Multitenantperorg enabling

src/app/[locale]/dashboard/new/page.tsx

@@ -0,0 +1,49 @@
+import { getSessionUser } from "@/lib/session";
+import { getTranslations } from "next-intl/server";
+import { redirect } from "next/navigation";
+import { OnboardingFlow } from "@/components/onboarding/onboarding-flow";
+import Link from "next/link";
+
+/**
+ * /dashboard/new — wizard for creating an additional instance for an
+ * existing customer. Reachable from the dashboard "+ Create new instance"
+ * link.
+ *
+ * Slice 3: this page is the entry point for follow-up instances. The
+ * first-instance case is still served inline on /dashboard. Both paths
+ * mount the same <OnboardingFlow>; the API resolves the difference
+ * server-side based on whether prior approved rows exist for the org.
+ *
+ * Platform admins are redirected to /dashboard — they shouldn't be
+ * creating tenant instances under their own org.
+ */
+export default async function NewInstancePage() {
+  const user = await getSessionUser();
+  if (!user) redirect("/login");
+  if (user.isPlatform) redirect("/dashboard");
+
+  const t = await getTranslations("dashboard");
+
+  return (
+    <div>
+      <div className="mb-8 animate-in">
+        <Link
+          href="/dashboard"
+          className="inline-flex items-center gap-1.5 mb-4 text-xs font-medium text-text-muted hover:text-text-primary transition-colors"
+        >
+          <span>←</span> {t("title")}
+        </Link>
+        <h1 className="font-display text-2xl font-semibold accent-rule mb-2">
+          {t("createInstance")}
+        </h1>
+        <p className="text-text-secondary text-sm mt-4">
+          {t("createInstanceDescription")}
+        </p>
+      </div>
+
+      <div className="animate-in animate-in-delay-1">
+        <OnboardingFlow orgName={user.orgName} />
+      </div>
+    </div>
+  );
+}

src/app/[locale]/dashboard/page.tsx

@@ -2,11 +2,11 @@ import { getSessionUser } from "@/lib/session";
 import { getTranslations, getFormatter } from "next-intl/server";
 import { redirect } from "next/navigation";
 import { listTenants } from "@/lib/k8s";
-import { getTenantRequestByOrgId } from "@/lib/db";
+import { listActiveTenantRequestsByOrgId } from "@/lib/db";
 import { Card, CardHeader } from "@/components/ui/card";
 import { StatusBadge } from "@/components/ui/status-badge";
-import { UsageDisplay } from "@/components/dashboard/usage-display";
 import { OnboardingFlow } from "@/components/onboarding/onboarding-flow";
+import { ProvisioningStatus } from "@/components/onboarding/provisioning-status";
 import { formatDateTime } from "@/lib/format";
 import Link from "next/link";
 
@@ -20,7 +20,7 @@ export default async function DashboardPage() {
 
   const allTenants = await listTenants();
 
-  // Platform users see overview of all tenants
+  // Platform users see overview of all tenants — unchanged from pre-Slice-3.
   if (user.isPlatform) {
     const phaseCount = allTenants.reduce<Record<string, number>>((acc, t) => {
       const phase = t.status?.phase ?? "Pending";
@@ -133,20 +133,24 @@ export default async function DashboardPage() {
     );
   }
 
-  // Regular user: find their tenant
+  // ---------------------------------------------------------------------
-  const myTenant = allTenants.find(
+  // Customer view (Slice 3 multi-tenant)
+  // ---------------------------------------------------------------------
+
+  const orgTenants = allTenants.filter(
     (t) => t.metadata.labels?.["pieced.ch/zitadel-org-id"] === user.orgId
   );
+  const orgRequests = await listActiveTenantRequestsByOrgId(user.orgId);
 
-  // No tenant → check for existing request, show onboarding flow
+  // Pending/in-flight requests that don't yet have a tenant CR. Once the
-  if (!myTenant) {
+  // CR exists, the tenant card carries the live phase, so a separate
-    const existingRequest = await getTenantRequestByOrgId(user.orgId);
+  // "request" card would just duplicate it.
-    // Treat "deleted" as no request — customer can re-onboard
+  const inflightRequests = orgRequests.filter(
-    const initialState =
+    (r) => !r.tenantName || !orgTenants.some((t) => t.metadata.name === r.tenantName)
-      !existingRequest || existingRequest.status === "deleted"
+  );
-        ? "no_request"
-        : existingRequest.status;
 
+  // First-time user: empty company. Show the onboarding wizard inline.
+  if (orgTenants.length === 0 && inflightRequests.length === 0) {
     return (
       <div>
         <div className="mb-8 animate-in">
@@ -159,70 +163,107 @@ export default async function DashboardPage() {
         </div>
 
         <div className="animate-in animate-in-delay-1">
-          <OnboardingFlow
+          <OnboardingFlow orgName={user.orgName} />
-            orgName={user.orgName}
-            initialState={initialState as any}
-          />
         </div>
       </div>
     );
   }
 
-  const tenantName = myTenant.metadata.name;
+  // Returning customer: list of tenants + in-flight requests, plus
-
+  // a button to add another instance.
   return (
     <div>
-      <div className="mb-8 animate-in">
+      <div className="mb-8 animate-in flex items-start justify-between gap-4">
-        <h1 className="font-display text-2xl font-semibold accent-rule mb-2">
+        <div>
-          {t("title")}
+          <h1 className="font-display text-2xl font-semibold accent-rule mb-2">
-        </h1>
+            {t("title")}
-        <p className="text-text-secondary text-sm mt-4">
+          </h1>
-          {t("welcome", { name: user.name || user.email })}
+          <p className="text-text-secondary text-sm mt-4">
-        </p>
+            {t("welcome", { name: user.name || user.email })}
+          </p>
+        </div>
+
+        <Link
+          href="/dashboard/new"
+          className="shrink-0 inline-flex items-center gap-1.5 py-2 px-4 bg-accent text-white text-xs font-medium rounded-lg hover:bg-accent-dim transition-colors"
+        >
+          <span>+</span> {t("createInstance")}
+        </Link>
       </div>
 
