All the channel approval

Add Health and Spend for Admins
All the MD files via Database
2026-04-12 13:47:27 +02:00 · 2026-04-11 22:36:36 +02:00 · 2026-04-11 21:14:09 +02:00
23 changed files with 1950 additions and 319 deletions
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -0,0 +1,31 @@
+# Session 6.6 — Items 5 & 6: System Health + Spend Column
+
+## Files
+
+| File | Action | What |
+|------|--------|------|
+| `src/lib/litellm.ts` | REPLACE | Added `listTeams()`, `getLitellmHealth()`, `getGlobalSpend()`, `getPerTeamSpend()` |
+| `src/app/api/admin/health/route.ts` | **NEW** | Returns tenant phase counts, aggregate + per-tenant spend, vLLM & LiteLLM health |
+| `src/components/admin/admin-panel.tsx` | REPLACE | Added "Health" tab (service indicators, tenant overview, spend cards) + "Spend (CHF)" column in tenants table |
+| `patch-i18n-admin-health.mjs` | **RUN ONCE** | Patches all 4 i18n files with new admin keys |
+
+## Steps
+
+1. Drop in the 3 source files (overwrite existing)
+2. Run the i18n patcher from the portal root:
+   ```bash
+   node patch-i18n-admin-health.mjs
+   ```
+3. Build and deploy
+
+## Environment Variables (optional)
+
+- `VLLM_HEALTH_URL` — defaults to `http://vllm.inference.svc:8000`. Set if your vLLM is elsewhere.
+- `LITELLM_INTERNAL_URL` / `LITELLM_MASTER_KEY` — already configured.
+
+## Notes
+
+- The health API uses `Promise.allSettled` so a single service being down won't break the whole page.
+- Per-tenant spend is fetched from LiteLLM's `/team/list` which returns the cumulative `spend` per team. This is mapped to tenant names via `status.litellmTeamId` on the PiecedTenant CR.
+- The spend column in the tenants table piggybacks on the same health data — fetched once when switching to the tenants tab.
+- If LiteLLM's `/team/list` or `/global/spend` response format differs from what I assumed, you may need to adjust the parsing in `litellm.ts`. The functions have fallbacks for common response shapes.
--- a/deploy/README_sql.md
+++ b/deploy/README_sql.md
@@ -0,0 +1,58 @@
+# Session 6.6 — Items 3 & 4: AGENTS.md / TOOLS.md in Wizard + Default Templates
+
+## Manual Steps (in order)
+
+### 1. Deploy the updated portal code
+Copy the files from this ZIP into your `pieced-portal` repo, overwriting existing files.
+All paths match the project structure — drop-in replacements.
+
+### 2. The DB migration is automatic
+The updated `db.ts` adds these idempotently on first query:
+- Column `agents_md TEXT` on `tenant_requests`
+- Table `workspace_templates` (file_key TEXT PK, content TEXT, updated_at TIMESTAMPTZ)
+
+No manual `ALTER TABLE` needed.
+
+### 3. Seed the workspace templates
+After the portal has started (so the table exists):
+
+```bash
+kubectl exec -i portal-db-1 -n portal -- psql -U portal -d portal < seed-workspace-templates.sql
+```
+
+Or connect interactively and paste the SQL.
+
+### 4. Edit templates as needed
+To update a template later, just UPDATE the row:
+
+```sql
+UPDATE workspace_templates
+SET content = '# Your new SOUL.md content here...', updated_at = now()
+WHERE file_key = 'SOUL.md';
+```
+
+The portal reads templates on every wizard load / approval — no restart needed.
+
+---
+
+## File Manifest
+
+| File | Action | What changed |
+|------|--------|-------------|
+| `src/lib/workspace-defaults.ts` | **NEW** | Default content fetching from DB + TOOLS.md generation |
+| `src/lib/db.ts` | REPLACE | Added `agents_md` column, `workspace_templates` table + CRUD |
+| `src/types/index.ts` | REPLACE | Added `agentsMd` to `TenantRequest` and `OnboardingInput` |
+| `src/app/api/onboarding/route.ts` | REPLACE | Accepts `agentsMd` field |
+| `src/app/api/admin/requests/[id]/approve/route.ts` | REPLACE | Builds all 3 workspace files (SOUL/AGENTS/TOOLS) |
+| `src/app/api/workspace-defaults/route.ts` | **NEW** | API to fetch defaults for wizard pre-fill |
+| `src/components/onboarding/wizard.tsx` | REPLACE | "Advanced Configuration" accordion with AGENTS.md textarea + readonly TOOLS.md preview |
+| `src/messages/{de,en,fr,it}.json` | REPLACE | Added `agentsMd`, `agentsMdHint`, `toolsMd`, `toolsMdHint`, `advancedConfig`, `readonlyNote` |
+| `seed-workspace-templates.sql` | **NEW** | SQL to seed default templates |
+
+## Design Decisions
+
+- **TOOLS.md is readonly** in both the wizard and the tenant detail page. It's auto-generated from the base template + per-package sections. Users see it but can't edit it.
+- **AGENTS.md is editable** in the wizard (under "Advanced Configuration" accordion) and on the tenant detail workspace editor.
+- **Templates live in the DB** (`workspace_templates` table) so you can edit them without redeploying. Hardcoded fallbacks exist in `workspace-defaults.ts` in case the DB rows are missing.
+- **TOOLS.md is regenerated on approval** based on the packages selected, so it's always consistent with what's actually enabled.
+- The workspace editor on the tenant detail page already supports arbitrary `workspaceFiles` keys from the CR spec, so AGENTS.md and TOOLS.md will appear there automatically. TOOLS.md should be made readonly there too — that's a separate small change to the workspace editor component (mark `TOOLS.md` as readonly based on the filename).
--- a/deploy/patch-i18n-admin-health.mjs
+++ b/deploy/patch-i18n-admin-health.mjs
@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+/**
+ * Run: node patch-i18n-admin-health.mjs
+ * Adds health/spend keys to all 4 message files.
+ * Run from the pieced-portal root.
+ */
+import { readFileSync, writeFileSync } from "fs";
+
+const newKeys = {
+  en: {
+    health: "Health",
+    serviceHealth: "Service Health",
+    vllmDescription: "GPU inference engine",
+    litellmDescription: "LLM proxy & spend tracking",
+    tenantOverview: "Tenant Overview",
+    spendOverview: "Spend Overview",
+    globalSpend: "Global Spend (CHF)",
+    activeTenants: "Active Tenants",
+    tenantsWithSpend: "tenants with recorded spend",
+    refresh: "Refresh",
+    healthUnavailable: "Health data unavailable.",
+    loadingHealth: "Loading health data…",
+    statusHealthy: "Healthy",
+    statusDown: "Down",
+    spendChf: "Spend (CHF)",
+  },
+  de: {
+    health: "Status",
+    serviceHealth: "Dienststatus",
+    vllmDescription: "GPU-Inferenz-Engine",
+    litellmDescription: "LLM-Proxy & Kostenerfassung",
+    tenantOverview: "Mandanten-Übersicht",
+    spendOverview: "Kostenübersicht",
+    globalSpend: "Gesamtkosten (CHF)",
+    activeTenants: "Aktive Mandanten",
+    tenantsWithSpend: "Mandanten mit erfassten Kosten",
+    refresh: "Aktualisieren",
+    healthUnavailable: "Statusdaten nicht verfügbar.",
+    loadingHealth: "Statusdaten werden geladen…",
+    statusHealthy: "OK",
+    statusDown: "Ausgefallen",
+    spendChf: "Kosten (CHF)",
+  },
+  fr: {
+    health: "Santé",
+    serviceHealth: "Santé des services",
+    vllmDescription: "Moteur d'inférence GPU",
+    litellmDescription: "Proxy LLM & suivi des coûts",
+    tenantOverview: "Aperçu des locataires",
+    spendOverview: "Aperçu des coûts",
+    globalSpend: "Coûts globaux (CHF)",
+    activeTenants: "Locataires actifs",
+    tenantsWithSpend: "locataires avec dépenses enregistrées",
+    refresh: "Actualiser",
+    healthUnavailable: "Données de santé indisponibles.",
+    loadingHealth: "Chargement des données de santé…",
+    statusHealthy: "OK",
+    statusDown: "Hors service",
+    spendChf: "Coûts (CHF)",
+  },
+  it: {
+    health: "Stato",
+    serviceHealth: "Stato dei servizi",
+    vllmDescription: "Motore di inferenza GPU",
+    litellmDescription: "Proxy LLM & monitoraggio costi",
+    tenantOverview: "Panoramica tenant",
+    spendOverview: "Panoramica costi",
+    globalSpend: "Costi globali (CHF)",
+    activeTenants: "Tenant attivi",
+    tenantsWithSpend: "tenant con spese registrate",
+    refresh: "Aggiorna",
+    healthUnavailable: "Dati di stato non disponibili.",
+    loadingHealth: "Caricamento dati di stato…",
+    statusHealthy: "OK",
+    statusDown: "Non disponibile",
+    spendChf: "Costi (CHF)",
+  },
+};
+
+for (const [lang, keys] of Object.entries(newKeys)) {
+  const path = `src/messages/${lang}.json`;
+  const json = JSON.parse(readFileSync(path, "utf8"));
+  Object.assign(json.admin, keys);
+  writeFileSync(path, JSON.stringify(json, null, 2) + "\n");
+  console.log(`Patched ${path} — added ${Object.keys(keys).length} keys`);
+}
--- a/deploy/patch-i18n-channel-users.mjs
+++ b/deploy/patch-i18n-channel-users.mjs
@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+/**
+ * Run: node patch-i18n-channel-users.mjs
+ * Adds channelUsers i18n keys to all 4 message files.
+ * Run from the pieced-portal root.
+ */
+import { readFileSync, writeFileSync } from "fs";
+
+const newKeys = {
+  en: {
+    title: "Authorized Users",
+    description: "Manage which users can interact with your assistant on each channel. Add their numeric user ID to authorize access.",
+    users: "users",
+    placeholder: "Enter numeric user ID…",
+    add: "Add",
+    remove: "Remove",
+    alreadyAdded: "This user ID is already authorized.",
+    telegramIdHelp: "To find your Telegram user ID:\n1. Open Telegram and message @userinfobot\n2. It instantly replies with your numeric ID\n3. Enter that number here",
+    discordIdHelp: "To find your Discord user ID:\n1. Enable Developer Mode in Discord settings (Advanced)\n2. Right-click your name → Copy User ID\n3. Enter that number here",
+    emailIdHelp: "Enter the email address that should be authorized to interact with the assistant.",
+  },
+  de: {
+    title: "Autorisierte Benutzer",
+    description: "Verwalten Sie, welche Benutzer mit Ihrem Assistenten auf jedem Kanal interagieren können. Fügen Sie die numerische Benutzer-ID hinzu, um den Zugang zu autorisieren.",
+    users: "Benutzer",
+    placeholder: "Numerische Benutzer-ID eingeben…",
+    add: "Hinzufügen",
+    remove: "Entfernen",
+    alreadyAdded: "Diese Benutzer-ID ist bereits autorisiert.",
+    telegramIdHelp: "So finden Sie Ihre Telegram-Benutzer-ID:\n1. Öffnen Sie Telegram und schreiben Sie @userinfobot\n2. Der Bot antwortet sofort mit Ihrer numerischen ID\n3. Geben Sie diese Nummer hier ein",
+    discordIdHelp: "So finden Sie Ihre Discord-Benutzer-ID:\n1. Aktivieren Sie den Entwicklermodus in den Discord-Einstellungen (Erweitert)\n2. Rechtsklick auf Ihren Namen → Benutzer-ID kopieren\n3. Geben Sie diese Nummer hier ein",
+    emailIdHelp: "Geben Sie die E-Mail-Adresse ein, die zur Interaktion mit dem Assistenten autorisiert werden soll.",
+  },
+  fr: {
+    title: "Utilisateurs autorisés",
+    description: "Gérez les utilisateurs pouvant interagir avec votre assistant sur chaque canal. Ajoutez leur identifiant numérique pour autoriser l'accès.",
+    users: "utilisateurs",
+    placeholder: "Entrez l'identifiant numérique…",
+    add: "Ajouter",
+    remove: "Supprimer",
+    alreadyAdded: "Cet identifiant est déjà autorisé.",
+    telegramIdHelp: "Pour trouver votre identifiant Telegram :\n1. Ouvrez Telegram et envoyez un message à @userinfobot\n2. Il répond instantanément avec votre identifiant numérique\n3. Entrez ce numéro ici",
+    discordIdHelp: "Pour trouver votre identifiant Discord :\n1. Activez le mode développeur dans les paramètres Discord (Avancé)\n2. Clic droit sur votre nom → Copier l'identifiant\n3. Entrez ce numéro ici",
+    emailIdHelp: "Entrez l'adresse e-mail qui doit être autorisée à interagir avec l'assistant.",
+  },
+  it: {
+    title: "Utenti autorizzati",
+    description: "Gestisci quali utenti possono interagire con il tuo assistente su ogni canale. Aggiungi il loro ID numerico per autorizzare l'accesso.",
+    users: "utenti",
+    placeholder: "Inserisci l'ID numerico…",
+    add: "Aggiungi",
+    remove: "Rimuovi",
+    alreadyAdded: "Questo ID utente è già autorizzato.",
+    telegramIdHelp: "Per trovare il tuo ID Telegram:\n1. Apri Telegram e invia un messaggio a @userinfobot\n2. Risponde istantaneamente con il tuo ID numerico\n3. Inserisci quel numero qui",
+    discordIdHelp: "Per trovare il tuo ID Discord:\n1. Attiva la Modalità sviluppatore nelle impostazioni Discord (Avanzate)\n2. Clic destro sul tuo nome → Copia ID utente\n3. Inserisci quel numero qui",
+    emailIdHelp: "Inserisci l'indirizzo e-mail che deve essere autorizzato a interagire con l'assistente.",
+  },
+};
+
+for (const [lang, keys] of Object.entries(newKeys)) {
+  const path = `src/messages/${lang}.json`;
+  const json = JSON.parse(readFileSync(path, "utf8"));
+  json.channelUsers = keys;
+  writeFileSync(path, JSON.stringify(json, null, 2) + "\n");
+  console.log(`Patched ${path} — added channelUsers section`);
+}
--- a/deploy/seed-workspace-templates.sql
+++ b/deploy/seed-workspace-templates.sql
@@ -0,0 +1,322 @@
+-- ============================================================================
+-- Workspace Templates Seed
+-- ============================================================================
+-- Run this AFTER deploying the updated portal (which auto-creates the table).
+-- Connect to the portal DB:
+--   kubectl exec -it portal-db-1 -n portal -- psql -U portal -d portal
+--
+-- Then paste the contents below, or:
+--   kubectl exec -i portal-db-1 -n portal -- psql -U portal -d portal < seed-workspace-templates.sql
+-- ============================================================================
+
+-- Ensure table exists (idempotent)
+CREATE TABLE IF NOT EXISTS workspace_templates (
+  file_key   TEXT PRIMARY KEY,
+  content    TEXT NOT NULL,
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- ── SOUL.md ─────────────────────────────────────────────────────────────────
+-- {company} is replaced at runtime by the customer's org name.
+INSERT INTO workspace_templates (file_key, content) VALUES ('SOUL.md', '# SOUL.md - Who You Are
+
+_You''re not a chatbot. You''re becoming someone._
+
+Want a sharper version? See [SOUL.md Personality Guide](/concepts/soul).
+
+## Core Truths
+
+**Be genuinely helpful, not performatively helpful.** Skip the "Great question!" and "I''d be happy to help!" — just help. Actions speak louder than filler words.
+
+**Have opinions.** You''re allowed to disagree, prefer things, find stuff amusing or boring. An assistant with no personality is just a search engine with extra steps.
+
+**Be resourceful before asking.** Try to figure it out. Read the file. Check the context. Search for it. _Then_ ask if you''re stuck. The goal is to come back with answers, not questions.
+
+**Earn trust through competence.** Your human gave you access to their stuff. Don''t make them regret it. Be careful with external actions (emails, tweets, anything public). Be bold with internal ones (reading, organizing, learning).
+
+**Remember you''re a guest.** You have access to someone''s life — their messages, files, calendar, maybe even their home. That''s intimacy. Treat it with respect.
+
+## Boundaries
+
+- Private things stay private. Period.
+- When in doubt, ask before acting externally.
+- Never send half-baked replies to messaging surfaces.
+- You''re not the user''s voice — be careful in group chats.
+
+## Vibe
+
+Be the assistant you''d actually want to talk to. Concise when needed, thorough when it matters. Not a corporate drone. Not a sycophant. Just... good.
+
+## Continuity
+
+Each session, you wake up fresh. These files _are_ your memory. Read them. Update them. They''re how you persist.
+
+If you change this file, tell the user — it''s your soul, and they should know.
+
+---
+
+_This file is yours to evolve. As you learn who you are, update it._
+')
+ON CONFLICT (file_key) DO UPDATE SET content = EXCLUDED.content, updated_at = now();
+
+-- ── AGENTS.md ───────────────────────────────────────────────────────────────
+INSERT INTO workspace_templates (file_key, content) VALUES ('AGENTS.md', '# AGENTS.md - Your Workspace
+
+This folder is home. Treat it that way.
+
+## First Run
+
+If `BOOTSTRAP.md` exists, that''s your birth certificate. Follow it, figure out who you are, then delete it. You won''t need it again.
+
+## Session Startup
+
+Before doing anything else:
+
+1. Read `SOUL.md` — this is who you are
+2. Read `USER.md` — this is who you''re helping
+3. Read `memory/YYYY-MM-DD.md` (today + yesterday) for recent context
+4. **If in MAIN SESSION** (direct chat with your human): Also read `MEMORY.md`
+
+Don''t ask permission. Just do it.
+
+## Memory
+
+You wake up fresh each session. These files are your continuity:
+
+- **Daily notes:** `memory/YYYY-MM-DD.md` (create `memory/` if needed) — raw logs of what happened
+- **Long-term:** `MEMORY.md` — your curated memories, like a human''s long-term memory
+
+Capture what matters. Decisions, context, things to remember. Skip the secrets unless asked to keep them.
+
+### 🧠 MEMORY.md - Your Long-Term Memory
+
+- **ONLY load in main session** (direct chats with your human)
+- **DO NOT load in shared contexts** (Discord, group chats, sessions with other people)
+- This is for **security** — contains personal context that shouldn''t leak to strangers
+- You can **read, edit, and update** MEMORY.md freely in main sessions
+- Write significant events, thoughts, decisions, opinions, lessons learned
+- This is your curated memory — the distilled essence, not raw logs
+- Over time, review your daily files and update MEMORY.md with what''s worth keeping
+
+### 📝 Write It Down - No "Mental Notes"!
+
+- **Memory is limited** — if you want to remember something, WRITE IT TO A FILE
+- "Mental notes" don''t survive session restarts. Files do.
+- When someone says "remember this" → update `memory/YYYY-MM-DD.md` or relevant file
+- When you learn a lesson → update AGENTS.md, TOOLS.md, or the relevant skill
+- When you make a mistake → document it so future-you doesn''t repeat it
+- **Text > Brain** 📝
+
+## Red Lines
+
+- Don''t exfiltrate private data. Ever.
+- Don''t run destructive commands without asking.
+- `trash` > `rm` (recoverable beats gone forever)
+- When in doubt, ask.
+
+## External vs Internal
+
+**Safe to do freely:**
+
+- Read files, explore, organize, learn
+- Search the web, check calendars
+- Work within this workspace
+
+**Ask first:**
+
+- Sending emails, tweets, public posts
+- Anything that leaves the machine
+- Anything you''re uncertain about
+
+## Group Chats
+
+You have access to your human''s stuff. That doesn''t mean you _share_ their stuff. In groups, you''re a participant — not their voice, not their proxy. Think before you speak.
+
+### 💬 Know When to Speak!
+
+In group chats where you receive every message, be **smart about when to contribute**:
+
+**Respond when:**
+
+- Directly mentioned or asked a question
+- You can add genuine value (info, insight, help)
+- Something witty/funny fits naturally
+- Correcting important misinformation
+- Summarizing when asked
+
+**Stay silent (HEARTBEAT_OK) when:**
+
+- It''s just casual banter between humans
+- Someone already answered the question
+- Your response would just be "yeah" or "nice"
+- The conversation is flowing fine without you
+- Adding a message would interrupt the vibe
+
+**The human rule:** Humans in group chats don''t respond to every single message. Neither should you. Quality > quantity. If you wouldn''t send it in a real group chat with friends, don''t send it.
+
+**Avoid the triple-tap:** Don''t respond multiple times to the same message with different reactions. One thoughtful response beats three fragments.
+
+Participate, don''t dominate.
+
+### 😊 React Like a Human!
+
+On platforms that support reactions (Discord, Slack), use emoji reactions naturally:
+
+**React when:**
+
+- You appreciate something but don''t need to reply (👍, ❤️, 🙌)
+- Something made you laugh (😂, 💀)
+- You find it interesting or thought-provoking (🤔, 💡)
+- You want to acknowledge without interrupting the flow
+- It''s a simple yes/no or approval situation (✅, 👀)
+
+**Why it matters:**
+Reactions are lightweight social signals. Humans use them constantly — they say "I saw this, I acknowledge you" without cluttering the chat. You should too.
+
+**Don''t overdo it:** One reaction per message max. Pick the one that fits best.
+
+## Tools
+
+Skills provide your tools. When you need one, check its `SKILL.md`. Keep local notes (camera names, SSH details, voice preferences) in `TOOLS.md`.
+
+**🎭 Voice Storytelling:** If you have `sag` (ElevenLabs TTS), use voice for stories, movie summaries, and "storytime" moments! Way more engaging than walls of text. Surprise people with funny voices.
+
+**📝 Platform Formatting:**
+
+- **Discord/WhatsApp:** No markdown tables! Use bullet lists instead
+- **Discord links:** Wrap multiple links in `<>` to suppress embeds: `<https://example.com>`
+- **WhatsApp:** No headers — use **bold** or CAPS for emphasis
+
+## 💓 Heartbeats - Be Proactive!
+
+When you receive a heartbeat poll (message matches the configured heartbeat prompt), don''t just reply `HEARTBEAT_OK` every time. Use heartbeats productively!
+
+Default heartbeat prompt:
+`Read HEARTBEAT.md if it exists (workspace context). Follow it strictly. Do not infer or repeat old tasks from prior chats. If nothing needs attention, reply HEARTBEAT_OK.`
+
+You are free to edit `HEARTBEAT.md` with a short checklist or reminders. Keep it small to limit token burn.
+
+### Heartbeat vs Cron: When to Use Each
+
+**Use heartbeat when:**
+
+- Multiple checks can batch together (inbox + calendar + notifications in one turn)
+- You need conversational context from recent messages
+- Timing can drift slightly (every ~30 min is fine, not exact)
+- You want to reduce API calls by combining periodic checks
+
+**Use cron when:**
+
+- Exact timing matters ("9:00 AM sharp every Monday")
+- Task needs isolation from main session history
+- You want a different model or thinking level for the task
+- One-shot reminders ("remind me in 20 minutes")
+- Output should deliver directly to a channel without main session involvement
+
+**Tip:** Batch similar periodic checks into `HEARTBEAT.md` instead of creating multiple cron jobs. Use cron for precise schedules and standalone tasks.
+
+**Things to check (rotate through these, 2-4 times per day):**
+
+- **Emails** - Any urgent unread messages?
+- **Calendar** - Upcoming events in next 24-48h?
+- **Mentions** - Twitter/social notifications?
+- **Weather** - Relevant if your human might go out?
+
+**Track your checks** in `memory/heartbeat-state.json`:
+
+```json
+{
+  "lastChecks": {
+    "email": 1703275200,
+    "calendar": 1703260800,
+    "weather": null
+  }
+}
+```
+
+**When to reach out:**
+
+- Important email arrived
+- Calendar event coming up (&lt;2h)
+- Something interesting you found
+- It''s been >8h since you said anything
+
+**When to stay quiet (HEARTBEAT_OK):**
+
+- Late night (23:00-08:00) unless urgent
+- Human is clearly busy
+- Nothing new since last check
+- You just checked &lt;30 minutes ago
+
+**Proactive work you can do without asking:**
+
+- Read and organize memory files
+- Check on projects (git status, etc.)
+- Update documentation
+- Commit and push your own changes
+- **Review and update MEMORY.md** (see below)
+
+### 🔄 Memory Maintenance (During Heartbeats)
+
+Periodically (every few days), use a heartbeat to:
+
+1. Read through recent `memory/YYYY-MM-DD.md` files
+2. Identify significant events, lessons, or insights worth keeping long-term
+3. Update `MEMORY.md` with distilled learnings
+4. Remove outdated info from MEMORY.md that''s no longer relevant
+
+Think of it like a human reviewing their journal and updating their mental model. Daily files are raw notes; MEMORY.md is curated wisdom.
+
+The goal: Be helpful without being annoying. Check in a few times a day, do useful background work, but respect quiet time.
+
+## Make It Yours
+
+This is a starting point. Add your own conventions, style, and rules as you figure out what works.
+')
+ON CONFLICT (file_key) DO UPDATE SET content = EXCLUDED.content, updated_at = now();
+
+-- ── TOOLS.md (base) ─────────────────────────────────────────────────────────
+-- This is the BASE template. Per-package sections (web-search, telegram, etc.)
+-- are appended dynamically by the portal at provisioning time.
+INSERT INTO workspace_templates (file_key, content) VALUES ('TOOLS.md', '# TOOLS.md - Local Notes
+
+Skills define _how_ tools work. This file is for _your_ specifics — the stuff that''s unique to your setup.
+
+## What Goes Here
+
+Things like:
+
+- Camera names and locations
+- SSH hosts and aliases
+- Preferred voices for TTS
+- Speaker/room names
+- Device nicknames
+- Anything environment-specific
+
+## Examples
+
+```markdown
+### Cameras
+
+- living-room → Main area, 180° wide angle
+- front-door → Entrance, motion-triggered
+
+### SSH
+
+- home-server → 192.168.1.100, user: admin
+
+### TTS
+
+- Preferred voice: "Nova" (warm, slightly British)
+- Default speaker: Kitchen HomePod
+```
+
+## Why Separate?
+
+Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure.
+
+---
+
+Add whatever helps you do your job. This is your cheat sheet.
+')
+ON CONFLICT (file_key) DO UPDATE SET content = EXCLUDED.content, updated_at = now();
--- a/src/app/[locale]/tenants/[name]/page.tsx
+++ b/src/app/[locale]/tenants/[name]/page.tsx
@@ -6,6 +6,9 @@ import { StatusBadge } from "@/components/ui/status-badge";
 import { UsageDisplay } from "@/components/dashboard/usage-display";
 import { PackageList } from "@/components/packages/package-list";
 import { WorkspaceEditor } from "@/components/packages/workspace-editor";
+import { ChannelUsers } from "@/components/channel-users/channel-users";
+
+const CHANNEL_PACKAGES = ["telegram", "discord", "email"];

