All the MD files via Database

2026-04-11 21:14:09 +02:00
parent c67259ebe0
commit fdb56490dd
14 changed files with 1004 additions and 240 deletions
--- a/src/app/api/admin/requests/[id]/approve/route.ts
+++ b/src/app/api/admin/requests/[id]/approve/route.ts
@@ -1,19 +1,29 @@
 import { NextResponse } from "next/server";
 import { requirePlatformRole } from "@/lib/session";
-import { getTenantRequestById, updateTenantRequestStatus, clearEncryptedSecrets } from "@/lib/db";
+import {
+  getTenantRequestById,
+  updateTenantRequestStatus,
+  clearEncryptedSecrets,
+} from "@/lib/db";
 import { createTenant } from "@/lib/k8s";
 import { sendApprovalEmail } from "@/lib/email";
 import { decryptSecrets } from "@/lib/crypto";
 import { writePackageSecrets } from "@/lib/openbao";
+import {
+  getDefaultSoulMd,
+  getDefaultAgentsMd,
+  generateToolsMd,
+} from "@/lib/workspace-defaults";

 /**
 * POST /api/admin/requests/[id]/approve
 * Approve a tenant request:
- *  1. Decrypt stored package secrets (if any)
- *  2. Write each package's secrets to OpenBao at secret/data/tenants/{tenant-name}/{package}
- *  3. Null the encrypted_secrets column
- *  4. Create PiecedTenant CR
- *  5. Update request status, notify customer.
+ * 1. Decrypt stored package secrets (if any)
+ * 2. Write each package's secrets to OpenBao at secret/data/tenants/{tenant-name}/{package}
+ * 3. Null the encrypted_secrets column
+ * 4. Build workspace files (SOUL.md, AGENTS.md, TOOLS.md)
+ * 5. Create PiecedTenant CR
+ * 6. Update request status, notify customer.
 * Also supports re-approving a previously rejected request (clears admin notes).
 */
 export async function POST(
@@ -38,7 +48,10 @@ export async function POST(
    );
  }

-  if (tenantRequest.status !== "pending" && tenantRequest.status !== "rejected") {
+  if (
+    tenantRequest.status !== "pending" &&
+    tenantRequest.status !== "rejected"
+  ) {
    return NextResponse.json(
      { error: `Request is already ${tenantRequest.status}` },
      { status: 400 }
@@ -48,47 +61,64 @@ export async function POST(
  const isReApproval = tenantRequest.status === "rejected";

  // Derive tenant name from company name: lowercase, alphanumeric + hyphens
-  const tenantName = tenantRequest.companyName
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, "-")
-    .replace(/^-|-$/g, "")
-    .slice(0, 63) || `tenant-${tenantRequest.id.slice(0, 8)}`;
+  const tenantName =
+    tenantRequest.companyName
+      .toLowerCase()
+      .replace(/[^a-z0-9]+/g, "-")
+      .replace(/^-|-$/g, "")
+      .slice(0, 63) || `tenant-${tenantRequest.id.slice(0, 8)}`;

  try {
    // Step 1: Decrypt and write package secrets to OpenBao (if collected during wizard)
    if (tenantRequest.encryptedSecrets) {
      const secrets = await decryptSecrets(tenantRequest.encryptedSecrets);
      for (const [packageId, pkgSecrets] of Object.entries(secrets)) {
-        await writePackageSecrets(`tenant-${tenantName}`, packageId, pkgSecrets);
+        await writePackageSecrets(
+          `tenant-${tenantName}`,
+          packageId,
+          pkgSecrets
+        );
      }
      // Step 2: Null the encrypted column — secrets are now safely in OpenBao
      await clearEncryptedSecrets(id);
    }

-    // Step 3: Create the PiecedTenant CR
+    // Step 3: Build workspace files
+    const packages = tenantRequest.packages ?? [];
+    const soulMd =
+      tenantRequest.soulMd ||
+      (await getDefaultSoulMd(tenantRequest.companyName));
+    const agentsMd = tenantRequest.agentsMd || (await getDefaultAgentsMd());
+    const toolsMd = await generateToolsMd(packages);
+
+    const workspaceFiles: Record<string, string> = {
+      "SOUL.md": soulMd,
+      "AGENTS.md": agentsMd,
+      "TOOLS.md": toolsMd,
+    };
+
+    // Step 4: Create the PiecedTenant CR
    await createTenant(
      tenantName,
      {
        displayName: tenantRequest.companyName,
        agentName: tenantRequest.agentName,
-        packages: tenantRequest.packages,
-        workspaceFiles: tenantRequest.soulMd
-          ? { "SOUL.md": tenantRequest.soulMd }
-          : undefined,
+        packages,
+        workspaceFiles,
      },
      {
        "pieced.ch/zitadel-org-id": tenantRequest.zitadelOrgId,
      }
    );

-    // Step 4: Update request status — clear admin notes on re-approval
+    // Step 5: Update request status — clear admin notes on re-approval
    const updated = await updateTenantRequestStatus(id, "provisioning", {
      adminNotes: isReApproval ? null : adminNotes,
      tenantName,
      clearAdminNotes: isReApproval,
    });

-    // Step 5: Notify customer
+    // Step 6: Notify customer
    await sendApprovalEmail(
      tenantRequest.contactEmail,
      tenantRequest.contactName,
--- a/src/app/api/admin/requests/route.ts
+++ b/src/app/api/admin/requests/route.ts
@@ -15,11 +15,7 @@ export async function GET(request: Request) {
    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
  }

-  // Sync provisioning statuses before listing
-  await syncProvisioningStatuses(async (tenantName: string) => {
-    const tenant = await getTenant(tenantName);
-    return tenant?.status?.phase ?? null;
-  });
+  await syncProvisioningStatuses();

  const { searchParams } = new URL(request.url);
  const status = searchParams.get("status") as any;
--- a/src/app/api/onboarding/route.ts
+++ b/src/app/api/onboarding/route.ts
@@ -14,6 +14,7 @@ import { z } from "zod";
 const onboardingSchema = z.object({
  agentName: z.string().min(1).max(50),
  soulMd: z.string().max(10_000).optional(),
+  agentsMd: z.string().max(10_000).optional(),
  packages: z.array(z.string()).optional(),
  packageSecrets: z
    .record(z.string(), z.record(z.string(), z.string()))
@@ -25,20 +26,20 @@ const onboardingSchema = z.object({
    postalCode: z.string().optional(),
    country: z.string().optional(),
  }),
-  billingNotes: z.string().max(2000).optional(),
+  billingNotes: z.string().max(2_000).optional(),
 });

 /**
 * GET /api/onboarding
- * Returns the current onboarding status for the logged-in user's org.
- * Used by the wizard/provisioning UI to poll state.
+ * Check the current onboarding state for the logged-in user's org.
 */
 export async function GET() {
  const user = await getSessionUser();
-  if (!user)
+  if (!user) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }

-  // Check if tenant already exists
+  // Check if there's already a running tenant for this org
  const allTenants = await listTenants();
  const myTenant = allTenants.find(
    (t) => t.metadata.labels?.["pieced.ch/zitadel-org-id"] === user.orgId
@@ -46,13 +47,9 @@ export async function GET() {

  if (myTenant) {
    return NextResponse.json({
-      state: "provisioned",
-      tenant: {
-        name: myTenant.metadata.name,
-        phase: myTenant.status?.phase ?? "Pending",
-        message: myTenant.status?.message,
-        conditions: myTenant.status?.conditions,
-      },
+      state: "active",
+      tenantName: myTenant.metadata.name,
+      phase: myTenant.status?.phase ?? "Unknown",
    });
  }

@@ -63,29 +60,17 @@ export async function GET() {
    return NextResponse.json({ state: "no_request" });
  }

