Évolution de Meridian au fil du temps.

Les trois listes du haut de votre catalogue — Types de produits, Services et Besoins (contact) — peuvent désormais porter un libellé en français et en anglais. L'affichage suit automatiquement la langue de la personne qui consulte la page : formulaire de contact public, sélecteur de services dans une opportunité, badges sur les fiches client et opportunité, et propositions générées — sans jamais mélanger les deux langues sur un même écran.

Dans Paramètres → Listes & libellés, chaque entrée de ces trois listes propose maintenant des champs « Nom (FR) » et « Nom (EN) » côte à côte, avec une clé stable générée automatiquement. Un seul des deux noms suffit : si l'autre langue n'est pas encore traduite, l'affichage retombe sur la langue disponible.

Sous le capot, chaque entrée reçoit une clé stable : renommer un libellé (dans une langue ou l'autre) ne casse plus les opportunités, clients et blocs de service qui y font référence. Les données existantes ont été migrées automatiquement.

Changement d'API (rupture) — l'endpoint GET /api/me renvoie désormais les catalogues services et product_types sous forme d'objets {key, name_fr, name_en} au lieu de simples chaînes de caractères. Les intégrations qui lisaient ces champs comme des chaînes doivent être adaptées.

Un service ajouté « à la volée » (hors catalogue) depuis la modale d'opportunité recevait la mauvaise catégorie par défaut : le code cherchait uniquement le libellé anglais « Other », absent des catalogues francisés (« Autre »), et retombait sur la première catégorie du catalogue (ex. « Validation CSV ») plutôt que sur la catégorie fourre-tout. La catégorie « Autre »/« Other » (insensible à la casse) est maintenant reconnue en priorité, avec repli sur la dernière catégorie du catalogue si aucune n'est trouvée.

Les courriels de confirmation de réservation, de relance et de rappel de rendez-vous peuvent maintenant être envoyés manuellement depuis la fiche d'une opportunité, en plus de leur envoi automatique existant. Un bouton « Envoyer » par type ouvre un aperçu éditable (destinataire, sujet, corps) avant l'envoi. Le rappel n'apparaît que lorsqu'un rendez-vous est associé à l'opportunité.

Les catalogues « Catégories » et « Intérêts de service » sont fusionnés en un seul catalogue « Services », partagé entre l'offre et la demande. Le formulaire de contact public capte désormais les services souhaités par le prospect, et la plateforme suggère automatiquement les blocs de service correspondants dans les propositions — l'offre rencontre enfin la demande sur cet axe, comme c'était déjà le cas pour les types de produits. La page Listes & Libellés est réordonnée en trois groupes (offre → clients → pipeline) avec une courte introduction pour guider l'ordre de configuration.

Votre base de connaissances alimente désormais une page FAQ publique (/faq/votre-slug). Cochez « Afficher dans la FAQ publique » sur un article de portée Organisation pour le publier, classez-le par catégorie et fixez son ordre — le contenu reste modifiable à un seul endroit, dans Connaissances.

Les articles rattachés à un client précis ne sont jamais exposés publiquement : la page ne montre que les articles de portée Organisation, approuvés et marqués publics.

Vous pouvez maintenant pré-rédiger votre propre sujet et corps bilingues pour les courriels de proposition envoyée et de facture, directement dans Réglages (paramètres de l'entonnoir). L'éditeur est amorcé avec le modèle par défaut actuel, bouton d'action et lien du portail client inclus. À l'envoi, l'éditeur de prévisualisation est pré-rempli avec ce contenu — laissez le champ vide pour conserver le modèle système par défaut.

Avant une rencontre, le courriel de rappel envoyé à l'équipe inclut maintenant un récapitulatif (client, besoin, opportunité, réponses de découverte); rédigé par l'IA quand disponible, avec un repli structuré sinon — l'envoi n'échoue jamais.

Chaque service sélectionné dans une opportunité peut désormais recevoir une quantité (1 par défaut). Elle multiplie le prix affiché dans le modal d'opportunité et se propage automatiquement à la proposition générée — les opportunités existantes restent inchangées puisque la quantité par défaut demeure 1.

Le questionnaire de découverte s'adapte désormais au besoin et au service choisis par le prospect : seules les questions pertinentes s'affichent, au lieu du même jeu de questions pour tout le monde.

Un éditeur de questions de découverte est ajouté dans Paramètres → Site public, onglet Découverte, pour créer, modifier et réordonner les questions (EN + FR, obligatoire ou non, applicabilité par besoin et par service). Le courriel d'invitation à la découverte porte lui aussi le bon jeu de questions.

L'action « Supprimer » est maintenant accessible depuis le menu d'actions de la fiche client (avec confirmation). La fiche se referme automatiquement une fois le client supprimé.

Sur le formulaire de contact public, le besoin (« De quoi avez-vous besoin? ») passe désormais en tête du formulaire et se sélectionne en cartes multi-choix, au lieu d'une liste déroulante à choix unique. Les trois axes du formulaire — besoin, types de produit, services — s'affichent maintenant sous forme de cartes cohérentes.

Choisir « Autre » dans le besoin ou les services demande une courte précision en texte libre, conservée avec la demande. Un lien vers la foire aux questions publique est ajouté pour répondre aux questions courantes avant l'envoi.

La fiche client et la fiche d'opportunité affichent désormais un véritable historique des communications : en plus des activités manuelles, chaque courriel envoyé apparaît maintenant dans le journal, avec son statut (« envoyé » ou « lu » lorsque l'ouverture a été détectée).

Les envois automatiques (relances, rappels, notifications) et manuels sont consolidés dans un seul journal d'envois — l'ancien registre distinct propre aux opportunités a été retiré, sans perte de traçabilité.

Le suivi des ouvertures se fait par pixel invisible inséré dans les courriels HTML sortants. Comme il s'agit d'une technologie de suivi, chaque organisation peut l'activer ou la désactiver depuis Paramètres → Public, onglet Courriels — la bascule est désactivée d'un simple interrupteur et s'applique à tous les envois futurs de l'organisation. Le suivi des ouvertures reste un signal indicatif : certains clients de messagerie préchargent les images ou les bloquent, ce qui peut sur- ou sous-évaluer le nombre d'ouvertures réelles.

Chaque service du catalogue peut désormais porter un nom et une description en anglais et en français. L'affichage suit automatiquement la langue de la personne qui consulte la page — sélecteur de service dans une opportunité, propositions générées et section Paramètres — sans jamais mélanger les deux langues sur un même écran.

Le formulaire de gestion des services (Paramètres → Services) propose désormais des champs distincts « Nom (EN) » / « Nom (FR) » et « Description (EN) » / « Description (FR) ». Un seul des deux noms suffit pour enregistrer un service : si l'autre langue n'est pas encore traduite, l'affichage retombe sur la langue disponible.

A new Fournisseurs section under Comptabilité lets any organization track the companies it buys from. Suppliers reuse the full company record (contacts, documents, notes), and each supplier page carries a Dépenses panel to record one-off or scheduled expenses, mark them paid, and see planned / overdue / paid totals at a glance.

Recurring expenses are supported as templates (monthly or yearly): a daily worker expands each due template into a concrete expense occurrence, so planned costs show up on their own schedule. Templates are listed separately from occurrences so paying or deleting one never disturbs the schedule by accident.

The platform↔tenant billing link is now bidirectional. When the SignalOrange platform bills a tenant for its subscription, the platform automatically appears as a supplier in that tenant's own books, and each recurring subscription invoice is mirrored as an expense — so every org sees what it owes us the same way we see what they owe us.

Vendors can now mark a document as "Shared with client" from a company or proposal's documents list. Shared documents appear to the client in both the magic-link portal hub and the in-app Received page, each with a download link. Documents are private by default — only those explicitly shared are exposed.

The Received page now also respects the vendor's client-portal entitlement: if a vendor no longer has the client portal module, their proposals, invoices, and documents stop appearing for their clients, matching the magic-link portal.