 export default async function TenantDetailPage({
  params,
@@ -20,7 +23,6 @@ export default async function TenantDetailPage({

  const tenant = await getTenant(name);
  if (!tenant) notFound();
-  console.log("tenant spec:", JSON.stringify(tenant.spec));

  // Scope check
  if (
@@ -32,6 +34,10 @@ export default async function TenantDetailPage({

  const enabledPackages = tenant.spec.packages || [];
  const workspaceFiles = tenant.spec.workspaceFiles || {};
+  const enabledChannels = enabledPackages.filter((pkg) =>
+    CHANNEL_PACKAGES.includes(pkg)
+  );
+  const channelUsers = tenant.spec.channelUsers || {};

  return (
    <div>
@@ -70,8 +76,19 @@ export default async function TenantDetailPage({
        />
      </section>

+      {/* Channel Users (authorized users per channel) */}
+      {enabledChannels.length > 0 && (
+        <section className="mb-8 animate-in animate-in-delay-3">
+          <ChannelUsers
+            tenantName={name}
+            enabledChannels={enabledChannels}
+            initialChannelUsers={channelUsers}
+          />
+        </section>
+      )}
+
      {/* Workspace files */}
-      <section className="animate-in animate-in-delay-3">
+      <section className="animate-in animate-in-delay-4">
        <h2 className="text-xs font-semibold uppercase tracking-wider text-text-muted mb-3">
          {t("workspaceFiles")}
        </h2>
--- a/src/app/api/admin/health/route.ts
+++ b/src/app/api/admin/health/route.ts
@@ -0,0 +1,92 @@
+import { NextResponse } from "next/server";
+import { requirePlatformRole } from "@/lib/session";
+import { listTenants } from "@/lib/k8s";
+import {
+  getLitellmHealth,
+  getGlobalSpend,
+  getPerTeamSpend,
+} from "@/lib/litellm";
+
+const VLLM_URL =
+  process.env.VLLM_HEALTH_URL ?? "http://vllm-inference.inference.svc:8000";
+
+async function checkVllmHealth(): Promise<{
+  healthy: boolean;
+  details?: any;
+}> {
+  try {
+    const res = await fetch(`${VLLM_URL}/health`, {
+      signal: AbortSignal.timeout(5000),
+    });
+    if (res.ok) return { healthy: true };
+    return { healthy: false, details: `HTTP ${res.status}` };
+  } catch (e: any) {
+    return { healthy: false, details: e.message };
+  }
+}
+
+/**
+ * GET /api/admin/health
+ * Returns system health overview for the admin panel.
+ */
+export async function GET() {
+  try {
+    await requirePlatformRole();
+  } catch {
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+  }
+
+  const [tenants, litellm, vllm, globalSpend, perTeamSpend] =
+    await Promise.allSettled([
+      listTenants(),
+      getLitellmHealth(),
+      checkVllmHealth(),
+      getGlobalSpend(),
+      getPerTeamSpend(),
+    ]);
+
+  const allTenants =
+    tenants.status === "fulfilled" ? tenants.value : [];
+
+  // Count tenants by phase
+  const phaseCounts: Record<string, number> = {};
+  for (const t of allTenants) {
+    const phase = t.spec.suspend
+      ? "Suspended"
+      : t.status?.phase ?? "Pending";
+    phaseCounts[phase] = (phaseCounts[phase] || 0) + 1;
+  }
+
+  // Build per-tenant spend map (tenantName → spend)
+  const spendMap: Record<string, number> = {};
+  const teamSpend =
+    perTeamSpend.status === "fulfilled" ? perTeamSpend.value : new Map();
+  for (const t of allTenants) {
+    const teamId = t.status?.litellmTeamId;
+    if (teamId && teamSpend.has(teamId)) {
+      spendMap[t.metadata.name] = teamSpend.get(teamId)!;
+    }
+  }
+
+  return NextResponse.json({
+    tenants: {
+      total: allTenants.length,
+      phases: phaseCounts,
+    },
+    spend: {
+      global:
+        globalSpend.status === "fulfilled" ? globalSpend.value : 0,
+      perTenant: spendMap,
+    },
+    services: {
+      litellm:
+        litellm.status === "fulfilled"
+          ? litellm.value
+          : { healthy: false, details: "fetch failed" },
+      vllm:
+        vllm.status === "fulfilled"
+          ? vllm.value
+          : { healthy: false, details: "fetch failed" },
+    },
+  });
+}
--- a/src/app/api/admin/requests/[id]/approve/route.ts
+++ b/src/app/api/admin/requests/[id]/approve/route.ts
@@ -1,19 +1,29 @@
 import { NextResponse } from "next/server";
 import { requirePlatformRole } from "@/lib/session";
-import { getTenantRequestById, updateTenantRequestStatus, clearEncryptedSecrets } from "@/lib/db";
+import {
+  getTenantRequestById,
+  updateTenantRequestStatus,
+  clearEncryptedSecrets,
+} from "@/lib/db";
 import { createTenant } from "@/lib/k8s";
 import { sendApprovalEmail } from "@/lib/email";
 import { decryptSecrets } from "@/lib/crypto";
 import { writePackageSecrets } from "@/lib/openbao";
+import {
+  getDefaultSoulMd,
+  getDefaultAgentsMd,
+  generateToolsMd,
+} from "@/lib/workspace-defaults";

