zz-meridian 0.7.0 → 0.9.0

package/README.md

@@ -9,7 +9,7 @@ dashboard depends on it afterwards.
 Give your coding agent (Codex, Claude Code, or any agent that can run a shell) this, with what you want in your own
 words at the end:
 
-> Run `npx zz-meridian@latest skill --global`, then follow the zz-meridian skill it installs to: <what you want>.
+> Run `npx zz-meridian@latest skill --global`, then follow the zz-meridian skill it installs to: [what you want, in your own words].
 
 The skill picks the command from what you said and what is in the folder, and names it before running anything:
 `adopt` to change this Next.js App Router project in place ("make this admin panel look professional"), `create` for a

package/dist/adopt.js

@@ -258,8 +258,12 @@ Rename or move them, then run adopt again.`);
         writes.set(`${dir}/icon.ts`, exactImports(`${dir}/icon.ts`, readPayload('app/icon.ts'), known));
     const ignore = path.join(root, '.gitignore');
     const ignored = fs.existsSync(ignore) ? fs.readFileSync(ignore, 'utf8') : '';
-    if (!/^\/?out\/?$/m.test(ignored))
-        writes.set('.gitignore', `${ignored.trimEnd()}\n\n# zz-meridian: verify's report and the screenshots\n/out/\n`);
+    // verify's report and screenshots, and an update in progress: Meridian's own, never the team's to commit. The manifest,
+    // keep.json and history/ are committed, since the next update reads them.
+    const bare = (l) => l.trim().replace(/^\//, '').replace(/\/$/, '');
+    const unignored = ['/out/', '/.meridian/update/', '/.meridian/update.lock'].filter((l) => !ignored.split('\n').some((x) => bare(x) === bare(l)));
+    if (unignored.length)
+        writes.set('.gitignore', `${ignored.trimEnd()}\n\n# zz-meridian: verify's report and an update in progress\n${unignored.join('\n')}\n`);
     // ── Write: every target checked first, so a bad one stops it before anything changes ─────────────────
     try {
         for (const rel of writes.keys())

package/dist/migrations.js

@@ -205,7 +205,31 @@ export const RELEASE_MIGRATIONS = [
         instructions: 'Read "Writes authorize, then invalidate" and "The assistant route" in references/cache.md. Call `resolveAccess()` first in the route and in each Server Action, answer 401 or an error result when there is no session, and hand the assistant only the collections the caller may read. The route passes a guard that authorizes each approved change again when it runs, so `src/lib/assistant/tools.ts` and `src/lib/assistant/respond.ts` take that guard too: bring them over from the release with the route.',
         checks: GATE_AND_BUILD,
     },
+    {
+        id: 'share-view-context',
+        since: '0.9.0',
+        applies: (root) => matching(root, (_, src) => callArity(src, 'useShareView').some((n) => n === 2)),
+        summary: 'useShareView takes one shared context, not a sentence and an object.',
+        instructions: 'Read "Legible" in references/agents.md and "A shared context" in references/customize.md. Build the view\'s context with the fields of `SharedContext` from `src/lib/shared-context.ts` (scope, freshness, each figure with its unit, change and definition, what code finds, what the data cannot say) in a pure function beside the view, and pass it alone: `useShareView(context)`. Both agents read it: an MCP host and the console\'s assistant.',
+        checks: GATE_AND_BUILD,
+    },
+    {
+        id: 'agent-reads-section',
+        since: '0.9.0',
+        applies: pagesWithoutAgentReads,
+        summary: 'A page under app/(dashboard)/ or app/embed/ says what the agent reads.',
+        instructions: 'Read "A page spec" in references/customize.md. Under `## Agents` in the page\'s README.md, add `### What the agent reads`: what the page\'s shared context tells each agent, with a real line of it, and what the MCP App and the console\'s assistant each receive. `scripts/check.ts` requires it.',
+        checks: ['gate'],
+    },
 ];
+/** The page specifications under the console and embed folders that lack the part the 0.9.0 check requires. */
+function pagesWithoutAgentReads(root) {
+    const files = [];
+    for (const d of ['app/(dashboard)', 'app/embed'])
+        walk(root, d, files, /^README\.md$/);
+    const hits = files.filter((rel) => !/^## Agents\n[\s\S]*?^### What the agent reads$/m.test(text(root, rel) ?? ''));
+    return hits.length > 0 ? hits : null;
+}
 /** The registry entries that apply to a project moving from `source` to `target`, as journal migrations. */
 export function releaseMigrations(root, source, target) {
     const out = [];