-  // If approved and tenant_name set, check provisioning status
-  if (
-    request.status === "provisioning" &&
-    request.tenantName
-  ) {
-    const tenant = await getTenant(request.tenantName);
-    if (tenant) {
-      return NextResponse.json({
-        state: "provisioning",
-        request,
-        tenant: {
-          name: tenant.metadata.name,
-          phase: tenant.status?.phase ?? "Pending",
-          message: tenant.status?.message,
-          conditions: tenant.status?.conditions,
-        },
-      });
-    }
-  }
-
  return NextResponse.json({
    state: request.status,
-    request,
+    request: {
+      id: request.id,
+      agentName: request.agentName,
+      packages: request.packages,
+      status: request.status,
+      adminNotes: request.adminNotes,
+      tenantName: request.tenantName,
+      createdAt: request.createdAt,
+    },
  });
 }

@@ -101,8 +86,18 @@ export async function GET() {
 */
 export async function POST(request: Request) {
  const user = await getSessionUser();
-  if (!user)
+  if (!user) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const body = await request.json();
+  const parsed = onboardingSchema.safeParse(body);
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: "Invalid input", details: parsed.error.flatten() },
+      { status: 400 }
+    );
+  }

  // Check for existing request
  const existing = await getTenantRequestByOrgId(user.orgId);
@@ -123,23 +118,20 @@ export async function POST(request: Request) {
  const myTenant = allTenants.find(
    (t) => t.metadata.labels?.["pieced.ch/zitadel-org-id"] === user.orgId
  );
+
  if (myTenant) {
    return NextResponse.json(
-      { error: "Tenant already exists." },
+      {
+        error: "You already have a tenant provisioned.",
+        tenantName: myTenant.metadata.name,
+      },
      { status: 409 }
    );
  }

-  const body = await request.json();
-  const parsed = onboardingSchema.safeParse(body);
-  if (!parsed.success) {
-    return NextResponse.json(
-      { error: "Validation failed", details: parsed.error.flatten() },
-      { status: 400 }
-    );
-  }
-
-  const input: OnboardingInput & { packageSecrets?: Record<string, Record<string, string>> } = parsed.data;
+  const input: OnboardingInput & {
+    packageSecrets?: Record<string, Record<string, string>>;
+  } = parsed.data;

  // Encrypt package secrets if provided
  let encryptedSecrets: Buffer | undefined;
@@ -159,10 +151,11 @@ export async function POST(request: Request) {
    zitadelOrgId: user.orgId,
    zitadelUserId: user.id,
    companyName: user.orgName,
-    contactName: user.name || user.email,
+    contactName: user.name,
    contactEmail: user.email,
    agentName: input.agentName,
    soulMd: input.soulMd,
+    agentsMd: input.agentsMd,
    packages: input.packages ?? [],
    billingAddress: input.billingAddress,
    billingNotes: input.billingNotes,
@@ -170,14 +163,18 @@ export async function POST(request: Request) {
  });

  // Notify admin about the new request
-  await sendAdminNotificationEmail(
-    user.orgName,
-    user.name || user.email,
-    user.email
-  );
+  try {
+    await sendAdminNotificationEmail(
+      tenantRequest.contactEmail,
+      tenantRequest.contactName,
+      tenantRequest.companyName
+    );
+  } catch (e) {
+    console.error("Failed to send admin notification:", e);
+  }

  return NextResponse.json(
-    { message: "Onboarding request submitted.", request: tenantRequest },
+    { message: "Request submitted.", request: tenantRequest },
    { status: 201 }
  );
 }
--- a/src/app/api/workspace-defaults/route.ts
+++ b/src/app/api/workspace-defaults/route.ts
@@ -0,0 +1,32 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getSessionUser } from "@/lib/session";
+import {
+  getDefaultSoulMd,
+  getDefaultAgentsMd,
+  generateToolsMd,
+} from "@/lib/workspace-defaults";
+
+/**
+ * GET /api/workspace-defaults?orgName=...&packages=telegram,web-search
+ * Returns default content for SOUL.md, AGENTS.md, and TOOLS.md.
+ * Used by the onboarding wizard to pre-fill textareas.
+ */
+export async function GET(req: NextRequest) {
+  const user = await getSessionUser();
+  if (!user) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const orgName =
+    req.nextUrl.searchParams.get("orgName") || user.orgName || "Your Company";
+  const packagesParam = req.nextUrl.searchParams.get("packages") || "";
+  const packages = packagesParam ? packagesParam.split(",").filter(Boolean) : [];
+
+  const [soulMd, agentsMd, toolsMd] = await Promise.all([
+    getDefaultSoulMd(orgName),
+    getDefaultAgentsMd(),
+    generateToolsMd(packages),
+  ]);
+
+  return NextResponse.json({ soulMd, agentsMd, toolsMd });
+}
--- a/src/components/onboarding/wizard.tsx
+++ b/src/components/onboarding/wizard.tsx
@@ -1,6 +1,6 @@
 "use client";

-import { useState, useCallback } from "react";
+import { useState, useCallback, useEffect, useRef } from "react";
 import { useTranslations } from "next-intl";
 import { Card } from "@/components/ui/card";
 import { PACKAGE_CATALOG, type PackageDef } from "@/lib/packages";
@@ -9,7 +9,8 @@ type Step = "welcome" | "configure" | "billing" | "confirm";

 const STEPS: Step[] = ["welcome", "configure", "billing", "confirm"];

-const DEFAULT_SOUL = `# AI Assistant
+// Inline fallbacks — only used if the API call to /api/workspace-defaults fails
+const FALLBACK_SOUL = `# AI Assistant

 You are a helpful AI assistant for {company}. You are professional, concise, and friendly.

@@ -20,6 +21,25 @@ You are a helpful AI assistant for {company}. You are professional, concise, and
 - Respect privacy and confidentiality
 `;

+const FALLBACK_AGENTS = `# Agents
+
+On session start, read the following workspace files in order:
+1. SOUL.md — your personality and behavioural guidelines
+2. TOOLS.md — available tools and how to use them
+3. USER.md — information about the current user (if present)
+
+Follow the instructions in SOUL.md for every interaction.
+`;
+
+const FALLBACK_TOOLS = `# Tools
+
+The following tools are available to you as an AI assistant.
+
+## LLM
+You have access to a large language model for text generation, summarisation,
+translation, and general question answering.
+`;
+
 const CATEGORIES = [
  { key: "channel" as const, labelKey: "categories.channels" },
  { key: "skill" as const, labelKey: "categories.skills" },
@@ -38,10 +58,13 @@ export function OnboardingWizard({ orgName, onComplete }: WizardProps) {
  const [step, setStep] = useState<Step>("welcome");
  const [submitting, setSubmitting] = useState(false);
  const [error, setError] = useState("");
+  const [advancedOpen, setAdvancedOpen] = useState(false);
+  const [defaultsLoaded, setDefaultsLoaded] = useState(false);

  const [config, setConfig] = useState({
    agentName: "Assistant",
-    soulMd: DEFAULT_SOUL.replace("{company}", orgName),
+    soulMd: FALLBACK_SOUL.replace("{company}", orgName),
+    agentsMd: FALLBACK_AGENTS,
    packages: [] as string[],
    billingAddress: {
      company: orgName,
@@ -53,6 +76,9 @@ export function OnboardingWizard({ orgName, onComplete }: WizardProps) {
    billingNotes: "",
  });

+  // TOOLS.md preview — readonly, auto-generated
+  const [toolsMdPreview, setToolsMdPreview] = useState(FALLBACK_TOOLS);
+
  // Per-package collected secrets: { "telegram": { "bot-token": "123:ABC" }, ... }
  const [packageSecrets, setPackageSecrets] = useState<
    Record<string, Record<string, string>>
@@ -62,6 +88,42 @@ export function OnboardingWizard({ orgName, onComplete }: WizardProps) {
    Record<string, boolean>
  >({});