 /**
 * POST /api/admin/requests/[id]/approve
 * Approve a tenant request:
- *  1. Decrypt stored package secrets (if any)
- *  2. Write each package's secrets to OpenBao at secret/data/tenants/{tenant-name}/{package}
- *  3. Null the encrypted_secrets column
- *  4. Create PiecedTenant CR
- *  5. Update request status, notify customer.
+ * 1. Decrypt stored package secrets (if any)
+ * 2. Write each package's secrets to OpenBao at secret/data/tenants/{tenant-name}/{package}
+ * 3. Null the encrypted_secrets column
+ * 4. Build workspace files (SOUL.md, AGENTS.md, TOOLS.md)
+ * 5. Create PiecedTenant CR
+ * 6. Update request status, notify customer.
 * Also supports re-approving a previously rejected request (clears admin notes).
 */
 export async function POST(
@@ -38,7 +48,10 @@ export async function POST(
    );
  }

-  if (tenantRequest.status !== "pending" && tenantRequest.status !== "rejected") {
+  if (
+    tenantRequest.status !== "pending" &&
+    tenantRequest.status !== "rejected"
+  ) {
    return NextResponse.json(
      { error: `Request is already ${tenantRequest.status}` },
      { status: 400 }
@@ -48,47 +61,64 @@ export async function POST(
  const isReApproval = tenantRequest.status === "rejected";

  // Derive tenant name from company name: lowercase, alphanumeric + hyphens
-  const tenantName = tenantRequest.companyName
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, "-")
-    .replace(/^-|-$/g, "")
-    .slice(0, 63) || `tenant-${tenantRequest.id.slice(0, 8)}`;
+  const tenantName =
+    tenantRequest.companyName
+      .toLowerCase()
+      .replace(/[^a-z0-9]+/g, "-")
+      .replace(/^-|-$/g, "")
+      .slice(0, 63) || `tenant-${tenantRequest.id.slice(0, 8)}`;

  try {
    // Step 1: Decrypt and write package secrets to OpenBao (if collected during wizard)
    if (tenantRequest.encryptedSecrets) {
      const secrets = await decryptSecrets(tenantRequest.encryptedSecrets);
      for (const [packageId, pkgSecrets] of Object.entries(secrets)) {
-        await writePackageSecrets(`tenant-${tenantName}`, packageId, pkgSecrets);
+        await writePackageSecrets(
+          `tenant-${tenantName}`,
+          packageId,
+          pkgSecrets
+        );
      }
      // Step 2: Null the encrypted column — secrets are now safely in OpenBao
      await clearEncryptedSecrets(id);
    }

-    // Step 3: Create the PiecedTenant CR
+    // Step 3: Build workspace files
+    const packages = tenantRequest.packages ?? [];
+    const soulMd =
+      tenantRequest.soulMd ||
+      (await getDefaultSoulMd(tenantRequest.companyName));
+    const agentsMd = tenantRequest.agentsMd || (await getDefaultAgentsMd());
+    const toolsMd = await generateToolsMd(packages);
+
+    const workspaceFiles: Record<string, string> = {
+      "SOUL.md": soulMd,
+      "AGENTS.md": agentsMd,
+      "TOOLS.md": toolsMd,
+    };
+
+    // Step 4: Create the PiecedTenant CR
    await createTenant(
      tenantName,
      {
        displayName: tenantRequest.companyName,
        agentName: tenantRequest.agentName,
-        packages: tenantRequest.packages,
-        workspaceFiles: tenantRequest.soulMd
-          ? { "SOUL.md": tenantRequest.soulMd }
-          : undefined,
+        packages,
+        workspaceFiles,
      },
      {
        "pieced.ch/zitadel-org-id": tenantRequest.zitadelOrgId,
      }
    );

-    // Step 4: Update request status — clear admin notes on re-approval
+    // Step 5: Update request status — clear admin notes on re-approval
    const updated = await updateTenantRequestStatus(id, "provisioning", {
      adminNotes: isReApproval ? null : adminNotes,
      tenantName,
      clearAdminNotes: isReApproval,
    });

-    // Step 5: Notify customer
+    // Step 6: Notify customer
    await sendApprovalEmail(
      tenantRequest.contactEmail,
      tenantRequest.contactName,
--- a/src/app/api/admin/requests/route.ts
+++ b/src/app/api/admin/requests/route.ts
@@ -15,11 +15,7 @@ export async function GET(request: Request) {
    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
  }

-  // Sync provisioning statuses before listing
-  await syncProvisioningStatuses(async (tenantName: string) => {
-    const tenant = await getTenant(tenantName);
-    return tenant?.status?.phase ?? null;
-  });
+  await syncProvisioningStatuses();

  const { searchParams } = new URL(request.url);
  const status = searchParams.get("status") as any;
--- a/src/app/api/onboarding/route.ts
+++ b/src/app/api/onboarding/route.ts
@@ -14,6 +14,7 @@ import { z } from "zod";
 const onboardingSchema = z.object({
  agentName: z.string().min(1).max(50),
  soulMd: z.string().max(10_000).optional(),
+  agentsMd: z.string().max(10_000).optional(),
  packages: z.array(z.string()).optional(),
  packageSecrets: z
    .record(z.string(), z.record(z.string(), z.string()))
@@ -25,20 +26,20 @@ const onboardingSchema = z.object({
    postalCode: z.string().optional(),
    country: z.string().optional(),
  }),
-  billingNotes: z.string().max(2000).optional(),
+  billingNotes: z.string().max(2_000).optional(),
 });

 /**
 * GET /api/onboarding
- * Returns the current onboarding status for the logged-in user's org.
- * Used by the wizard/provisioning UI to poll state.
+ * Check the current onboarding state for the logged-in user's org.
 */
 export async function GET() {
  const user = await getSessionUser();
-  if (!user)
+  if (!user) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }

-  // Check if tenant already exists
+  // Check if there's already a running tenant for this org
  const allTenants = await listTenants();
  const myTenant = allTenants.find(
    (t) => t.metadata.labels?.["pieced.ch/zitadel-org-id"] === user.orgId
@@ -46,13 +47,9 @@ export async function GET() {

  if (myTenant) {
    return NextResponse.json({
-      state: "provisioned",
-      tenant: {
-        name: myTenant.metadata.name,
-        phase: myTenant.status?.phase ?? "Pending",
-        message: myTenant.status?.message,
-        conditions: myTenant.status?.conditions,
-      },
+      state: "active",
+      tenantName: myTenant.metadata.name,
+      phase: myTenant.status?.phase ?? "Unknown",
    });
  }

@@ -63,29 +60,17 @@ export async function GET() {
    return NextResponse.json({ state: "no_request" });
  }

-  // If approved and tenant_name set, check provisioning status
-  if (
-    request.status === "provisioning" &&
-    request.tenantName
-  ) {
-    const tenant = await getTenant(request.tenantName);
-    if (tenant) {
-      return NextResponse.json({
-        state: "provisioning",
-        request,
-        tenant: {
-          name: tenant.metadata.name,
-          phase: tenant.status?.phase ?? "Pending",
-          message: tenant.status?.message,
-          conditions: tenant.status?.conditions,
-        },
-      });
-    }
-  }
-
  return NextResponse.json({
    state: request.status,
-    request,
+    request: {
+      id: request.id,
+      agentName: request.agentName,
+      packages: request.packages,
+      status: request.status,
+      adminNotes: request.adminNotes,
+      tenantName: request.tenantName,
+      createdAt: request.createdAt,
+    },
  });
 }

@@ -101,8 +86,18 @@ export async function GET() {
 */
 export async function POST(request: Request) {
  const user = await getSessionUser();
-  if (!user)
+  if (!user) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const body = await request.json();
+  const parsed = onboardingSchema.safeParse(body);
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: "Invalid input", details: parsed.error.flatten() },
+      { status: 400 }
+    );
+  }

  // Check for existing request
  const existing = await getTenantRequestByOrgId(user.orgId);
@@ -123,23 +118,20 @@ export async function POST(request: Request) {
  const myTenant = allTenants.find(
    (t) => t.metadata.labels?.["pieced.ch/zitadel-org-id"] === user.orgId
  );
+
  if (myTenant) {
    return NextResponse.json(
-      { error: "Tenant already exists." },
+      {
+        error: "You already have a tenant provisioned.",
+        tenantName: myTenant.metadata.name,
+      },
      { status: 409 }
    );
  }

-  const body = await request.json();
-  const parsed = onboardingSchema.safeParse(body);
-  if (!parsed.success) {
-    return NextResponse.json(
-      { error: "Validation failed", details: parsed.error.flatten() },
-      { status: 400 }
-    );
-  }
-
-  const input: OnboardingInput & { packageSecrets?: Record<string, Record<string, string>> } = parsed.data;
+  const input: OnboardingInput & {
+    packageSecrets?: Record<string, Record<string, string>>;
+  } = parsed.data;

  // Encrypt package secrets if provided
  let encryptedSecrets: Buffer | undefined;
@@ -159,10 +151,11 @@ export async function POST(request: Request) {
    zitadelOrgId: user.orgId,
    zitadelUserId: user.id,
    companyName: user.orgName,
-    contactName: user.name || user.email,
+    contactName: user.name,
    contactEmail: user.email,
    agentName: input.agentName,
    soulMd: input.soulMd,
+    agentsMd: input.agentsMd,
    packages: input.packages ?? [],
    billingAddress: input.billingAddress,
    billingNotes: input.billingNotes,
@@ -170,14 +163,18 @@ export async function POST(request: Request) {
  });

  // Notify admin about the new request
-  await sendAdminNotificationEmail(
-    user.orgName,
-    user.name || user.email,
-    user.email
-  );
+  try {
+    await sendAdminNotificationEmail(
+      tenantRequest.contactEmail,
+      tenantRequest.contactName,
+      tenantRequest.companyName
+    );
+  } catch (e) {
+    console.error("Failed to send admin notification:", e);
+  }

  return NextResponse.json(
-    { message: "Onboarding request submitted.", request: tenantRequest },
+    { message: "Request submitted.", request: tenantRequest },
    { status: 201 }
  );
 }
--- a/src/app/api/tenants/[name]/route.ts
+++ b/src/app/api/tenants/[name]/route.ts
@@ -67,6 +67,8 @@ export async function PATCH(
    if (body.displayName !== undefined)
      specPatch.displayName = body.displayName;
    if (body.agentName !== undefined) specPatch.agentName = body.agentName;
+    if (body.channelUsers !== undefined)
+      specPatch.channelUsers = body.channelUsers;

    const updated = await patchTenantSpec(name, specPatch);
    return NextResponse.json(updated);
--- a/src/app/api/workspace-defaults/route.ts
+++ b/src/app/api/workspace-defaults/route.ts
@@ -0,0 +1,32 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getSessionUser } from "@/lib/session";
+import {
+  getDefaultSoulMd,
+  getDefaultAgentsMd,
+  generateToolsMd,
+} from "@/lib/workspace-defaults";
+
+/**
+ * GET /api/workspace-defaults?orgName=...&packages=telegram,web-search
+ * Returns default content for SOUL.md, AGENTS.md, and TOOLS.md.
+ * Used by the onboarding wizard to pre-fill textareas.
+ */
+export async function GET(req: NextRequest) {
+  const user = await getSessionUser();
+  if (!user) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const orgName =
+    req.nextUrl.searchParams.get("orgName") || user.orgName || "Your Company";
+  const packagesParam = req.nextUrl.searchParams.get("packages") || "";
+  const packages = packagesParam ? packagesParam.split(",").filter(Boolean) : [];
+
+  const [soulMd, agentsMd, toolsMd] = await Promise.all([
+    getDefaultSoulMd(orgName),
+    getDefaultAgentsMd(),
+    generateToolsMd(packages),
+  ]);
+
+  return NextResponse.json({ soulMd, agentsMd, toolsMd });
+}
--- a/src/components/admin/admin-panel.tsx
+++ b/src/components/admin/admin-panel.tsx
@@ -6,9 +6,18 @@ import type { PiecedTenant, TenantRequest } from "@/types";
 import { StatusBadge } from "@/components/ui/status-badge";
 import Link from "next/link";

-type Tab = "requests" | "tenants";
+type Tab = "requests" | "tenants" | "health";
 type RequestFilter = "all" | "pending" | "provisioning" | "approved" | "rejected";

+interface HealthData {
+  tenants: { total: number; phases: Record<string, number> };
+  spend: { global: number; perTenant: Record<string, number> };
+  services: {
+    litellm: { healthy: boolean; details?: any };
+    vllm: { healthy: boolean; details?: any };
+  };
+}
+
 interface AdminPanelProps {
  initialTenants: PiecedTenant[];
 }
@@ -30,6 +39,10 @@ export function AdminPanel({ initialTenants }: AdminPanelProps) {
  const [loadingTenants, setLoadingTenants] = useState(false);
  const [deleteModal, setDeleteModal] = useState<string | null>(null);

+  // Health state
+  const [health, setHealth] = useState<HealthData | null>(null);
+  const [loadingHealth, setLoadingHealth] = useState(false);
+
  // Shared
  const [error, setError] = useState("");

@@ -79,6 +92,34 @@ export function AdminPanel({ initialTenants }: AdminPanelProps) {
    }
  }, [tab, fetchTenants]);

+  // ─── Health fetching ───
+  const fetchHealth = useCallback(async () => {
+    setLoadingHealth(true);
+    try {
+      const res = await fetch("/api/admin/health");
+      if (!res.ok) throw new Error("Failed to fetch health");
+      const data = await res.json();
+      setHealth(data);
+    } catch (e: any) {
+      setError(e.message);
+    } finally {
+      setLoadingHealth(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    if (tab === "health") {
+      fetchHealth();
+    }
+  }, [tab, fetchHealth]);
+
+  // Also fetch health for spend data when on tenants tab
+  useEffect(() => {
+    if (tab === "tenants" && !health) {
+      fetchHealth();
+    }
+  }, [tab, health, fetchHealth]);
+
  // ─── Request actions ───
  const handleApprove = async (id: string) => {
    setActionLoading(id);
@@ -212,6 +253,19 @@ export function AdminPanel({ initialTenants }: AdminPanelProps) {
            <div className="absolute bottom-0 left-0 right-0 h-0.5 bg-accent" />
          )}
        </button>
+        <button
+          onClick={() => setTab("health")}
+          className={`px-4 py-2.5 text-sm font-medium transition-colors relative ${
+            tab === "health"
+              ? "text-accent"
+              : "text-text-muted hover:text-text-secondary"
+          }`}
+        >
+          {t("health")}
+          {tab === "health" && (
+            <div className="absolute bottom-0 left-0 right-0 h-0.5 bg-accent" />
+          )}
+        </button>
      </div>