package/dist/ownership.js

@@ -1,14 +1,14 @@
 const HASH = /^sha256-[0-9a-f]{64}$/;
 const SEMVER = /^\d+\.\d+\.\d+$/;
 /** The library modules Meridian's components and gates import; the rest of src/lib belongs to the template's pages. */
-export const LIB = ['cn', 'format', 'format-date', 'period', 'color', 'host', 'preferences', 'csv', 'safe-markdown', 'logo', 'collection', 'live'].map((n) => `src/lib/${n}.ts`);
+export const LIB = ['cn', 'format', 'format-date', 'period', 'color', 'host', 'preferences', 'csv', 'safe-markdown', 'logo', 'collection', 'live', 'shared-context', 'agent-guidance', 'insight'].map((n) => `src/lib/${n}.ts`);
 /** The single files adopt copies besides the folders and the library: all of them must be in a payload that is whole. */
 export const FIXED = [...LIB, 'src/lib/assistant/prompt.ts', 'src/views/console-chrome.tsx', 'tests/setup.ts'];
 /** The one rule, a plain-English line per clause. `references/ownership.md` renders it, so the guidance cannot drift. */
 export const OWNERSHIP = [
     'Managed: the payload files under `tokens/`, `src/styles/` and `src/components/`, except each component\'s `README.md` and `preview.tsx`.',
     'Managed: the distributed scripts under `scripts/`, except `scripts/verify.config.ts`, the first-load baseline `optional:scripts/verify.baseline.json` and a team-local `optional:scripts/check.local.ts`.',
-    'Managed: the library helpers `src/lib/cn.ts`, `src/lib/format.ts`, `src/lib/format-date.ts`, `src/lib/period.ts`, `src/lib/color.ts`, `src/lib/host.ts`, `src/lib/preferences.ts`, `src/lib/csv.ts`, `src/lib/safe-markdown.ts`, `src/lib/logo.ts`, `src/lib/collection.ts` and `src/lib/live.ts`, and the assistant prompt `src/lib/assistant/prompt.ts`.',
+    'Managed: the library helpers `src/lib/cn.ts`, `src/lib/format.ts`, `src/lib/format-date.ts`, `src/lib/period.ts`, `src/lib/color.ts`, `src/lib/host.ts`, `src/lib/preferences.ts`, `src/lib/csv.ts`, `src/lib/safe-markdown.ts`, `src/lib/logo.ts`, `src/lib/collection.ts`, `src/lib/live.ts`, `src/lib/shared-context.ts`, `src/lib/agent-guidance.ts` and `src/lib/insight.ts`, and the assistant prompt `src/lib/assistant/prompt.ts`.',
     'Managed: `src/views/console-chrome.tsx` and `tests/setup.ts`.',
     'Managed: `optional:scripts/package.json`, only when the adopt or create that set the project up generated it for this project shape.',
     'Managed: both installed skill trees, `optional:.agents/skills/zz-meridian/` and `optional:.claude/skills/zz-meridian/`, taken from the release\'s skill payload.',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zz-meridian",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Bring ZZ Meridian, a dashboard design system, into a Next.js project, or start a new dashboard on it. Copies the files in; nothing depends on this package at runtime.",
   "license": "MIT",
   "type": "module",

package/payload/CHANGELOG.md

@@ -2,6 +2,44 @@
 
 Every release of ZZ Meridian, newest first. Versions follow semver: a removed or renamed token, prop or card is major; a new card, token or variant is minor; a corrected value is a patch. Each entry says what breaks and what to do instead.
 
+## [0.9.0] · 2026-10-07
+
+### Added
+
+- **Every page tells both agents the same thing (decision 0011).** A view builds one shared context (`src/lib/shared-context.ts`, one producer per page in `src/views/*-context.ts`): its scope and freshness, what the person points at, every figure with its unit, its change and its definition, what code computed from them (`src/lib/insight.ts`: a day against its median, a share, a ranking, a run of days, what nothing recorded explains), and what the data cannot say. An MCP host receives it through `ui/update-model-context`, inline and in fullscreen; the console's assistant receives it in its prompt, with the page's address and query. All nine console pages and the four embed views share one.
+- **Every view has a tool.** `src/views/tools.ts` holds each view's contract: its name, its address as input, its `ui://` resource, and one read that returns what it renders and what the agents are told. The console's assistant offers each as a read-only `view_<name>`; `docs/agents.md` registers the same list on an MCP server, with the apply tool of a change registered view-only. The embed routes render from their tool's read.
+- **The assistant is told its limits.** Its prompt lists what it cannot do or see, from each collection's `pageOnly`, `hidden` and missing operations, so it can say why.
+- **Ask hands a card to the console's assistant.** With the assistant on, Ask appears on the featured card of Overview, Requests, Health and Analytics; a press opens the panel and sends the card's question with the page's context (`ConsoleSurface`). Ask renders only after hydration.
+- **An MCP view says when the host refuses.** A refused context is sent once more, and Ask then carries the view's address; a refused Ask tells the person in a toast with the question's words.
+- **The person sees the findings.** `MetricTile` takes `finding` (a line, with a day it points the Meridian there) and `baseline` ("2.7× usual" beside a day being read); `TrendChart` takes `baseline`, a dashed median line. The Overview uses all three.
+- **An agent's change leaves an Activity line.** The assistant's guard takes an optional `record`; the template writes to a new `activity` collection, and the Overview's Activity is live.
+- **The Overview, Analytics and Health read through `read()`.** Daily totals, endpoints, responses, services, incidents and activity are read-only collections (`src/data/metrics.ts`).
+- **An address can name a day.** `?day=2026-09-22` opens the Overview pointed at it (`Meridian day`).
+
+### Breaking
+
+`update` reports the two that touch the team's own files as migrations, `share-view-context` and `agent-reads-section`, with what to change (`references/update.md`, "Resolving 0.9.0's migrations"); `src/lib/shared-context.ts`, `src/lib/agent-guidance.ts` and `src/lib/insight.ts` are Meridian's now and arrive with the update.
+
+- `useShareView(text, structured)` is `useShareView(context)`. Build a context with the fields in `SharedContext`; `contextText` writes the text both agents read.
+- `scripts/check.ts` requires `### What the agent reads` under `## Agents` in the README of every page under `app/(dashboard)/` and `app/embed/`. Add it to a product's own pages, saying what the page's context tells each agent.
+- `src/data/sample.ts` no longer exports `ENDPOINTS`, `STATUS_MIX`, `ACTIVITY`, `INCIDENTS`, `PAST_INCIDENTS`, `SERVICES` or `demoTotals`: read them through `src/data/metrics.ts`. `RequestView` takes `routeP95`.
+- `OverviewBody`, `HealthBody` and `AnalyticsBody` take the period key, `updatedAt` and, for the first and last, the incidents and activity beside the figures; `RequestsView` takes `updatedAt` and `now`.
+
+## [0.8.0] · 2026-10-06
+
+### Added
+
+- **A demo password in front of the whole product.** With `DEMO_PASSWORD` set at run time, `proxy.ts` sends every route to the sign-in page (an API answers 401), whose panel becomes "Open the demo": one password field, a 30-day signed session (`src/lib/demo-gate.ts`, keyed by `DEMO_SECRET` when set), and opening the page again signs out. Without it nothing changes: the panel is the product's sign-in and nothing is gated. The sign-in panel now streams in behind a Suspense boundary, so the rest of the page still prerenders. Meridian's own demo deploys to CapRover from this repository (`Dockerfile`, `captain-definition`, neither in the package).
+
+### Changed
+
+- **`update` is tested from the last three releases.** The release updates a project of the release before, adopted and created, through finalize; the weekly run the last three. Every published origin used to run at each release, which took 11 of its 18 minutes and grew with every release. From an older project, update in steps (`references/update.md`).
+
+### Fixed
+
+- **A project leaves an update in progress and each person's agent settings out of git.** Its `.gitignore` (the template's, for a created project; three lines `adopt` adds, for an adopted one) ignores `.meridian/update/` and `.meridian/update.lock`, the staged copies, backups and lock of an unfinished update, which a commit mid-session used to take in; a created project also ignores `.claude/settings.local.json` and `.claude/*.lock`. The manifest, `keep.json`, `.meridian/history/` and both copies of the skill stay committed: the next update and the team's agents read them. In a project made before 0.8.0, add those lines to `.gitignore`.
+- **The one sentence shows its blank.** It ended in `<what you want>`, which GitHub and npm read as an HTML tag and dropped, so it read "installs to: .". It ends in `[what you want, in your own words]`.
+
 ## [0.7.0] · 2026-10-06
 