+  // Fetch DB-stored defaults on mount
+  useEffect(() => {
+    fetch(`/api/workspace-defaults?orgName=${encodeURIComponent(orgName)}`)
+      .then((r) => (r.ok ? r.json() : null))
+      .then((data) => {
+        if (data) {
+          setConfig((prev) => ({
+            ...prev,
+            soulMd: data.soulMd ?? prev.soulMd,
+            agentsMd: data.agentsMd ?? prev.agentsMd,
+          }));
+          setToolsMdPreview(data.toolsMd ?? FALLBACK_TOOLS);
+          setDefaultsLoaded(true);
+        }
+      })
+      .catch(() => {
+        /* use inline fallbacks */
+      });
+  }, [orgName]);
+
+  // Re-fetch TOOLS.md preview when packages change
+  const packagesKey = config.packages.sort().join(",");
+  const prevPackagesKey = useRef(packagesKey);
+  useEffect(() => {
+    if (prevPackagesKey.current === packagesKey && defaultsLoaded) return;
+    prevPackagesKey.current = packagesKey;
+    fetch(
+      `/api/workspace-defaults?orgName=${encodeURIComponent(orgName)}&packages=${encodeURIComponent(packagesKey)}`
+    )
+      .then((r) => (r.ok ? r.json() : null))
+      .then((data) => {
+        if (data?.toolsMd) setToolsMdPreview(data.toolsMd);
+      })
+      .catch(() => {});
+  }, [packagesKey, orgName, defaultsLoaded]);
+
  const stepIndex = STEPS.indexOf(step);

  const goNext = () => {
@@ -274,6 +336,74 @@ export function OnboardingWizard({ orgName, onComplete }: WizardProps) {
              </p>
            </div>

+            {/* Advanced: AGENTS.md + TOOLS.md preview */}
+            <div className="border border-border rounded-lg overflow-hidden">
+              <button
+                type="button"
+                onClick={() => setAdvancedOpen((o) => !o)}
+                className="w-full flex items-center justify-between px-3 py-2.5 text-left hover:bg-surface-3/30 transition-colors"
+              >
+                <span className="text-xs font-semibold uppercase tracking-wider text-text-muted">
+                  {t("advancedConfig")}
+                </span>
+                <svg
+                  className={`h-4 w-4 text-text-muted transition-transform ${
+                    advancedOpen ? "rotate-180" : ""
+                  }`}
+                  fill="none"
+                  viewBox="0 0 24 24"
+                  stroke="currentColor"
+                  strokeWidth={2}
+                >
+                  <path
+                    strokeLinecap="round"
+                    strokeLinejoin="round"
+                    d="M19 9l-7 7-7-7"
+                  />
+                </svg>
+              </button>
+              {advancedOpen && (
+                <div className="border-t border-border px-3 py-4 space-y-4 bg-surface-1/30">
+                  {/* AGENTS.md */}
+                  <div>
+                    <label className="block text-xs font-semibold uppercase tracking-wider text-text-muted mb-1.5">
+                      {t("agentsMd")}
+                    </label>
+                    <textarea
+                      value={config.agentsMd}
+                      onChange={(e) =>
+                        setConfig((prev) => ({
+                          ...prev,
+                          agentsMd: e.target.value,
+                        }))
+                      }
+                      rows={6}
+                      className="w-full px-3 py-2 bg-surface-2 border border-border rounded-lg text-sm text-text-primary font-mono text-xs focus:outline-none focus:ring-1 focus:ring-accent focus:border-accent transition-colors resize-y"
+                    />
+                    <p className="text-xs text-text-muted mt-1">
+                      {t("agentsMdHint")}
+                    </p>
+                  </div>
+
+                  {/* TOOLS.md — readonly preview */}
+                  <div>
+                    <label className="block text-xs font-semibold uppercase tracking-wider text-text-muted mb-1.5">
+                      {t("toolsMd")}
+                    </label>
+                    <textarea
+                      value={toolsMdPreview}
+                      readOnly
+                      rows={6}
+                      className="w-full px-3 py-2 bg-surface-3/50 border border-border rounded-lg text-sm text-text-secondary font-mono text-xs cursor-not-allowed resize-y"
+                    />
+                    <p className="text-xs text-text-muted mt-1">
+                      {t("toolsMdHint")}
+                    </p>
+                  </div>
+                </div>
+              )}
+            </div>
+
            {/* Packages — grouped by category */}
            <div>
              <label className="block text-xs font-semibold uppercase tracking-wider text-text-muted mb-2">
--- a/src/lib/db.ts
+++ b/src/lib/db.ts
@@ -1,64 +1,62 @@
-/**
- * Database client for the portal-db PostgreSQL database.
- *
- * Uses the `pg` package directly — no ORM overhead for a single table.
- * The tenant_requests table acts as the approval gate between customer
- * registration and actual PiecedTenant CR creation.
- *
- * Connection: via DATABASE_URL env var pointing to CloudNativePG cluster.
- */
-
 import { Pool } from "pg";
 import type { TenantRequest, TenantRequestStatus } from "@/types";
+import { listTenants, getTenant } from "./k8s";

-// Lazy-init: pool is created on first use, not at module import time.
-// This avoids "Invalid URL" errors during Next.js build when env vars
-// aren't available yet.
-let _pool: Pool | null = null;
+// ---------------------------------------------------------------------------
+// Connection pool (singleton)
+// ---------------------------------------------------------------------------
+
+let pool: Pool | null = null;

 function getPool(): Pool {
-  if (!_pool) {
-    const url = process.env.DATABASE_URL;
-    if (!url) throw new Error("DATABASE_URL is not set");
-    _pool = new Pool({
-      connectionString: url,
-      max: 5,
-      idleTimeoutMillis: 30_000,
-    });
+  if (!pool) {
+    const connectionString =
+      process.env.DATABASE_URL ??
+      "postgresql://portal:portal@portal-db-rw.portal.svc:5432/portal";
+    pool = new Pool({ connectionString, max: 5 });
  }
-  return _pool;
+  return pool;
 }

 // ---------------------------------------------------------------------------
-// Schema migration (idempotent)
+// Schema migration (auto-run on first query)
 // ---------------------------------------------------------------------------

 const MIGRATION_SQL = `
  CREATE TABLE IF NOT EXISTS tenant_requests (
-    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-    zitadel_org_id TEXT NOT NULL UNIQUE,
-    zitadel_user_id TEXT NOT NULL,
-    company_name TEXT NOT NULL,
-    contact_name TEXT NOT NULL,
-    contact_email TEXT NOT NULL,
-    agent_name TEXT NOT NULL DEFAULT 'Assistant',
-    soul_md TEXT,
-    packages TEXT[] DEFAULT '{}',
-    billing_address JSONB DEFAULT '{}',
-    billing_notes TEXT,
-    status TEXT NOT NULL DEFAULT 'pending',
-    admin_notes TEXT,
-    tenant_name TEXT,
+    id                UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    zitadel_org_id    TEXT NOT NULL UNIQUE,
+    zitadel_user_id   TEXT NOT NULL,
+    company_name      TEXT NOT NULL,
+    contact_name      TEXT NOT NULL,
+    contact_email     TEXT NOT NULL,
+    agent_name        TEXT NOT NULL DEFAULT 'Assistant',
+    soul_md           TEXT,
+    agents_md         TEXT,
+    packages          TEXT[] DEFAULT '{}',
+    billing_address   JSONB DEFAULT '{}',
+    billing_notes     TEXT,
+    status            TEXT NOT NULL DEFAULT 'pending',
+    admin_notes       TEXT,
+    tenant_name       TEXT,
    encrypted_secrets BYTEA,
-    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
-    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+    created_at        TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at        TIMESTAMPTZ NOT NULL DEFAULT now()
  );

  CREATE INDEX IF NOT EXISTS idx_tenant_requests_status ON tenant_requests(status);
  CREATE INDEX IF NOT EXISTS idx_tenant_requests_org_id ON tenant_requests(zitadel_org_id);

-  -- Idempotent column add for existing databases
+  -- Idempotent column adds for existing databases
  ALTER TABLE tenant_requests ADD COLUMN IF NOT EXISTS encrypted_secrets BYTEA;
+  ALTER TABLE tenant_requests ADD COLUMN IF NOT EXISTS agents_md TEXT;
+
+  -- Workspace templates: admin-editable default content for workspace files
+  CREATE TABLE IF NOT EXISTS workspace_templates (
+    file_key   TEXT PRIMARY KEY,
+    content    TEXT NOT NULL,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+  );
 `;

 let migrated = false;
@@ -70,7 +68,59 @@ export async function ensureSchema(): Promise<void> {
 }