-      {/* Instance status card */}
+      {/* In-flight (pending/approved/provisioning/rejected) requests */}
-      <div className="mb-6 animate-in animate-in-delay-1">
+      {inflightRequests.length > 0 && (
-        <Card>
+        <div className="mb-8 animate-in animate-in-delay-1">
-          <CardHeader>{t("instanceStatus")}</CardHeader>
+          <h2 className="text-xs font-semibold uppercase tracking-wider text-text-muted mb-3">
-          <div className="flex items-center gap-4">
+            {t("inflightRequests")}
-            <StatusBadge phase={myTenant.status?.phase ?? "Pending"} />
+          </h2>
-            {myTenant.spec.agentName && (
+          <div className="space-y-3">
-              <span className="text-sm text-text-secondary">
+            {inflightRequests.map((r) => (
-                {myTenant.spec.agentName}
+              <ProvisioningStatus key={r.id} requestId={r.id} />
-              </span>
+            ))}
-            )}
           </div>
-          {myTenant.spec.packages && myTenant.spec.packages.length > 0 && (
+        </div>
-            <div className="flex flex-wrap gap-2 mt-3">
+      )}
-              {myTenant.spec.packages.map((pkg) => (
-                <span
-                  key={pkg}
-                  className="text-xs font-mono bg-accent/10 text-accent border border-accent/20 rounded-full px-2.5 py-0.5"
-                >
-                  {pkg}
-                </span>
-              ))}
-            </div>
-          )}
-        </Card>
-      </div>
 
-      {/* Usage — no teamId passed, backend resolves from session */}
+      {/* Active tenants */}
-      <div className="mb-6 animate-in animate-in-delay-2">
+      {orgTenants.length > 0 && (
-        <h2 className="text-xs font-semibold uppercase tracking-wider text-text-muted mb-3">
+        <div className="animate-in animate-in-delay-2">
-          {t("usage")}
+          <h2 className="text-xs font-semibold uppercase tracking-wider text-text-muted mb-3">
-        </h2>
+            {t("instances")}
-        <UsageDisplay />
+          </h2>
-      </div>
+          <div className="grid gap-4 md:grid-cols-2">
+            {orgTenants.map((tenant) => (
+              <Link
+                key={tenant.metadata.name}
+                href={`/tenants/${tenant.metadata.name}`}
+                className="block group"
+              >
+                <Card className="h-full hover:border-accent/40 transition-colors">
+                  <div className="flex items-start justify-between gap-3 mb-3">
+                    <div className="min-w-0">
+                      <div className="text-sm font-semibold text-text-primary truncate">
+                        {tenant.spec.displayName || tenant.metadata.name}
+                      </div>
+                      <div className="font-mono text-xs text-text-muted truncate mt-0.5">
+                        {tenant.metadata.name}
+                      </div>
+                    </div>
+                    <StatusBadge phase={tenant.status?.phase ?? "Pending"} />
+                  </div>
 
-      {/* Link to tenant detail */}
+                  {tenant.spec.agentName && (
-      <Link
+                    <div className="text-xs text-text-secondary mb-2">
-        href={`/tenants/${tenantName}`}
+                      {tenant.spec.agentName}
-        className="inline-flex items-center gap-1.5 text-xs font-medium text-accent hover:text-accent-dim transition-colors animate-in animate-in-delay-3"
+                    </div>
-      >
+                  )}
-        <span>→</span> {t("manage")}
+
-      </Link>
+                  {tenant.spec.packages && tenant.spec.packages.length > 0 && (
+                    <div className="flex flex-wrap gap-1.5 mb-3">
+                      {tenant.spec.packages.slice(0, 4).map((pkg) => (
+                        <span
+                          key={pkg}
+                          className="text-xs font-mono bg-accent/10 text-accent border border-accent/20 rounded-full px-2 py-0.5"
+                        >
+                          {pkg}
+                        </span>
+                      ))}
+                      {tenant.spec.packages.length > 4 && (
+                        <span className="text-xs text-text-muted">
+                          +{tenant.spec.packages.length - 4}
+                        </span>
+                      )}
+                    </div>
+                  )}
+
+                  <div className="text-xs font-medium text-accent group-hover:text-accent-dim transition-colors">
+                    {t("manage")} →
+                  </div>
+                </Card>
+              </Link>
+            ))}
+          </div>
+        </div>
+      )}
     </div>
   );
 }

src/app/api/admin/requests/[id]/approve/route.ts

@@ -100,11 +100,19 @@ export async function POST(
       "TOOLS.md": toolsMd,
     };
 
-    // Step 4: Create the PiecedTenant CR
+    // Step 4: Create the PiecedTenant CR.
+    // displayName: prefer the customer-chosen instance name; fall back to
+    // the company name. With multi-tenant per org, instanceName is what
+    // distinguishes "Acme Production" from "Acme Dev" on the dashboard.
+    const displayName =
+      tenantRequest.instanceName && tenantRequest.instanceName.trim().length > 0
+        ? tenantRequest.instanceName.trim()
+        : tenantRequest.companyName;
+
     await createTenant(
       tenantName,
       {
-        displayName: tenantRequest.companyName,
+        displayName,
         agentName: tenantRequest.agentName,
         packages,
         workspaceFiles,

src/app/api/onboarding/route.ts

@@ -1,17 +1,26 @@
-import { NextResponse } from "next/server";
+import { NextRequest, NextResponse } from "next/server";
 import { getSessionUser } from "@/lib/session";
 import {
   createTenantRequest,
-  getTenantRequestByOrgId,
+  getTenantRequestById,
-  deleteTenantRequest,
+  listTenantRequestsByOrgId,
+  listActiveTenantRequestsByOrgId,
+  getMostRecentApprovedRequestForOrg,
 } from "@/lib/db";
 import { getTenant, listTenants } from "@/lib/k8s";
 import { sendAdminNotificationEmail } from "@/lib/email";
 import { encryptSecrets } from "@/lib/crypto";
-import type { OnboardingInput } from "@/types";
+import type { OnboardingInput, PiecedTenant, TenantRequest } from "@/types";
 import { z } from "zod";
 
 const onboardingSchema = z.object({
+  instanceName: z
+    .string()
+    .trim()
+    .max(80)
+    .optional()
+    // Empty string from a form input → drop to undefined so the DB stores NULL
+    .transform((v) => (v && v.length > 0 ? v : undefined)),
   agentName: z.string().min(1).max(50),
   soulMd: z.string().max(10_000).optional(),
   agentsMd: z.string().max(10_000).optional(),
@@ -30,59 +39,116 @@ const onboardingSchema = z.object({
 });
 