Accepting a proposal is now a short signing step: the client types their full name, confirms their email, and agrees to the terms. Meridian records who signed, when, from which IP and device, and a fingerprint of the exact document they agreed to — and stores a signed PDF with a signature certificate. The full trail shows on the proposal's detail page, with a link to download the signed PDF.

Organizations now run on a plan that defines their entitlements and is billed on a recurring cycle. Admins can view their plan, usage, and switch plans from Settings → Plan.

Lead scoring is now configurable per organization. A new Paramètres → Scoring des leads page lets admins tune the point weights, target lists (aligned products, clear needs, high-value industries, personal email domains) and the hot/warm thresholds, with a live preview that re-scores a sample lead as you type. Unconfigured organizations keep the previous built-in defaults.

Meridian now chases overdue invoices for you. Turn on automatic reminders (relances) under Settings → Organisation → Reminders & late fees and set the cadence — by default a reminder goes out 7, 14, and 30 days after the due date — and Meridian emails the customer's primary contact on schedule. Each reminder is sent once per stage, and you can opt any single invoice out with the new "Skip automatic payment reminders" checkbox on the invoice.

You can also charge late interest: set an annual rate and an optional grace period, and overdue reminders show the accrued interest and the running total the customer owes.

Clients can now sign in to one place to review and sign proposals, view and pay invoices, and track projects. Organizations that are themselves clients see what their vendors sent them right inside the app under "Received".

get_prepared_by/1 was a stub returning nil, so the public proposal page never showed the preparer. Resolve it from opportunity.owner_user (full_name, else email), preloading owner_user on all four proposal load paths.

The BANT qualification panel has been removed from the client drawer while we re-design it. No data was lost — existing qualification information is preserved and will return with the new version.

Contact, booking and proposal pages now detect English visitors automatically and offer a language switcher, instead of always showing French.

Proposal detail now shows Avancer/Reculer buttons next to the status stepper, letting users with the crm_proposals_edit permission advance or regress a proposal through its status path in one click. When advancing a proposal that requires approval, the existing approval flow is triggered automatically.

Creating an opportunity is roomier and clearer: pick multiple services, adjust each line's price/hours, and see the total update live.

Opportunities now have an editable "Last contact" just like clients, the client "Next action" is a dropdown you can extend with your own actions, and both the clients and opportunities tables can sort by last-contact date.

Dates and times across the app were rendered straight from their stored UTC value, so an action taken in the evening (for example 8:30 PM in America/Montreal, which is past midnight UTC) could display tomorrow's date.

Every display surface now shifts timestamps into the organization's timezone before formatting — invoices, billing, the team roster, backups, agent traces, admin screens, proposal and invoice PDFs, and the CRM detail panels. Date-only fields that are backed by a real date (due dates, issue dates) are unchanged; only stored timestamps that carry a time are shifted. A shared, tested helper now drives all of this, so new screens get correct local display by default.

Routes every stored-UTC timestamp through the org-timezone display helpers (Localization.shift_to_zone/2 + LiveHelpers.format_in_tz/3) so users see their own wall clock instead of UTC. Previously ~30 format_date/format_datetime helpers formatted straight off the UTC value, so an evening action could show tomorrow's date (the cross-midnight bug).

• agent_detail_live: render the chat conversation-list date in the org timezone (was raw UTC via Calendar.strftime, drifted near midnight)
• format_in_tz: promote a %Date{} to midnight in the org tz before strftime so a date paired with a time-bearing format no longer raises KeyError :hour; the date is preserved (DST-gap/invalid-tz → UTC midnight)
• proposals/timezone_display_test: add a routed assertion that the detail page renders the Sent timestamp in org wall clock, not UTC (was only helper-isolation coverage)

Foundation for the app-wide UTC-display sweep. Adds Localization.shift_to_zone/2 (the core tz-shift primitive: NaiveDateTime assumed UTC, Date/nil pass through, invalid-tz falls back to the raw value) and LiveHelpers.format_in_tz/3 (strftime display delegating to it). saved_at_label/2 now reuses the primitive instead of duplicating the shift.

The documents drawer rendered each entry with hardcoded zinc colors (text-zinc-500 on bg-zinc-800/50 = grey-on-grey, illegible) and formatted the UTC inserted_at with raw Calendar.strftime, so an evening upload showed tomorrow's date. Entries now use --surface-overlay / --text-primary / --text-secondary tokens, and a timezone attr threads the org timezone through the clients/opportunities/proposals detail trees so the date shifts to the org's wall clock.

Adds a "Claude (web · Desktop · Cowork)" card to the Integrations settings page surfacing the MCP connector URL with copy-to-clipboard, setup instructions, and a connected-sessions table with per-session revoke. Reuses the existing phx:copy event pattern (readonly input + dispatch).

The pre-signed upload/download URLs were built from conn.host, which behind Cloudflare can be an internal host unreachable by a remote MCP client. Use the configured public endpoint URL instead. Also reword the base64 over-cap message and the create/upload_url tool descriptions: sandboxed clients (Cowork) cannot PUT to the pre-signed URL, so large files should be uploaded via the Meridian web UI; the handshake is only for clients with outbound network (e.g. Claude Desktop).

Microsoft's JWKS keys omit the per-key "alg" field. JokenJwks' get_algorithm(nil, nil) returns {:error, :no_algorithm_supplied}, and validate_and_parse_keys HALTS the entire key set on that error — so zero signers were ever cached and every id_token validation failed with {:id_token_invalid, :no_signers_fetched}. The boot log confirmed it: "Failed to fetch signers. Reason: {:error, :no_algorithm_supplied}".

The prior first_fetch_sync change was necessary but not sufficient: it made the (failing) fetch run at boot instead of an hour later, which is exactly what surfaced this real root cause.

Set explicit_alg: "RS256" (Microsoft v2 id_tokens are RS256-signed) so the keys parse and signers populate. Verified against Microsoft's live JWKS endpoint: the boot-time "Failed to fetch signers" error is gone.

JokenJwks' DefaultStrategyTemplate schedules its first signer fetch one full time_interval (1h here) after boot and does no eager fetch unless first_fetch_sync is set. The signer cache was therefore empty for the first hour after every deploy, so every id_token validation failed with {:id_token_invalid, :no_signers_fetched} and Microsoft 365 login was broken until the first refresh fired.

Add first_fetch_sync: true so keys are fetched at startup. The strategy is already supervised before the Endpoint, so keys are ready before the first /auth/microsoft/callback is served.

Through the Meridian connector, Claude can now list and read the documents attached to your opportunities, proposals, and companies (quick text reading, or the original file when fidelity matters), and upload new documents and attach them to a record. Small files are sent inline; larger files use a secure, time-limited upload link.

Access is governed by two new permissions, View documents and Upload documents, which you can assign per role under Settings → Team.

Settings → Integrations now shows the Claude connector URL with copy-and-paste setup instructions for Claude.ai, Claude Desktop, and Cowork, plus a list of your connected Claude sessions. You can disconnect any session at any time.

Meridian now exposes a remote MCP endpoint that Claude.ai, Claude Desktop, and Claude Cowork connect to as a custom connector. You add it once with the connector URL and sign in with your Meridian account (OAuth), then ask Claude to work with your opportunities, proposals, clients, and more.

This replaces the previous downloadable Claude Desktop extension (.mcpb): there is nothing to install, and the same connector works across the web, desktop, and Cowork.

Implements Meridian.OAuth context with register_client/1, get_client/1, and verify_client_secret/2. Also fixes Client changeset to correctly reject empty redirect_uris (validate_length on array field validates string lengths, not array count; replaced with get_field-based guard).

Adds Meridian.Documents.Transfer (Phoenix.Token sign/verify for upload and download grants, staging-dir helpers) and MeridianWeb.DocumentTransferController (PUT /api/meridian/uploads/:token, GET /api/meridian/downloads/:token) on a public :api pipeline — the signed token is the sole authorization.

Body-size cap: application/octet-stream PUTs bypass the global 4 MB Plug.Parsers limit because that parser only covers :urlencoded/:multipart/:json; octet-stream is passed through unread and the controller reads it directly with a 50 MB cap via Plug.Conn.read_body/2. Confirmed by a 5 MB upload integration test that asserts 200 and correct staged file size.