 ### Changed

package/payload/CONTRIBUTING.md

@@ -39,7 +39,7 @@ Every card's README follows the same order, so a reader always knows where to lo
 4. **States**: rest, hover, pressed, focus, selected, disabled, loading, empty, error, each with its transition (property, duration token, curve).
 5. **Behaviour**: interaction, keyboard, timing.
 6. **Surfaces**: console, mobile (under 1024px) and embed (an MCP App): what changes on each, or "same", and why.
-7. **Agents**: what an agent may read here, what it may do (and through which proposal), and how its work is marked. Write "Not applicable" for purely presentational parts.
+7. **Agents**: what an agent may read here, what it may do (and through which proposal), and how its work is marked. Write "Not applicable" for purely presentational parts. A page or a view that shares a context (`useShareView`, decision 0011) adds **What the agent reads** under it: what its context says, with a real line of it, and what each consumer receives (the MCP App through `ui/update-model-context`, the console's assistant in its prompt).
 8. **Accessibility**: roles, names, keyboard, and contrast quoted from `node scripts/contrast.ts --all` (the dark theme and the indigo accent, the defaults; add light where it differs in kind).
 9. **Content**: copy rules with real strings.
 10. **Do and do not.**
@@ -75,6 +75,7 @@ Write the status on the line under the title: `Status: beta`.
 - Under reduced motion it shows its final state with nothing moving.
 - Keyboard: every control reachable, operable and visibly focused; focus order follows reading order.
 - An agent's work in it is marked (Agent mark, "via" attribution, or a Proposal); no agent write happens without one.
+- A page shares a context both agents read: its scope and freshness, every figure with its unit, change and definition, what code derived from them, and what the data cannot say, within 2,400 characters. A figure an agent would otherwise recompute is computed in the context.
 
 ## Tools
 

package/payload/README.md

@@ -74,15 +74,16 @@ Dark is the default, written on `:root`; the light theme follows the operating s
 | `scripts/` | Generators, gates, `brand.ts` and `verify.ts` (see `CONTRIBUTING.md`) |
 | `skills/zz-meridian/` | The agent skill (Claude Code, Codex) that builds dashboards on this template or brings it into yours |
 | `cli/` | The `zz-meridian` npm package: `create`, `adopt`, `update`, `brand` and `skill`, its build, its smoke test and the fixture app (`docs/distribution.md`) |
-| `.github/workflows/release.yml` | The release, each check once: a timed default verify and the consumer path from the tarball (every published origin updated), then npm with provenance, the registry's bytes and provenance checked, then the tag (`.claude/commands/release.md`) |
+| `.github/workflows/release.yml` | The release, each check once: a timed default verify and the consumer path from the tarball (the release before updated; the last three weekly), then npm with provenance, the registry's bytes and provenance checked, then the tag (`.claude/commands/release.md`) |
 | `.github/workflows/weekly.yml` | Weekly, never at release: `verify --full --perf` (perf a report) and the consumer smoke's recovery and failure cases; nothing waits on it |
+| `Dockerfile`, `captain-definition` | The demo deployment: the template and the Atlas behind `DEMO_PASSWORD` (`proxy.ts`, `app/sign-in/README.md`), deployed to CapRover from this repository; never in the package |
 