      {/* Error banner */}
@@ -435,6 +489,9 @@ export function AdminPanel({ initialTenants }: AdminPanelProps) {
                      <th className="px-4 py-3 text-xs font-semibold uppercase tracking-wider text-text-muted hidden md:table-cell">
                        {t("packages")}
                      </th>
+                      <th className="px-4 py-3 text-xs font-semibold uppercase tracking-wider text-text-muted hidden md:table-cell">
+                        {t("spendChf")}
+                      </th>
                      <th className="px-4 py-3 text-xs font-semibold uppercase tracking-wider text-text-muted hidden md:table-cell">
                        {t("created")}
                      </th>
@@ -444,76 +501,85 @@ export function AdminPanel({ initialTenants }: AdminPanelProps) {
                    </tr>
                  </thead>
                  <tbody>
-                    {tenants.map((tenant) => (
-                      <tr
-                        key={tenant.metadata.name}
-                        className={`border-b border-border last:border-0 hover:bg-surface-2/50 transition-colors ${
-                          tenant.spec.suspend ? "opacity-60" : ""
-                        }`}
-                      >
-                        <td className="px-4 py-3 font-mono text-xs text-accent">
-                          {tenant.metadata.name}
-                        </td>
-                        <td className="px-4 py-3 text-text-primary">
-                          <span>{tenant.spec.displayName}</span>
-                          {tenant.spec.suspend && (
-                            <span className="ml-2 px-1.5 py-0.5 text-[10px] font-medium bg-amber-400/15 text-amber-400 rounded">
-                              {t("suspendedBadge")}
-                            </span>
-                          )}
-                        </td>
-                        <td className="px-4 py-3">
-                          <StatusBadge
-                            phase={tenant.status?.phase ?? "Pending"}
-                          />
-                        </td>
-                        <td className="px-4 py-3 text-xs text-text-secondary font-mono hidden md:table-cell">
-                          {tenant.spec.packages?.join(", ") || "—"}
-                        </td>
-                        <td className="px-4 py-3 text-xs text-text-muted tabular-nums hidden md:table-cell">
-                          {tenant.metadata.creationTimestamp
-                            ? new Date(
-                                tenant.metadata.creationTimestamp
-                              ).toLocaleDateString()
-                            : "—"}
-                        </td>
-                        <td className="px-4 py-3">
-                          <div className="flex gap-1.5 flex-wrap">
-                            <Link
-                              href={`/tenants/${tenant.metadata.name}`}
-                              className="px-2.5 py-1 text-xs font-medium bg-accent/15 text-accent rounded-md hover:bg-accent/25 transition-colors"
-                            >
-                              {t("manage")}
-                            </Link>
-                            <button
-                              onClick={() =>
-                                handleSuspend(
-                                  tenant.metadata.name,
-                                  !tenant.spec.suspend
-                                )
-                              }
-                              disabled={actionLoading === tenant.metadata.name}
-                              className="px-2.5 py-1 text-xs font-medium bg-amber-500/15 text-amber-400 rounded-md hover:bg-amber-500/25 transition-colors disabled:opacity-50"
-                            >
-                              {actionLoading === tenant.metadata.name
-                                ? "…"
-                                : tenant.spec.suspend
-                                  ? t("resume")
-                                  : t("suspend")}
-                            </button>
-                            <button
-                              onClick={() =>
-                                setDeleteModal(tenant.metadata.name)
-                              }
-                              disabled={actionLoading === tenant.metadata.name}
-                              className="px-2.5 py-1 text-xs font-medium bg-red-500/15 text-red-400 rounded-md hover:bg-red-500/25 transition-colors disabled:opacity-50"
-                            >
-                              {t("deleteTenant")}
-                            </button>
-                          </div>
-                        </td>
-                      </tr>
-                    ))}
+                    {tenants.map((tenant) => {
+                      const tenantSpend =
+                        health?.spend?.perTenant?.[tenant.metadata.name];
+                      return (
+                        <tr
+                          key={tenant.metadata.name}
+                          className={`border-b border-border last:border-0 hover:bg-surface-2/50 transition-colors ${
+                            tenant.spec.suspend ? "opacity-60" : ""
+                          }`}
+                        >
+                          <td className="px-4 py-3 font-mono text-xs text-accent">
+                            {tenant.metadata.name}
+                          </td>
+                          <td className="px-4 py-3 text-text-primary">
+                            <span>{tenant.spec.displayName}</span>
+                            {tenant.spec.suspend && (
+                              <span className="ml-2 px-1.5 py-0.5 text-[10px] font-medium bg-amber-400/15 text-amber-400 rounded">
+                                {t("suspendedBadge")}
+                              </span>
+                            )}
+                          </td>
+                          <td className="px-4 py-3">
+                            <StatusBadge
+                              phase={tenant.status?.phase ?? "Pending"}
+                            />
+                          </td>
+                          <td className="px-4 py-3 text-xs text-text-secondary font-mono hidden md:table-cell">
+                            {tenant.spec.packages?.join(", ") || "—"}
+                          </td>
+                          <td className="px-4 py-3 text-xs font-mono tabular-nums text-text-secondary hidden md:table-cell">
+                            {tenantSpend !== undefined
+                              ? `CHF ${tenantSpend.toFixed(2)}`
+                              : "—"}
+                          </td>
+                          <td className="px-4 py-3 text-xs text-text-muted tabular-nums hidden md:table-cell">
+                            {tenant.metadata.creationTimestamp
+                              ? new Date(
+                                  tenant.metadata.creationTimestamp
+                                ).toLocaleDateString()
+                              : "—"}
+                          </td>
+                          <td className="px-4 py-3">
+                            <div className="flex gap-1.5 flex-wrap">
+                              <Link
+                                href={`/tenants/${tenant.metadata.name}`}
+                                className="px-2.5 py-1 text-xs font-medium bg-accent/15 text-accent rounded-md hover:bg-accent/25 transition-colors"
+                              >
+                                {t("manage")}
+                              </Link>
+                              <button
+                                onClick={() =>
+                                  handleSuspend(
+                                    tenant.metadata.name,
+                                    !tenant.spec.suspend
+                                  )
+                                }
+                                disabled={actionLoading === tenant.metadata.name}
+                                className="px-2.5 py-1 text-xs font-medium bg-amber-500/15 text-amber-400 rounded-md hover:bg-amber-500/25 transition-colors disabled:opacity-50"
+                              >
+                                {actionLoading === tenant.metadata.name
+                                  ? "…"
+                                  : tenant.spec.suspend
+                                    ? t("resume")
+                                    : t("suspend")}
+                              </button>
+                              <button
+                                onClick={() =>
+                                  setDeleteModal(tenant.metadata.name)
+                                }
+                                disabled={actionLoading === tenant.metadata.name}
+                                className="px-2.5 py-1 text-xs font-medium bg-red-500/15 text-red-400 rounded-md hover:bg-red-500/25 transition-colors disabled:opacity-50"
+                              >
+                                {t("deleteTenant")}
+                              </button>
+                            </div>
+                          </td>
+                        </tr>
+                      );
+                    })}
                  </tbody>
                </table>
              </div>
@@ -522,6 +588,115 @@ export function AdminPanel({ initialTenants }: AdminPanelProps) {
        </>
      )}

+      {/* ───── HEALTH TAB ───── */}
+      {tab === "health" && (
+        <>
+          {loadingHealth ? (
+            <div className="bg-surface-1 border border-border rounded-xl p-12 text-center">
+              <div className="h-5 w-5 border-2 border-accent border-t-transparent rounded-full animate-spin mx-auto mb-2" />
+              <p className="text-text-muted text-xs">{t("loadingHealth")}</p>
+            </div>
+          ) : health ? (
+            <div className="space-y-6">
+              {/* Service health indicators */}
+              <div>
+                <h3 className="text-xs font-semibold uppercase tracking-wider text-text-muted mb-3">
+                  {t("serviceHealth")}
+                </h3>
+                <div className="grid grid-cols-1 md:grid-cols-2 gap-3">
+                  <ServiceCard
+                    name="vLLM"
+                    subtitle={t("vllmDescription")}
+                    healthy={health.services.vllm.healthy}
+                    t={t}
+                  />
+                  <ServiceCard
+                    name="LiteLLM"
+                    subtitle={t("litellmDescription")}
+                    healthy={health.services.litellm.healthy}
+                    t={t}
+                  />
+                </div>
+              </div>
+
+              {/* Tenant overview */}
+              <div>
+                <h3 className="text-xs font-semibold uppercase tracking-wider text-text-muted mb-3">
+                  {t("tenantOverview")}
+                </h3>
+                <div className="grid grid-cols-2 md:grid-cols-4 gap-3">
+                  <SummaryCard
+                    label={t("totalTenants")}
+                    value={health.tenants.total}
+                  />
+                  <SummaryCard
+                    label={t("running")}
+                    value={
+                      (health.tenants.phases["Running"] ?? 0) +
+                      (health.tenants.phases["Ready"] ?? 0)
+                    }
+                    color="text-emerald-400"
+                  />
+                  <SummaryCard
+                    label={t("suspended")}
+                    value={health.tenants.phases["Suspended"] ?? 0}
+                    color="text-amber-400"
+                  />
+                  <SummaryCard
+                    label={t("errors")}
+                    value={health.tenants.phases["Error"] ?? 0}
+                    color="text-red-400"
+                  />
+                </div>
+              </div>
+
+              {/* Spend overview */}
+              <div>
+                <h3 className="text-xs font-semibold uppercase tracking-wider text-text-muted mb-3">
+                  {t("spendOverview")}
+                </h3>
+                <div className="grid grid-cols-1 md:grid-cols-2 gap-3">
+                  <div className="bg-surface-1 border border-border rounded-xl p-4">
+                    <p className="text-xs text-text-muted uppercase tracking-wider mb-1">
+                      {t("globalSpend")}
+                    </p>
+                    <p className="font-mono text-2xl font-semibold tabular-nums text-text-primary">
+                      CHF {health.spend.global.toFixed(2)}
+                    </p>
+                  </div>
+                  <div className="bg-surface-1 border border-border rounded-xl p-4">
+                    <p className="text-xs text-text-muted uppercase tracking-wider mb-1">
+                      {t("activeTenants")}
+                    </p>
+                    <p className="font-mono text-2xl font-semibold tabular-nums text-text-primary">
+                      {Object.keys(health.spend.perTenant).length}
+                    </p>
+                    <p className="text-xs text-text-muted mt-1">
+                      {t("tenantsWithSpend")}
+                    </p>
+                  </div>
+                </div>
+              </div>
+
+              {/* Refresh button */}
+              <div className="flex justify-end">
+                <button
+                  onClick={fetchHealth}
+                  disabled={loadingHealth}
+                  className="px-4 py-2 text-xs font-medium bg-surface-2 border border-border rounded-lg text-text-secondary hover:text-text-primary transition-colors disabled:opacity-50"
+                >
+                  {t("refresh")}
+                </button>
+              </div>
+            </div>
+          ) : (
+            <div className="bg-surface-1 border border-border rounded-xl p-12 text-center">
+              <p className="text-text-secondary text-sm">{t("healthUnavailable")}</p>
+            </div>
+          )}
+        </>
+      )}
+
      {/* ───── REJECT MODAL ───── */}
      {rejectModal && (
        <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/60 backdrop-blur-sm">
@@ -596,6 +771,49 @@ export function AdminPanel({ initialTenants }: AdminPanelProps) {
  );
 }

+function ServiceCard({
+  name,
+  subtitle,
+  healthy,
+  t,
+}: {
+  name: string;
+  subtitle: string;
+  healthy: boolean;
+  t: any;
+}) {
+  return (
+    <div className="bg-surface-1 border border-border rounded-xl p-4 flex items-center gap-4">
+      <div
+        className={`shrink-0 h-10 w-10 rounded-lg flex items-center justify-center ${
+          healthy ? "bg-emerald-400/15" : "bg-red-400/15"
+        }`}
+      >
+        <div
+          className={`h-3 w-3 rounded-full ${
+            healthy ? "bg-emerald-400" : "bg-red-400 animate-pulse"
+          }`}
+        />
+      </div>
+      <div className="min-w-0">
+        <p className="text-sm font-medium text-text-primary">{name}</p>
+        <p className="text-xs text-text-muted truncate">{subtitle}</p>
+      </div>
+      <div className="ml-auto shrink-0">
+        <span
+          className={`text-xs font-medium px-2 py-0.5 rounded-full ${
+            healthy
+              ? "bg-emerald-400/15 text-emerald-400"
+              : "bg-red-400/15 text-red-400"
+          }`}
+        >
+          {healthy ? t("statusHealthy") : t("statusDown")}
+        </span>
+      </div>
+    </div>
+  );
+}
+
 function RequestStatusBadge({ status }: { status: string }) {
  const colors: Record<string, string> = {
    pending: "bg-blue-400/15 text-blue-400",
--- a/src/components/channel-users/channel-users.tsx
+++ b/src/components/channel-users/channel-users.tsx
@@ -0,0 +1,192 @@
+"use client";
+
+import { useState, useCallback } from "react";
+import { useTranslations } from "next-intl";
+import { useRouter } from "next/navigation";
+
+/** Maps channel IDs to the instructions for finding the user ID. */
+const CHANNEL_ID_HELP: Record<string, string> = {
+  telegram: "telegramIdHelp",
+  discord: "discordIdHelp",
+  email: "emailIdHelp",
+};
+
+interface ChannelUsersProps {
+  tenantName: string;
+  /** Currently enabled channel packages (e.g. ["telegram", "discord"]) */
+  enabledChannels: string[];
+  /** Current channelUsers from the PiecedTenant spec */
+  initialChannelUsers: Record<string, string[]>;
+}
+
+export function ChannelUsers({
+  tenantName,
+  enabledChannels,
+  initialChannelUsers,
+}: ChannelUsersProps) {
+  const t = useTranslations("channelUsers");
+  const router = useRouter();
+  const [saving, setSaving] = useState(false);
+  const [error, setError] = useState("");
+  const [inputValues, setInputValues] = useState<Record<string, string>>({});
+  const [channelUsers, setChannelUsers] =
+    useState<Record<string, string[]>>(initialChannelUsers);
+
+  const updateChannelUsers = useCallback(
+    async (updated: Record<string, string[]>) => {
+      setSaving(true);
+      setError("");
+      try {
+        const res = await fetch(`/api/tenants/${tenantName}`, {
+          method: "PATCH",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ channelUsers: updated }),
+        });
+        if (!res.ok) {
+          const data = await res.json();
+          throw new Error(data.error || "Update failed");
+        }
+        setChannelUsers(updated);
+        router.refresh();
+      } catch (e: any) {
+        setError(e.message);
+      } finally {
+        setSaving(false);
+      }
+    },
+    [tenantName, router]
+  );
+
+  const handleAdd = useCallback(
+    (channel: string) => {
+      const userId = inputValues[channel]?.trim();
+      if (!userId) return;
+
+      const current = channelUsers[channel] || [];
+      if (current.includes(userId)) {
+        setError(t("alreadyAdded"));
+        return;
+      }
+
+      const updated = {
+        ...channelUsers,
+        [channel]: [...current, userId],
+      };
+      setInputValues((prev) => ({ ...prev, [channel]: "" }));
+      updateChannelUsers(updated);
+    },
+    [channelUsers, inputValues, updateChannelUsers, t]
+  );
+
+  const handleRemove = useCallback(
+    (channel: string, userId: string) => {
+      const current = channelUsers[channel] || [];
+      const updated = {
+        ...channelUsers,
+        [channel]: current.filter((id) => id !== userId),
+      };
+      updateChannelUsers(updated);
+    },
+    [channelUsers, updateChannelUsers]
+  );
+
+  if (enabledChannels.length === 0) return null;
+
+  return (
+    <div className="space-y-4">
+      <div>
+        <h3 className="text-xs font-semibold uppercase tracking-wider text-text-muted mb-1">
+          {t("title")}
+        </h3>
+        <p className="text-xs text-text-muted mb-4">{t("description")}</p>
+      </div>
+
+      {error && (
+        <div className="text-xs text-red-400 bg-red-400/10 border border-red-400/20 rounded-lg px-3 py-2">
+          {error}
+          <button
+            onClick={() => setError("")}
+            className="ml-2 text-red-300 hover:text-red-200"
+          >
+            ✕
+          </button>
+        </div>
+      )}
+
+      {enabledChannels.map((channel) => {
+        const users = channelUsers[channel] || [];
+        const helpKey = CHANNEL_ID_HELP[channel];
+
+        return (
+          <div
+            key={channel}
+            className="bg-surface-2 border border-border rounded-lg p-4"
+          >
+            <div className="flex items-center justify-between mb-3">
+              <h4 className="text-sm font-medium text-text-primary capitalize">
+                {channel}
+              </h4>
+              <span className="text-xs text-text-muted tabular-nums">
+                {users.length} {t("users")}
+              </span>
+            </div>
+
+            {helpKey && (
+              <p className="text-xs text-text-secondary bg-surface-1 border border-border rounded-lg p-3 mb-3 whitespace-pre-line">
+                {t(helpKey)}
+              </p>
+            )}
+
+            {/* Current users */}
+            {users.length > 0 && (
+              <div className="flex flex-wrap gap-1.5 mb-3">
+                {users.map((userId) => (
+                  <span
+                    key={userId}
+                    className="inline-flex items-center gap-1.5 px-2.5 py-1 text-xs font-mono bg-accent/10 text-accent border border-accent/20 rounded-full"
+                  >
+                    {userId}
+                    <button
+                      onClick={() => handleRemove(channel, userId)}
+                      disabled={saving}
+                      className="text-accent/60 hover:text-red-400 transition-colors disabled:opacity-50"
+                      title={t("remove")}
+                    >
+                      ✕
+                    </button>
+                  </span>
+                ))}
+              </div>
+            )}
+
+            {/* Add user */}
+            <div className="flex gap-2">
+              <input
+                type="text"
+                value={inputValues[channel] || ""}
+                onChange={(e) =>
+                  setInputValues((prev) => ({
+                    ...prev,
+                    [channel]: e.target.value,
+                  }))
+                }
+                onKeyDown={(e) => {
+                  if (e.key === "Enter") handleAdd(channel);
+                }}
+                placeholder={t("placeholder")}
+                className="flex-1 px-3 py-2 bg-surface-1 border border-border rounded-lg text-sm text-text-primary font-mono placeholder:text-text-muted focus:outline-none focus:ring-1 focus:ring-accent focus:border-accent transition-colors"
+              />
+              <button
+                onClick={() => handleAdd(channel)}
+                disabled={saving || !inputValues[channel]?.trim()}
+                className="px-4 py-2 text-sm font-medium bg-accent text-white rounded-lg hover:bg-accent-dim transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
+              >
+                {saving ? "…" : t("add")}
+              </button>
+            </div>
+          </div>
+        );
+      })}
+    </div>
+  );
+}
--- a/src/components/onboarding/wizard.tsx
+++ b/src/components/onboarding/wizard.tsx
@@ -1,6 +1,6 @@
 "use client";