Adds issue_tokens/3, validate_access_token/1, refresh/2, list_connections/1, and revoke_connection/2 to the OAuth context; all covered by 4 new TDD tests.

Controller, test, route, and both @tool_specs/@permissions map entries removed; catalog boot-validation still passes clean.

Adversarial review of the last 2-3 days of features (optimistic locking, CRM.Sales split, invoice payments, a11y/UX hardening, LiveView test coverage). Fixes all confirmed findings; each has a regression test that fails before the fix.

Security (pre-existing escalation, surfaced by the review):

• TeamLive (/organization/team) gated mount + all mutations on can_administer_organization? (MEMBERSHIP only), so any org member could manage users/roles and grant themselves admin. Add LiveHelpers.authorize_permission/2 and require admin_users_view|admin_roles_view on mount, all 7 mutation re-checks, and the previously-ungated set_default_approver.

Correctness (MAJOR):

• Optimistic-lock stale-entry branches (clients/opportunities/proposals/invoices _live) flashed "Reloading…" but never closed the edit modal, trapping the user in an infinite re-conflict loop on the stale struct. Close the modal in each {:error, :stale_entry} branch (mirror the success branch).
• Proposal double-submit guard sat on the preview-prep step, not the terminal send. Guard confirm_send_email/skip_email so a double-click emails the client once (first send nils :email_action_proposal; re-entrant message dropped).
• Branding autosave silently dropped the rich-editor public_description while the "Saved at" indicator claimed success. Extract put_editor_description/2 and apply it on both the explicit-save and autosave paths.

Implements Meridian.Mcp.Dispatcher which executes MCP tools/call by invoking the matching REST controller action directly via Plug.Test capturing conn, enforcing required_permission via user_has_permission?.

GET /oauth/authorize renders a consent page for authenticated users, redirecting unauthenticated users to /login with :user_return_to stored. POST /oauth/authorize issues an auth code bound to current_user + current_organization; rejects unregistered redirect_uris (no open redirect) and enforces PKCE S256 presence. EN + FR gettext added.

Remove @desktop_key_name, get_desktop_key/2, generate_desktop_key/2, revoke_desktop_key/2, and the private maybe_deactivate_desktop_key/2 helper from Organizations context (all callers removed in prior tasks). Drop the api_keys_user_org_desktop_unique partial index via reversible migration; remove the corresponding describe block from organizations_test.

Remove priv/skill/meridian-desktop/, lib/meridian/mcp/desktop_bundle.ex, the :desktop build clause in mix meridian.skill.build, and the :desktop path in SkillBundleController. The :code bundle build, serve, and tests are fully intact. Remaining integrations_live.ex desktop-key UI/assigns are left for Tasks 6/7.

The public invoice payment page (/pay/:token) never initialized the Stripe payment form because the payment-intent creation code path was unreachable, so customers could not pay invoices online. The page now initializes the payment intent when the invoice is payable. A fully-paid (zero-balance) invoice is now shown as already paid instead of attempting a Stripe payment for $0.

A round of quality-of-life improvements across the app:

• No more accidental double-sends. Sending or resending a proposal can no longer fire twice from an impatient double-click, so clients won't receive duplicate emails. Many other create/update buttons now disable themselves while saving.
• Concurrent-edit protection. If two people edit the same opportunity, invoice, client, or proposal at once, the second save is now caught: you're told the record changed and it reloads with the latest data instead of silently overwriting the other person's work.
• Auto-save on settings. The organization profile and branding settings pages now save automatically as you type, with a "Saved at HH:MM" indicator, and warn you if you try to leave a page with unsaved changes.
• Accessibility. Form errors are now announced to screen readers, every dialog traps keyboard focus and closes on Escape, and a "Skip to content" link lets keyboard users jump past the navigation.
• Consistent notifications. All in-app messages now use a single, auto-dismissing toast style.

Per-organization AI, email, and billing configuration now live in dedicated tables behind the scenes, reducing write contention on busy billing counters. As part of the change, a bug that could interrupt billing on prepaid AI calls has been fixed, and the admin organization form now saves all of its sections together: if one field is invalid, nothing is saved and the values you entered are kept on screen with the error highlighted, instead of silently saving part of the form.

🚀 Nouveautés

• Cut over schema, context, migration, and all callers to satellites
• Add BillingSettings satellite schema
• Add EmailConfig satellite schema
• Add AiSettings satellite schema
• Enforce OpenAPI validation on OpenAI-compat + Router admin surfaces
• Enforce OpenAPI validation on Meridian CRM surface
• Add OpenAPI operation spec to mcp/tools endpoint
• OpenAI-compat 422 renderer for OpenAPI validation
• Structured 422 renderer for OpenAPI validation
• Split tax into snapshotted TPS/TVQ tax_lines (schema, compute, PDF)
• Cost-by-module breakdown on AI overview
• Graceful degradation flashes + 503 for open circuits
• Org_usage_by_use_case analytics query
• Expose external-service breaker state in health check
• Contact & legal section on org settings page
• Report exhausted Oban jobs to ErrorTracker
• Render org legal_name + legal/contact footer on invoice and proposal
• Per-tenant SMTP circuit breaker with worker snooze
• Shared org legal-footer HTML helper
• Add legal/contact fields (legal_name, address, NEQ, TPS/TVQ)
• Route Stripe writes through breaker with idempotency keys
• Add StripeClient with breaker + idempotency-gated backoff
• Guard OpenRouter streaming with circuit breaker
• Circuit-break OpenRouter chat + embeddings
• Configure circuit breaker thresholds
• Org-admin settings page with self-serve AI module toggle
• Add term-keyed CircuitBreaker

🐛 Correctifs

• Resolve adversarial review findings
• Admin org form pre-populates from satellites + regression test
• Defensively preload satellites in Emails (password reset, welcome, test email)
• Defensive router preload + remaining caller/test stragglers
• Consistent 422 details shape + fill validation test gaps
• OpenAI-compat validation errors return 400, not 422
• Health probe stays up on 3rd-party outage; embeddings 503; no retry on open circuit; drop dead open_keys
• Restore breaker config in half_open test to stop cross-test threshold leak
• T&M invoice preview snapshots org tax_config (TPS/TVQ), matching generation
• Log the real callback failure reason
• Dead-letter handler logs only; avoid duplicate ErrorTracker reports
• Handle SMTP circuit-open honestly in LowBalanceNotifierWorker batch loop
• Fill FR translations and use token for AI toggle knob
• Wrap maybe_migrate/0 in with_repo so it works before the tree
• Wrap maybe_migrate/0 in with_repo so it works before the tree
• Soften trust marquee to aspirational, non-legal copy
• Run migrations before supervision tree, supervise M365 JWKS strategy
• Run migrations before supervision tree, supervise M365 JWKS strategy
• Exclude paid invoices by semantic_type not code
• Truncate next_run_at to usec so scheduler stops crashing

♻️ Refactorisations

• Satisfy credo --strict (mailer complexity, aliases)
• Shape the mcp/tools ok-response schema
• Align StructuredValidationError with house plug style
• Drop unused profile_form assign (added later with the form)
• Avoid spurious breaker rows on success; clarify open_keys docs
• Use DateTime.add for usec coercion (clearer than map-update)

Incoming requests to the public APIs are now validated against the published OpenAPI specs before they reach a controller. Malformed requests — missing required fields, wrong types, out-of-range values — are rejected up front with a clear error. The OpenAI-compatible endpoints (/api/v1/*) return a 400 in the OpenAI error envelope, and the Meridian and Router-admin endpoints return a 422 describing each offending field. Extra fields that OpenAI SDKs send (such as top_p or n) continue to be accepted.

Meridian now fails fast and degrades gracefully when an external provider (AI, payments, or email) is temporarily unavailable, instead of hanging or retrying indefinitely. Email delivery problems are now isolated per organization.

