Copy the files from this ZIP into your pieced-portal repo, overwriting existing files. All paths match the project structure — drop-in replacements.

2. The DB migration is automatic

The updated db.ts adds these idempotently on first query:

Column agents_md TEXT on tenant_requests
Table workspace_templates (file_key TEXT PK, content TEXT, updated_at TIMESTAMPTZ)

No manual ALTER TABLE needed.

3. Seed the workspace templates

After the portal has started (so the table exists):

kubectl exec -i portal-db-1 -n portal -- psql -U portal -d portal < seed-workspace-templates.sql

Or connect interactively and paste the SQL.

4. Edit templates as needed

To update a template later, just UPDATE the row:

UPDATE workspace_templates
SET content = '# Your new SOUL.md content here...', updated_at = now()
WHERE file_key = 'SOUL.md';

The portal reads templates on every wizard load / approval — no restart needed.

File Manifest

File	Action	What changed
`src/lib/workspace-defaults.ts`	NEW	Default content fetching from DB + TOOLS.md generation
`src/lib/db.ts`	REPLACE	Added `agents_md` column, `workspace_templates` table + CRUD
`src/types/index.ts`	REPLACE	Added `agentsMd` to `TenantRequest` and `OnboardingInput`
`src/app/api/onboarding/route.ts`	REPLACE	Accepts `agentsMd` field
`src/app/api/admin/requests/[id]/approve/route.ts`	REPLACE	Builds all 3 workspace files (SOUL/AGENTS/TOOLS)
`src/app/api/workspace-defaults/route.ts`	NEW	API to fetch defaults for wizard pre-fill
`src/components/onboarding/wizard.tsx`	REPLACE	"Advanced Configuration" accordion with AGENTS.md textarea + readonly TOOLS.md preview
`src/messages/{de,en,fr,it}.json`	REPLACE	Added `agentsMd`, `agentsMdHint`, `toolsMd`, `toolsMdHint`, `advancedConfig`, `readonlyNote`
`seed-workspace-templates.sql`	NEW	SQL to seed default templates

Design Decisions

TOOLS.md is readonly in both the wizard and the tenant detail page. It's auto-generated from the base template + per-package sections. Users see it but can't edit it.
AGENTS.md is editable in the wizard (under "Advanced Configuration" accordion) and on the tenant detail workspace editor.
Templates live in the DB (workspace_templates table) so you can edit them without redeploying. Hardcoded fallbacks exist in workspace-defaults.ts in case the DB rows are missing.
TOOLS.md is regenerated on approval based on the packages selected, so it's always consistent with what's actually enabled.
The workspace editor on the tenant detail page already supports arbitrary workspaceFiles keys from the CR spec, so AGENTS.md and TOOLS.md will appear there automatically. TOOLS.md should be made readonly there too — that's a separate small change to the workspace editor component (mark TOOLS.md as readonly based on the filename).