 ## Get a dashboard on Meridian, in one sentence
 
 Give your coding agent (Codex, Claude Code, or any agent that can run a shell) this, with what you want in your own
 words at the end:
 
-> Run `npx zz-meridian@latest skill --global`, then follow the zz-meridian skill it installs to: <what you want>.
+> Run `npx zz-meridian@latest skill --global`, then follow the zz-meridian skill it installs to: [what you want, in your own words].
 
 You do not choose between the package's commands; the skill does, from what you said and what is in the folder, and
 names the route before it runs anything:

package/payload/app/(dashboard)/(overview)/README.md

@@ -41,7 +41,24 @@ From `src/system/fixtures/sample.ts`: `demoSeries(period)` (one point per day, a
 
 ## Agents
 
-The embed view shares the period and its totals, or the day the Meridian points at, with the model. Ask on the trend posts "Why did requests change on <day>?". The Activity feed marks the agent's own changes ("Claude … · for Jonas Weber").
+The page shares one context with both agents (decision 0011), built by `overviewContext` in `src/views/overview-context.ts` from the figures the page draws. The Activity feed marks the agent's own changes ("Claude … · for Jonas Weber").
+
+### What the agent reads
+
+The period with its dates, freshness, the four figures, each with its change against the previous period and its definition (the tiles' `hint`s come from the same `OVERVIEW_METRICS`), the day the Meridian points at against the same weekday and the period's median, and what code computed:
+
+```text
+- Error rate was 2.6× to 2.7× the period's median of 0.81% on 21 and 22 Sept (2.13%, 2.18%); no other day passed 1.2×.
+- Latency p95 rose on the same days: 525ms and 505ms against a median of 296ms.
+Unknown:
+- Nothing is recorded between 20 Sept and 23 Sept: no incident and no activity event, so nothing on this page explains the rise on 21 and 22 Sept.
+```
+
+It also says which endpoint contributes most errors, that requests follow the week, what the status classes mean against the error rate's definition, which incident sits beside a spike when one does (in 90 days: "Upload failures for files over 50 MB"), and that today is partial.
+
+- **MCP App:** the text above as `ui/update-model-context`, with the same context as its structured part, from the inline view and from fullscreen alike, on load and on every change.
+- **Console assistant:** the same text in its prompt's `<view-context>` block, with the page's address and query, and the page text after it for anything the context does not cover.
+- **Handoff:** Ask on the featured card hands the period, or the day the Meridian points at, to the assistant: "What stands out in requests, errors and latency over the last 30 days, and why?"
 
 ## Embed view
 

package/payload/app/(dashboard)/(overview)/page.tsx

@@ -5,15 +5,20 @@ import { Freshness } from '@/components/patterns/freshness';
 import { PeriodSelect } from '@/components/patterns/period-select';
 import { Skeleton } from '@/components/ui/skeleton';
 import { OverviewBody } from '@/views/overview';
-import { DEMO_NOW, DEMO_UPDATED_AT, demoSeries, demoTotals, ENDPOINTS, STATUS_MIX, ACTIVITY } from '@/data/sample';
-import { parsePeriod, PERIOD_LABEL } from '@/lib/period';
+import { DEMO_NOW, DEMO_UPDATED_AT } from '@/data/sample';
+import { overviewTool } from '@/views/tools';
+import { cache } from 'react';
+import { parsePeriod } from '@/lib/period';
 import { app } from '@/app.config';
 import { Busy } from '../_loading';
 import { OverviewSkeleton } from './loading';
 
 export const metadata = { title: 'Overview' };
 
-type SearchParams = Promise<{ period?: string }>;
+type SearchParams = Promise<{ period?: string; day?: string }>;
+
+/** The page's one read, through the Overview tool (`src/views/tools.ts`), shared by the export and the body. */
+const readPeriod = cache((period: ReturnType<typeof parsePeriod>, day?: string) => overviewTool.read({ period, day: /^\d{4}-\d{2}-\d{2}$/.test(day ?? '') ? day : undefined }));
 
 /** The masthead renders at once; the period select, the export and the body read the address inside their own boundaries. */
 export default function OverviewPage({ searchParams }: { searchParams: SearchParams }) {
@@ -38,15 +43,17 @@ export default function OverviewPage({ searchParams }: { searchParams: SearchPar
 
 async function Actions({ searchParams }: { searchParams: SearchParams }) {
   const period = parsePeriod((await searchParams).period);
+  const { data } = await readPeriod(period);
   return (
     <>
       <Suspense><PeriodSelect value={period} /></Suspense>
-      <ExportButton rows={demoSeries(period).current} filename={`overview-${period}.csv`} noun="days" className="max-sm:hidden" />
+      <ExportButton rows={data.series} filename={`overview-${period}.csv`} noun="days" className="max-sm:hidden" />
     </>
   );
 }
 