 // ---------------------------------------------------------------------------
-// CRUD
+// Workspace templates
+// ---------------------------------------------------------------------------
+
+/**
+ * Get a workspace template by file key (e.g. "SOUL.md", "AGENTS.md", "TOOLS.md").
+ * Returns null if no template is stored for this key.
+ */
+export async function getWorkspaceTemplate(
+  fileKey: string
+): Promise<string | null> {
+  await ensureSchema();
+  const result = await getPool().query<{ content: string }>(
+    "SELECT content FROM workspace_templates WHERE file_key = $1",
+    [fileKey]
+  );
+  return result.rows[0]?.content ?? null;
+}
+
+/**
+ * Upsert a workspace template.
+ */
+export async function setWorkspaceTemplate(
+  fileKey: string,
+  content: string
+): Promise<void> {
+  await ensureSchema();
+  await getPool().query(
+    `INSERT INTO workspace_templates (file_key, content, updated_at)
+     VALUES ($1, $2, now())
+     ON CONFLICT (file_key) DO UPDATE SET content = $2, updated_at = now()`,
+    [fileKey, content]
+  );
+}
+
+/**
+ * List all workspace templates.
+ */
+export async function listWorkspaceTemplates(): Promise<
+  Array<{ fileKey: string; content: string; updatedAt: string }>
+> {
+  await ensureSchema();
+  const result = await getPool().query(
+    "SELECT file_key, content, updated_at FROM workspace_templates ORDER BY file_key"
+  );
+  return result.rows.map((r: any) => ({
+    fileKey: r.file_key,
+    content: r.content,
+    updatedAt: r.updated_at?.toISOString?.() ?? r.updated_at,
+  }));
+}
+
+// ---------------------------------------------------------------------------
+// Tenant requests CRUD
 // ---------------------------------------------------------------------------

 export async function createTenantRequest(
@@ -81,10 +131,10 @@ export async function createTenantRequest(
  await ensureSchema();
  const result = await getPool().query<TenantRequest>(
    `INSERT INTO tenant_requests
-      (zitadel_org_id, zitadel_user_id, company_name, contact_name,
-       contact_email, agent_name, soul_md, packages, billing_address,
-       billing_notes, encrypted_secrets)
-     VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
+       (zitadel_org_id, zitadel_user_id, company_name, contact_name,
+        contact_email, agent_name, soul_md, agents_md, packages, billing_address,
+        billing_notes, encrypted_secrets)
+     VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
     RETURNING *`,
    [
      params.zitadelOrgId,
@@ -94,6 +144,7 @@ export async function createTenantRequest(
      params.contactEmail,
      params.agentName,
      params.soulMd,
+      params.agentsMd ?? null,
      params.packages,
      JSON.stringify(params.billingAddress),
      params.billingNotes,
@@ -103,62 +154,75 @@ export async function createTenantRequest(
  return mapRow(result.rows[0]);
 }

-export async function getTenantRequestByOrgId(
-  orgId: string
-): Promise<TenantRequest | null> {
-  await ensureSchema();
-  const result = await getPool().query(
-    "SELECT * FROM tenant_requests WHERE zitadel_org_id = $1",
-    [orgId]
-  );
-  return result.rows[0] ? mapRow(result.rows[0]) : null;
-}
-
 export async function getTenantRequestById(
  id: string
 ): Promise<TenantRequest | null> {
  await ensureSchema();
-  const result = await getPool().query(
+  const result = await getPool().query<TenantRequest>(
    "SELECT * FROM tenant_requests WHERE id = $1",
    [id]
  );
  return result.rows[0] ? mapRow(result.rows[0]) : null;
 }

+export async function getTenantRequestByOrgId(
+  orgId: string
+): Promise<TenantRequest | null> {
+  await ensureSchema();
+  const result = await getPool().query<TenantRequest>(
+    "SELECT * FROM tenant_requests WHERE zitadel_org_id = $1 ORDER BY created_at DESC LIMIT 1",
+    [orgId]
+  );
+  return result.rows[0] ? mapRow(result.rows[0]) : null;
+}
+
 export async function listTenantRequests(
  status?: TenantRequestStatus
 ): Promise<TenantRequest[]> {
  await ensureSchema();
-  const pool = getPool();
-  const query = status
-    ? { text: "SELECT * FROM tenant_requests WHERE status = $1 ORDER BY created_at DESC", values: [status] }
-    : { text: "SELECT * FROM tenant_requests ORDER BY created_at DESC", values: [] };
-  const result = await pool.query(query);
+  const result = status
+    ? await getPool().query<TenantRequest>(
+        "SELECT * FROM tenant_requests WHERE status = $1 ORDER BY created_at DESC",
+        [status]
+      )
+    : await getPool().query<TenantRequest>(
+        "SELECT * FROM tenant_requests ORDER BY created_at DESC"
+      );
  return result.rows.map(mapRow);
 }

 export async function updateTenantRequestStatus(
  id: string,
  status: TenantRequestStatus,
-  extra?: { adminNotes?: string | null; tenantName?: string; clearAdminNotes?: boolean }
+  extra?: {
+    adminNotes?: string | null;
+    tenantName?: string;
+    clearAdminNotes?: boolean;
+  }
 ): Promise<TenantRequest> {
  await ensureSchema();
+  const sets = ["status = $2", "updated_at = now()"];
+  const values: any[] = [id, status];
+  let idx = 3;

-  // If clearAdminNotes is true, explicitly set admin_notes to NULL
-  // Otherwise use COALESCE to preserve existing value when not provided
-  const adminNotesExpr = extra?.clearAdminNotes
-    ? "$2"
-    : "COALESCE($2, admin_notes)";
+  if (extra?.adminNotes !== undefined) {
+    sets.push(`admin_notes = $${idx}`);
+    values.push(extra.adminNotes);
+    idx++;
+  }
+  if (extra?.clearAdminNotes) {
+    sets.push("admin_notes = NULL");
+  }
+  if (extra?.tenantName) {
+    sets.push(`tenant_name = $${idx}`);
+    values.push(extra.tenantName);
+    idx++;
+  }

-  const result = await getPool().query(
-    `UPDATE tenant_requests
-     SET status = $1, admin_notes = ${adminNotesExpr},
-         tenant_name = COALESCE($3, tenant_name), updated_at = now()
-     WHERE id = $4
-     RETURNING *`,
-    [status, extra?.adminNotes ?? null, extra?.tenantName ?? null, id]
+  const result = await getPool().query<TenantRequest>(
+    `UPDATE tenant_requests SET ${sets.join(", ")} WHERE id = $1 RETURNING *`,
+    values
  );
-  if (!result.rows[0]) throw new Error(`TenantRequest ${id} not found`);
  return mapRow(result.rows[0]);
 }

@@ -200,34 +264,33 @@ export async function deleteTenantRequest(id: string): Promise<void> {
 /**
 * Sync provisioning statuses: for all requests with status "provisioning",
 * check if the PiecedTenant CR has reached "Ready" and update to "active".
- * Called from the admin requests list endpoint.
 */
-export async function syncProvisioningStatuses(
-  checkTenantPhase: (tenantName: string) => Promise<string | null>
-): Promise<void> {
+export async function syncProvisioningStatuses(): Promise<void> {
  await ensureSchema();
-  const pool = getPool();
-  const result = await pool.query(
-    "SELECT id, tenant_name FROM tenant_requests WHERE status = 'provisioning' AND tenant_name IS NOT NULL"
+  const result = await getPool().query<TenantRequest>(
+    "SELECT * FROM tenant_requests WHERE status = 'provisioning'"
  );

  for (const row of result.rows) {
+    const mapped = mapRow(row);
+    if (!mapped.tenantName) continue;
+
    try {
-      const phase = await checkTenantPhase(row.tenant_name);
-      if (phase === "Ready" || phase === "Running") {
-        await pool.query(
-          "UPDATE tenant_requests SET status = 'active', updated_at = now() WHERE id = $1",
-          [row.id]
-        );
+      const tenant = await getTenant(mapped.tenantName);
+      if (
+        tenant?.status?.phase === "Ready" ||
+        tenant?.status?.phase === "Running"
+      ) {
+        await updateTenantRequestStatus(mapped.id, "active");
      }
-    } catch (e) {
-      console.error(`Failed to sync status for request ${row.id}:`, e);
+    } catch {
+      // Tenant might not exist yet — skip
    }
  }
 }