 /**
- * GET /api/onboarding
+ * Helper: shape a TenantRequest row for client consumption.
- * Check the current onboarding state for the logged-in user's org.
+ * Hides server-only fields (encryptedSecrets, internal db ids).
  */
-export async function GET() {
+function publicRequestShape(r: TenantRequest) {
+  return {
+    id: r.id,
+    instanceName: r.instanceName,
+    agentName: r.agentName,
+    packages: r.packages,
+    status: r.status,
+    adminNotes: r.adminNotes,
+    tenantName: r.tenantName,
+    createdAt: r.createdAt,
+    updatedAt: r.updatedAt,
+  };
+}
+
+function publicTenantShape(t: PiecedTenant) {
+  return {
+    name: t.metadata.name,
+    displayName: t.spec.displayName,
+    phase: t.status?.phase ?? "Pending",
+    suspended: t.spec.suspend ?? false,
+    packages: t.spec.packages ?? [],
+    creationTimestamp: t.metadata.creationTimestamp,
+    conditions: t.status?.conditions ?? [],
+  };
+}
+
+/**
+ * GET /api/onboarding
+ *
+ * Two response shapes depending on the `?id=` query:
+ *
+ *   - With `?id=<requestId>`: returns the single request's status plus
+ *     the linked tenant's phase if approved. Used by ProvisioningStatus
+ *     to poll a specific request. The id is validated against the
+ *     caller's orgId so admins-and-only-admins can read across orgs.
+ *
+ *   - Without `id`: returns lists of all in-flight requests and active
+ *     tenants for the caller's org. Used by the dashboard to render the
+ *     multi-tenant view.
+ *
+ * Slice 3 note: this replaces the old single-state response shape
+ * (`{ state: "...", request: {...} }`). Pre-Slice-3 callers will see
+ * the new shape and need to be updated. The only known caller is
+ * `<ProvisioningStatus>`, updated in lockstep.
+ */
+export async function GET(req: NextRequest) {
   const user = await getSessionUser();
   if (!user) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
 
-  // Check if there's already a running tenant for this org
+  const requestedId = req.nextUrl.searchParams.get("id");
-  const allTenants = await listTenants();
-  const myTenant = allTenants.find(
-    (t) => t.metadata.labels?.["pieced.ch/zitadel-org-id"] === user.orgId
-  );
 
-  if (myTenant) {
+  if (requestedId) {
+    const tr = await getTenantRequestById(requestedId);
+    if (!tr) {
+      return NextResponse.json({ error: "Not found" }, { status: 404 });
+    }
+    // Customers may only read their own org's requests; platform
+    // admins/operators may read any.
+    if (!user.isPlatform && tr.zitadelOrgId !== user.orgId) {
+      return NextResponse.json({ error: "Not found" }, { status: 404 });
+    }
+
+    let tenant: PiecedTenant | null = null;
+    if (tr.tenantName) {
+      tenant = (await getTenant(tr.tenantName)) ?? null;
+    }
     return NextResponse.json({
-      state: "active",
+      request: publicRequestShape(tr),
-      tenantName: myTenant.metadata.name,
+      tenant: tenant ? publicTenantShape(tenant) : null,
-      phase: myTenant.status?.phase ?? "Unknown",
     });
   }
 
-  // Check if there's a pending request
+  // List view: requests + tenants for this org
-  const request = await getTenantRequestByOrgId(user.orgId);
+  const [requests, allTenants] = await Promise.all([
+    listActiveTenantRequestsByOrgId(user.orgId),
+    listTenants(),
+  ]);
 
-  if (!request || request.status === "deleted") {
+  const orgTenants = allTenants.filter(
-    return NextResponse.json({ state: "no_request" });
+    (t) => t.metadata.labels?.["pieced.ch/zitadel-org-id"] === user.orgId
-  }
+  );
 
   return NextResponse.json({
-    state: request.status,
+    requests: requests.map(publicRequestShape),
-    request: {
+    tenants: orgTenants.map(publicTenantShape),
-      id: request.id,
-      agentName: request.agentName,
-      packages: request.packages,
-      status: request.status,
-      adminNotes: request.adminNotes,
-      tenantName: request.tenantName,
-      createdAt: request.createdAt,
-    },
   });
 }
 
 /**
  * POST /api/onboarding
- * Submit the onboarding wizard. Creates a tenant_request with status "pending".
- * The actual PiecedTenant CR is NOT created yet — admin approval required.
  *
- * If packageSecrets are provided (for packages requiring credentials like
+ * Always creates a NEW tenant_request row, regardless of how many other
- * Telegram, Discord, Email), they are encrypted with AES-256-GCM and stored
+ * rows already exist for this org. The pre-Slice-3 409 ("you already
- * as a BYTEA blob. They are decrypted only during admin approval to write
+ * have a request") is gone — multi-tenant is the design now.
- * to OpenBao.
+ *
+ * For additional instances in an existing company, the customer's prior
+ * approved row is used to seed billing/contact info, so the wizard
+ * doesn't need to re-collect data already on file. The wizard *does*
+ * still send a billingAddress payload (the field is required by the
+ * schema), but in practice the client can pre-fill it from
+ * `getMostRecentApprovedRequestForOrg`.
+ *
+ * Encrypted package secrets, if provided, are AES-256-GCM-sealed and
+ * stored as a BYTEA blob. They are decrypted only during admin approval
+ * to write to OpenBao.
  */
 export async function POST(request: Request) {
   const user = await getSessionUser();
@@ -99,40 +165,17 @@ export async function POST(request: Request) {
     );
   }
 
