACS). Project documentation, code comments, and UI copy are in Portuguese — match that language for anything user-facing or spec-related. Current state: functional prototype, validated locally via Docker Compose; not production-ready. Already delivered: ACS institutional login (RF07, matrícula + senha/Argon2id, credentials kept locally — no integration with a real identity provider), patient passwordless login (RF01, CPF + birth date + OTP), RBAC per micro-area (RNF06), TLS on the RPC via Traefik (RNF04) and on the broker (password + ACL + client certificate on the local stack, `scripts/qa/mtls_invariants.sh`), TOTP MFA for the ACS login, RF08 micro-area persisted in the encrypted local database (72 h, per owner), `FLAG_SECURE` on the ACS window, release builds that refuse the debug key unless explicitly allowed (a release keystore is still to be provisioned) and the UBS call button. Still missing: refresh token (deliberately deferred — with MFA on, the ACS session of 15 min cannot be renewed silently; see `PROGRESS.md`, section Pendências do ACS), per-device client-certificate provisioning in production (mTLS is delivered only on the local stack), MFA reset by the coordinator (manual today), a backend for the admin backoffice (`apps/admin` still runs on `MockAdminDataSource`), and a production deploy (`backend/DEPLOY.md` is only a free-tier demo path).
 
 Two core flows:
 - **Paciente (patient)**: passwordless auth (OTP), urgency alert, structured triage, request status tracking, "Meus Dados" (LGPD).
@@ -108,6 +108,7 @@ Product/architecture source of truth (PRD, UX flows, LGPD design, stack decision
 - CI lives in [.github/workflows/ci.yml](.github/workflows/ci.yml) and runs on every PR, on pushes to `main`/`develop`, and by hand (`gh workflow run CI --ref <branch>`). 9 jobs: `workflow-lint`, `serverpod-backend`, `backend-docker-build`, `patient-app`, `acs-app`, `admin-app`, `coverage-report`, `android-e2e` (the only one that boots a real emulator against the stack), `admin-android-build`. `workflow-lint` runs actionlint plus `scripts/qa/ci_invariants.sh`, which fails when: this job list drifts from `JOBS_DOCUMENTADOS`; a job leaves the pinned runner (`RUNNER = 'ubuntu-24.04'`, never `ubuntu-latest`); an action drops below its node24 major (`checkout@v7`, `setup-java@v6`, `cache@v6`, `upload-artifact@v7`); the workflow gains a `paths` filter or loses the per-PR/per-SHA `concurrency` group; `android-e2e` loses its `pg_data/` cleanup step; or the AVD cache key does not end in `-<RUNNER>`. `workflow-lint` also runs `scripts/ci/decode_secret_file_test.sh`, `scripts/qa/ci_push_e2e_test.sh` and `scripts/qa/ci_invariants_fcm_test.sh`, and `ci_invariants.sh` additionally fails when the secrets `FCM_CREDENTIALS_BASE64`/`GOOGLE_SERVICES_JSON_BASE64` appear inside a `run:` or in the job-level `env:`, when a decode step comes after the E2E step, when the `if: always()` cleanup step is missing, when the emulator loses `target: google_apis` (Play Services; the action's default image is AOSP and FCM returns no token) or when the AVD cache key does not contain it. `android-e2e` decodes both secrets (service-account key to a temp file + `GOOGLE_APPLICATION_CREDENTIALS`, `google-services.json` into `apps/patient/android/app/`) and, when they exist, ends with `scripts/qa/ci_push_e2e.sh` (real Gorush and FCM); without them (fork PRs) it skips.
 - `main` and `develop` are protected: the 8 checks from `./scripts/qa/ci_invariants.sh --checks-obrigatorios` (every job except `android-e2e`, tied to GitHub Actions app 15368) must pass to merge, and `main` also requires a PR; admins can still push directly. `android-e2e` has been green since the fixes of 2026-09-28 but stays informational until it builds a longer history. The script does not read the live protection: after renaming or adding a job, re-apply it (see `CONTRIBUTING.md` › CI e merge) or PRs wait forever for a check that no longer exists. Moving to Ubuntu 26.04 (`ubuntu-latest` migrates on 2026-10-19; a rehearsal ran 9/9 green) is a PR that changes `runs-on`, `RUNNER` and the AVD key suffix together, and needs an actionlint that knows the `ubuntu-26.04` label. History in `docs/ci-audit/2026-09-28-avaliacao-ci-develop.md`; known gaps in the guard are issues #19–#21, #23–#24 (#22 fixed — `on:` as a string/list is normalized instead of crashing, and an unrecognized flag exits 2 with a usage message instead of silently exiting 0).
 - Never commit real patient data, credentials, or the dev Docker Compose secrets into anything beyond local development.
+- Never include AI attributions, "Co-Authored-By", or "Generated with Claude Code" labels in git commits or PR descriptions.
 
 ## graphify