 // ---------------------------------------------------------------------------
-// Row mapping (snake_case → camelCase)
+// Row mapper
 // ---------------------------------------------------------------------------

 function mapRow(row: any): TenantRequest {
@@ -240,10 +303,9 @@ function mapRow(row: any): TenantRequest {
    contactEmail: row.contact_email,
    agentName: row.agent_name,
    soulMd: row.soul_md,
+    agentsMd: row.agents_md ?? null,
    packages: row.packages ?? [],
-    billingAddress: typeof row.billing_address === "string"
-      ? JSON.parse(row.billing_address)
-      : row.billing_address ?? {},
+    billingAddress: row.billing_address ?? {},
    billingNotes: row.billing_notes,
    status: row.status as TenantRequestStatus,
    adminNotes: row.admin_notes,
--- a/src/lib/workspace-defaults.ts
+++ b/src/lib/workspace-defaults.ts
@@ -0,0 +1,111 @@
+/**
+ * Workspace file defaults.
+ *
+ * Default content for SOUL.md, AGENTS.md, and TOOLS.md is stored in the
+ * `workspace_templates` database table so it can be edited without redeploying.
+ *
+ * TOOLS.md is always auto-generated:
+ *   base template from DB  +  per-package tool sections appended dynamically.
+ */
+
+import { getWorkspaceTemplate } from "./db";
+import { PACKAGE_CATALOG } from "./packages";
+
+// ── Hardcoded fallbacks (used only if DB templates are missing) ─────────────
+
+const FALLBACK_SOUL = `# AI Assistant
+
+You are a helpful AI assistant. You are professional, concise, and friendly.
+
+## Guidelines
+- Answer questions accurately and helpfully
+- If you don't know something, say so
+- Keep responses clear and to the point
+- Respect privacy and confidentiality
+`;
+
+const FALLBACK_AGENTS = `# Agents
+
+On session start, read the following workspace files in order:
+1. SOUL.md — your personality and behavioural guidelines
+2. TOOLS.md — available tools and how to use them
+3. USER.md — information about the current user (if present)
+
+Follow the instructions in SOUL.md for every interaction.
+`;
+
+const FALLBACK_TOOLS = `# Tools
+
+The following tools are available to you as an AI assistant.
+
+## LLM
+You have access to a large language model for text generation, summarisation,
+translation, and general question answering.
+`;
+
+// ── Per-package TOOLS.md appendices ─────────────────────────────────────────
+
+const PACKAGE_TOOL_SECTIONS: Record<string, string> = {
+  "web-search": `
+## Web Search (SearXNG)
+You can search the web using the integrated SearXNG instance.
+Use this to find current information, verify facts, or research topics
+that go beyond your training data.
+`,
+  "document-processing": `
+## Document Processing
+You can parse, summarise, and extract information from uploaded documents
+including PDF, DOCX, XLSX, and plain text files.
+`,
+  telegram: `
+## Telegram
+You are connected to a Telegram bot. Messages from users arrive as chat
+messages. Respond naturally and follow the guidelines in SOUL.md.
+`,
+  discord: `
+## Discord
+You are connected to a Discord bot. Messages from server members arrive
+as chat messages. Respond naturally and follow the guidelines in SOUL.md.
+`,
+  email: `
+## Email
+You can send and receive email. Use this to respond to enquiries,
+send notifications, or process incoming messages according to SOUL.md.
+`,
+};
+
+// ── Public API ──────────────────────────────────────────────────────────────
+
+/**
+ * Fetch the default SOUL.md content.
+ * Substitutes {company} with the given org name.
+ */
+export async function getDefaultSoulMd(orgName: string): Promise<string> {
+  const tpl = await getWorkspaceTemplate("SOUL.md");
+  const content = tpl ?? FALLBACK_SOUL;
+  return content.replace(/\{company\}/g, orgName);
+}
+
+/**
+ * Fetch the default AGENTS.md content.
+ */
+export async function getDefaultAgentsMd(): Promise<string> {
+  const tpl = await getWorkspaceTemplate("AGENTS.md");
+  return tpl ?? FALLBACK_AGENTS;
+}
+
+/**
+ * Build the TOOLS.md content for a given set of enabled packages.
+ * Base template from DB (or fallback) + per-package appendices.
+ */
+export async function generateToolsMd(
+  enabledPackages: string[]
+): Promise<string> {
+  const base = (await getWorkspaceTemplate("TOOLS.md")) ?? FALLBACK_TOOLS;
+
+  const sections = enabledPackages
+    .filter((id) => PACKAGE_TOOL_SECTIONS[id])
+    .map((id) => PACKAGE_TOOL_SECTIONS[id]);
+
+  return [base.trimEnd(), ...sections].join("\n");
+}
--- a/src/messages/de.json
+++ b/src/messages/de.json
@@ -49,6 +49,11 @@
    "agentName": "Agent-Name",
    "soulMd": "Persönlichkeit (SOUL.md)",
    "soulMdHint": "Definiert das Verhalten Ihres Assistenten. Markdown-Format. Kann später bearbeitet werden.",
+    "agentsMd": "Agent-Anweisungen (AGENTS.md)",
+    "agentsMdHint": "Definiert, was Ihr Assistent beim Sitzungsstart tut. Optional — die Standardwerte funktionieren für die meisten Setups.",
+    "toolsMd": "Verfügbare Werkzeuge (TOOLS.md)",
+    "toolsMdHint": "Automatisch generiert basierend auf Ihren gewählten Paketen. Diese Datei wird automatisch verwaltet.",
+    "advancedConfig": "Erweiterte Konfiguration",
    "packages": "Pakete",
    "packagesHint": "Optionale Integrationen. Pakete mit Zugangsdaten werden diese inline abfragen. Können auch später aktiviert werden.",
    "billingTitle": "Rechnungsinformationen",
@@ -111,6 +116,7 @@
  "workspace": {
    "save": "Speichern",
    "placeholder": "Inhalt für {file} eingeben…",
+    "readonlyNote": "Diese Datei wird automatisch generiert und kann nicht manuell bearbeitet werden.",
    "seedingNote": "Workspace-Dateien werden beim ersten Start geladen. Eine Aktualisierung auf einer bestehenden Instanz löst ein ConfigMap-Update und Pod-Neustart aus."
  },
  "packages": {
--- a/src/messages/en.json
+++ b/src/messages/en.json
@@ -49,6 +49,11 @@
    "agentName": "Agent Name",
    "soulMd": "Personality (SOUL.md)",
    "soulMdHint": "This defines how your assistant behaves. Markdown format. You can edit this later.",
+    "agentsMd": "Agent Instructions (AGENTS.md)",
+    "agentsMdHint": "Defines what your assistant does on session start. Optional — defaults work well for most setups.",
+    "toolsMd": "Available Tools (TOOLS.md)",
+    "toolsMdHint": "Auto-generated based on your selected packages. This file is managed automatically.",
+    "advancedConfig": "Advanced Configuration",
    "packages": "Packages",
    "packagesHint": "Optional integrations. Packages requiring credentials will ask for them inline. You can also enable these later.",
    "billingTitle": "Billing information",
@@ -111,6 +116,7 @@
  "workspace": {
    "save": "Save",
    "placeholder": "Enter content for {file}…",
+    "readonlyNote": "This file is auto-generated and cannot be edited manually.",
    "seedingNote": "Workspace files are seeded on first boot. Updating on an existing instance triggers a ConfigMap update and pod restart."
  },
  "packages": {
--- a/src/messages/fr.json
+++ b/src/messages/fr.json
@@ -2,8 +2,8 @@
  "common": {
    "appName": "PieCed",
    "tagline": "Plateforme IA",
-    "login": "Se connecter",
-    "logout": "Se déconnecter",
+    "login": "Connexion",
+    "logout": "Déconnexion",
    "dashboard": "Tableau de bord",
    "admin": "Admin",
    "loading": "Chargement…",
@@ -19,36 +19,41 @@
    "button": "Continuer avec ZITADEL",
    "footer": "Hébergé on-premises en Suisse",