-  // Check for existing request
-  const existing = await getTenantRequestByOrgId(user.orgId);
-  if (existing && existing.status !== "deleted") {
-    return NextResponse.json(
-      { error: "Onboarding request already submitted.", request: existing },
-      { status: 409 }
-    );
-  }
-
-  // If previous request was deleted, remove it so a fresh one can be created
-  if (existing && existing.status === "deleted") {
-    await deleteTenantRequest(existing.id);
-  }
-
-  // Check for existing tenant
-  const allTenants = await listTenants();
-  const myTenant = allTenants.find(
-    (t) => t.metadata.labels?.["pieced.ch/zitadel-org-id"] === user.orgId
-  );
-
-  if (myTenant) {
-    return NextResponse.json(
-      {
-        error: "You already have a tenant provisioned.",
-        tenantName: myTenant.metadata.name,
-      },
-      { status: 409 }
-    );
-  }
-
   const input: OnboardingInput & {
     packageSecrets?: Record<string, Record<string, string>>;
   } = parsed.data;
 
+  // Look up an existing approved request for this org to inherit
+  // company-level billing data. For brand-new orgs (first registration),
+  // there is no prior row and we use the form-supplied billingAddress
+  // verbatim. For follow-up requests, we ignore the form-supplied
+  // company line in favour of the recorded company name.
+  const prior = await getMostRecentApprovedRequestForOrg(user.orgId);
+
   // Encrypt package secrets if provided
   let encryptedSecrets: Buffer | undefined;
   if (input.packageSecrets && Object.keys(input.packageSecrets).length > 0) {
@@ -147,34 +190,55 @@ export async function POST(request: Request) {
     }
   }
 
+  // For follow-up instances, prefer the on-file company name and contact
+  // details; the user can't change those by re-typing them in the wizard.
+  const companyName = prior?.companyName ?? user.orgName;
+  const contactName = prior?.contactName ?? user.name;
+  const contactEmail = prior?.contactEmail ?? user.email;
+  const billingAddress = prior?.billingAddress ?? input.billingAddress;
+  const billingNotes = input.billingNotes ?? prior?.billingNotes;
+
   const tenantRequest = await createTenantRequest({
     zitadelOrgId: user.orgId,
     zitadelUserId: user.id,
-    companyName: user.orgName,
+    companyName,
-    contactName: user.name,
+    instanceName: input.instanceName,
-    contactEmail: user.email,
+    contactName,
+    contactEmail,
     agentName: input.agentName,
     soulMd: input.soulMd,
     agentsMd: input.agentsMd,
     packages: input.packages ?? [],
-    billingAddress: input.billingAddress,
+    billingAddress,
-    billingNotes: input.billingNotes,
+    billingNotes,
     encryptedSecrets,
   });
 
-  // Notify admin about the new request
+  // Notify admin about the new request. For follow-up instances, include
+  // the instance name in the notification so the admin sees what's
+  // being requested without opening the panel.
   try {
     await sendAdminNotificationEmail(
       tenantRequest.contactEmail,
       tenantRequest.contactName,
-      tenantRequest.companyName
+      tenantRequest.instanceName
+        ? `${tenantRequest.companyName} (${tenantRequest.instanceName})`
+        : tenantRequest.companyName
     );
   } catch (e) {
     console.error("Failed to send admin notification:", e);
   }
 
+  // For diagnostics: how many other in-flight requests does this org
+  // already have? Useful for the admin queue.
+  const allRequests = await listTenantRequestsByOrgId(user.orgId);
+
   return NextResponse.json(
-    { message: "Request submitted.", request: tenantRequest },
+    {
+      message: "Request submitted.",
+      request: publicRequestShape(tenantRequest),
+      orgRequestCount: allRequests.length,
+    },
     { status: 201 }
   );
 }

src/components/onboarding/onboarding-flow.tsx

@@ -1,31 +1,36 @@
 "use client";
 
-import { useState, useEffect } from "react";
+import { useRouter } from "next/navigation";
 import { OnboardingWizard } from "./wizard";
-import { ProvisioningStatus } from "./provisioning-status";
 
 interface OnboardingFlowProps {
   orgName: string;
-  initialState: "no_request" | "pending" | "approved" | "provisioning" | "rejected";
 }
 
 /**
- * Orchestrates the onboarding experience:
+ * Wraps the onboarding wizard. On successful submission, refreshes the
- * - no_request → show wizard
+ * router so the parent server component re-renders with the new pending
- * - pending/approved/provisioning/rejected → show status
+ * request visible in the dashboard list.
- * - After wizard submission → switch to status polling
+ *
+ * Slice 3: this component used to manage the no_request → pending →
+ * provisioning → active state machine, with conditional rendering of
+ * `<ProvisioningStatus>`. That state is now reflected at the dashboard
+ * level (which renders one `<ProvisioningStatus>` per pending request),
+ * so this wrapper does just one thing: show the wizard, then navigate.
  */
-export function OnboardingFlow({ orgName, initialState }: OnboardingFlowProps) {
+export function OnboardingFlow({ orgName }: OnboardingFlowProps) {
-  const [showWizard, setShowWizard] = useState(initialState === "no_request");
+  const router = useRouter();
 
-  if (showWizard) {
+  return (
-    return (
+    <OnboardingWizard
-      <OnboardingWizard
+      orgName={orgName}
-        orgName={orgName}
+      onComplete={() => {
-        onComplete={() => setShowWizard(false)}
+        // Navigate back to /dashboard and re-fetch on the server. The
-      />
+        // parent server component will see the new `pending` row and
-    );
+        // render its `<ProvisioningStatus>` card automatically.
-  }
+        router.push("/dashboard");
-
+        router.refresh();
-  return <ProvisioningStatus />;
+      }}
+    />
+  );
 }

src/components/onboarding/provisioning-status.tsx

@@ -6,64 +6,81 @@ import { Card } from "@/components/ui/card";
 import { StatusBadge } from "@/components/ui/status-badge";
 import { formatDateTime, formatRelative } from "@/lib/format";
 