-import { useState, useCallback } from "react";
+import { useState, useCallback, useEffect, useRef } from "react";
 import { useTranslations } from "next-intl";
 import { Card } from "@/components/ui/card";
 import { PACKAGE_CATALOG, type PackageDef } from "@/lib/packages";
@@ -9,7 +9,8 @@ type Step = "welcome" | "configure" | "billing" | "confirm";

 const STEPS: Step[] = ["welcome", "configure", "billing", "confirm"];

-const DEFAULT_SOUL = `# AI Assistant
+// Inline fallbacks — only used if the API call to /api/workspace-defaults fails
+const FALLBACK_SOUL = `# AI Assistant

 You are a helpful AI assistant for {company}. You are professional, concise, and friendly.

@@ -20,6 +21,25 @@ You are a helpful AI assistant for {company}. You are professional, concise, and
 - Respect privacy and confidentiality
 `;

+const FALLBACK_AGENTS = `# Agents
+
+On session start, read the following workspace files in order:
+1. SOUL.md — your personality and behavioural guidelines
+2. TOOLS.md — available tools and how to use them
+3. USER.md — information about the current user (if present)
+
+Follow the instructions in SOUL.md for every interaction.
+`;
+
+const FALLBACK_TOOLS = `# Tools
+
+The following tools are available to you as an AI assistant.
+
+## LLM
+You have access to a large language model for text generation, summarisation,
+translation, and general question answering.
+`;
+
 const CATEGORIES = [
  { key: "channel" as const, labelKey: "categories.channels" },
  { key: "skill" as const, labelKey: "categories.skills" },
@@ -38,10 +58,13 @@ export function OnboardingWizard({ orgName, onComplete }: WizardProps) {
  const [step, setStep] = useState<Step>("welcome");
  const [submitting, setSubmitting] = useState(false);
  const [error, setError] = useState("");
+  const [advancedOpen, setAdvancedOpen] = useState(false);
+  const [defaultsLoaded, setDefaultsLoaded] = useState(false);

  const [config, setConfig] = useState({
    agentName: "Assistant",
-    soulMd: DEFAULT_SOUL.replace("{company}", orgName),
+    soulMd: FALLBACK_SOUL.replace("{company}", orgName),
+    agentsMd: FALLBACK_AGENTS,
    packages: [] as string[],
    billingAddress: {
      company: orgName,
@@ -53,6 +76,9 @@ export function OnboardingWizard({ orgName, onComplete }: WizardProps) {
    billingNotes: "",
  });

+  // TOOLS.md preview — readonly, auto-generated
+  const [toolsMdPreview, setToolsMdPreview] = useState(FALLBACK_TOOLS);
+
  // Per-package collected secrets: { "telegram": { "bot-token": "123:ABC" }, ... }
  const [packageSecrets, setPackageSecrets] = useState<
    Record<string, Record<string, string>>
@@ -62,6 +88,42 @@ export function OnboardingWizard({ orgName, onComplete }: WizardProps) {
    Record<string, boolean>
  >({});

+  // Fetch DB-stored defaults on mount
+  useEffect(() => {
+    fetch(`/api/workspace-defaults?orgName=${encodeURIComponent(orgName)}`)
+      .then((r) => (r.ok ? r.json() : null))
+      .then((data) => {
+        if (data) {
+          setConfig((prev) => ({
+            ...prev,
+            soulMd: data.soulMd ?? prev.soulMd,
+            agentsMd: data.agentsMd ?? prev.agentsMd,
+          }));
+          setToolsMdPreview(data.toolsMd ?? FALLBACK_TOOLS);
+          setDefaultsLoaded(true);
+        }
+      })
+      .catch(() => {
+        /* use inline fallbacks */
+      });
+  }, [orgName]);
+
+  // Re-fetch TOOLS.md preview when packages change
+  const packagesKey = config.packages.sort().join(",");
+  const prevPackagesKey = useRef(packagesKey);
+  useEffect(() => {
+    if (prevPackagesKey.current === packagesKey && defaultsLoaded) return;
+    prevPackagesKey.current = packagesKey;
+    fetch(
+      `/api/workspace-defaults?orgName=${encodeURIComponent(orgName)}&packages=${encodeURIComponent(packagesKey)}`
+    )
+      .then((r) => (r.ok ? r.json() : null))
+      .then((data) => {
+        if (data?.toolsMd) setToolsMdPreview(data.toolsMd);
+      })
+      .catch(() => {});
+  }, [packagesKey, orgName, defaultsLoaded]);
+
  const stepIndex = STEPS.indexOf(step);

  const goNext = () => {
@@ -274,6 +336,74 @@ export function OnboardingWizard({ orgName, onComplete }: WizardProps) {
              </p>
            </div>

+            {/* Advanced: AGENTS.md + TOOLS.md preview */}
+            <div className="border border-border rounded-lg overflow-hidden">
+              <button
+                type="button"
+                onClick={() => setAdvancedOpen((o) => !o)}
+                className="w-full flex items-center justify-between px-3 py-2.5 text-left hover:bg-surface-3/30 transition-colors"
+              >
+                <span className="text-xs font-semibold uppercase tracking-wider text-text-muted">
+                  {t("advancedConfig")}
+                </span>
+                <svg
+                  className={`h-4 w-4 text-text-muted transition-transform ${
+                    advancedOpen ? "rotate-180" : ""
+                  }`}
+                  fill="none"
+                  viewBox="0 0 24 24"
+                  stroke="currentColor"
+                  strokeWidth={2}
+                >
+                  <path
+                    strokeLinecap="round"
+                    strokeLinejoin="round"
+                    d="M19 9l-7 7-7-7"
+                  />
+                </svg>
+              </button>
+              {advancedOpen && (
+                <div className="border-t border-border px-3 py-4 space-y-4 bg-surface-1/30">
+                  {/* AGENTS.md */}
+                  <div>
+                    <label className="block text-xs font-semibold uppercase tracking-wider text-text-muted mb-1.5">
+                      {t("agentsMd")}
+                    </label>
+                    <textarea
+                      value={config.agentsMd}
+                      onChange={(e) =>
+                        setConfig((prev) => ({
+                          ...prev,
+                          agentsMd: e.target.value,
+                        }))
+                      }
+                      rows={6}
+                      className="w-full px-3 py-2 bg-surface-2 border border-border rounded-lg text-sm text-text-primary font-mono text-xs focus:outline-none focus:ring-1 focus:ring-accent focus:border-accent transition-colors resize-y"
+                    />
+                    <p className="text-xs text-text-muted mt-1">
+                      {t("agentsMdHint")}
+                    </p>
+                  </div>
+
+                  {/* TOOLS.md — readonly preview */}
+                  <div>
+                    <label className="block text-xs font-semibold uppercase tracking-wider text-text-muted mb-1.5">
+                      {t("toolsMd")}
+                    </label>
+                    <textarea
+                      value={toolsMdPreview}
+                      readOnly
+                      rows={6}
+                      className="w-full px-3 py-2 bg-surface-3/50 border border-border rounded-lg text-sm text-text-secondary font-mono text-xs cursor-not-allowed resize-y"
+                    />
+                    <p className="text-xs text-text-muted mt-1">
+                      {t("toolsMdHint")}
+                    </p>
+                  </div>
+                </div>
+              )}
+            </div>
+
            {/* Packages — grouped by category */}
            <div>
              <label className="block text-xs font-semibold uppercase tracking-wider text-text-muted mb-2">
--- a/src/lib/db.ts
+++ b/src/lib/db.ts
@@ -1,64 +1,62 @@
-/**
- * Database client for the portal-db PostgreSQL database.
- *
- * Uses the `pg` package directly — no ORM overhead for a single table.
- * The tenant_requests table acts as the approval gate between customer
- * registration and actual PiecedTenant CR creation.
- *
- * Connection: via DATABASE_URL env var pointing to CloudNativePG cluster.
- */
-
 import { Pool } from "pg";
 import type { TenantRequest, TenantRequestStatus } from "@/types";
+import { listTenants, getTenant } from "./k8s";

-// Lazy-init: pool is created on first use, not at module import time.
-// This avoids "Invalid URL" errors during Next.js build when env vars
-// aren't available yet.
-let _pool: Pool | null = null;
+// ---------------------------------------------------------------------------
+// Connection pool (singleton)
+// ---------------------------------------------------------------------------
+
+let pool: Pool | null = null;

 function getPool(): Pool {
-  if (!_pool) {
-    const url = process.env.DATABASE_URL;
-    if (!url) throw new Error("DATABASE_URL is not set");
-    _pool = new Pool({
-      connectionString: url,
-      max: 5,
-      idleTimeoutMillis: 30_000,
-    });
+  if (!pool) {
+    const connectionString =
+      process.env.DATABASE_URL ??
+      "postgresql://portal:portal@portal-db-rw.portal.svc:5432/portal";
+    pool = new Pool({ connectionString, max: 5 });
  }
-  return _pool;
+  return pool;
 }

 // ---------------------------------------------------------------------------
-// Schema migration (idempotent)
+// Schema migration (auto-run on first query)
 // ---------------------------------------------------------------------------

 const MIGRATION_SQL = `
  CREATE TABLE IF NOT EXISTS tenant_requests (
-    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-    zitadel_org_id TEXT NOT NULL UNIQUE,
-    zitadel_user_id TEXT NOT NULL,
-    company_name TEXT NOT NULL,
-    contact_name TEXT NOT NULL,
-    contact_email TEXT NOT NULL,
-    agent_name TEXT NOT NULL DEFAULT 'Assistant',
-    soul_md TEXT,
-    packages TEXT[] DEFAULT '{}',
-    billing_address JSONB DEFAULT '{}',
-    billing_notes TEXT,
-    status TEXT NOT NULL DEFAULT 'pending',
-    admin_notes TEXT,
-    tenant_name TEXT,
+    id                UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    zitadel_org_id    TEXT NOT NULL UNIQUE,
+    zitadel_user_id   TEXT NOT NULL,
+    company_name      TEXT NOT NULL,
+    contact_name      TEXT NOT NULL,
+    contact_email     TEXT NOT NULL,
+    agent_name        TEXT NOT NULL DEFAULT 'Assistant',
+    soul_md           TEXT,
+    agents_md         TEXT,
+    packages          TEXT[] DEFAULT '{}',
+    billing_address   JSONB DEFAULT '{}',
+    billing_notes     TEXT,
+    status            TEXT NOT NULL DEFAULT 'pending',
+    admin_notes       TEXT,
+    tenant_name       TEXT,
    encrypted_secrets BYTEA,
-    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
-    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+    created_at        TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at        TIMESTAMPTZ NOT NULL DEFAULT now()
  );

  CREATE INDEX IF NOT EXISTS idx_tenant_requests_status ON tenant_requests(status);
  CREATE INDEX IF NOT EXISTS idx_tenant_requests_org_id ON tenant_requests(zitadel_org_id);

-  -- Idempotent column add for existing databases
+  -- Idempotent column adds for existing databases
  ALTER TABLE tenant_requests ADD COLUMN IF NOT EXISTS encrypted_secrets BYTEA;
+  ALTER TABLE tenant_requests ADD COLUMN IF NOT EXISTS agents_md TEXT;
+
+  -- Workspace templates: admin-editable default content for workspace files
+  CREATE TABLE IF NOT EXISTS workspace_templates (
+    file_key   TEXT PRIMARY KEY,
+    content    TEXT NOT NULL,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+  );
 `;

 let migrated = false;
@@ -70,7 +68,59 @@ export async function ensureSchema(): Promise<void> {
 }

 // ---------------------------------------------------------------------------
-// CRUD
+// Workspace templates
+// ---------------------------------------------------------------------------
+
+/**
+ * Get a workspace template by file key (e.g. "SOUL.md", "AGENTS.md", "TOOLS.md").
+ * Returns null if no template is stored for this key.
+ */
+export async function getWorkspaceTemplate(
+  fileKey: string
+): Promise<string | null> {
+  await ensureSchema();
+  const result = await getPool().query<{ content: string }>(
+    "SELECT content FROM workspace_templates WHERE file_key = $1",
+    [fileKey]
+  );
+  return result.rows[0]?.content ?? null;
+}
+
+/**
+ * Upsert a workspace template.
+ */
+export async function setWorkspaceTemplate(
+  fileKey: string,
+  content: string
+): Promise<void> {
+  await ensureSchema();
+  await getPool().query(
+    `INSERT INTO workspace_templates (file_key, content, updated_at)
+     VALUES ($1, $2, now())
+     ON CONFLICT (file_key) DO UPDATE SET content = $2, updated_at = now()`,
+    [fileKey, content]
+  );
+}
+
+/**
+ * List all workspace templates.
+ */
+export async function listWorkspaceTemplates(): Promise<
+  Array<{ fileKey: string; content: string; updatedAt: string }>
+> {
+  await ensureSchema();
+  const result = await getPool().query(
+    "SELECT file_key, content, updated_at FROM workspace_templates ORDER BY file_key"
+  );
+  return result.rows.map((r: any) => ({
+    fileKey: r.file_key,
+    content: r.content,
+    updatedAt: r.updated_at?.toISOString?.() ?? r.updated_at,
+  }));
+}
+
+// ---------------------------------------------------------------------------
+// Tenant requests CRUD
 // ---------------------------------------------------------------------------

 export async function createTenantRequest(
@@ -81,10 +131,10 @@ export async function createTenantRequest(
  await ensureSchema();
  const result = await getPool().query<TenantRequest>(
    `INSERT INTO tenant_requests
-      (zitadel_org_id, zitadel_user_id, company_name, contact_name,
-       contact_email, agent_name, soul_md, packages, billing_address,
-       billing_notes, encrypted_secrets)
-     VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
+       (zitadel_org_id, zitadel_user_id, company_name, contact_name,
+        contact_email, agent_name, soul_md, agents_md, packages, billing_address,
+        billing_notes, encrypted_secrets)
+     VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
     RETURNING *`,
    [
      params.zitadelOrgId,
@@ -94,6 +144,7 @@ export async function createTenantRequest(
      params.contactEmail,
      params.agentName,
      params.soulMd,
+      params.agentsMd ?? null,
      params.packages,
      JSON.stringify(params.billingAddress),
      params.billingNotes,
@@ -103,62 +154,75 @@ export async function createTenantRequest(
  return mapRow(result.rows[0]);
 }