Fixed a precision mismatch that caused the scheduled-backup worker to crash when a backup became due, which prevented automatic backups from running. Scheduled backups now execute and advance to their next run time as expected.

Fixed a filter that failed to exclude paid invoices when scheduling upcoming-due reminders, so paid invoices no longer generate spurious anticipatory reminder events.

Les pages de documentation publiques (/docs) ont été entièrement revues par rapport au produit réel :

• Navigation et chemins Paramètres → … corrigés pour correspondre à l'application.
• Fonctionnalités décrites mais non encore disponibles retirées des pages et consignées au backlog (avec des notes « À venir »).
• Captures d'écran ajoutées : tableau de bord, pipeline, image de marque, intégrations et suivi du temps.

Connect more than one Microsoft 365 account and choose exactly which calendars sync into Meridian. Your calendar now shows events from every connected account and every opted-in calendar in one place, with the same meeting appearing once even when it lives on several calendars.

• Connect multiple Microsoft 365 mailboxes; each one picks its own account at sign-in.
• Turn individual calendars on or off for sync in Settings -> Integrations -> Microsoft.
• Create, update, and delete events on a specific calendar (editable calendars only).

🚀 Nouveautés

• Calendar opt-in toggles in settings
• Unified cross-account calendar view
• Unified cross-account event query with ical dedup
• Calendar-targeted write-back + default-calendar stamping for legacy writers
• Initial sync discovers calendars and syncs opted-in ones
• Per-calendar subscriptions, webhook routing, and opt-in wiring
• Per-calendar sync worker
• Per-calendar CalendarSync with isolated failures
• List calendars and toggle sync opt-in
• Discover mailbox calendars from Graph
• Force account picker so users can add multiple accounts
• Add calendar FK to Subscription
• Per-calendar delta links
• Add calendar FK and provenance to CalendarEvent
• Add MailboxCalendar schema and factory
• Migration for multi-calendar sync schema

🐛 Correctifs

• Address multi-calendar review findings

🐛 Correctifs

• Wire dashboard into settings nav + respect theme

🚀 Nouveautés

• Register Graph and sync metrics with Prometheus
• Add MicrosoftConnectionLive and route
• Add MicrosoftStatus component
• Add routes for auth and webhooks
• Add Webhooks.MicrosoftController
• Add Auth.MicrosoftController (start, callback, disconnect)
• Schedule token refresher and subscription renewer crons
• Add MicrosoftNotificationProcessor worker
• Add MicrosoftInitialSync worker
• Add MicrosoftSubscriptionRenewer worker
• Add MicrosoftTokenRefresher worker
• Add WebhookHandler (clientState + lifecycle)
• Implement Meetings (standalone Teams online meetings)
• Implement Mail context and MailSync
• Implement Calendar context (list/create/update/delete)
• Add CalendarSync delta handler
• Implement Subscriptions context (create, renew, delete)
• Add facade and sub-context stubs
• Add Accounts context
• Emit Graph request telemetry events
• Graph supports POST/PATCH/DELETE/paginate/delta
• Graph retries on 429 with Retry-After and on 5xx with backoff
• Graph auto-refreshes account token on 401
• Add Graph client with GET happy path and structured errors
• Add Auth.validate_id_token
• Add Auth.exchange_code and Auth.refresh
• Add Auth.authorize_url and PKCE helpers
• Add JWKS strategy for id_token validation
• Add CalendarEvent, Message, and DeltaLink schemas
• Add Subscription schema
• Add Account schema with encrypted tokens
• Replace Outlook tables with microsoft_* schema
• Phase 0 setup — deps, queue, runtime config

🐛 Correctifs

• Address validation review findings
• Add @type t to schemas for context @spec references
• Use bigint PKs on microsoft_* tables for codebase consistency

♻️ Refactorisations

• Demolish Outlook integration and rewire CRM to Microsoft.*

Visibilité complète sur les erreurs, latences et régressions par version d'application. Page admin unifiée pour les admins d'organisation, infrastructure Prometheus/Grafana optionnelle pour le monitoring système.

Nouveautés

• Page d'admin /admin/observability — KPIs (erreurs, P95 latence HTTP, échecs Oban, échecs métier), graphiques temporels Chart.js avec marqueurs de version, tables des erreurs et endpoints les plus lents, drill-down par catégorie avec export CSV. Org admins voient leur organisation, super admins voient tout.
• ErrorTracker à /admin/errors — capture et navigation des exceptions non-gérées (Phoenix, Oban, LiveView), stack traces groupés par signature, super admin uniquement.
• Pipeline de collecte — Collector attaché à 10 événements télémétrie (Phoenix, Ecto, Oban, proposals Typst, skills agents, SMTP, AI), buffer ETS avec flush 10s vers Postgres, rollups horaires/journaliers, purge automatique (7j brut, 90j horaire, daily indéfini).
• Endpoint Prometheus /metrics — protégé par les clés API Meridian existantes, pipeline allégé sans audit/idempotency.
• Stack Docker docker-compose.observability.yml — Prometheus
  • Grafana avec 4 dashboards pré-provisionnés (system overview, HTTP performance, Oban jobs, AI/business ops). Ports bindés sur 127.0.0.1, secrets gérés via env vars et fichiers gitignored.
• Logs structurés JSON en production — formatter LoggerJSON, correlation IDs ajoutés à la metadata (request_id, org_id, user_id) via un plug appliqué aux pipelines :browser et :api.
• Health check étendu — /health (liveness) et /ready (readiness) vérifient maintenant DB, Oban et PubSub.

Configuration Docker (optionnelle)

export GF_ADMIN_PASSWORD=<mot-de-passe-grafana>
echo "<clé-api-super-admin>" > docker/prometheus/meridian_token
docker compose -f docker-compose.observability.yml up

Grafana : http://localhost:3000 (admin / $GF_ADMIN_PASSWORD) Prometheus : http://localhost:9090

🐛 Correctifs

• Fix ClientEnrichment test data shape + bump version to 0.81.0
• Update Stripe test assertions to match atom params + add ex_unit to PLT
• Resolve all 748 Dialyzer warnings — clean exit 0
• Select semantic_type separately in ClientEnrichment proposal query
• Remove stale this.panel reference in SidebarHook._sync()

♻️ Refactorisations

• Fix remaining CyclomaticComplexity issues in lib/meridian_web/
• Fix Credo nesting, arity, and some complexity issues in lib/meridian_web/ (partial)
• Fix Credo nesting, complexity, and arity issues in lib/meridian/

Le compilateur de propositions PDF (NIF Rust) passe à Typst 0.14.2 et Rustler 0.38. Les PDFs générés incluent maintenant le balisage d'accessibilité (tagged PDF) par défaut.

Changements

• Typst 0.13.1 → 0.14.2 — corrections de bugs, améliorations du rendu PDF, support des PDFs tagués pour l'accessibilité
• Rustler 0.37 → 0.38 — support OTP-29, atomes UTF-8
• Suppression des dépendances explicites comemo et ecow (résolues transitivement par Typst)

🚀 Nouveautés

• Expose org catalogs and custom statuses on /me
• Regroup org catalog sidebar items under Catalogues sub-header
• Split Activity.type into system_event + org-catalog activity_type
• /settings/statuses admin page + fix missed milestone query
• StatusReorder JS hook for drag-reorder status admin
• Milestone.status → organization_statuses FK
• ProjectPhase.status → organization_statuses FK
• Company.qualification_status → organization_statuses FK
• Meeting.status → organization_statuses FK
• Deliverable.status → organization_statuses FK
• Project.status + health_status → organization_statuses FK
• Invoice.status → organization_statuses FK (invoice_status)
• Proposal.status → organization_statuses FK (proposal_status)
• Opportunity.status → organization_statuses FK (opportunity_status)
• Task.priority → organization_statuses FK (task_priority)
• Task.status → organization_statuses FK with semantic_type branching
• Live preview + help for 12 status field_kinds
• Status_pill component with color palette
• Seed 12 default status sets per org + backfill existing
• Organization_statuses table, schema, and context
• Company.service_interests org-configurable with admin tab + live preview
• Contact.role org-configurable with admin tab + live preview
• Company.tax_id_type org-configurable with admin tab + live preview
• Company.manual_last_contact_kind org-configurable with admin tab + live preview
• Payment.payment_method org-configurable with admin tab + live preview
• ServiceBlock.pricing_type org-configurable (shared catalog_pricing_types)
• Invoice.invoice_type org-configurable (shared catalog_pricing_types)
• Add billing_mode canonical field — decouple billing logic from catalog labels
• Project.contract_type org-configurable (shared catalog_pricing_types)
• Proposal.pricing_type org-configurable with shared pricing_types tab
• Opportunity.deal_type org-configurable with admin tab + live preview
• Seed default flat catalogs on org creation
• Add 7 flat catalog columns with French defaults
• Field_help and field_preview components with deal_types renderer
• Gate /settings/services behind catalogs_edit permission
• Add catalogs_edit permission auto-attached to all roles