-interface OnboardingState {
+interface RequestSummary {
-  state: string;
+  id: string;
-  request?: {
+  instanceName?: string | null;
-    id: string;
+  agentName: string;
-    status: string;
+  packages: string[];
-    companyName: string;
+  status: string;
-    agentName: string;
+  adminNotes?: string;
-    adminNotes?: string;
+  tenantName?: string;
-    createdAt?: string;
+  createdAt?: string;
-  };
+  updatedAt?: string;
-  tenant?: {
-    name: string;
-    phase: string;
-    message?: string;
-    conditions?: Array<{
-      type: string;
-      status: string;
-      reason?: string;
-      message?: string;
-      lastTransitionTime?: string;
-    }>;
-  };
 }
 
-export function ProvisioningStatus() {
+interface TenantSummary {
+  name: string;
+  displayName: string;
+  phase: string;
+  conditions: Array<{
+    type: string;
+    status: string;
+    reason?: string;
+    message?: string;
+    lastTransitionTime?: string;
+  }>;
+}
+
+interface SingleRequestState {
+  request: RequestSummary;
+  tenant: TenantSummary | null;
+}
+
+/**
+ * ProvisioningStatus
+ *
+ * Polls /api/onboarding?id=<requestId> every 5s until the request reaches
+ * a terminal state. Slice 3: takes a `requestId` prop so multiple of these
+ * can render on the same dashboard for different in-flight requests.
+ *
+ * The pre-Slice-3 version polled /api/onboarding with no params and
+ * assumed one-request-per-org — that endpoint shape is gone now.
+ */
+export function ProvisioningStatus({ requestId }: { requestId: string }) {
   const t = useTranslations("onboarding");
   const f = useFormatter();
-  const [data, setData] = useState<OnboardingState | null>(null);
+  const [data, setData] = useState<SingleRequestState | null>(null);
   const [error, setError] = useState("");
 
   const poll = useCallback(async () => {
     try {
-      const res = await fetch("/api/onboarding");
+      const res = await fetch(
+        `/api/onboarding?id=${encodeURIComponent(requestId)}`
+      );
       if (!res.ok) throw new Error("Failed to fetch status");
       const json = await res.json();
       setData(json);
     } catch (err: any) {
       setError(err.message);
     }
-  }, []);
+  }, [requestId]);
 
   useEffect(() => {
     poll();
 
-    // Poll every 5 seconds while not in a terminal state
+    const status = data?.request?.status;
-    const interval = setInterval(() => {
+    const phase = data?.tenant?.phase;
-      if (
+    const terminal =
-        data?.state === "provisioned" ||
+      status === "rejected" ||
-        data?.state === "rejected" ||
+      status === "active" ||
-        data?.state === "active"
+      phase === "Ready" ||
-      ) {
+      phase === "Running";
-        return;
-      }
-      poll();
-    }, 5000);
 
+    if (terminal) return;
+
+    const interval = setInterval(poll, 5000);
     return () => clearInterval(interval);
-  }, [poll, data?.state]);
+  }, [poll, data?.request?.status, data?.tenant?.phase]);
 
   if (error) {
     return (
@@ -84,8 +101,14 @@ export function ProvisioningStatus() {
     );
   }
 
+  const status = data.request.status;
+  const label =
+    data.request.instanceName ||
+    data.request.tenantName ||
+    data.request.agentName;
+
   // Pending admin approval
-  if (data.state === "pending") {
+  if (status === "pending") {
     return (
       <Card className="animate-in">
         <div className="text-center py-6">
@@ -107,10 +130,13 @@ export function ProvisioningStatus() {
           <h2 className="font-display text-lg font-semibold text-text-primary mb-2">
             {t("pendingTitle")}
           </h2>
+          {label && (
+            <p className="text-xs font-mono text-text-secondary mb-2">{label}</p>
+          )}
           <p className="text-sm text-text-secondary max-w-sm mx-auto">
             {t("pendingDescription")}
           </p>
-          {data.request?.createdAt && (
+          {data.request.createdAt && (
             <p
               className="text-xs text-text-muted mt-4"
               title={formatDateTime(data.request.createdAt, f)}
@@ -130,7 +156,7 @@ export function ProvisioningStatus() {
   }
 
   // Rejected
-  if (data.state === "rejected") {
+  if (status === "rejected") {
     return (
       <Card className="animate-in">
         <div className="text-center py-6">
@@ -152,10 +178,13 @@ export function ProvisioningStatus() {
           <h2 className="font-display text-lg font-semibold text-text-primary mb-2">
             {t("rejectedTitle")}
           </h2>
+          {label && (
+            <p className="text-xs font-mono text-text-secondary mb-2">{label}</p>
+          )}
           <p className="text-sm text-text-secondary max-w-sm mx-auto">
             {t("rejectedDescription")}
           </p>
-          {data.request?.adminNotes && (
+          {data.request.adminNotes && (
             <p className="text-xs text-text-muted mt-3 bg-surface-2 border border-border rounded-lg p-3 max-w-sm mx-auto">
               {data.request.adminNotes}
             </p>
@@ -165,10 +194,11 @@ export function ProvisioningStatus() {
     );
   }
 
-  // Provisioning in progress
+  // Provisioning in progress (status approved/provisioning, optionally with tenant phase < Ready)
   if (
-    data.state === "approved" ||
+    status === "approved" ||
-    data.state === "provisioning"
+    status === "provisioning" ||
+    (status === "active" && data.tenant && data.tenant.phase !== "Ready")
   ) {
     const phase = data.tenant?.phase ?? "Pending";
     const conditions = data.tenant?.conditions ?? [];
@@ -182,6 +212,9 @@ export function ProvisioningStatus() {
           <h2 className="font-display text-lg font-semibold text-text-primary mb-2">
             {t("provisioningTitle")}
           </h2>
+          {label && (
+            <p className="text-xs font-mono text-text-secondary mb-2">{label}</p>
+          )}
           <p className="text-sm text-text-secondary">
             {t("provisioningDescription")}
           </p>
@@ -216,8 +249,8 @@ export function ProvisioningStatus() {
     );
   }
 