 async function Body({ searchParams }: { searchParams: SearchParams }) {
-  const period = parsePeriod((await searchParams).period);
-  return <OverviewBody period={PERIOD_LABEL[period].toLowerCase()} series={demoSeries(period).current} totals={demoTotals(period)} endpoints={ENDPOINTS} mix={STATUS_MIX} activity={ACTIVITY} now={DEMO_NOW.toISOString()} />;
+  const { period, day } = await searchParams;
+  const { data } = await readPeriod(parsePeriod(period), day);
+  return <OverviewBody {...data} />;
 }

package/payload/app/(dashboard)/analytics/README.md

@@ -39,7 +39,19 @@ Status: beta
 
 ## Agents
 
-Not applicable: an agent answers analytical questions from the Overview and Requests views' shared context and the API, not by driving this page.
+An agent drives nothing here; it reads the page through its shared context (decision 0011), built by `analyticsContext` in `src/views/analytics-context.ts`.
+
+### What the agent reads
+
+The period, freshness, the busiest hour of the week and of the day, each region's share with its p50, every endpoint in the table's current order, the day the Meridian points at, and what code found: the same error spike as the Overview (by the same code), the slowest and the most failing endpoint against the median, the slowest region, and the weekend's share of a weekday. It says that the weekday-and-hour pattern, the regions and the endpoints are sums over the period, not a day.
+
+```text
+- POST /v1/files fails most: 1.88% of its requests, 5.0× the 0.37% across endpoints. Evidence: /requests?q=%2Fv1%2Ffiles
+```
+
+- **Console assistant:** this text in its prompt's `<view-context>` block, with the page's address and query, and the page text after it for anything the context does not cover.
+- **MCP App:** no embed view yet; an MCP server can return this context as a tool's text (`docs/agents.md`).
+- **Handoff:** Ask on Errors per day hands the pointed day, or the period, to the assistant: "Why did errors change on 22 Sept 2026?"
 
 ## Accessibility
 

package/payload/app/(dashboard)/analytics/page.tsx

@@ -6,7 +6,9 @@ import { Freshness } from '@/components/patterns/freshness';
 import { PeriodSelect } from '@/components/patterns/period-select';
 import { Skeleton } from '@/components/ui/skeleton';
 import { AnalyticsBody } from '@/views/analytics';
-import { DEMO_NOW, DEMO_UPDATED_AT, ENDPOINTS, demoHeatmap, demoSeries, REGION_LATENCY, requestsByHour } from '@/data/sample';
+import { DEMO_NOW, DEMO_UPDATED_AT } from '@/data/sample';
+import { analyticsTool } from '@/views/tools';
+import { cache } from 'react';
 import { parsePeriod } from '@/lib/period';
 import { Busy } from '../_loading';
 import { AnalyticsSkeleton } from './loading';
@@ -36,17 +38,21 @@ export default function AnalyticsPage({ searchParams }: { searchParams: SearchPa
   );
 }
 
+/** The page's one read, through the Analytics tool (`src/views/tools.ts`), shared by the export and the body. */
+const readPeriod = cache((period: ReturnType<typeof parsePeriod>) => analyticsTool.read({ period }));
+
 async function Actions({ searchParams }: { searchParams: SearchParams }) {
   const period = parsePeriod((await searchParams).period);
+  const { data } = await readPeriod(period);
   return (
     <>
       <Suspense><PeriodSelect value={period} /></Suspense>
-      <ExportButton rows={demoSeries(period).current} filename={`analytics-${period}.csv`} noun="days" className="max-sm:hidden" />
+      <ExportButton rows={data.series} filename={`analytics-${period}.csv`} noun="days" className="max-sm:hidden" />
     </>
   );
 }
 
 async function Body({ searchParams }: { searchParams: SearchParams }) {
-  const period = parsePeriod((await searchParams).period);
-  return <AnalyticsBody series={demoSeries(period).current} heat={demoHeatmap()} hours={requestsByHour()} regions={REGION_LATENCY} endpoints={ENDPOINTS} />;
+  const { data } = await readPeriod(parsePeriod((await searchParams).period));
+  return <AnalyticsBody {...data} />;
 }

package/payload/app/(dashboard)/customers/README.md

@@ -39,7 +39,18 @@ None yet: a `zz_meridian_customer { name }` view would show one customer's card
 
 ## Agents
 
-An agent reads customers through their requests view; it never changes a plan or invites from here.
+An agent reads customers through this page's shared context and their requests view; it never changes a plan or invites from here. The context is built by `customersContext` in `src/views/customers-context.ts`, and the tiles' `hint`s come from its `CUSTOMER_METRICS`.
+
+### What the agent reads
+
+The three tiles with their definitions, every customer in the table's filter and order (with the columns a narrow screen drops: the error rate and the trend are still the person's to read), and what code found: how concentrated spend is, how combined requests moved over the last 7 days against the 7 before and who departs from that by 10 points or more, and which customers fail at twice the median rate. Lists stop at 25 and say how many more there are.
+
+```text
+- Combined requests are up 15% over the last 7 days against the 7 before. Apart from that: Fernway Bank up 36%.
+```
+
+- **Console assistant:** this text in its prompt's `<view-context>` block, with the page's address and query, and the page text after it for anything the context does not cover.
+- **MCP App:** no embed view yet; an MCP server can return this context as a tool's text (`docs/agents.md`).
 
 ## Content
 

package/payload/app/(dashboard)/health/README.md

@@ -42,7 +42,15 @@ Without a live incident row 1 becomes one full-width featured card.
 