🐛 Correctifs

• Resolve final test failures from Phase 2 status FK migration
• Resolve remaining test failures from Phase 2 status FK migration
• Bulk-update source code and tests for Phase 2 status FK requirements
• Resolve merge conflict in skill/build.ex — use main's version
• Enumerate writable fields on clients + proposals request bodies
• Assemble bundles in-memory at runtime, drop Mix from request path
• Catalog_previews use declared surface-sunken CSS var
• Align catalogs_edit flash with team_live convention

• manifest.json: bump manifest_version 0.2 → 0.3 (current MCPB spec)
• icon.png: replace 1-bit monochrome placeholder with branded 256x256 orange (#FF6B35) icon with white "M"
• McpToolsController: read version via Application.spec(:meridian, :vsn) at runtime instead of baking Mix.Project.config()[:version] at compile
• IntegrationsLive:
  • distinguish "generated" vs "regenerated" flash messages
  • add data-confirm on Regenerate (silently invalidating an installed Desktop key was easy to do accidentally)
  • align date format with the rest of the page (%b %d, %Y)
  • extract do_generate_desktop_key/2 helper (deduplicated, contiguous handle_event/3 clauses for warnings-as-errors)
• Organizations.generate_desktop_key/2: replace pattern-match-or-raise in the deactivation step with a clean with/rollback chain
• server/index.ts: replace hardcoded version "0.0.0" with PACKAGE_VERSION constant, substituted at build by the Mix task
• McpToolsControllerTest: assert a second permission-gated tool is also filtered for a regular user (update_client / crm_companies_edit)

Le formulaire de contact public peut maintenant être intégré directement dans une page de votre site web existant, sans remplacer celle-ci. Le visiteur reste sur votre site, votre entête, votre navigation et votre pied de page sont conservés ; seul le formulaire vit dans un <iframe> qui s'ajuste automatiquement en hauteur.

Comment l'utiliser

Dans Réglages → Site public → Formulaire contact, copiez le snippet de la nouvelle carte « Intégrer à votre site web » et collez-le dans le HTML de votre page :

<iframe src="https://app.meridian.dev/embed/contact/votre-slug?locale=fr"
        style="width:100%;border:0;min-height:600px"
        title="Contact"></iframe>
<script src="https://app.meridian.dev/embed.js" async></script>

Vous pouvez basculer la langue par défaut (FR/EN) dans la carte avant de copier. Les soumissions arrivent dans le CRM exactement comme celles du formulaire hébergé — même création d'opportunité, même notification de nouveau lead.

Détails techniques

• Nouvelles routes /embed/contact/:slug, /embed/contact/:slug/thank-you
• Sécurité : CSP frame-ancestors * scopé au préfixe /embed/* uniquement ; tout le reste de Meridian garde X-Frame-Options d'origine. Le formulaire ne traite que des leads anonymes (pas de session, pas de données sensibles), et le rate-limit :contact_form s'applique aux POST embed comme aux POST hosted.
• Le formulaire embed n'inclut pas le hero marketing, l'entête org, ni le switch de langue — ce sont des éléments que votre page hôte gère déjà.
• Pas de DNS à configurer, pas de sous-domaine à créer. Le snippet pointe sur l'hôte Meridian canonique.

Adds serialize/1 to OpenApiToTools, mapping Tool structs to the JSON shape consumed by GET /api/meridian/v1/mcp/tools. The _dispatch map carries method, path, pathParams, queryParams, and bodyParams for the bundled Node MCP server to use when routing tool calls.

The "I've copied the key" button and the modal's X / backdrop / escape key all relied solely on a server-side assign clear + LiveView re-render to remove the modal from the DOM. In practice the modal stayed visible in the browser (server handler ran fine; tests pass; diff observably didn't take effect).

Switch to the canonical Phoenix modal pattern: wrap the modal in a stable outer div (id="desktop-key-modal-wrapper") and chain JS.hide(to: "#...") |> JS.push("dismiss_desktop_key_modal") on every close action. The JS.hide takes effect immediately client-side; the push still clears the assign so the modal stays gone on the next render.

Adds convert/0 (alias for all/0), populates query_params and body_params on each Tool by extracting keys from the OpenAPI body/query schemas. Also enriches the update_opportunity OpenAPI spec with enumerated body properties so dispatch metadata is accurate for PATCH endpoints.

Wire generate_desktop_key, regenerate_desktop_key, revoke_desktop_key, and dismiss_desktop_key_modal event handlers. Add a one-time reveal modal (mirroring the existing mint modal) that shows the raw key with a three-step install guide and a download link. Includes Task 10 tests.

Aligns the MCP module namespace with the codebase convention (Meridian..*). Renames ToolRegistry → OpenApiToTools, adds query_params/body_params to the Tool struct.

Four gaps from review:

1. Branding CSS variables now propagate to the embed layout via style={branding_style(...)} on . The submit button already used the org color (inline style) but focus rings and any other --color-primary references were stuck on Meridian defaults. Now the whole form picks up the org's branding consistently.

2. Thank-you booking link uses target="_blank" (was target="_top"). target=_top navigated the entire host page away from the org's site to Meridian — the opposite of the chosen "thank-you in-place" behavior. _blank opens booking in a new tab and the visitor stays on the host page. Adds rel=noopener for the usual security reason.

3. "Copy code" button shows a brief "Copied!" pill next to it (JS.show + delayed JS.hide with opacity transitions). Previously the click had zero visual feedback.

4. New "Preview" link in the embed card opens the embed URL in a new tab so the org can see the rendered form before integrating it.

Adds a controller-level test that asserts org branding CSS variables are inlined on the embed's element.

Adds an iframe-friendly contact form surface at /embed/contact/:slug so orgs can drop the form inside an existing page on their own marketing site instead of redirecting visitors to /contact/:slug. The first org with this need is Patero.

Routes (new :embed pipeline) GET /embed/contact/:slug form-only render GET /embed/contact/:slug/thank-you in-iframe thank you POST /embed/contact/:slug same logic as ContactController

Headers (scoped to /embed/* only via Plugs.AllowEmbedding) X-Frame-Options removed Content-Security-Policy frame-ancestors *

Form-only view strips the hero pane, mobile banner, org_brand_header and locale switcher, keeps me-glass-frame and all seven existing fields. Submit + thank-you both stay inside the iframe (same-origin → native Phoenix CSRF, no CORS surface). An inline 15-line script posts {type:"meridian:resize", height} to the parent on load and on ResizeObserver; a 25-line priv/static/embed.js on the host side matches by contentWindow and sets iframe.style.height.

Settings UI (Settings → Public site → Contact form) gets a new "Embed on your website" card with a copyable snippet (textarea + phx:copy) and a FR/EN locale toggle that swaps ?locale= in the snippet.

Out of scope for now (Phase 2 candidates): per-org allowlist of embedding domains, widget JS / JSON-API alternatives, CSS theming beyond branding.primary_color, parent→iframe pre-fill via postMessage, analytics submit events, bot protection beyond rate limit. See LOGBOOK/features/feat-contact-form-embed/design.md.