-  // Provisioned / Running
+  // Active / Ready
-  if (data.state === "provisioned") {
+  if (status === "active") {
     return (
       <Card className="animate-in">
         <div className="text-center py-6">
@@ -239,6 +272,9 @@ export function ProvisioningStatus() {
           <h2 className="font-display text-lg font-semibold text-text-primary mb-2">
             {t("readyTitle")}
           </h2>
+          {label && (
+            <p className="text-xs font-mono text-text-secondary mb-2">{label}</p>
+          )}
           <p className="text-sm text-text-secondary max-w-sm mx-auto mb-4">
             {t("readyDescription")}
           </p>

src/components/onboarding/wizard.tsx

@@ -62,6 +62,7 @@ export function OnboardingWizard({ orgName, onComplete }: WizardProps) {
   const [defaultsLoaded, setDefaultsLoaded] = useState(false);
 
   const [config, setConfig] = useState({
+    instanceName: "",
     agentName: "Assistant",
     soulMd: FALLBACK_SOUL.replace("{company}", orgName),
     agentsMd: FALLBACK_AGENTS,
@@ -306,6 +307,24 @@ export function OnboardingWizard({ orgName, onComplete }: WizardProps) {
           </p>
 
           <div className="space-y-4">
+            <div>
+              <label className="block text-xs font-semibold uppercase tracking-wider text-text-muted mb-1.5">
+                {t("instanceName")}
+              </label>
+              <input
+                type="text"
+                value={config.instanceName}
+                onChange={(e) =>
+                  setConfig((prev) => ({ ...prev, instanceName: e.target.value }))
+                }
+                placeholder={t("instanceNamePlaceholder")}
+                className="w-full px-3 py-2 bg-surface-2 border border-border rounded-lg text-sm text-text-primary focus:outline-none focus:ring-1 focus:ring-accent focus:border-accent transition-colors"
+              />
+              <p className="text-xs text-text-muted mt-1">
+                {t("instanceNameHint")}
+              </p>
+            </div>
+
             <div>
               <label className="block text-xs font-semibold uppercase tracking-wider text-text-muted mb-1.5">
                 {t("agentName")}
@@ -734,6 +753,14 @@ export function OnboardingWizard({ orgName, onComplete }: WizardProps) {
 
           <div className="space-y-4">
             <div className="bg-surface-2 border border-border rounded-lg p-4 space-y-3">
+              {config.instanceName.trim() && (
+                <div className="flex justify-between text-sm">
+                  <span className="text-text-muted">{t("instanceName")}</span>
+                  <span className="text-text-primary font-mono">
+                    {config.instanceName.trim()}
+                  </span>
+                </div>
+              )}
               <div className="flex justify-between text-sm">
                 <span className="text-text-muted">{t("agentName")}</span>
                 <span className="text-text-primary font-mono">

src/lib/db.ts

@@ -22,12 +22,27 @@ function getPool(): Pool {
 // Schema migration (auto-run on first query)
 // ---------------------------------------------------------------------------
 
+// Notes on the Slice 3 changes
+// ----------------------------
+// 1. Removed `UNIQUE` from `zitadel_org_id` in the CREATE TABLE for fresh
+//    installs, AND emit a defensive `DROP CONSTRAINT IF EXISTS` for
+//    existing installs whose schema was created pre-Slice-3. The
+//    constraint was Postgres-autonamed; the name is deterministic.
+// 2. Added `instance_name TEXT` — the customer's human label per
+//    instance (e.g. "Production", "Dev"). NULL is fine and means "use
+//    the company name for display".
+// 3. Added a unique index on `tenant_name WHERE NOT NULL`. Multiple
+//    rows in the table can have NULL tenant_name (pending/rejected
+//    requests), but every approved row points to a distinct K8s CR.
+// 4. Added `(zitadel_org_id, status)` index for the list-by-org queries
+//    introduced this slice.
 const MIGRATION_SQL = `
   CREATE TABLE IF NOT EXISTS tenant_requests (
     id                UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-    zitadel_org_id    TEXT NOT NULL UNIQUE,
+    zitadel_org_id    TEXT NOT NULL,
     zitadel_user_id   TEXT NOT NULL,
     company_name      TEXT NOT NULL,
+    instance_name     TEXT,
     contact_name      TEXT NOT NULL,
     contact_email     TEXT NOT NULL,
     agent_name        TEXT NOT NULL DEFAULT 'Assistant',
@@ -46,10 +61,18 @@ const MIGRATION_SQL = `
 
   CREATE INDEX IF NOT EXISTS idx_tenant_requests_status ON tenant_requests(status);
   CREATE INDEX IF NOT EXISTS idx_tenant_requests_org_id ON tenant_requests(zitadel_org_id);
+  CREATE INDEX IF NOT EXISTS idx_tenant_requests_org_status ON tenant_requests(zitadel_org_id, status);
+  CREATE UNIQUE INDEX IF NOT EXISTS uniq_tenant_requests_tenant_name
+    ON tenant_requests(tenant_name)
+    WHERE tenant_name IS NOT NULL;
 
   -- Idempotent column adds for existing databases
   ALTER TABLE tenant_requests ADD COLUMN IF NOT EXISTS encrypted_secrets BYTEA;
   ALTER TABLE tenant_requests ADD COLUMN IF NOT EXISTS agents_md TEXT;
+  ALTER TABLE tenant_requests ADD COLUMN IF NOT EXISTS instance_name TEXT;
+
+  -- Slice 3: drop the legacy 1-org-1-request constraint if it exists
+  ALTER TABLE tenant_requests DROP CONSTRAINT IF EXISTS tenant_requests_zitadel_org_id_key;
 