    "noAccount": "Pas encore de compte ?",
-    "register": "Inscrivez votre entreprise"
+    "register": "Enregistrer votre entreprise"
  },
  "register": {
    "title": "Créer votre compte",
-    "subtitle": "Inscrivez votre entreprise pour un assistant IA hébergé en Suisse",
+    "subtitle": "Enregistrez votre entreprise pour un assistant IA hébergé en Suisse",
    "companyName": "Nom de l'entreprise",
-    "companyNamePlaceholder": "Acme SA",
+    "companyNamePlaceholder": "Exemple SA",
    "givenName": "Prénom",
    "familyName": "Nom",
    "email": "Adresse e-mail",
    "submit": "S'inscrire",
-    "hasAccount": "Vous avez déjà un compte ?",
+    "hasAccount": "Déjà un compte ?",
    "footer": "Vos données sont hébergées exclusivement on-premises en Suisse.",
    "successTitle": "Inscription reçue",
-    "successDescription": "Vous recevrez un e-mail d'invitation avec un lien pour définir votre mot de passe et vérifier votre adresse e-mail. Une fois terminé, vous pourrez vous connecter pour configurer votre assistant IA.",
+    "successDescription": "Vous recevrez un e-mail d'invitation avec un lien pour définir votre mot de passe et vérifier votre adresse e-mail. Ensuite, vous pourrez vous connecter et configurer votre assistant IA.",
    "goToLogin": "Aller à la connexion"
  },
  "onboarding": {
    "loading": "Chargement du statut…",
-    "welcomeTitle": "Configurez votre assistant IA",
+    "welcomeTitle": "Configurer votre assistant IA",
    "welcomeDescription": "En quelques étapes, vous aurez votre propre assistant IA — hébergé exclusivement en Suisse, entièrement sous votre contrôle.",
    "welcomeFeature_swissHosted": "Hébergé on-premises en Suisse — vos données ne quittent jamais le pays",
    "welcomeFeature_privacy": "Aucune donnée partagée avec des tiers — confidentialité totale",
    "welcomeFeature_customizable": "Personnalité, paquets et intégrations entièrement personnalisables",
    "getStarted": "Commencer",
    "configureTitle": "Configurer votre assistant",
-    "configureDescription": "Donnez un nom et une personnalité à votre assistant. Vous pourrez toujours modifier cela plus tard.",
+    "configureDescription": "Donnez un nom et une personnalité à votre assistant. Vous pouvez toujours les modifier par la suite.",
    "agentName": "Nom de l'agent",
    "soulMd": "Personnalité (SOUL.md)",
    "soulMdHint": "Définit le comportement de votre assistant. Format Markdown. Modifiable ultérieurement.",
+    "agentsMd": "Instructions de l'agent (AGENTS.md)",
+    "agentsMdHint": "Définit ce que votre assistant fait au démarrage de la session. Optionnel — les paramètres par défaut conviennent à la plupart des configurations.",
+    "toolsMd": "Outils disponibles (TOOLS.md)",
+    "toolsMdHint": "Généré automatiquement en fonction des paquets sélectionnés. Ce fichier est géré automatiquement.",
+    "advancedConfig": "Configuration avancée",
    "packages": "Paquets",
    "packagesHint": "Intégrations optionnelles. Les paquets nécessitant des identifiants les demanderont en ligne. Vous pouvez aussi les activer plus tard.",
    "billingTitle": "Informations de facturation",
@@ -59,7 +64,7 @@
    "billingCity": "Ville",
    "billingCountry": "Pays",
    "billingNotes": "Remarques",
-    "billingNotesPlaceholder": "Remarques concernant la facturation (numéro de commande, TVA, mode de paiement préféré, etc.)",
+    "billingNotesPlaceholder": "Remarques sur la facturation (numéro de commande, numéro de TVA, mode de paiement préféré, etc.)",
    "confirmTitle": "Vérifier et envoyer",
    "confirmDescription": "Veuillez vérifier votre configuration. Votre demande sera examinée par notre équipe avant la mise en service.",
    "confirmNote": "Après l'envoi, notre équipe examinera votre demande et vos informations de facturation. Vous recevrez l'accès après approbation — généralement dans un délai d'un jour ouvrable.",
@@ -68,7 +73,7 @@
    "back": "Retour",
    "next": "Suivant",
    "pendingTitle": "Demande envoyée",
-    "pendingDescription": "Votre demande d'intégration a été envoyée et est en attente d'examen par notre équipe. Vous recevrez l'accès après approbation — généralement dans un délai d'un jour ouvrable.",
+    "pendingDescription": "Votre demande a été envoyée et est en cours d'examen par notre équipe. Vous recevrez l'accès après approbation — généralement dans un délai d'un jour ouvrable.",
    "rejectedTitle": "Demande non approuvée",
    "rejectedDescription": "Malheureusement, votre demande n'a pas été approuvée. Veuillez nous contacter pour plus d'informations.",
    "provisioningTitle": "Configuration de votre instance",
@@ -93,8 +98,8 @@
    "agent": "Agent",
    "packages": "Paquets",
    "workspaceFiles": "Fichiers workspace",
-    "notFound": "Tenant introuvable.",
-    "usage": "Utilisation et dépenses"
+    "notFound": "Locataire non trouvé.",
+    "usage": "Utilisation et coûts"
  },
  "usage": {
    "inputTokens": "Tokens d'entrée",
@@ -102,7 +107,7 @@
    "totalSpend": "Dépenses totales",
    "totalCost": "Coût total",
    "budget": "Budget",
-    "noLimit": "Aucune limite",
+    "noLimit": "Pas de limite",
    "last30Days": "30 derniers jours",
    "noData": "Aucune donnée d'utilisation disponible.",
    "dailyBreakdown": "Détail journalier",
@@ -111,6 +116,7 @@
  "workspace": {
    "save": "Enregistrer",
    "placeholder": "Saisir le contenu pour {file}…",
+    "readonlyNote": "Ce fichier est généré automatiquement et ne peut pas être modifié manuellement.",
    "seedingNote": "Les fichiers workspace sont initialisés au premier démarrage. Une mise à jour sur une instance existante déclenche une mise à jour du ConfigMap et un redémarrage du pod."
  },
  "packages": {
@@ -122,7 +128,7 @@
    "disable": "Désactiver",
    "enableAndSave": "Activer et enregistrer",
    "configure": "Configurer",
-    "requiresApiKey": "Clé API requise",
+    "requiresApiKey": "Nécessite une clé API",
    "missingFields": "Veuillez remplir tous les champs obligatoires.",
    "status": {
      "pending": "En attente",
@@ -133,15 +139,15 @@
      "description": "Connectez votre assistant IA à un bot Telegram.",
      "botTokenLabel": "Token du bot Telegram",
      "botTokenPlaceholder": "123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11",
-      "instructions": "1. Ouvrez @BotFather sur Telegram\n2. Envoyez /newbot et suivez les instructions\n3. Copiez le token du bot fourni",
-      "disclaimer": "Je confirme être propriétaire de ce bot Telegram et autorise PieCed IT à le connecter à mon assistant IA."
+      "instructions": "1. Ouvrez @BotFather sur Telegram\n2. Envoyez /newbot et suivez les instructions\n3. Copiez le token du bot",
+      "disclaimer": "Je confirme que je possède ce bot Telegram et autorise PieCed IT à le connecter à mon assistant IA."
    },
    "discord": {
      "description": "Connectez votre assistant IA à un serveur Discord via un bot.",
      "botTokenLabel": "Token du bot Discord",
      "botTokenPlaceholder": "MTAxNjQ0OTk2NjAz...",
      "instructions": "1. Allez sur discord.com/developers/applications\n2. Créez une nouvelle application et ajoutez un bot\n3. Copiez le token du bot",
-      "disclaimer": "Je confirme être propriétaire de ce bot Discord et autorise PieCed IT à le connecter à mon assistant IA."