 ## Agents
 
-The page itself takes no agent action. Its embed shares the summary and the open incident with the model; an agent can be asked about the incident from the inline banner.
+The page itself takes no agent action. It shares one context with both agents (decision 0011), built by `healthContext` in `src/views/health-context.ts`.
+
+### What the agent reads
+
+Every service's state, latency now and uptime; the average uptime with its definition; which services carry the days below operational ("Inference API accounts for 3 of them"); the open incident with its latest update by time, not by position; the longest incident resolved in the period. Unknowns: that a monitoring incident is not yet confirmed fixed, and that latency is one reading with no history to call it unusual.
+
+- **MCP App:** the text above as `ui/update-model-context`, with the same context as its structured part, from the inline view and from fullscreen alike, on load and on every change.
+- **Console assistant:** the same text in its prompt's `<view-context>` block, with the page's address and query, and the page text after it for anything the context does not cover.
+- **Handoff:** Ask on the uptime card hands the open incident to the assistant: "Which service is hurting uptime, and is … over?"
 
 ## Embed view
 

package/payload/app/(dashboard)/health/page.tsx

@@ -2,22 +2,23 @@ import { app } from '@/app.config';
 import { PageFrame } from '@/components/base/shell';
 import { Freshness } from '@/components/patterns/freshness';
 import { PackedHealthBody, SubscribeButton } from '@/views/health';
+import { healthTool } from '@/views/tools';
 import { packServices } from '@/components/patterns/status-list/summarise';
-import { DEMO_NOW, DEMO_UPDATED_AT, INCIDENTS, SERVICES, PAST_INCIDENTS } from '@/data/sample';
 
 export const metadata = { title: 'Health' };
 
-export default function HealthPage() {
-  const current = INCIDENTS.find((i) => i.state !== 'resolved') ?? null;
+/** Rendered from the Health tool's own read (`src/views/tools.ts`): the services and incidents the caller may read. */
+export default async function HealthPage() {
+  const { data } = await healthTool.read({});
   return (
     <PageFrame
       kicker={<>{app.name} · {app.workspace}</>}
       title="Health"
       description="Every service, how it is right now, and what happened in the last 90 days."
-      meta={<Freshness updatedAt={DEMO_UPDATED_AT} now={DEMO_NOW} />}
+      meta={<Freshness updatedAt={new Date(data.updatedAt)} now={new Date(data.now)} />}
       actions={<SubscribeButton />}
     >
-      <PackedHealthBody services={packServices(SERVICES)} current={current} past={PAST_INCIDENTS} now={DEMO_NOW.toISOString()} />
+      <PackedHealthBody {...data} services={packServices(data.services)} />
     </PageFrame>
   );
 }

package/payload/app/(dashboard)/keys/README.md

@@ -41,7 +41,14 @@ Not offered. Keys are secrets, and creating one is a page-only operation. In the
 
 ## Agents
 
-An agent may say which keys are unused (from the shared context of other views) and may propose revoking a key (a critical Proposal); it never creates one. The proposal waits for approval, and its approval removes the key through the same collection.
+An agent may propose revoking a key (a critical Proposal); it never creates one, because a key's secret is shown once, on this page (`pageOnly`). The proposal waits for approval, and its approval removes the key through the same collection. The page shares its context through `keysContext` in `src/views/keys-context.ts`.
+
+### What the agent reads
+
+Every key with its id, environment, hint (the first and last characters, never the secret), owner, scopes, when it was created and last used, and what code found: live keys unused for 30 days, live keys with every scope, and an owner holding several live keys. The secret and its hash are never in it (`secretHash` is `hidden`), and the context says so, with the rule that creating a key is the person's.
+
+- **Console assistant:** this text in its prompt's `<view-context>` block, with the page's address and query, and the page text after it for anything the context does not cover.
+- **MCP App:** no embed view yet; an MCP server can return this context as a tool's text (`docs/agents.md`).
 
 ## Content
 

package/payload/app/(dashboard)/members/README.md

@@ -42,7 +42,18 @@ Not offered. Inviting and removing people are decisions for the console, not a c
 
 ## Agents
 
-The assistant reads and proposes changes here through Proposals: it adds, changes and removes members only after a person approves, and what it changed shows on this page after a refresh. A change made here is what the assistant reads next.
+The assistant reads and proposes changes here through Proposals: it adds, changes and removes members only after a person approves, and what it changed shows on this page after a refresh. A change made here is what the assistant reads next. The page shares its context through `membersContext` in `src/views/members-context.ts`.
+
+### What the agent reads
+
+Counts by status, role (with what each role may do) and team, everyone with their role, team, status and when they were last seen (25 at most; `query_members` finds the rest), and what code found: active members unseen for 60 days or more, unanswered invitations, and who can change the workspace. It says that "last active" is a console sign-in, not use of the API.
+
+```text
+- 3 active members have not been seen for 60 days or more: Alice Moreno (Viewer, Support, 94 days), Felix Andersson (Viewer, Engineering, 75 days), Ravi Patel (Viewer, Support, 71 days).
+```
+
+- **Console assistant:** this text in its prompt's `<view-context>` block, with the page's address and query, and the page text after it for anything the context does not cover.
+- **MCP App:** no embed view yet; an MCP server can return this context as a tool's text (`docs/agents.md`).
 