Replaces the old flat-directory desktop output with a proper .mcpb zip containing manifest.json (version-substituted), icon.png, server/index.mjs (built via npm ci && npm run build), server/package.json, SKILL.md, and INSTALL.md. Output: _build/skill/meridian-desktop-.mcpb.

Add desktop_key and desktop_key_just_generated assigns to mount/3, and render a new Claude Desktop card below the Calendar card showing the empty-state CTA or the active-key actions (Download/Regenerate/Revoke). Includes Task 9 smoke test.

Three user-reported issues from the first local install attempt:

1. Bundle install failed with "Impossible de se connecter au serveur d'extension". Root cause: server/index.ts checked import.meta.url === \file://${process.argv[1]}`` which fails when Claude Desktop installs into a path containing spaces (e.g. "Application Support/Claude/..."). import.meta.url percent-encodes spaces, argv[1] doesn't. main() never ran, stdio handshake never started, Desktop bailed. Switched to pathToFileURL(argv[1]).href which is the canonical Node ESM entry-point check, and wrapped main() in .catch() so future startup errors land in stderr.

2. Desktop connector title showed "meridian" instead of the user's org. manifest.json display_name now templates "Meridian — ${ORG_NAME}". The build task accepts org_name + org_slug opts; the SkillBundleController passes the current_organization. Bundles are cached per (version, org_slug) so each org gets its own file. CLI mix task without args defaults org_name to "Workspace".

3. The dedicated "Claude Desktop" card on /settings/integrations is now redundant with the top-row download button (which generates + opens the reveal modal). Card removed entirely. The active Desktop key still shows up in the regular Meridian API keys table for revoke.

The remote MCP connector approach was abandoned in favor of the .mcpb desktop extension. This removes the obsolete URL display, its assign, and the test that asserted /api/meridian/mcp on the page. Also renames the top-row Desktop download CTA from (.zip) to (.mcpb).

Switches desktop downloads from .zip to .mcpb (application/octet-stream). The .mcpb is built on-demand by build(:desktop) if missing; code target retains the existing zip-from-flat-dir behavior.

Adds McpToolsController with index/1 that calls OpenApiToTools.list_for/2 then serialize/1, returning server metadata + MCP-shaped tool list. Route registered in the :api_meridian_auth scope (auth + rate-limit + audit automatic). McpToolsController registered in @tool_specs and @permissions to satisfy the router-walk boot validation.

Meridian s'installe maintenant dans Claude Desktop comme une extension .mcpb : un fichier téléchargeable depuis Paramètres → Intégrations → Claude Desktop qui s'installe en un double-clic.

Au moment du téléchargement, Meridian génère une clé API dédiée ("Claude Desktop") affichée une seule fois. Cette clé est stockée par Claude Desktop dans le trousseau du système d'exploitation (Keychain macOS / Credential Manager Windows) — elle n'est jamais dans le fichier .mcpb lui-même.

Une fois installé, tous les outils Meridian (list_opportunities, create_proposal, get_me, etc.) apparaissent dans Desktop. Les permissions utilisateur sont appliquées côté serveur : un utilisateur ne voit dans Desktop que les outils qu'il a le droit d'invoquer.

Pour Claude Code (Bash + curl), le skill meridian-code reste disponible sans changement.

Les quatre endpoints d'administration Router ont été déplacés vers un nouveau namespace dédié. Mettez à jour vos scripts :

• /api/v1/router/audit → /api/router/v1/audit
• /api/v1/billing/* → /api/router/v1/billing/*
• /api/v1/api_keys → /api/router/v1/api_keys
• /api/v1/logs → /api/router/v1/logs

Les endpoints compatibles OpenAI (/api/v1/chat/completions, /api/v1/embeddings, /api/v1/models) sont inchangés. Ce déplacement ne les affecte pas. La documentation interactive est maintenant disponible sous /api/router/docs/ (anciennement /api/docs/).

Les utilisateurs peuvent maintenant générer des clés API personnelles depuis Paramètres → Intégrations pour accéder à l'API CRM Meridian (/api/meridian/v1/*). Chaque clé hérite exactement des permissions de l'utilisateur qui l'a créée — aucun accès élargi, aucun accès inter-organisations. Un Skill Claude téléchargeable depuis la même page permet d'interroger et d'agir sur votre organisation directement depuis n'importe quel client Claude, en tant que vous-même.

Les paramètres du Router (onglet Clés API) affichent maintenant le nombre de clés actuel par rapport à la limite par organisation (50 par défaut). Quand la limite est atteinte, le bouton « Créer une clé API » est désactivé et une bannière explique qu'il faut révoquer une clé inutilisée avant d'en créer une nouvelle.

Auparavant, la limite n'était surfaçée qu'au moment de la création (erreur HTTP 422 côté API, message flash côté interface). Le compteur inclut les clés actives et révoquées, comme la vérification serveur.

Six new editable forms in the constitution drawer on /agents/:slug: authority (4 lists), allowed contacts, escalation rules, guardrails, business context (read + write), and KPIs. The autonomy matrix already had interactive promote/demote and stays as-is.

Mixed data shape (string-or-map) handled by reading both shapes and writing canonical map shape on save — no DB migration needed. Empty rows are dropped on save (clearing inputs deletes the row). EN + FR gettext entries included.

Many small LLM calls (typical of agent workloads) were each rounded up to a whole cent before markup+FX, then floored at 1¢ per call, producing roughly 3x over-billing. 200 calls at $0.00375 USD each ($0.75 total) drained $4 CAD instead of the expected $1.38.

Switch the cost pipeline to compute exact millicents (1/1000 cent) with a single round at the end, and accumulate sub-cent residuals on the organization so they only bill once they roll over to a whole cent.

Also fixes a separate reconciler bug: llm_settle markers (idempotency artifacts that don't actually decrement balance) were being summed as debits, which would silently force balances downward by 1¢ per call.

La constitution d'un agent (autorité, contacts permis, règles d'escalade, garde-fous, contexte d'affaires, KPIs) s'éditait jusqu'ici en touchant le JSON brut. Six éditeurs structurés viennent d'arriver dans le tiroir de la page agent :

• Autorité · 4 listes (autonome, propose, ne peut pas, hors-portée)
• Contacts permis · table avec agent, types et usage typique
• Règles d'escalade · déclencheur, destinataire, contexte
• Garde-fous · risque + garde-fou à appliquer
• Contexte d'affaires · accès en lecture et en écriture
• KPIs · métrique, cible, fréquence

Les entrées existantes (chaînes ou maps mélangées) restent affichées correctement et sont normalisées au format map au prochain enregistrement, sans migration de données.

Les crédits IA pouvaient se vider plus vite que la consommation réelle lorsque le travail se faisait en plusieurs petits appels (typique des flux d'agents). Une organisation pouvait perdre jusqu'à trois fois la valeur consommée.

La cause: chaque appel arrondissait son coût USD au cent supérieur avant d'appliquer la majoration et la conversion CAD, puis appliquait un plancher de 1¢ par appel. Sur 200 appels à 0,375¢ USD chacun (0,75 USD total), l'organisation se faisait facturer 4,00 $ CAD au lieu de 1,38 $ CAD.

Le calcul utilise maintenant le coût USD exact jusqu'au bout, puis accumule le résidu sous-cent sur l'organisation pour le facturer seulement quand un cent entier est atteint. Les soldes restent corrects même sur des centaines de micro-appels.

Quand un fournisseur d'IA (OpenAI, OpenRouter, etc.) renvoyait une erreur HTTP, certaines actions internes (recherche d'entreprise, qualification, résumés de transcripts, génération de propositions) plantaient au lieu de signaler l'erreur proprement.

Le routeur retourne maintenant systématiquement la même forme d'erreur, et toutes les actions reprennent leur chemin d'erreur normal plutôt que de crasher. L'agent Business Development en particulier reste stable quand la recherche d'entreprise échoue côté fournisseur.

Le tableau des clients affiche maintenant deux nouvelles colonnes éditables en place : Étape en cours et À faire. L'en-tête du tableau reste visible quand on défile.