   -- Workspace templates: admin-editable default content for workspace files
   CREATE TABLE IF NOT EXISTS workspace_templates (
@@ -131,15 +154,16 @@ export async function createTenantRequest(
   await ensureSchema();
   const result = await getPool().query<TenantRequest>(
     `INSERT INTO tenant_requests
-       (zitadel_org_id, zitadel_user_id, company_name, contact_name,
+       (zitadel_org_id, zitadel_user_id, company_name, instance_name,
-        contact_email, agent_name, soul_md, agents_md, packages, billing_address,
+        contact_name, contact_email, agent_name, soul_md, agents_md,
-        billing_notes, encrypted_secrets)
+        packages, billing_address, billing_notes, encrypted_secrets)
-     VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
+     VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)
      RETURNING *`,
     [
       params.zitadelOrgId,
       params.zitadelUserId,
       params.companyName,
+      params.instanceName ?? null,
       params.contactName,
       params.contactEmail,
       params.agentName,
@@ -165,12 +189,67 @@ export async function getTenantRequestById(
   return result.rows[0] ? mapRow(result.rows[0]) : null;
 }
 
-export async function getTenantRequestByOrgId(
+/**
+ * Slice 3: returns ALL requests for an org, most recent first.
+ *
+ * Replaces the pre-Slice-3 `getTenantRequestByOrgId` which returned the
+ * single most recent row. Callers that previously assumed one-row-per-org
+ * must now iterate or pick by status. The intent is explicit at every
+ * call site, which is the point of the rename.
+ *
+ * Includes rows in every status (pending, approved, provisioning, active,
+ * rejected, deleted). For "active or in-flight only" filtering, see
+ * {@link listActiveTenantRequestsByOrgId}.
+ */
+export async function listTenantRequestsByOrgId(
+  orgId: string
+): Promise<TenantRequest[]> {
+  await ensureSchema();
+  const result = await getPool().query<TenantRequest>(
+    "SELECT * FROM tenant_requests WHERE zitadel_org_id = $1 ORDER BY created_at DESC",
+    [orgId]
+  );
+  return result.rows.map(mapRow);
+}
+
+/**
+ * As {@link listTenantRequestsByOrgId} but excludes terminal-failed states
+ * (rejected, deleted). Useful for the dashboard which wants to show
+ * pending/approved/provisioning/active tenants and pending requests, not
+ * historical rejections.
+ */
+export async function listActiveTenantRequestsByOrgId(
+  orgId: string
+): Promise<TenantRequest[]> {
+  await ensureSchema();
+  const result = await getPool().query<TenantRequest>(
+    `SELECT * FROM tenant_requests
+       WHERE zitadel_org_id = $1
+         AND status NOT IN ('deleted', 'rejected')
+       ORDER BY created_at DESC`,
+    [orgId]
+  );
+  return result.rows.map(mapRow);
+}
+
+/**
+ * Returns the most recent approved-or-active request for an org. Used to
+ * seed billing/contact defaults when a customer creates an additional
+ * instance — saves them re-typing data already on file.
+ *
+ * Returns null if the org has never had an approved instance (e.g. first
+ * registration is still pending).
+ */
+export async function getMostRecentApprovedRequestForOrg(
   orgId: string
 ): Promise<TenantRequest | null> {
   await ensureSchema();
   const result = await getPool().query<TenantRequest>(
-    "SELECT * FROM tenant_requests WHERE zitadel_org_id = $1 ORDER BY created_at DESC LIMIT 1",
+    `SELECT * FROM tenant_requests
+       WHERE zitadel_org_id = $1
+         AND status IN ('approved', 'provisioning', 'active')
+       ORDER BY created_at DESC
+       LIMIT 1`,
     [orgId]
   );
   return result.rows[0] ? mapRow(result.rows[0]) : null;
@@ -250,8 +329,10 @@ export async function checkDuplicateDomain(email: string) {
 }
 
 /**
- * Mark a tenant request as "deleted" when the associated tenant CR is deleted.
+ * Mark a single tenant request as "deleted" when the associated tenant CR
- * This allows the customer to re-submit the onboarding wizard.
+ * is deleted. With multi-tenant per org this affects exactly one row,
+ * since tenant_name is unique by index. The customer's other instances
+ * are untouched.
  */
 export async function markTenantRequestDeletedByTenantName(
   tenantName: string
@@ -275,6 +356,10 @@ export async function deleteTenantRequest(id: string): Promise<void> {
 /**
  * Sync provisioning statuses: for all requests with status "provisioning",
  * check if the PiecedTenant CR has reached "Ready" and update to "active".
+ *
+ * Slice 3 note: with multi-tenant per org, this iterates each row
+ * individually (keyed by its own tenant_name), so multiple in-flight
+ * tenants in the same org are handled correctly.
  */
 export async function syncProvisioningStatuses(): Promise<void> {
   await ensureSchema();
@@ -310,6 +395,7 @@ function mapRow(row: any): TenantRequest {
     zitadelOrgId: row.zitadel_org_id,
     zitadelUserId: row.zitadel_user_id,
     companyName: row.company_name,
+    instanceName: row.instance_name ?? null,
     contactName: row.contact_name,
     contactEmail: row.contact_email,
     agentName: row.agent_name,

src/messages/de.json

@@ -83,7 +83,10 @@
     "readyTitle": "Ihr Assistent ist bereit!",
     "readyDescription": "Ihr KI-Assistent wurde bereitgestellt und ist aktiv. Sie können ihn nun über das Dashboard verwalten.",
     "goToDashboard": "Zum Dashboard",
-    "submittedAt": "Eingereicht"
+    "submittedAt": "Eingereicht",
+    "instanceName": "Instanzname",
+    "instanceNamePlaceholder": "z.B. Produktion, Dev, Vertrieb",
+    "instanceNameHint": "Optionaler lesbarer Name, um diese Instanz von anderen in Ihrem Dashboard zu unterscheiden. Leer lassen, um den Firmennamen zu verwenden."
   },
   "dashboard": {
     "title": "Dashboard",
@@ -94,7 +97,11 @@
     "noInstance": "Noch keine Instanz bereitgestellt.",
     "comingSoon": "Detailansicht folgt in Session 6.2",
     "noInstanceDescription": "Richten Sie Ihre KI-Assistenten-Instanz ein, um mit PieCed IT zu starten.",
-    "manage": "Instanz & Pakete verwalten"
+    "manage": "Instanz & Pakete verwalten",
+    "instances": "Ihre Instanzen",
+    "inflightRequests": "Laufende Anfragen",
+    "createInstance": "Neue Instanz erstellen",
+    "createInstanceDescription": "Eine weitere KI-Assistent-Instanz für Ihre Organisation bereitstellen. Die Anfrage wird von einem Administrator geprüft, bevor die Instanz erstellt wird."
   },
   "tenantDetail": {
     "agent": "Agent",