 ## Content
 

package/payload/app/(dashboard)/requests/README.md

@@ -51,7 +51,21 @@ Export CSV is a link to `/api/export/requests` with the same filters and sort: t
 
 ## Agents
 
-An agent opens this page's views through `zz_meridian_requests`; it reads them through the shared context; it never exports or blocks from here. Its filters are marked until a person changes one.
+An agent opens this page's views through `zz_meridian_requests`; it never exports or blocks from here. Its filters are marked until a person changes one. The page shares one context with both agents (decision 0011), built by `requestsContext` in `src/views/requests-context.ts` from the page's read: the rows on screen and the summary of the whole filtered set.
+
+### What the agent reads
+
+The filters in words and the span of time the log covers; freshness; the three figures with their change against the half hour before and their definitions (the tiles' `hint`s come from `REQUEST_METRICS`); the page, the sort and the rows on screen by id; and what the matching requests and their errors have in common:
+
+```text
+- 5 of the 9 errors and limits are in eu-west-1 (56%). Evidence: /requests?region=eu-west-1
+```
+
+When a half hour holds fewer than 30 requests it says the change is too few to read as a trend, and when the summary reads only the newest 500 it says so.
+
+- **MCP App:** the text above as `ui/update-model-context`, with the same context as its structured part, from the inline view and from fullscreen alike, on load and on every change.
+- **Console assistant:** the same text in its prompt's `<view-context>` block, with the page's address and query, and the page text after it for anything the context does not cover.
+- **Handoff:** Ask in the filter bar hands the filtered set to the assistant: "What do these requests with status 5xx have in common, and why?"
 
 ## Accessibility
 

package/payload/app/(dashboard)/requests/[id]/README.md

@@ -41,7 +41,18 @@ None of its own. An agent shows a request through `zz_meridian_requests` (inline
 
 ## Agents
 
-Replay and blocking a key are a person's actions here. An agent that wants either sends a Proposal.
+Replay is a person's action here: it is `pageOnly`, so no agent can run or propose it. The page shares its context through `requestContext` in `src/views/request-context.ts`.
+
+### What the agent reads
+
+The request, its status, latency (with its definition), customer and region, every phase with its start and duration, the payloads' sizes (their text is in the page text), and what code found: where most of the time went, the latency against the route's p95, and, for a failed request, that it counts in the error rate. It says that one request is one sample, and that replaying it is the person's.
+
+```text
+- Most of its time went to Rate limit (Over 1,200 requests a minute): 159ms, 93% of 171ms.
+```
+
+- **Console assistant:** this text in its prompt's `<view-context>` block, with the page's address and query, and the page text after it for anything the context does not cover.
+- **MCP App:** no embed view yet; an MCP server can return this context as a tool's text (`docs/agents.md`).
 
 ## Accessibility
 

package/payload/app/(dashboard)/requests/[id]/page.tsx

@@ -1,4 +1,5 @@
 import { read } from '@/data/read';
+import { readEndpoints } from '@/data/metrics';
 import { FEATURED_REQUEST_IDS, traceOf, payloadsOf, type RequestRow } from '@/data/sample';
 import { MissingPage } from '@/views/missing-page';
 import { RequestView } from '@/views/request';
@@ -23,5 +24,6 @@ export default async function RequestPage({ params }: { params: Promise<{ id: st
   const { request: r, observedAt } = await byId(id);
   // Rendered here rather than thrown, so the screen is in the first HTML (see MissingPage).
   if (!r) return <MissingPage />;
-  return <RequestView request={r} trace={traceOf(r)} payloads={payloadsOf(r)} now={observedAt} replay={replayRequest} />;
+  const route = (await readEndpoints()).find((e) => e.method === r.method && e.route === r.route);
+  return <RequestView request={r} trace={traceOf(r)} payloads={payloadsOf(r)} routeP95={route?.p95 ?? null} now={observedAt} replay={replayRequest} />;
 }

package/payload/app/(dashboard)/requests/page.tsx

@@ -65,6 +65,6 @@ async function RequestsExport({ searchParams }: { searchParams: SearchParams })
 }
 
 async function Requests({ searchParams }: { searchParams: SearchParams }) {
-  const { rows, total, summary, state } = await readPage(await searchParams);
-  return <RequestsView rows={rows} total={total} summary={summary} state={state} pageSize={REQUEST_PAGE} />;
+  const { rows, total, summary, state, observedAt } = await readPage(await searchParams);
+  return <RequestsView rows={rows} total={total} summary={summary} state={state} pageSize={REQUEST_PAGE} updatedAt={DEMO_UPDATED_AT.toISOString()} now={observedAt} />;
 }

package/payload/app/(dashboard)/settings/README.md

@@ -42,6 +42,13 @@ Appearance reads and writes `usePreferences()` (stored on the device). Time zone
 
 This is where people govern agents: whether assistants may read, which are connected, and the rule (locked on) that nothing an agent proposes runs without approval, a removal included. The assistant section, shown only where the product has an assistant, holds the person's switch for its panel.
 
