diff --git a/src/mais_humana/cli.py b/src/mais_humana/cli.py
index a8a9831..7ccd5a2 100644
--- a/src/mais_humana/cli.py
+++ b/src/mais_humana/cli.py
@@ -31,6 +31,7 @@ from .operational_dossier import build_execution_round_dossier
 from .governance_engine import build_governance_portfolio, compact_governance_payload
 from .human_rulebook import evaluate_rulebook, rulebook_compact_json
 from .human_readiness_registry import build_readiness_registry
+from .institutional_assurance import compact_assurance_payload, run_institutional_assurance
 from .runtime_budget import build_round_line_budget
 from .orders import build_exit_orders
 from .reports import generate
@@ -167,6 +168,20 @@ def build_parser() -> argparse.ArgumentParser:
     )
     canonical_migration.add_argument("--no-generated", action="store_true", help="Build acceptance cases from runtime repository targets.")
     canonical_migration.add_argument("--limit", type=int, default=40)
+    institutional_assurance = sub.add_parser(
+        "institutional-assurance",
+        help="Scan router-000 institutional decisions and write assurance artifacts.",
+    )
+    institutional_assurance.add_argument("--ecosystem-root", default="G:/_codex-git")
+    institutional_assurance.add_argument("--project-root", default="G:/_codex-git/tudo-para-ia-mais-humana")
+    institutional_assurance.add_argument(
+        "--central-projects-root",
+        default="G:/_codex-git/nucleo-gestao-operacional/central-de-ordem-de-servico/projects",
+    )
+    institutional_assurance.add_argument("--sandbox-mode", default="workspace-write")
+    institutional_assurance.add_argument("--plugin-auth-attempt", default="")
+    institutional_assurance.add_argument("--no-central", action="store_true")
+    institutional_assurance.add_argument("--limit", type=int, default=40)
     return parser
 
 
@@ -647,6 +662,21 @@ def command_canonical_migration_plan(args: argparse.Namespace) -> int:
     return 0
 
 
+def command_institutional_assurance(args: argparse.Namespace) -> int:
+    report, records = run_institutional_assurance(
+        ecosystem_root=Path(args.ecosystem_root),
+        project_root=Path(args.project_root),
+        central_projects_root=Path(args.central_projects_root),
+        sandbox_mode=args.sandbox_mode,
+        plugin_auth_attempt=args.plugin_auth_attempt,
+        write_central=not bool(args.no_central),
+    )
+    payload = compact_assurance_payload(report, limit=int(args.limit))
+    payload["generatedFiles"] = [record.path for record in records]
+    print(json.dumps(payload, ensure_ascii=False, indent=2))
+    return 0
+
+
 def main(argv: list[str] | None = None) -> int:
     parser = build_parser()
     args = parser.parse_args(argv)
@@ -696,6 +726,8 @@ def main(argv: list[str] | None = None) -> int:
         return command_canonical_identity(args)
     if args.command == "canonical-migration-plan":
         return command_canonical_migration_plan(args)
+    if args.command == "institutional-assurance":
+        return command_institutional_assurance(args)
     parser.error(f"unknown command: {args.command}")
     return 2