docs: reconciliar OpenSpec e escopo do MVP (MAN-124) (#50)

openspec/specs/health-check/spec.md

@@ -26,3 +26,17 @@ The system SHALL return a failure status when the application cannot initialize
 - **WHEN** the application fails to boot due to misconfiguration or missing dependencies
 - **THEN** the health endpoint MUST NOT return HTTP 200
 
+### Requirement: Staging health and smoke use the public /up endpoint
+
+Staging healthchecks and post-deploy smoke MUST call `GET /up` without authentication and MUST treat a non-200 response as deployment failure (SPEC §15.5, §16.2). The health response MUST NOT expose secrets.
+
+#### Scenario: Staging healthcheck probes /up
+
+- **WHEN** Dokploy or the container runtime evaluates application health after deploy
+- **THEN** it MUST request `/up`
+- **AND** MUST require HTTP 200 before marking the service healthy
+
+#### Scenario: Smoke failure on /up fails the deploy gate
+
+- **WHEN** post-deploy smoke requests `/up` and receives a non-200 response
+- **THEN** the staging promotion MUST be considered failed