Les actions à faire ouvertes sur l'ensemble des clients de l'organisation apparaissent aussi dans la carte « Prochaines actions » du tableau de bord. Cliquer ✓ marque l'action comme faite et la retire de la liste.

Debian bookworm's nodejs package is v18, but [email protected] declares engines.node: ">=20.19.0 || >=22.13.0 || >=24". npm ci was failing with EBADENGINE on the asset install step.

Switch to NodeSource's setup_22.x to install Node 22 LTS (which also ships its own npm, so we drop the separate npm apt package).

The builder image was missing COPY native native, so when mix compile hit Meridian.Proposals.Typst.Compiler rustler errored with:

spawn: Could not cd to native/typst_compiler
** (RuntimeError) calling `cargo metadata` failed.

.dockerignore already keeps the source (only native/*/target/ is excluded), so a plain COPY native native before mix compile is enough.

Adds Meridian.Actions.ResearchCompany to the business-development agent in all three templates so newly seeded orgs cover every action listed in SetupAlerts.platform_actions/0. Introduces AgentActionsBackfill to idempotently add the 5 platform actions (and silent autonomy rules) to the BD agent of existing orgs that were seeded before these actions existed.

On the dashboard the agent row was wrapped in <.link navigate>, so clicks on the inner activate/pause buttons were swallowed by the anchor's default navigation — event.stopPropagation() doesn't suppress that. Switched the row to a phx-click={JS.navigate(...)} div so the inner buttons' click handlers actually run.

On the agent detail page the ActionsDropdownComponent dispatched {:actions_dropdown_event, "activate_agent", id} via send/2, but no handle_info/2 clause captured it — the catch-all swallowed every status change. Added a handler that updates status and starts or stops the supervisor accordingly.

Critical bug surfaced by Phase 3 code review. Real browsers submit multi-checkbox arrays like service_block[product_types][]= as part of the form encoding (a hidden empty input ensures an empty array reaches the server when nothing is checked). Plug.Conn.Query decodes that into ["", "Cosmetics"], and the org-catalog validator rejected the empty string as "not in catalog: ", so NO service block save would succeed through the modal.

Tests passed because Phoenix.LiveViewTest.form/3 (Floki) silently strips empty hidden inputs during serialization, hiding the issue.

• C1: replace 5 occurrences of undefined CSS token --surface-elevated with --surface-raised. Without this, the count badge, service rows, and 3 sub-form panels rendered with no background (invisible in dark mode).
• I1: add dark: variants to ESSENTIEL pill (text-emerald) and the unchecked-essentials warning banner (amber bg/border/text), per the project's dark-mode pairing convention.
• I3: add put_flash success on save_inline_company so users get acknowledgement after "Créer & sélectionner" (was silently closing the sub-form).

Les services se définissent maintenant dans Paramètres → Catalogue de services. Sélectionner un type de produit (Cosmetics, NHP, …) sur une opportunité fait apparaître la liste des services associés, avec les essentiels pré-cochés. Les choix sont copiés automatiquement comme line items à la création de la proposition, puis comme tâches forfait, banques d'heures ou suivi récurrent sur le projet à l'acceptation.

Améliorations du tableau client :

• Statut client manuel et configurable (cellule éditable directement dans la liste)
• Suivi des contacts hors-système (appels, courriels, rencontres) avec colonne « Dernier contact » mise à jour
• Création de compagnie + premier contact directement depuis la modale d'opportunité

Adds two unique indexes flagged by Phase 0 code review:

• crm_opportunity_presets(organization_id, name) — prevents duplicate preset names within an org (would be ambiguous in the picker)
• crm_project_service_allocations(project_id, proposal_line_item_id) — enforces 1:1 between a line item and its allocation, matching the cascade invariant from spec §6.3

Extract agents_subnav_link/1 to AgentDetailComponents as a public def, then apply the breadcrumb + sub-nav + entity_header shell to all 4 agents sub-pages to match the dashboard cockpit pattern.

These tokens are not defined in app.css — references to them rendered as transparent (cards invisible against page bg) or as text-color clashes.

• All bg-[var(--surface)] → bg-[var(--surface-raised)]
• All bg-[var(--surface-default)] → bg-[var(--surface-raised)]
• text-[var(--surface-default)] (Activity tab filter active state) → text-white
  • active filter pill now uses primary bg + glow shadow per design system
• skill_card gets shadow-surface + hover:shadow-raised

Cards in Overview/Activity/Capabilities/Chat used --surface-default which became the same shade as the new --surface-base page background, removing visual contrast. Switched to --surface-raised + --shadow-surface across all shared agent_detail_components and the chat panel container.

Replace the agent detail page header with the canonical Meridian breadcrumb + entity_header pattern, expand the container to full-width (px-6 py-4), update the sticky pill bar to use --surface-base with -mx-6 px-6, and delete the dead agent_header/1 component along with its now-unused icon/gradient/status_color helpers.

Ports 9 constitution sections from agent_detail_live.ex into dormant function components (2 forms + 7 read-only sections). Lifts level_color, level_icon, and display_entry from private LiveView defp to public AgentDetailLive.Helpers, and moves authority_list to AgentConstitutionComponents as a private component.

Adds a reusable Phoenix function component and paired JS hook (LineEditorHook) for client-side add/remove of repeatable string lists; submits as name[] arrays.

Les pages Agents ont été affinées pour le monitoring quotidien et l'admin.

• Liste /agents : nouvelle structure cockpit. Une section « Demande de l'attention » apparaît en haut quand des agents sont en pause/erreur ou ont une inbox en attente. La grille décorative devient un roster compact 1-colonne avec les signaux essentiels (statut, inbox). Le digest hebdomadaire passe en section pliable en bas.
• Détail /agents/:slug : la page passe en pleine largeur, adopte le breadcrumb et le entity_header cohérents avec le reste du CRM. Les cartes ont maintenant une vraie profondeur (ombres + surfaces tokenisées).
• Constitution : refondue en vue snapshot. Un seul card lisible d'un coup résume toute la constitution (identité, autorité, comportement, performance), et chaque section s'édite dans un drawer dédié — fini le scroll infini avec des forms inline.

Sous le capot, deux nouveaux composants <.line_editor> et <.segmented_control> couvrent les patterns de form les plus communs ; l'extension <:footer> slot sur <.drawer> permet le pattern Cancel / Save standardisé dans les drawers d'édition.

• Create MeridianWeb.AgentDetailLive.Helpers with the 7 shared defp helpers (c/3, ensure_list/1, split_lines/1, parse_int/2, tier_label/1, resolved_model_name/2, resolved_default_model_name/2)
• Replace duplicate defp definitions in AgentDetailLive with import
• Create MeridianWeb.AgentConstitutionComponents skeleton with identity_form/1 and voice_form/1 as canonical text-form and line_editor+segmented_control examples (remaining 9 forms deferred to T4b)

Two new virtual fields on the Agent struct, populated via left-joins on HumanInboxItem (status="pending") and AgentTrace (outcome in error/rejected/ escalated). Powers the "Need attention" section on the redesigned /agents list.

Replaced by the snapshot + drawer pattern in the Constitution tab refactor.

Replaces the 4 stacked inline-form groups with a compact snapshot card on the left, an aside_panel with 11 section links on the right, and a single shared drawer that opens for whichever section is active. The 4 editable sections (identity, ai_model, voice, memory) get Save/Cancel footers; the 7 read-only sections (authority, autonomy_matrix, allowed_contacts, escalations, guardrails, business_context, kpis) show a Done button only.

La page d'un agent (/agents/:slug) passe d'une longue colonne de sections à un layout 5-tabs avec pills.

• Overview — décisions à prendre (promotion d'autonomie suggérée à partir des traces récentes), KPIs cette semaine, dernières activités.
• Activity — chart des 7 derniers jours + liste filtrable des traces, drawer pour le détail complet d'une trace.
• Capabilities — skills attachées en cards avec leur rail « déclenchée par · utilise », plus un disclosure pour les actions orphelines.
• Constitution — 4 groupes (Identity & Voice / Authority & Autonomy / Behavior & Memory / Measurement) + bouton « Voir le prompt » qui ouvre le system prompt réel envoyé au LLM avec les sections cliquables.
• Chat — conversation avec l'agent embarquée dans la page (la route /agents/:slug/chat séparée n'existe plus).