+      "disclaimer": "Je confirme que je possède ce bot Discord et autorise PieCed IT à le connecter à mon assistant IA."
    },
    "email": {
      "description": "Permettez à votre assistant IA d'envoyer et de recevoir des e-mails.",
@@ -154,7 +160,7 @@
      "imapHostLabel": "Hôte IMAP",
      "imapHostPlaceholder": "imap.example.com",
      "instructions": "Fournissez les identifiants SMTP et IMAP. L'assistant les utilise pour envoyer et surveiller les messages.",
-      "disclaimer": "Je confirme être autorisé à utiliser ces identifiants e-mail et que PieCed IT peut accéder à cette boîte mail."
+      "disclaimer": "Je confirme que je suis autorisé à utiliser ces identifiants e-mail et que PieCed IT peut accéder à cette boîte mail."
    },
    "webSearch": {
      "description": "Donnez à votre assistant IA la capacité de rechercher sur le web."
@@ -165,7 +171,7 @@
  },
  "admin": {
    "title": "Admin plateforme",
-    "subtitle": "Gérer les demandes d'intégration et le cycle de vie des locataires",
+    "subtitle": "Gérer les demandes d'onboarding et le cycle de vie des locataires",
    "allTenants": "Locataires",
    "noTenants": "Aucun locataire provisionné.",
    "noAccess": "Permissions insuffisantes pour cette vue.",
@@ -179,7 +185,7 @@
    "pendingRequests": "Demandes en attente",
    "approve": "Approuver",
    "reject": "Rejeter",
-    "reApprove": "Ré-approuver",
+    "reApprove": "Réapprouver",
    "company": "Entreprise",
    "contact": "Contact",
    "agentName": "Agent",
@@ -188,7 +194,7 @@
    "actions": "Actions",
    "noRequests": "Aucune demande trouvée.",
    "loadingRequests": "Chargement des demandes…",
-    "approveConfirm": "Approuver cette demande et lancer le provisionnement ?",
+    "approveConfirm": "Approuver cette demande et démarrer la mise en service ?",
    "rejectConfirm": "Rejeter cette demande ?",
    "rejectTitle": "Rejeter la demande",
    "adminNotesLabel": "Notes (optionnel)",
@@ -202,7 +208,7 @@
    "filter_approved": "Approuvé",
    "filter_rejected": "Rejeté",
    "totalTenants": "Total",
-    "running": "Actif",
+    "running": "En cours",
    "provisioning": "Provisionnement",
    "errors": "Erreurs",
    "suspend": "Suspendre",
--- a/src/messages/it.json
+++ b/src/messages/it.json
@@ -24,8 +24,8 @@
  "register": {
    "title": "Crea il tuo account",
    "subtitle": "Registra la tua azienda per un assistente IA ospitato in Svizzera",
-    "companyName": "Nome dell'azienda",
-    "companyNamePlaceholder": "Acme SA",
+    "companyName": "Nome azienda",
+    "companyNamePlaceholder": "Esempio SA",
    "givenName": "Nome",
    "familyName": "Cognome",
    "email": "Indirizzo e-mail",
@@ -33,22 +33,27 @@
    "hasAccount": "Hai già un account?",
    "footer": "I tuoi dati sono ospitati esclusivamente on-premises in Svizzera.",
    "successTitle": "Registrazione ricevuta",
-    "successDescription": "Riceverai un'e-mail di invito con un link per impostare la password e verificare il tuo indirizzo e-mail. Una volta completato, potrai accedere per configurare il tuo assistente IA.",
+    "successDescription": "Riceverai un'e-mail di invito con un link per impostare la password e verificare il tuo indirizzo e-mail. Dopodiché potrai accedere e configurare il tuo assistente IA.",
    "goToLogin": "Vai all'accesso"
  },
  "onboarding": {
-    "loading": "Caricamento dello stato…",
+    "loading": "Caricamento stato…",
    "welcomeTitle": "Configura il tuo assistente IA",
-    "welcomeDescription": "In pochi passaggi avrai il tuo assistente IA personale — ospitato esclusivamente in Svizzera, completamente sotto il tuo controllo.",
-    "welcomeFeature_swissHosted": "Ospitato on-premises in Svizzera — i tuoi dati non lasciano mai il paese",
+    "welcomeDescription": "In pochi passaggi avrai il tuo assistente IA — ospitato esclusivamente in Svizzera, completamente sotto il tuo controllo.",
+    "welcomeFeature_swissHosted": "Ospitato on-premises in Svizzera — i tuoi dati non lasciano mai il Paese",
    "welcomeFeature_privacy": "Nessun dato condiviso con terzi — privacy completa",
    "welcomeFeature_customizable": "Personalità, pacchetti e integrazioni completamente personalizzabili",
    "getStarted": "Inizia",
    "configureTitle": "Configura il tuo assistente",
-    "configureDescription": "Dai un nome e una personalità al tuo assistente. Puoi sempre modificarlo in seguito.",
-    "agentName": "Nome dell'agente",
+    "configureDescription": "Dai un nome e una personalità al tuo assistente. Puoi sempre modificarli in seguito.",
+    "agentName": "Nome agente",
    "soulMd": "Personalità (SOUL.md)",
    "soulMdHint": "Definisce il comportamento del tuo assistente. Formato Markdown. Modificabile in seguito.",
+    "agentsMd": "Istruzioni agente (AGENTS.md)",
+    "agentsMdHint": "Definisce cosa fa il tuo assistente all'avvio della sessione. Opzionale — i valori predefiniti funzionano per la maggior parte delle configurazioni.",
+    "toolsMd": "Strumenti disponibili (TOOLS.md)",
+    "toolsMdHint": "Generato automaticamente in base ai pacchetti selezionati. Questo file viene gestito automaticamente.",
+    "advancedConfig": "Configurazione avanzata",
    "packages": "Pacchetti",
    "packagesHint": "Integrazioni opzionali. I pacchetti che richiedono credenziali le chiederanno inline. Puoi attivarli anche in seguito.",
    "billingTitle": "Informazioni di fatturazione",
@@ -59,7 +64,7 @@
    "billingCity": "Città",
    "billingCountry": "Paese",
    "billingNotes": "Note",
-    "billingNotesPlaceholder": "Note sulla fatturazione (numero d'ordine, partita IVA, metodo di pagamento preferito, ecc.)",
+    "billingNotesPlaceholder": "Note sulla fatturazione (numero ordine, partita IVA, metodo di pagamento preferito, ecc.)",
    "confirmTitle": "Verifica e invia",
    "confirmDescription": "Verifica la tua configurazione. La tua richiesta verrà esaminata dal nostro team prima dell'attivazione.",
    "confirmNote": "Dopo l'invio, il nostro team esaminerà la tua richiesta e i dati di fatturazione. Riceverai l'accesso dopo l'approvazione — di solito entro un giorno lavorativo.",
@@ -68,23 +73,23 @@
    "back": "Indietro",
    "next": "Avanti",
    "pendingTitle": "Richiesta inviata",
-    "pendingDescription": "La tua richiesta di attivazione è stata inviata ed è in attesa di revisione da parte del nostro team. Riceverai l'accesso dopo l'approvazione — di solito entro un giorno lavorativo.",
+    "pendingDescription": "La tua richiesta è stata inviata ed è in fase di esame da parte del nostro team. Riceverai l'accesso dopo l'approvazione — di solito entro un giorno lavorativo.",
    "rejectedTitle": "Richiesta non approvata",
-    "rejectedDescription": "Purtroppo la tua richiesta non è stata approvata. Contattaci per maggiori informazioni.",
+    "rejectedDescription": "Purtroppo la tua richiesta non è stata approvata. Contattaci per ulteriori informazioni.",
    "provisioningTitle": "Configurazione dell'istanza",
-    "provisioningDescription": "Il tuo assistente IA è in fase di attivazione. Di solito sono necessari pochi minuti.",
+    "provisioningDescription": "Il tuo assistente IA è in fase di attivazione. Di solito richiede pochi minuti.",
    "phase": "Fase",
    "readyTitle": "Il tuo assistente è pronto!",
-    "readyDescription": "Il tuo assistente IA è stato attivato ed è operativo. Puoi ora gestirlo dalla dashboard.",