-export async function getTenantRequestByOrgId(
-  orgId: string
-): Promise<TenantRequest | null> {
-  await ensureSchema();
-  const result = await getPool().query(
-    "SELECT * FROM tenant_requests WHERE zitadel_org_id = $1",
-    [orgId]
-  );
-  return result.rows[0] ? mapRow(result.rows[0]) : null;
-}
-
 export async function getTenantRequestById(
  id: string
 ): Promise<TenantRequest | null> {
  await ensureSchema();
-  const result = await getPool().query(
+  const result = await getPool().query<TenantRequest>(
    "SELECT * FROM tenant_requests WHERE id = $1",
    [id]
  );
  return result.rows[0] ? mapRow(result.rows[0]) : null;
 }

+export async function getTenantRequestByOrgId(
+  orgId: string
+): Promise<TenantRequest | null> {
+  await ensureSchema();
+  const result = await getPool().query<TenantRequest>(
+    "SELECT * FROM tenant_requests WHERE zitadel_org_id = $1 ORDER BY created_at DESC LIMIT 1",
+    [orgId]
+  );
+  return result.rows[0] ? mapRow(result.rows[0]) : null;
+}
+
 export async function listTenantRequests(
  status?: TenantRequestStatus
 ): Promise<TenantRequest[]> {
  await ensureSchema();
-  const pool = getPool();
-  const query = status
-    ? { text: "SELECT * FROM tenant_requests WHERE status = $1 ORDER BY created_at DESC", values: [status] }
-    : { text: "SELECT * FROM tenant_requests ORDER BY created_at DESC", values: [] };
-  const result = await pool.query(query);
+  const result = status
+    ? await getPool().query<TenantRequest>(
+        "SELECT * FROM tenant_requests WHERE status = $1 ORDER BY created_at DESC",
+        [status]
+      )
+    : await getPool().query<TenantRequest>(
+        "SELECT * FROM tenant_requests ORDER BY created_at DESC"
+      );
  return result.rows.map(mapRow);
 }

 export async function updateTenantRequestStatus(
  id: string,
  status: TenantRequestStatus,
-  extra?: { adminNotes?: string | null; tenantName?: string; clearAdminNotes?: boolean }
+  extra?: {
+    adminNotes?: string | null;
+    tenantName?: string;
+    clearAdminNotes?: boolean;
+  }
 ): Promise<TenantRequest> {
  await ensureSchema();
+  const sets = ["status = $2", "updated_at = now()"];
+  const values: any[] = [id, status];
+  let idx = 3;

-  // If clearAdminNotes is true, explicitly set admin_notes to NULL
-  // Otherwise use COALESCE to preserve existing value when not provided
-  const adminNotesExpr = extra?.clearAdminNotes
-    ? "$2"
-    : "COALESCE($2, admin_notes)";
+  if (extra?.adminNotes !== undefined) {
+    sets.push(`admin_notes = $${idx}`);
+    values.push(extra.adminNotes);
+    idx++;
+  }
+  if (extra?.clearAdminNotes) {
+    sets.push("admin_notes = NULL");
+  }
+  if (extra?.tenantName) {
+    sets.push(`tenant_name = $${idx}`);
+    values.push(extra.tenantName);
+    idx++;
+  }

-  const result = await getPool().query(
-    `UPDATE tenant_requests
-     SET status = $1, admin_notes = ${adminNotesExpr},
-         tenant_name = COALESCE($3, tenant_name), updated_at = now()
-     WHERE id = $4
-     RETURNING *`,
-    [status, extra?.adminNotes ?? null, extra?.tenantName ?? null, id]
+  const result = await getPool().query<TenantRequest>(
+    `UPDATE tenant_requests SET ${sets.join(", ")} WHERE id = $1 RETURNING *`,
+    values
  );
-  if (!result.rows[0]) throw new Error(`TenantRequest ${id} not found`);
  return mapRow(result.rows[0]);
 }

@@ -200,34 +264,33 @@ export async function deleteTenantRequest(id: string): Promise<void> {
 /**
 * Sync provisioning statuses: for all requests with status "provisioning",
 * check if the PiecedTenant CR has reached "Ready" and update to "active".
- * Called from the admin requests list endpoint.
 */
-export async function syncProvisioningStatuses(
-  checkTenantPhase: (tenantName: string) => Promise<string | null>
-): Promise<void> {
+export async function syncProvisioningStatuses(): Promise<void> {
  await ensureSchema();
-  const pool = getPool();
-  const result = await pool.query(
-    "SELECT id, tenant_name FROM tenant_requests WHERE status = 'provisioning' AND tenant_name IS NOT NULL"
+  const result = await getPool().query<TenantRequest>(
+    "SELECT * FROM tenant_requests WHERE status = 'provisioning'"
  );

  for (const row of result.rows) {
+    const mapped = mapRow(row);
+    if (!mapped.tenantName) continue;
+
    try {
-      const phase = await checkTenantPhase(row.tenant_name);
-      if (phase === "Ready" || phase === "Running") {
-        await pool.query(
-          "UPDATE tenant_requests SET status = 'active', updated_at = now() WHERE id = $1",
-          [row.id]
-        );
+      const tenant = await getTenant(mapped.tenantName);
+      if (
+        tenant?.status?.phase === "Ready" ||
+        tenant?.status?.phase === "Running"
+      ) {
+        await updateTenantRequestStatus(mapped.id, "active");
      }
-    } catch (e) {
-      console.error(`Failed to sync status for request ${row.id}:`, e);
+    } catch {
+      // Tenant might not exist yet — skip
    }
  }
 }

 // ---------------------------------------------------------------------------
-// Row mapping (snake_case → camelCase)
+// Row mapper
 // ---------------------------------------------------------------------------