src/messages/en.json

@@ -83,7 +83,10 @@
     "readyTitle": "Your assistant is ready!",
     "readyDescription": "Your AI assistant has been provisioned and is running. You can now manage it from the dashboard.",
     "goToDashboard": "Go to Dashboard",
-    "submittedAt": "Submitted"
+    "submittedAt": "Submitted",
+    "instanceName": "Instance name",
+    "instanceNamePlaceholder": "e.g. Production, Dev, Sales",
+    "instanceNameHint": "Optional human-readable name to distinguish this instance from others on your dashboard. Leave blank to use your company name."
   },
   "dashboard": {
     "title": "Dashboard",
@@ -94,7 +97,11 @@
     "noInstance": "No instance provisioned yet.",
     "comingSoon": "Detailed view coming in Session 6.2",
     "noInstanceDescription": "Set up your AI assistant instance to get started with PieCed IT.",
-    "manage": "Manage instance & packages"
+    "manage": "Manage instance & packages",
+    "instances": "Your instances",
+    "inflightRequests": "In-flight requests",
+    "createInstance": "Create new instance",
+    "createInstanceDescription": "Provision an additional AI assistant instance for your organization. The request will be reviewed by an administrator before the instance is created."
   },
   "tenantDetail": {
     "agent": "Agent",

src/messages/fr.json

@@ -83,7 +83,10 @@
     "readyTitle": "Votre assistant est prêt !",
     "readyDescription": "Votre assistant IA a été mis en service et est actif. Vous pouvez maintenant le gérer depuis le tableau de bord.",
     "goToDashboard": "Aller au tableau de bord",
-    "submittedAt": "Soumis"
+    "submittedAt": "Soumis",
+    "instanceName": "Nom de l'instance",
+    "instanceNamePlaceholder": "ex. Production, Dev, Ventes",
+    "instanceNameHint": "Nom lisible facultatif pour distinguer cette instance des autres sur votre tableau de bord. Laisser vide pour utiliser le nom de votre entreprise."
   },
   "dashboard": {
     "title": "Tableau de bord",
@@ -94,7 +97,11 @@
     "noInstance": "Aucune instance provisionnée.",
     "comingSoon": "Vue détaillée à venir dans la Session 6.2",
     "noInstanceDescription": "Configurez votre instance d'assistant IA pour commencer avec PieCed IT.",
-    "manage": "Gérer l'instance et les paquets"
+    "manage": "Gérer l'instance et les paquets",
+    "instances": "Vos instances",
+    "inflightRequests": "Demandes en cours",
+    "createInstance": "Créer une nouvelle instance",
+    "createInstanceDescription": "Provisionner une instance supplémentaire d'assistant IA pour votre organisation. La demande sera examinée par un administrateur avant la création de l'instance."
   },
   "tenantDetail": {
     "agent": "Agent",

src/messages/it.json

@@ -83,7 +83,10 @@
     "readyTitle": "Il tuo assistente è pronto!",
     "readyDescription": "Il tuo assistente IA è stato attivato ed è operativo. Ora puoi gestirlo dalla dashboard.",
     "goToDashboard": "Vai alla dashboard",
-    "submittedAt": "Inviato"
+    "submittedAt": "Inviato",
+    "instanceName": "Nome istanza",
+    "instanceNamePlaceholder": "es. Produzione, Dev, Vendite",
+    "instanceNameHint": "Nome leggibile facoltativo per distinguere questa istanza dalle altre nella dashboard. Lasciare vuoto per usare il nome dell'azienda."
   },
   "dashboard": {
     "title": "Dashboard",
@@ -94,7 +97,11 @@
     "noInstance": "Nessuna istanza attivata.",
     "comingSoon": "Vista dettagliata in arrivo nella Sessione 6.2",
     "noInstanceDescription": "Configura la tua istanza di assistente IA per iniziare con PieCed IT.",
-    "manage": "Gestisci istanza e pacchetti"
+    "manage": "Gestisci istanza e pacchetti",
+    "instances": "Le tue istanze",
+    "inflightRequests": "Richieste in corso",
+    "createInstance": "Crea nuova istanza",
+    "createInstanceDescription": "Effettua il provisioning di un'ulteriore istanza dell'assistente IA per la tua organizzazione. La richiesta sarà esaminata da un amministratore prima della creazione dell'istanza."
   },
   "tenantDetail": {
     "agent": "Agente",

src/types/index.ts

@@ -112,6 +112,13 @@ export interface TenantRequest {
   zitadelOrgId: string;
   zitadelUserId: string;
   companyName: string;
+  /**
+   * Customer-chosen human label per instance (e.g. "Production", "Dev").
+   * Optional. When set, used as the K8s `displayName` so the customer's
+   * dashboard distinguishes their instances. When null, the company
+   * name is used.
+   */
+  instanceName?: string | null;
   contactName: string;
   contactEmail: string;
   agentName: string;
@@ -130,6 +137,14 @@ export interface TenantRequest {
 
 // Onboarding wizard input
 export interface OnboardingInput {
+  /**
+   * Customer's human label for this instance. Optional; when blank, the
+   * company name is used as the display name. Required when an org
+   * already has at least one approved instance, to avoid two
+   * indistinguishable rows on the dashboard — that constraint is
+   * enforced server-side, not by the type.
+   */
+  instanceName?: string;
   agentName: string;
   soulMd?: string;
   agentsMd?: string;