+    "readyDescription": "Il tuo assistente IA è stato attivato ed è operativo. Ora puoi gestirlo dalla dashboard.",
    "goToDashboard": "Vai alla dashboard"
  },
  "dashboard": {
    "title": "Dashboard",
    "welcome": "Bentornato, {name}",
-    "instanceStatus": "Stato dell'istanza",
+    "instanceStatus": "Stato istanza",
    "usage": "Utilizzo",
    "packages": "Pacchetti",
-    "noInstance": "Nessuna istanza ancora attivata.",
+    "noInstance": "Nessuna istanza attivata.",
    "comingSoon": "Vista dettagliata in arrivo nella Sessione 6.2",
    "noInstanceDescription": "Configura la tua istanza di assistente IA per iniziare con PieCed IT.",
    "manage": "Gestisci istanza e pacchetti"
@@ -94,7 +99,7 @@
    "packages": "Pacchetti",
    "workspaceFiles": "File workspace",
    "notFound": "Tenant non trovato.",
-    "usage": "Utilizzo e spese"
+    "usage": "Utilizzo e costi"
  },
  "usage": {
    "inputTokens": "Token di input",
@@ -111,6 +116,7 @@
  "workspace": {
    "save": "Salva",
    "placeholder": "Inserisci il contenuto per {file}…",
+    "readonlyNote": "Questo file viene generato automaticamente e non può essere modificato manualmente.",
    "seedingNote": "I file workspace vengono inizializzati al primo avvio. Un aggiornamento su un'istanza esistente attiva un aggiornamento del ConfigMap e un riavvio del pod."
  },
  "packages": {
@@ -122,26 +128,26 @@
    "disable": "Disattiva",
    "enableAndSave": "Attiva e salva",
    "configure": "Configura",
-    "requiresApiKey": "Chiave API richiesta",
-    "missingFields": "Compila tutti i campi obbligatori.",
+    "requiresApiKey": "Richiede chiave API",
+    "missingFields": "Compilare tutti i campi obbligatori.",
    "status": {
-      "pending": "In sospeso",
+      "pending": "In attesa",
      "active": "Attivo",
      "error": "Errore"
    },
    "telegram": {
      "description": "Collega il tuo assistente IA a un bot Telegram.",
-      "botTokenLabel": "Token del bot Telegram",
+      "botTokenLabel": "Token bot Telegram",
      "botTokenPlaceholder": "123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11",
-      "instructions": "1. Apri @BotFather su Telegram\n2. Invia /newbot e segui le istruzioni\n3. Copia il token del bot fornito",
-      "disclaimer": "Confermo di essere proprietario di questo bot Telegram e autorizzo PieCed IT a collegarlo al mio assistente IA."
+      "instructions": "1. Apri @BotFather su Telegram\n2. Invia /newbot e segui le istruzioni\n3. Copia il token del bot",
+      "disclaimer": "Confermo di possedere questo bot Telegram e autorizzo PieCed IT a collegarlo al mio assistente IA."
    },
    "discord": {
      "description": "Collega il tuo assistente IA a un server Discord tramite un bot.",
-      "botTokenLabel": "Token del bot Discord",
+      "botTokenLabel": "Token bot Discord",
      "botTokenPlaceholder": "MTAxNjQ0OTk2NjAz...",
      "instructions": "1. Vai su discord.com/developers/applications\n2. Crea una nuova applicazione e aggiungi un bot\n3. Copia il token del bot",
-      "disclaimer": "Confermo di essere proprietario di questo bot Discord e autorizzo PieCed IT a collegarlo al mio assistente IA."
+      "disclaimer": "Confermo di possedere questo bot Discord e autorizzo PieCed IT a collegarlo al mio assistente IA."
    },
    "email": {
      "description": "Permetti al tuo assistente IA di inviare e ricevere e-mail.",
@@ -153,21 +159,21 @@
      "smtpPasswordPlaceholder": "••••••••",
      "imapHostLabel": "Host IMAP",
      "imapHostPlaceholder": "imap.example.com",
-      "instructions": "Fornisci le credenziali SMTP e IMAP. L'assistente le utilizza per inviare e monitorare i messaggi.",
+      "instructions": "Fornisci le credenziali SMTP e IMAP. L'assistente le usa per inviare e monitorare i messaggi.",
      "disclaimer": "Confermo di essere autorizzato a utilizzare queste credenziali e-mail e che PieCed IT può accedere a questa casella di posta."
    },
    "webSearch": {
-      "description": "Dai al tuo assistente IA la capacità di cercare sul web."
+      "description": "Dai al tuo assistente IA la capacità di cercare nel web."
    },
    "documentProcessing": {
-      "description": "Attiva analisi, riepilogo ed estrazione di documenti."
+      "description": "Attiva l'analisi, il riassunto e l'estrazione di documenti."
    }
  },
  "admin": {
    "title": "Admin piattaforma",
-    "subtitle": "Gestire le richieste di onboarding e il ciclo di vita dei tenant",
+    "subtitle": "Gestisci le richieste di onboarding e il ciclo di vita dei tenant",
    "allTenants": "Tenant",
-    "noTenants": "Nessun tenant provisionato.",
+    "noTenants": "Nessun tenant attivato.",
    "noAccess": "Permessi insufficienti per questa vista.",
    "name": "Nome",
    "displayName": "Nome visualizzato",
@@ -179,7 +185,7 @@
    "pendingRequests": "Richieste in attesa",
    "approve": "Approva",
    "reject": "Rifiuta",
-    "reApprove": "Ri-approva",
+    "reApprove": "Riapprova",
    "company": "Azienda",
    "contact": "Contatto",
    "agentName": "Agente",
@@ -188,22 +194,22 @@
    "actions": "Azioni",
    "noRequests": "Nessuna richiesta trovata.",
    "loadingRequests": "Caricamento richieste…",
-    "approveConfirm": "Approvare questa richiesta e avviare il provisioning?",
+    "approveConfirm": "Approvare questa richiesta e avviare l'attivazione?",
    "rejectConfirm": "Rifiutare questa richiesta?",
    "rejectTitle": "Rifiuta richiesta",
    "adminNotesLabel": "Note (opzionale)",
    "adminNotesPlaceholder": "Motivo del rifiuto…",
    "cancelAction": "Annulla",
    "confirmReject": "Rifiuta",
-    "viewTenant": "Vedi",
+    "viewTenant": "Visualizza",
    "filter_all": "Tutti",
-    "filter_pending": "In attenta",
-    "filter_provisioning": "Provisioning",
+    "filter_pending": "In attesa",
+    "filter_provisioning": "Attivazione",
    "filter_approved": "Approvato",
    "filter_rejected": "Rifiutato",
    "totalTenants": "Totale",
    "running": "Attivo",
-    "provisioning": "Provisioning",
+    "provisioning": "Attivazione",
    "errors": "Errori",
    "suspend": "Sospendi",
    "resume": "Riprendi",
--- a/src/types/index.ts
+++ b/src/types/index.ts
@@ -88,12 +88,12 @@ export interface BillingAddress {
 }

 export type TenantRequestStatus =
-  | "pending"  // Submitted, awaiting admin approval
-  | "approved"  // Admin approved, provisioning will start
-  | "provisioning"  // PiecedTenant CR created, operator reconciling
-  | "active"  // Tenant running
-  | "rejected"  // Admin rejected
-  | "deleted";  // Tenant was deleted by admin
+  | "pending" // Submitted, awaiting admin approval
+  | "approved" // Admin approved, provisioning will start
+  | "provisioning" // PiecedTenant CR created, operator reconciling
+  | "active" // Tenant running
+  | "rejected" // Admin rejected
+  | "deleted"; // Tenant was deleted by admin

 export interface TenantRequest {
  id: string;
@@ -104,6 +104,7 @@ export interface TenantRequest {
  contactEmail: string;
  agentName: string;
  soulMd?: string;
+  agentsMd?: string | null;
  packages: string[];
  billingAddress: BillingAddress;
  billingNotes?: string;
@@ -119,6 +120,7 @@ export interface TenantRequest {
 export interface OnboardingInput {
  agentName: string;
  soulMd?: string;
+  agentsMd?: string;
  packages?: string[];
  billingAddress: BillingAddress;
  billingNotes?: string;