 function mapRow(row: any): TenantRequest {
@@ -240,10 +303,9 @@ function mapRow(row: any): TenantRequest {
    contactEmail: row.contact_email,
    agentName: row.agent_name,
    soulMd: row.soul_md,
+    agentsMd: row.agents_md ?? null,
    packages: row.packages ?? [],
-    billingAddress: typeof row.billing_address === "string"
-      ? JSON.parse(row.billing_address)
-      : row.billing_address ?? {},
+    billingAddress: row.billing_address ?? {},
    billingNotes: row.billing_notes,
    status: row.status as TenantRequestStatus,
    adminNotes: row.admin_notes,
--- a/src/lib/litellm.ts
+++ b/src/lib/litellm.ts
@@ -48,3 +48,57 @@ export async function getTeamSpendLogsV2(
  });
  return litellmFetch(`/spend/logs/v2?${params}`);
 }
+
+/**
+ * Get all teams registered in LiteLLM.
+ * Returns team_id, spend, max_budget, etc.
+ */
+export async function listTeams(): Promise<any[]> {
+  const data = await litellmFetch("/team/list");
+  // LiteLLM returns either an array or { data: [...] }
+  return Array.isArray(data) ? data : data?.data ?? data?.teams ?? [];
+}
+
+/**
+ * Get LiteLLM health status.
+ */
+export async function getLitellmHealth(): Promise<{
+  healthy: boolean;
+  details?: any;
+}> {
+  try {
+    const data = await litellmFetch("/health");
+    return { healthy: true, details: data };
+  } catch (e: any) {
+    return { healthy: false, details: e.message };
+  }
+}
+
+/**
+ * Get global spend across all teams for the current month.
+ */
+export async function getGlobalSpend(): Promise<number> {
+  try {
+    const data = await litellmFetch("/global/spend");
+    // LiteLLM returns { spend: number } or similar
+    if (typeof data === "number") return data;
+    return data?.spend ?? data?.total_spend ?? 0;
+  } catch {
+    return 0;
+  }
+}
+
+/**
+ * Fetch per-team spend as a map: teamId → spend (CHF).
+ * Uses /team/list which includes current spend per team.
+ */
+export async function getPerTeamSpend(): Promise<Map<string, number>> {
+  const teams = await listTeams();
+  const map = new Map<string, number>();
+  for (const team of teams) {
+    const id = team.team_id ?? team.id;
+    const spend = team.spend ?? 0;
+    if (id) map.set(id, spend);
+  }
+  return map;
+}
--- a/src/lib/workspace-defaults.ts
+++ b/src/lib/workspace-defaults.ts
@@ -0,0 +1,111 @@
+/**
+ * Workspace file defaults.
+ *
+ * Default content for SOUL.md, AGENTS.md, and TOOLS.md is stored in the
+ * `workspace_templates` database table so it can be edited without redeploying.
+ *
+ * TOOLS.md is always auto-generated:
+ *   base template from DB  +  per-package tool sections appended dynamically.
+ */
+
+import { getWorkspaceTemplate } from "./db";
+import { PACKAGE_CATALOG } from "./packages";
+
+// ── Hardcoded fallbacks (used only if DB templates are missing) ─────────────
+
+const FALLBACK_SOUL = `# AI Assistant
+
+You are a helpful AI assistant. You are professional, concise, and friendly.
+
+## Guidelines
+- Answer questions accurately and helpfully
+- If you don't know something, say so
+- Keep responses clear and to the point
+- Respect privacy and confidentiality
+`;
+
+const FALLBACK_AGENTS = `# Agents
+
+On session start, read the following workspace files in order:
+1. SOUL.md — your personality and behavioural guidelines
+2. TOOLS.md — available tools and how to use them
+3. USER.md — information about the current user (if present)
+
+Follow the instructions in SOUL.md for every interaction.
+`;
+
+const FALLBACK_TOOLS = `# Tools
+
+The following tools are available to you as an AI assistant.
+
+## LLM
+You have access to a large language model for text generation, summarisation,
+translation, and general question answering.
+`;
+
+// ── Per-package TOOLS.md appendices ─────────────────────────────────────────
+
+const PACKAGE_TOOL_SECTIONS: Record<string, string> = {
+  "web-search": `
+## Web Search (SearXNG)
+You can search the web using the integrated SearXNG instance.
+Use this to find current information, verify facts, or research topics
+that go beyond your training data.
+`,
+  "document-processing": `
+## Document Processing
+You can parse, summarise, and extract information from uploaded documents
+including PDF, DOCX, XLSX, and plain text files.
+`,
+  telegram: `
+## Telegram
+You are connected to a Telegram bot. Messages from users arrive as chat
+messages. Respond naturally and follow the guidelines in SOUL.md.
+`,
+  discord: `
+## Discord
+You are connected to a Discord bot. Messages from server members arrive
+as chat messages. Respond naturally and follow the guidelines in SOUL.md.
+`,
+  email: `
+## Email
+You can send and receive email. Use this to respond to enquiries,
+send notifications, or process incoming messages according to SOUL.md.
+`,
+};
+
+// ── Public API ──────────────────────────────────────────────────────────────
+
+/**
+ * Fetch the default SOUL.md content.
+ * Substitutes {company} with the given org name.
+ */
+export async function getDefaultSoulMd(orgName: string): Promise<string> {
+  const tpl = await getWorkspaceTemplate("SOUL.md");
+  const content = tpl ?? FALLBACK_SOUL;
+  return content.replace(/\{company\}/g, orgName);
+}
+
+/**
+ * Fetch the default AGENTS.md content.
+ */
+export async function getDefaultAgentsMd(): Promise<string> {
+  const tpl = await getWorkspaceTemplate("AGENTS.md");
+  return tpl ?? FALLBACK_AGENTS;
+}
+
+/**
+ * Build the TOOLS.md content for a given set of enabled packages.
+ * Base template from DB (or fallback) + per-package appendices.
+ */
+export async function generateToolsMd(
+  enabledPackages: string[]
+): Promise<string> {
+  const base = (await getWorkspaceTemplate("TOOLS.md")) ?? FALLBACK_TOOLS;
+
+  const sections = enabledPackages
+    .filter((id) => PACKAGE_TOOL_SECTIONS[id])
+    .map((id) => PACKAGE_TOOL_SECTIONS[id]);
+
+  return [base.trimEnd(), ...sections].join("\n");
+}
--- a/src/messages/de.json
+++ b/src/messages/de.json
@@ -49,6 +49,11 @@
    "agentName": "Agent-Name",
    "soulMd": "Persönlichkeit (SOUL.md)",
    "soulMdHint": "Definiert das Verhalten Ihres Assistenten. Markdown-Format. Kann später bearbeitet werden.",
+    "agentsMd": "Agent-Anweisungen (AGENTS.md)",
+    "agentsMdHint": "Definiert, was Ihr Assistent beim Sitzungsstart tut. Optional — die Standardwerte funktionieren für die meisten Setups.",
+    "toolsMd": "Verfügbare Werkzeuge (TOOLS.md)",
+    "toolsMdHint": "Automatisch generiert basierend auf Ihren gewählten Paketen. Diese Datei wird automatisch verwaltet.",
+    "advancedConfig": "Erweiterte Konfiguration",
    "packages": "Pakete",
    "packagesHint": "Optionale Integrationen. Pakete mit Zugangsdaten werden diese inline abfragen. Können auch später aktiviert werden.",
    "billingTitle": "Rechnungsinformationen",
@@ -111,6 +116,7 @@
  "workspace": {
    "save": "Speichern",
    "placeholder": "Inhalt für {file} eingeben…",
+    "readonlyNote": "Diese Datei wird automatisch generiert und kann nicht manuell bearbeitet werden.",
    "seedingNote": "Workspace-Dateien werden beim ersten Start geladen. Eine Aktualisierung auf einer bestehenden Instanz löst ein ConfigMap-Update und Pod-Neustart aus."
  },
  "packages": {
@@ -215,6 +221,33 @@
    "confirmDelete": "Endgültig löschen",
    "loadingTenants": "Mandanten werden geladen…",
    "filter_deleted": "Gelöscht",
-    "filter_active": "Aktiv"
+    "filter_active": "Aktiv",
+    "health": "Status",
+    "serviceHealth": "Dienststatus",
+    "vllmDescription": "GPU-Inferenz-Engine",
+    "litellmDescription": "LLM-Proxy & Kostenerfassung",
+    "tenantOverview": "Mandanten-Übersicht",
+    "spendOverview": "Kostenübersicht",
+    "globalSpend": "Gesamtkosten (CHF)",
+    "activeTenants": "Aktive Mandanten",
+    "tenantsWithSpend": "Mandanten mit erfassten Kosten",
+    "refresh": "Aktualisieren",
+    "healthUnavailable": "Statusdaten nicht verfügbar.",
+    "loadingHealth": "Statusdaten werden geladen…",
+    "statusHealthy": "OK",
+    "statusDown": "Ausgefallen",
+    "spendChf": "Kosten (CHF)"
+  },
+  "channelUsers": {
+    "title": "Autorisierte Benutzer",
+    "description": "Verwalten Sie, welche Benutzer mit Ihrem Assistenten auf jedem Kanal interagieren können. Fügen Sie die numerische Benutzer-ID hinzu, um den Zugang zu autorisieren.",
+    "users": "Benutzer",
+    "placeholder": "Numerische Benutzer-ID eingeben…",
+    "add": "Hinzufügen",
+    "remove": "Entfernen",
+    "alreadyAdded": "Diese Benutzer-ID ist bereits autorisiert.",
+    "telegramIdHelp": "So finden Sie Ihre Telegram-Benutzer-ID:\n1. Öffnen Sie Telegram und schreiben Sie @userinfobot\n2. Der Bot antwortet sofort mit Ihrer numerischen ID\n3. Geben Sie diese Nummer hier ein",
+    "discordIdHelp": "So finden Sie Ihre Discord-Benutzer-ID:\n1. Aktivieren Sie den Entwicklermodus in den Discord-Einstellungen (Erweitert)\n2. Rechtsklick auf Ihren Namen → Benutzer-ID kopieren\n3. Geben Sie diese Nummer hier ein",
+    "emailIdHelp": "Geben Sie die E-Mail-Adresse ein, die zur Interaktion mit dem Assistenten autorisiert werden soll."
  }
 }
--- a/src/messages/en.json
+++ b/src/messages/en.json
@@ -49,6 +49,11 @@
    "agentName": "Agent Name",
    "soulMd": "Personality (SOUL.md)",
    "soulMdHint": "This defines how your assistant behaves. Markdown format. You can edit this later.",
+    "agentsMd": "Agent Instructions (AGENTS.md)",
+    "agentsMdHint": "Defines what your assistant does on session start. Optional — defaults work well for most setups.",
+    "toolsMd": "Available Tools (TOOLS.md)",
+    "toolsMdHint": "Auto-generated based on your selected packages. This file is managed automatically.",
+    "advancedConfig": "Advanced Configuration",
    "packages": "Packages",
    "packagesHint": "Optional integrations. Packages requiring credentials will ask for them inline. You can also enable these later.",
    "billingTitle": "Billing information",
@@ -111,6 +116,7 @@
  "workspace": {
    "save": "Save",
    "placeholder": "Enter content for {file}…",
+    "readonlyNote": "This file is auto-generated and cannot be edited manually.",
    "seedingNote": "Workspace files are seeded on first boot. Updating on an existing instance triggers a ConfigMap update and pod restart."
  },
  "packages": {
@@ -215,6 +221,33 @@
    "confirmDelete": "Delete permanently",
    "loadingTenants": "Loading tenants…",
    "filter_deleted": "Deleted",
-    "filter_active": "Active"
+    "filter_active": "Active",
+    "health": "Health",
+    "serviceHealth": "Service Health",
+    "vllmDescription": "GPU inference engine",
+    "litellmDescription": "LLM proxy & spend tracking",
+    "tenantOverview": "Tenant Overview",
+    "spendOverview": "Spend Overview",
+    "globalSpend": "Global Spend (CHF)",
+    "activeTenants": "Active Tenants",
+    "tenantsWithSpend": "tenants with recorded spend",
+    "refresh": "Refresh",
+    "healthUnavailable": "Health data unavailable.",
+    "loadingHealth": "Loading health data…",
+    "statusHealthy": "Healthy",
+    "statusDown": "Down",
+    "spendChf": "Spend (CHF)"
+  },
+  "channelUsers": {
+    "title": "Authorized Users",
+    "description": "Manage which users can interact with your assistant on each channel. Add their numeric user ID to authorize access.",
+    "users": "users",
+    "placeholder": "Enter numeric user ID…",
+    "add": "Add",
+    "remove": "Remove",
+    "alreadyAdded": "This user ID is already authorized.",
+    "telegramIdHelp": "To find your Telegram user ID:\n1. Open Telegram and message @userinfobot\n2. It instantly replies with your numeric ID\n3. Enter that number here",
+    "discordIdHelp": "To find your Discord user ID:\n1. Enable Developer Mode in Discord settings (Advanced)\n2. Right-click your name → Copy User ID\n3. Enter that number here",
+    "emailIdHelp": "Enter the email address that should be authorized to interact with the assistant."
  }
 }
--- a/src/messages/fr.json
+++ b/src/messages/fr.json
@@ -2,8 +2,8 @@
  "common": {
    "appName": "PieCed",
    "tagline": "Plateforme IA",
-    "login": "Se connecter",
-    "logout": "Se déconnecter",
+    "login": "Connexion",
+    "logout": "Déconnexion",
    "dashboard": "Tableau de bord",
    "admin": "Admin",
    "loading": "Chargement…",
@@ -19,36 +19,41 @@
    "button": "Continuer avec ZITADEL",
    "footer": "Hébergé on-premises en Suisse",
    "noAccount": "Pas encore de compte ?",
-    "register": "Inscrivez votre entreprise"
+    "register": "Enregistrer votre entreprise"
  },
  "register": {
    "title": "Créer votre compte",
-    "subtitle": "Inscrivez votre entreprise pour un assistant IA hébergé en Suisse",
+    "subtitle": "Enregistrez votre entreprise pour un assistant IA hébergé en Suisse",
    "companyName": "Nom de l'entreprise",
-    "companyNamePlaceholder": "Acme SA",
+    "companyNamePlaceholder": "Exemple SA",
    "givenName": "Prénom",
    "familyName": "Nom",
    "email": "Adresse e-mail",
    "submit": "S'inscrire",
-    "hasAccount": "Vous avez déjà un compte ?",
+    "hasAccount": "Déjà un compte ?",
    "footer": "Vos données sont hébergées exclusivement on-premises en Suisse.",
    "successTitle": "Inscription reçue",
-    "successDescription": "Vous recevrez un e-mail d'invitation avec un lien pour définir votre mot de passe et vérifier votre adresse e-mail. Une fois terminé, vous pourrez vous connecter pour configurer votre assistant IA.",
+    "successDescription": "Vous recevrez un e-mail d'invitation avec un lien pour définir votre mot de passe et vérifier votre adresse e-mail. Ensuite, vous pourrez vous connecter et configurer votre assistant IA.",
    "goToLogin": "Aller à la connexion"
  },
  "onboarding": {
    "loading": "Chargement du statut…",
-    "welcomeTitle": "Configurez votre assistant IA",
+    "welcomeTitle": "Configurer votre assistant IA",
    "welcomeDescription": "En quelques étapes, vous aurez votre propre assistant IA — hébergé exclusivement en Suisse, entièrement sous votre contrôle.",
    "welcomeFeature_swissHosted": "Hébergé on-premises en Suisse — vos données ne quittent jamais le pays",
    "welcomeFeature_privacy": "Aucune donnée partagée avec des tiers — confidentialité totale",
    "welcomeFeature_customizable": "Personnalité, paquets et intégrations entièrement personnalisables",
    "getStarted": "Commencer",
    "configureTitle": "Configurer votre assistant",
-    "configureDescription": "Donnez un nom et une personnalité à votre assistant. Vous pourrez toujours modifier cela plus tard.",
+    "configureDescription": "Donnez un nom et une personnalité à votre assistant. Vous pouvez toujours les modifier par la suite.",
    "agentName": "Nom de l'agent",
    "soulMd": "Personnalité (SOUL.md)",
    "soulMdHint": "Définit le comportement de votre assistant. Format Markdown. Modifiable ultérieurement.",
+    "agentsMd": "Instructions de l'agent (AGENTS.md)",
+    "agentsMdHint": "Définit ce que votre assistant fait au démarrage de la session. Optionnel — les paramètres par défaut conviennent à la plupart des configurations.",
+    "toolsMd": "Outils disponibles (TOOLS.md)",
+    "toolsMdHint": "Généré automatiquement en fonction des paquets sélectionnés. Ce fichier est géré automatiquement.",
+    "advancedConfig": "Configuration avancée",
    "packages": "Paquets",
    "packagesHint": "Intégrations optionnelles. Les paquets nécessitant des identifiants les demanderont en ligne. Vous pouvez aussi les activer plus tard.",
    "billingTitle": "Informations de facturation",
@@ -59,7 +64,7 @@
    "billingCity": "Ville",
    "billingCountry": "Pays",
    "billingNotes": "Remarques",
-    "billingNotesPlaceholder": "Remarques concernant la facturation (numéro de commande, TVA, mode de paiement préféré, etc.)",
+    "billingNotesPlaceholder": "Remarques sur la facturation (numéro de commande, numéro de TVA, mode de paiement préféré, etc.)",
    "confirmTitle": "Vérifier et envoyer",
    "confirmDescription": "Veuillez vérifier votre configuration. Votre demande sera examinée par notre équipe avant la mise en service.",
    "confirmNote": "Après l'envoi, notre équipe examinera votre demande et vos informations de facturation. Vous recevrez l'accès après approbation — généralement dans un délai d'un jour ouvrable.",
@@ -68,7 +73,7 @@
    "back": "Retour",
    "next": "Suivant",
    "pendingTitle": "Demande envoyée",
-    "pendingDescription": "Votre demande d'intégration a été envoyée et est en attente d'examen par notre équipe. Vous recevrez l'accès après approbation — généralement dans un délai d'un jour ouvrable.",
+    "pendingDescription": "Votre demande a été envoyée et est en cours d'examen par notre équipe. Vous recevrez l'accès après approbation — généralement dans un délai d'un jour ouvrable.",
    "rejectedTitle": "Demande non approuvée",
    "rejectedDescription": "Malheureusement, votre demande n'a pas été approuvée. Veuillez nous contacter pour plus d'informations.",
    "provisioningTitle": "Configuration de votre instance",
@@ -93,8 +98,8 @@
    "agent": "Agent",
    "packages": "Paquets",
    "workspaceFiles": "Fichiers workspace",
-    "notFound": "Tenant introuvable.",
-    "usage": "Utilisation et dépenses"
+    "notFound": "Locataire non trouvé.",
+    "usage": "Utilisation et coûts"
  },
  "usage": {
    "inputTokens": "Tokens d'entrée",
@@ -102,7 +107,7 @@
    "totalSpend": "Dépenses totales",
    "totalCost": "Coût total",
    "budget": "Budget",
-    "noLimit": "Aucune limite",
+    "noLimit": "Pas de limite",
    "last30Days": "30 derniers jours",
    "noData": "Aucune donnée d'utilisation disponible.",
    "dailyBreakdown": "Détail journalier",
@@ -111,6 +116,7 @@
  "workspace": {
    "save": "Enregistrer",
    "placeholder": "Saisir le contenu pour {file}…",
+    "readonlyNote": "Ce fichier est généré automatiquement et ne peut pas être modifié manuellement.",
    "seedingNote": "Les fichiers workspace sont initialisés au premier démarrage. Une mise à jour sur une instance existante déclenche une mise à jour du ConfigMap et un redémarrage du pod."
  },
  "packages": {
@@ -122,7 +128,7 @@
    "disable": "Désactiver",
    "enableAndSave": "Activer et enregistrer",
    "configure": "Configurer",
-    "requiresApiKey": "Clé API requise",
+    "requiresApiKey": "Nécessite une clé API",
    "missingFields": "Veuillez remplir tous les champs obligatoires.",
    "status": {
      "pending": "En attente",
@@ -133,15 +139,15 @@
      "description": "Connectez votre assistant IA à un bot Telegram.",
      "botTokenLabel": "Token du bot Telegram",
      "botTokenPlaceholder": "123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11",
-      "instructions": "1. Ouvrez @BotFather sur Telegram\n2. Envoyez /newbot et suivez les instructions\n3. Copiez le token du bot fourni",
-      "disclaimer": "Je confirme être propriétaire de ce bot Telegram et autorise PieCed IT à le connecter à mon assistant IA."
+      "instructions": "1. Ouvrez @BotFather sur Telegram\n2. Envoyez /newbot et suivez les instructions\n3. Copiez le token du bot",
+      "disclaimer": "Je confirme que je possède ce bot Telegram et autorise PieCed IT à le connecter à mon assistant IA."
    },
    "discord": {
      "description": "Connectez votre assistant IA à un serveur Discord via un bot.",
      "botTokenLabel": "Token du bot Discord",
      "botTokenPlaceholder": "MTAxNjQ0OTk2NjAz...",
      "instructions": "1. Allez sur discord.com/developers/applications\n2. Créez une nouvelle application et ajoutez un bot\n3. Copiez le token du bot",
-      "disclaimer": "Je confirme être propriétaire de ce bot Discord et autorise PieCed IT à le connecter à mon assistant IA."
+      "disclaimer": "Je confirme que je possède ce bot Discord et autorise PieCed IT à le connecter à mon assistant IA."
    },
    "email": {
      "description": "Permettez à votre assistant IA d'envoyer et de recevoir des e-mails.",
@@ -154,7 +160,7 @@
      "imapHostLabel": "Hôte IMAP",
      "imapHostPlaceholder": "imap.example.com",
      "instructions": "Fournissez les identifiants SMTP et IMAP. L'assistant les utilise pour envoyer et surveiller les messages.",
-      "disclaimer": "Je confirme être autorisé à utiliser ces identifiants e-mail et que PieCed IT peut accéder à cette boîte mail."
+      "disclaimer": "Je confirme que je suis autorisé à utiliser ces identifiants e-mail et que PieCed IT peut accéder à cette boîte mail."
    },
    "webSearch": {
      "description": "Donnez à votre assistant IA la capacité de rechercher sur le web."
@@ -165,7 +171,7 @@
  },
  "admin": {
    "title": "Admin plateforme",
-    "subtitle": "Gérer les demandes d'intégration et le cycle de vie des locataires",
+    "subtitle": "Gérer les demandes d'onboarding et le cycle de vie des locataires",
    "allTenants": "Locataires",
    "noTenants": "Aucun locataire provisionné.",
    "noAccess": "Permissions insuffisantes pour cette vue.",
@@ -179,7 +185,7 @@
    "pendingRequests": "Demandes en attente",
    "approve": "Approuver",
    "reject": "Rejeter",
-    "reApprove": "Ré-approuver",
+    "reApprove": "Réapprouver",
    "company": "Entreprise",
    "contact": "Contact",
    "agentName": "Agent",
@@ -188,7 +194,7 @@
    "actions": "Actions",
    "noRequests": "Aucune demande trouvée.",
    "loadingRequests": "Chargement des demandes…",
-    "approveConfirm": "Approuver cette demande et lancer le provisionnement ?",
+    "approveConfirm": "Approuver cette demande et démarrer la mise en service ?",
    "rejectConfirm": "Rejeter cette demande ?",
    "rejectTitle": "Rejeter la demande",
    "adminNotesLabel": "Notes (optionnel)",
@@ -202,7 +208,7 @@
    "filter_approved": "Approuvé",
    "filter_rejected": "Rejeté",
    "totalTenants": "Total",
-    "running": "Actif",
+    "running": "En cours",
    "provisioning": "Provisionnement",
    "errors": "Erreurs",
    "suspend": "Suspendre",
@@ -215,6 +221,33 @@
    "confirmDelete": "Supprimer définitivement",
    "loadingTenants": "Chargement des locataires…",
    "filter_deleted": "Supprimé",
-    "filter_active": "Actif"
+    "filter_active": "Actif",
+    "health": "Santé",
+    "serviceHealth": "Santé des services",
+    "vllmDescription": "Moteur d'inférence GPU",
+    "litellmDescription": "Proxy LLM & suivi des coûts",
+    "tenantOverview": "Aperçu des locataires",
+    "spendOverview": "Aperçu des coûts",
+    "globalSpend": "Coûts globaux (CHF)",
+    "activeTenants": "Locataires actifs",
+    "tenantsWithSpend": "locataires avec dépenses enregistrées",
+    "refresh": "Actualiser",
+    "healthUnavailable": "Données de santé indisponibles.",
+    "loadingHealth": "Chargement des données de santé…",
+    "statusHealthy": "OK",
+    "statusDown": "Hors service",
+    "spendChf": "Coûts (CHF)"
+  },
+  "channelUsers": {
+    "title": "Utilisateurs autorisés",
+    "description": "Gérez les utilisateurs pouvant interagir avec votre assistant sur chaque canal. Ajoutez leur identifiant numérique pour autoriser l'accès.",
+    "users": "utilisateurs",
+    "placeholder": "Entrez l'identifiant numérique…",
+    "add": "Ajouter",
+    "remove": "Supprimer",
+    "alreadyAdded": "Cet identifiant est déjà autorisé.",
+    "telegramIdHelp": "Pour trouver votre identifiant Telegram :\n1. Ouvrez Telegram et envoyez un message à @userinfobot\n2. Il répond instantanément avec votre identifiant numérique\n3. Entrez ce numéro ici",
+    "discordIdHelp": "Pour trouver votre identifiant Discord :\n1. Activez le mode développeur dans les paramètres Discord (Avancé)\n2. Clic droit sur votre nom → Copier l'identifiant\n3. Entrez ce numéro ici",
+    "emailIdHelp": "Entrez l'adresse e-mail qui doit être autorisée à interagir avec l'assistant."
  }
 }
--- a/src/messages/it.json
+++ b/src/messages/it.json
@@ -24,8 +24,8 @@
  "register": {
    "title": "Crea il tuo account",
    "subtitle": "Registra la tua azienda per un assistente IA ospitato in Svizzera",
-    "companyName": "Nome dell'azienda",
-    "companyNamePlaceholder": "Acme SA",
+    "companyName": "Nome azienda",
+    "companyNamePlaceholder": "Esempio SA",
    "givenName": "Nome",
    "familyName": "Cognome",
    "email": "Indirizzo e-mail",
@@ -33,22 +33,27 @@
    "hasAccount": "Hai già un account?",
    "footer": "I tuoi dati sono ospitati esclusivamente on-premises in Svizzera.",
    "successTitle": "Registrazione ricevuta",
-    "successDescription": "Riceverai un'e-mail di invito con un link per impostare la password e verificare il tuo indirizzo e-mail. Una volta completato, potrai accedere per configurare il tuo assistente IA.",
+    "successDescription": "Riceverai un'e-mail di invito con un link per impostare la password e verificare il tuo indirizzo e-mail. Dopodiché potrai accedere e configurare il tuo assistente IA.",
    "goToLogin": "Vai all'accesso"
  },
  "onboarding": {
-    "loading": "Caricamento dello stato…",
+    "loading": "Caricamento stato…",
    "welcomeTitle": "Configura il tuo assistente IA",
-    "welcomeDescription": "In pochi passaggi avrai il tuo assistente IA personale — ospitato esclusivamente in Svizzera, completamente sotto il tuo controllo.",
-    "welcomeFeature_swissHosted": "Ospitato on-premises in Svizzera — i tuoi dati non lasciano mai il paese",
+    "welcomeDescription": "In pochi passaggi avrai il tuo assistente IA — ospitato esclusivamente in Svizzera, completamente sotto il tuo controllo.",
+    "welcomeFeature_swissHosted": "Ospitato on-premises in Svizzera — i tuoi dati non lasciano mai il Paese",
    "welcomeFeature_privacy": "Nessun dato condiviso con terzi — privacy completa",
    "welcomeFeature_customizable": "Personalità, pacchetti e integrazioni completamente personalizzabili",
    "getStarted": "Inizia",
    "configureTitle": "Configura il tuo assistente",
-    "configureDescription": "Dai un nome e una personalità al tuo assistente. Puoi sempre modificarlo in seguito.",
-    "agentName": "Nome dell'agente",
+    "configureDescription": "Dai un nome e una personalità al tuo assistente. Puoi sempre modificarli in seguito.",
+    "agentName": "Nome agente",
    "soulMd": "Personalità (SOUL.md)",
    "soulMdHint": "Definisce il comportamento del tuo assistente. Formato Markdown. Modificabile in seguito.",
+    "agentsMd": "Istruzioni agente (AGENTS.md)",
+    "agentsMdHint": "Definisce cosa fa il tuo assistente all'avvio della sessione. Opzionale — i valori predefiniti funzionano per la maggior parte delle configurazioni.",
+    "toolsMd": "Strumenti disponibili (TOOLS.md)",
+    "toolsMdHint": "Generato automaticamente in base ai pacchetti selezionati. Questo file viene gestito automaticamente.",
+    "advancedConfig": "Configurazione avanzata",
    "packages": "Pacchetti",
    "packagesHint": "Integrazioni opzionali. I pacchetti che richiedono credenziali le chiederanno inline. Puoi attivarli anche in seguito.",
    "billingTitle": "Informazioni di fatturazione",
@@ -59,7 +64,7 @@
    "billingCity": "Città",
    "billingCountry": "Paese",
    "billingNotes": "Note",
-    "billingNotesPlaceholder": "Note sulla fatturazione (numero d'ordine, partita IVA, metodo di pagamento preferito, ecc.)",
+    "billingNotesPlaceholder": "Note sulla fatturazione (numero ordine, partita IVA, metodo di pagamento preferito, ecc.)",
    "confirmTitle": "Verifica e invia",
    "confirmDescription": "Verifica la tua configurazione. La tua richiesta verrà esaminata dal nostro team prima dell'attivazione.",
    "confirmNote": "Dopo l'invio, il nostro team esaminerà la tua richiesta e i dati di fatturazione. Riceverai l'accesso dopo l'approvazione — di solito entro un giorno lavorativo.",
@@ -68,23 +73,23 @@
    "back": "Indietro",
    "next": "Avanti",
    "pendingTitle": "Richiesta inviata",
-    "pendingDescription": "La tua richiesta di attivazione è stata inviata ed è in attesa di revisione da parte del nostro team. Riceverai l'accesso dopo l'approvazione — di solito entro un giorno lavorativo.",
+    "pendingDescription": "La tua richiesta è stata inviata ed è in fase di esame da parte del nostro team. Riceverai l'accesso dopo l'approvazione — di solito entro un giorno lavorativo.",
    "rejectedTitle": "Richiesta non approvata",
-    "rejectedDescription": "Purtroppo la tua richiesta non è stata approvata. Contattaci per maggiori informazioni.",
+    "rejectedDescription": "Purtroppo la tua richiesta non è stata approvata. Contattaci per ulteriori informazioni.",
    "provisioningTitle": "Configurazione dell'istanza",
-    "provisioningDescription": "Il tuo assistente IA è in fase di attivazione. Di solito sono necessari pochi minuti.",
+    "provisioningDescription": "Il tuo assistente IA è in fase di attivazione. Di solito richiede pochi minuti.",
    "phase": "Fase",
    "readyTitle": "Il tuo assistente è pronto!",
-    "readyDescription": "Il tuo assistente IA è stato attivato ed è operativo. Puoi ora gestirlo dalla dashboard.",
+    "readyDescription": "Il tuo assistente IA è stato attivato ed è operativo. Ora puoi gestirlo dalla dashboard.",
    "goToDashboard": "Vai alla dashboard"
  },
  "dashboard": {
    "title": "Dashboard",
    "welcome": "Bentornato, {name}",
-    "instanceStatus": "Stato dell'istanza",
+    "instanceStatus": "Stato istanza",
    "usage": "Utilizzo",
    "packages": "Pacchetti",
-    "noInstance": "Nessuna istanza ancora attivata.",
+    "noInstance": "Nessuna istanza attivata.",
    "comingSoon": "Vista dettagliata in arrivo nella Sessione 6.2",
    "noInstanceDescription": "Configura la tua istanza di assistente IA per iniziare con PieCed IT.",
    "manage": "Gestisci istanza e pacchetti"
@@ -94,7 +99,7 @@
    "packages": "Pacchetti",
    "workspaceFiles": "File workspace",
    "notFound": "Tenant non trovato.",
-    "usage": "Utilizzo e spese"
+    "usage": "Utilizzo e costi"
  },
  "usage": {
    "inputTokens": "Token di input",
@@ -111,6 +116,7 @@
  "workspace": {
    "save": "Salva",
    "placeholder": "Inserisci il contenuto per {file}…",
+    "readonlyNote": "Questo file viene generato automaticamente e non può essere modificato manualmente.",
    "seedingNote": "I file workspace vengono inizializzati al primo avvio. Un aggiornamento su un'istanza esistente attiva un aggiornamento del ConfigMap e un riavvio del pod."
  },
  "packages": {
@@ -122,26 +128,26 @@
    "disable": "Disattiva",
    "enableAndSave": "Attiva e salva",
    "configure": "Configura",
-    "requiresApiKey": "Chiave API richiesta",
-    "missingFields": "Compila tutti i campi obbligatori.",
+    "requiresApiKey": "Richiede chiave API",
+    "missingFields": "Compilare tutti i campi obbligatori.",
    "status": {
-      "pending": "In sospeso",
+      "pending": "In attesa",
      "active": "Attivo",
      "error": "Errore"
    },
    "telegram": {
      "description": "Collega il tuo assistente IA a un bot Telegram.",
-      "botTokenLabel": "Token del bot Telegram",
+      "botTokenLabel": "Token bot Telegram",
      "botTokenPlaceholder": "123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11",
-      "instructions": "1. Apri @BotFather su Telegram\n2. Invia /newbot e segui le istruzioni\n3. Copia il token del bot fornito",
-      "disclaimer": "Confermo di essere proprietario di questo bot Telegram e autorizzo PieCed IT a collegarlo al mio assistente IA."
+      "instructions": "1. Apri @BotFather su Telegram\n2. Invia /newbot e segui le istruzioni\n3. Copia il token del bot",
+      "disclaimer": "Confermo di possedere questo bot Telegram e autorizzo PieCed IT a collegarlo al mio assistente IA."
    },
    "discord": {
      "description": "Collega il tuo assistente IA a un server Discord tramite un bot.",
-      "botTokenLabel": "Token del bot Discord",
+      "botTokenLabel": "Token bot Discord",
      "botTokenPlaceholder": "MTAxNjQ0OTk2NjAz...",
      "instructions": "1. Vai su discord.com/developers/applications\n2. Crea una nuova applicazione e aggiungi un bot\n3. Copia il token del bot",
-      "disclaimer": "Confermo di essere proprietario di questo bot Discord e autorizzo PieCed IT a collegarlo al mio assistente IA."
+      "disclaimer": "Confermo di possedere questo bot Discord e autorizzo PieCed IT a collegarlo al mio assistente IA."
    },
    "email": {
      "description": "Permetti al tuo assistente IA di inviare e ricevere e-mail.",
@@ -153,21 +159,21 @@
      "smtpPasswordPlaceholder": "••••••••",
      "imapHostLabel": "Host IMAP",
      "imapHostPlaceholder": "imap.example.com",
-      "instructions": "Fornisci le credenziali SMTP e IMAP. L'assistente le utilizza per inviare e monitorare i messaggi.",
+      "instructions": "Fornisci le credenziali SMTP e IMAP. L'assistente le usa per inviare e monitorare i messaggi.",
      "disclaimer": "Confermo di essere autorizzato a utilizzare queste credenziali e-mail e che PieCed IT può accedere a questa casella di posta."
    },
    "webSearch": {
-      "description": "Dai al tuo assistente IA la capacità di cercare sul web."
+      "description": "Dai al tuo assistente IA la capacità di cercare nel web."
    },
    "documentProcessing": {
-      "description": "Attiva analisi, riepilogo ed estrazione di documenti."
+      "description": "Attiva l'analisi, il riassunto e l'estrazione di documenti."
    }
  },
  "admin": {
    "title": "Admin piattaforma",
-    "subtitle": "Gestire le richieste di onboarding e il ciclo di vita dei tenant",
+    "subtitle": "Gestisci le richieste di onboarding e il ciclo di vita dei tenant",
    "allTenants": "Tenant",
-    "noTenants": "Nessun tenant provisionato.",
+    "noTenants": "Nessun tenant attivato.",
    "noAccess": "Permessi insufficienti per questa vista.",
    "name": "Nome",
    "displayName": "Nome visualizzato",
@@ -179,7 +185,7 @@
    "pendingRequests": "Richieste in attesa",
    "approve": "Approva",
    "reject": "Rifiuta",
-    "reApprove": "Ri-approva",
+    "reApprove": "Riapprova",
    "company": "Azienda",
    "contact": "Contatto",
    "agentName": "Agente",
@@ -188,22 +194,22 @@
    "actions": "Azioni",
    "noRequests": "Nessuna richiesta trovata.",
    "loadingRequests": "Caricamento richieste…",
-    "approveConfirm": "Approvare questa richiesta e avviare il provisioning?",
+    "approveConfirm": "Approvare questa richiesta e avviare l'attivazione?",
    "rejectConfirm": "Rifiutare questa richiesta?",
    "rejectTitle": "Rifiuta richiesta",
    "adminNotesLabel": "Note (opzionale)",
    "adminNotesPlaceholder": "Motivo del rifiuto…",
    "cancelAction": "Annulla",
    "confirmReject": "Rifiuta",
-    "viewTenant": "Vedi",
+    "viewTenant": "Visualizza",
    "filter_all": "Tutti",
-    "filter_pending": "In attenta",
-    "filter_provisioning": "Provisioning",
+    "filter_pending": "In attesa",
+    "filter_provisioning": "Attivazione",
    "filter_approved": "Approvato",
    "filter_rejected": "Rifiutato",
    "totalTenants": "Totale",
    "running": "Attivo",
-    "provisioning": "Provisioning",
+    "provisioning": "Attivazione",
    "errors": "Errori",
    "suspend": "Sospendi",
    "resume": "Riprendi",
@@ -215,6 +221,33 @@
    "confirmDelete": "Elimina definitivamente",
    "loadingTenants": "Caricamento tenant…",
    "filter_deleted": "Eliminato",
-    "filter_active": "Attivo"
+    "filter_active": "Attivo",
+    "health": "Stato",
+    "serviceHealth": "Stato dei servizi",
+    "vllmDescription": "Motore di inferenza GPU",
+    "litellmDescription": "Proxy LLM & monitoraggio costi",
+    "tenantOverview": "Panoramica tenant",
+    "spendOverview": "Panoramica costi",
+    "globalSpend": "Costi globali (CHF)",
+    "activeTenants": "Tenant attivi",
+    "tenantsWithSpend": "tenant con spese registrate",
+    "refresh": "Aggiorna",
+    "healthUnavailable": "Dati di stato non disponibili.",
+    "loadingHealth": "Caricamento dati di stato…",
+    "statusHealthy": "OK",
+    "statusDown": "Non disponibile",
+    "spendChf": "Costi (CHF)"
+  },
+  "channelUsers": {
+    "title": "Utenti autorizzati",
+    "description": "Gestisci quali utenti possono interagire con il tuo assistente su ogni canale. Aggiungi il loro ID numerico per autorizzare l'accesso.",
+    "users": "utenti",
+    "placeholder": "Inserisci l'ID numerico…",
+    "add": "Aggiungi",
+    "remove": "Rimuovi",
+    "alreadyAdded": "Questo ID utente è già autorizzato.",
+    "telegramIdHelp": "Per trovare il tuo ID Telegram:\n1. Apri Telegram e invia un messaggio a @userinfobot\n2. Risponde istantaneamente con il tuo ID numerico\n3. Inserisci quel numero qui",
+    "discordIdHelp": "Per trovare il tuo ID Discord:\n1. Attiva la Modalità sviluppatore nelle impostazioni Discord (Avanzate)\n2. Clic destro sul tuo nome → Copia ID utente\n3. Inserisci quel numero qui",
+    "emailIdHelp": "Inserisci l'indirizzo e-mail che deve essere autorizzato a interagire con l'assistente."
  }
 }
--- a/src/types/index.ts
+++ b/src/types/index.ts
@@ -29,6 +29,7 @@ export interface PiecedTenantSpec {
  plan?: string;
  packages?: string[];
  workspaceFiles?: Record<string, string>;
+  channelUsers?: Record<string, string[]>;
  suspend?: boolean;
 }