+### What the agent reads
+
+Every section's current values, which neither an input's nor a switch's text carries: the workspace's name, address and time zone (and an unsaved edit, when there is one), each notification switch, this device's theme, accent and density, whether the assistant is shown, whether assistants may read dashboards and which are connected with what they may do, and that deleting the workspace is typed, never proposed. Each section reports its own line; `SettingsBody` shares them as one context. None is offered to an agent as a change, and the context says so.
+
+- **Console assistant:** this text in its prompt's `<view-context>` block, with the page's address and query, and the page text after it for anything the context does not cover.
+- **MCP App:** no embed view yet; an MCP server can return this context as a tool's text (`docs/agents.md`).
+
 ## Accessibility
 
 - Each section is a form with its own submit; switches carry their label and description.

package/payload/app/api/assistant/route.ts

@@ -2,9 +2,11 @@ import { safeValidateUIMessages } from 'ai';
 import { revalidateTag } from 'next/cache';
 import { assistantConfig } from '@/lib/assistant/config';
 import { clock, collections } from '@/data/collections';
-import { Unauthenticated, can, collectionFor, resolveAccess } from '@/data/access';
+import { Unauthenticated, can, collectionFor, nameOf, resolveAccess } from '@/data/access';
 import { collectionTag } from '@/data/read';
 import { respond } from '@/lib/assistant/respond';
+import type { AgentChange } from '@/lib/assistant/tools';
+import { viewTools } from '@/views/tools';
 
 /** The panel sends at most the last 100 messages; a larger body than 2 MB is refused before it is parsed. */
 const MAX_MESSAGES = 100;
@@ -20,7 +22,7 @@ export async function POST(request: Request): Promise<Response> {
   const raw = await request.text();
   if (raw.length > MAX_BODY) return new Response(null, { status: 413 });
   const body: unknown = (() => { try { return JSON.parse(raw); } catch { return null; } })();
-  const { messages, page } = (body ?? {}) as { messages?: unknown; page?: { path?: unknown; title?: unknown; text?: unknown } };
+  const { messages, page } = (body ?? {}) as { messages?: unknown; page?: { path?: unknown; title?: unknown; context?: unknown; text?: unknown } };
   if (!Array.isArray(messages) || messages.length === 0 || messages.length > MAX_MESSAGES) return new Response(null, { status: 400 });
   const valid = await safeValidateUIMessages({ messages });
   if (!valid.success) return new Response(null, { status: 400 });
@@ -35,14 +37,32 @@ export async function POST(request: Request): Promise<Response> {
       return now !== null && now.tenantId === scope.tenantId && now.subjectId === scope.subjectId && can(now, name, op, ids);
     },
     invalidate: (name: string) => revalidateTag(collectionTag(scope.tenantId, name), { expire: 0 }),
+    // Provenance (decision 0011): an approved change leaves an Activity line naming the agent and the person it acted
+    // for. Only where the product keeps activity and the person may add to it; the change stands either way.
+    record: async (change: AgentChange) => {
+      if (!(await can(scope, 'activity', 'create'))) return;
+      await collectionFor(scope, 'activity').create!({ at: clock().toISOString(), actor: (await nameOf(scope)) ?? 'You', via: 'Assistant', ...activityLine(change) });
+      revalidateTag(collectionTag(scope.tenantId, 'activity'), { expire: 0 });
+    },
   };
 
   return respond({
     ...config,
     collections: readable,
+    // Every view's read-only tool; each reads through `read()`, so it sees only what this caller may read.
+    views: viewTools,
     guard,
     now: clock(),
     messages: valid.data,
-    page: { path: String(page?.path ?? ''), title: String(page?.title ?? ''), text: String(page?.text ?? '') },
+    page: { path: String(page?.path ?? ''), title: String(page?.title ?? ''), context: String(page?.context ?? ''), text: String(page?.text ?? '') },
   });
 }
+
+/** An agent's change as an Activity line: "changed status to Suspended for Alice Moreno and Ravi Patel". */
+function activityLine({ label, op, titles, set }: AgentChange): { verb: string; object: string } {
+  const names = titles.length <= 3 ? titles.join(titles.length === 2 ? ' and ' : ', ') : `${titles.length} ${label.toLowerCase()}`;
+  if (op === 'create') return { verb: 'added', object: `${names} to ${label.toLowerCase()}` };
+  if (op === 'remove') return { verb: 'removed', object: `${names} from ${label.toLowerCase()}` };
+  const fields = Object.entries(set ?? {}).map(([k, v]) => `${k} to ${Array.isArray(v) ? v.join(', ') : String(v)}`).join(', ');
+  return { verb: 'changed', object: `${fields} for ${names}` };
+}

package/payload/app/embed/health/README.md

@@ -29,7 +29,12 @@ Embed only, at 360 to 760px inline and the host's full panel in fullscreen. The
 
 ## Agents
 
-Shared with the model on load and on every change: "ZZ Meridian health: 1 service degraded (Inference API degraded). Open incident: Elevated latency on Inference API in eu-west-1, monitoring." with `{ view, state, affected, incident }`. Ask on the banner posts "What is the impact of … on my traffic?".
+The Health page's context (`app/(dashboard)/health/README.md` lists it), inline and in fullscreen. Ask on the banner posts "What is the impact of … on my traffic?".
+
+### What the agent reads
+
+- **MCP App:** the text above as `ui/update-model-context`, with the same context as its structured part, from the inline view and from fullscreen alike, on load and on every change.
+- **Console assistant:** the same text in its prompt's `<view-context>` block, with the page's address and query, and the page text after it for anything the context does not cover.
 
 ## Accessibility