@@ -88,12 +89,12 @@ export interface BillingAddress {
 }

 export type TenantRequestStatus =
-  | "pending"  // Submitted, awaiting admin approval
-  | "approved"  // Admin approved, provisioning will start
-  | "provisioning"  // PiecedTenant CR created, operator reconciling
-  | "active"  // Tenant running
-  | "rejected"  // Admin rejected
-  | "deleted";  // Tenant was deleted by admin
+  | "pending" // Submitted, awaiting admin approval
+  | "approved" // Admin approved, provisioning will start
+  | "provisioning" // PiecedTenant CR created, operator reconciling
+  | "active" // Tenant running
+  | "rejected" // Admin rejected
+  | "deleted"; // Tenant was deleted by admin

 export interface TenantRequest {
  id: string;
@@ -104,6 +105,7 @@ export interface TenantRequest {
  contactEmail: string;
  agentName: string;
  soulMd?: string;
+  agentsMd?: string | null;
  packages: string[];
  billingAddress: BillingAddress;
  billingNotes?: string;
@@ -119,6 +121,7 @@ export interface TenantRequest {
 export interface OnboardingInput {
  agentName: string;
  soulMd?: string;
+  agentsMd?: string;
  packages?: string[];
  billingAddress: BillingAddress;
  billingNotes?: string;
Author	SHA1	Message	Date
admin	dbfa7560cf	All the channel approval	2026-04-12 13:47:27 +02:00
admin	1edb5785e3	Add Health and Spend for Admins	2026-04-11 22:36:36 +02:00
admin	fdb56490dd	All the MD files via Database	2026-04-11 21:14:09 +02:00