Un nouveau moteur de recommandations (Meridian.Agents.DecisionSupport) calcule les suggestions à partir des traces, autonomy_rules, et de l'inbox — promotion/démotion d'autonomie, items pending, capabilities idle, trajectoire de confiance. Chaque carte est dismissable pour 7 jours.

Big-bang migration per CLAUDE.md (no redirect). Chat content lives at ?tab=chat on the agent detail page. PubSub subscription set up at mount so streaming responses keep arriving across tab switches.

12 existing sections regrouped into 4 logical groups (Identity & Voice / Authority & Autonomy / Behavior & Memory / Measurement). Per-section edit-in-place flows preserved untouched. Actions section removed (Capabilities tab covers it now). "View the prompt" button opens AgentPromptDrawerComponent; section anchors deep-link into the matching edit panel.

Three new function components in AgentDetailComponents for the Overview tab.

Decision cards driven by Meridian.Agents.DecisionSupport. Promote/demote event handlers update AutonomyRule and refresh the recommendations. Dismiss persists a 7-day snooze in agent_state.

• Add :ai_directive textarea + live Earmark markdown preview to the admin organizations modal (super-admin only).
• Remove :ai_model and :ai_max_tokens form inputs from the modal (schema unchanged).
• Delete /settings/knowledge route, LiveView, settings sidebar entry, and corresponding test. The directive lives in the admin org modal now.
• EN/FR gettext entries for the new strings.

7-day bar chart with click-to-filter-day. Outcome filter pills (all, success, escalated, failed). Trace list reuses <.trace_row>. AgentTraceDrawerComponent slides over with full trace detail when a row is clicked. URL params drive everything (filter, day, trace).

LiveComponent reused by /agents/traces (global) and the Activity tab on the agent detail page.

Four more function components in AgentDetailComponents. Module is now at 8 components total (trace_row, kpi_tile, activity_row, decision_card + these four).

First component in a new module that will host the function components for the agent detail page redesign. agents_traces_live.ex adopts it now so the new Activity tab and global traces page render identically.

Renders Meridian.Agents.PromptBuilder.build_instructions/3 output with [Section] anchors made clickable. Clicking sends a message to the parent LiveView to jump to the corresponding edit panel.

Used by the Constitution tab on the agent detail page.

Addresses code review I1 (domain knowledge in DecisionSupport) and I2 (hardcoded French in data model). Recommendation tuples now carry structured payloads (counts, kinds) that the LiveView will gettext at render time.

inbox_pending uses the existing HumanInbox API (or defensively returns [] if missing). idle_capability flags actions with 0 traces in 30d. trust_trajectory emits a structured kind atom (:high|:moderate|:low) so the LiveView gettext-formats at render. dismiss/2 stores a snooze in agent_state with a 7-day expiry; dismissed?/2 filters at the boundary.

Constitution body moved verbatim into live_render_constitution/1 so the existing edit flow keeps working. Other tabs (overview/activity/ capabilities/chat) are stubs filled in by Tasks 10-14.

Skills attached to the agent render as cards with a rail showing what triggers them and which actions they use. Orphan actions (attached to the agent but not part of any skill) collapse into a disclosure block.

Move the article list, AI suggestions queue, and create/edit/approve/reject flows out of /settings/knowledge into a new top-level wiki page at /knowledge, under the Outils sidebar section. /settings/knowledge keeps only the org-wide AI directive editor plus a callout linking to the new page.

The pending-suggestions badge moves from the settings sidebar to the new top- level entry. Article bodies in the drawer detail view render as Markdown via Earmark.

L'éditeur de proposition Flux 2 boucle son MVP : le panneau de validations affiche les anomalies (prix, dates, sections requises, langue, scope, complétude) et permet de les résoudre ou de les ignorer ; un bouton « Lancer complète » réexécute toute la suite. Les commentaires arrivent au niveau section avec fil de réponses et résolution. Le bouton « Approuver et envoyer » dans la toolbar ouvre une confirmation et déclenche l'envoi par courriel au contact principal — fin du parcours opérateur.

EN: The settings sidebar has been simplified by merging closely-related pages into single tabbed views, modeled after the existing AI & Agents page:

• Mon compte (/settings/account) — fuses Profil + Disponibilité.
• Équipe (/organization/team) — fuses Utilisateurs + Rôles et permissions.
• Site public (/settings/public) — fuses Formulaire contact + Qualification + Templates email.
• Configuration Router (/router/settings) — fuses Guard + API Keys + Modèles LLM (super-admin).

Tabs use the standard pill_selector and now support deep-linking via ?tab=<name> so you can bookmark a specific tab and the browser back/forward buttons work as expected. The AI & Agents page (/router/settings/ai) was upgraded to the same URL pattern.

The settings sidebar drops from ~20 entries to ~12 without losing any functionality. Old URLs (/settings/user, /settings/availability, /organization/users, etc.) no longer resolve — use the sidebar to navigate.

FR : La barre latérale de paramètres est simplifiée : les pages étroitement liées sont regroupées en vues à onglets, sur le modèle de IA & Agents :

• Mon compte (/settings/account) — fusionne Profil + Disponibilité.
• Équipe (/organization/team) — fusionne Utilisateurs + Rôles et permissions.
• Site public (/settings/public) — fusionne Formulaire contact + Qualification + Templates email.
• Configuration Router (/router/settings) — fusionne Guard + API Keys + Modèles LLM (super-admin).

Les onglets utilisent le même pill_selector que IA & Agents, avec deep-linking via ?tab=<name> (vous pouvez maintenant marquer un onglet spécifique en favori et les boutons précédent/suivant du navigateur fonctionnent comme attendu). La page IA & Agents (/router/settings/ai) bénéficie aussi de ce nouveau format d'URL.

La sidebar passe de ~20 entrées à ~12 sans perte de fonctionnalité. Les anciennes URLs (/settings/user, /settings/availability, /organization/users, etc.) ne fonctionnent plus — utilisez la barre latérale pour naviguer.

EN: Two new tools to give your AI agents long-term context about your organization and your clients:

• Org Directive — write a single Markdown directive in /settings/knowledge (e.g. tone, languages, confidentiality rules, internal policies). It's injected into every agent's system prompt automatically — no per-agent configuration needed.
• Knowledge Base — articles scoped either organization-wide or to a specific client. Edit them yourself in /settings/knowledge (or in the Knowledge tab on a client page), or let agents propose articles automatically from meeting transcripts. Proposals land in an approval queue — nothing goes live until you say so.

When an agent works on an opportunity, it now sees both the global articles and the articles for that opportunity's client, giving every proposal, follow-up, or summary much richer context.

FR: Deux nouveaux outils pour donner à vos agents IA un contexte long-terme sur votre organisation et vos clients :

• Directive d'organisation — écrivez une seule directive Markdown dans /settings/knowledge (ton, langues, règles de confidentialité, politiques internes, etc.). Elle est injectée automatiquement dans le prompt système de chaque agent — aucune configuration par agent nécessaire.
• Base de connaissances — articles avec portée toute l'organisation ou un client spécifique. Modifiez-les vous-même dans /settings/knowledge (ou dans l'onglet Connaissances d'une fiche client), ou laissez les agents proposer des articles automatiquement à partir des transcripts de meetings. Les propositions arrivent dans une file d'approbation — rien ne devient actif sans votre validation.

Quand un agent travaille sur une opportunité, il voit maintenant à la fois les articles globaux et ceux du client concerné, ce qui enrichit chaque proposition, suivi ou résumé.

L'éditeur de proposition Flux 2 supporte maintenant les éditions assistées par IA. Survolez une section dans l'aperçu PDF pour révéler les chips d'action (Réécrire, Étendre, Raccourcir, Régénérer) — un clic envoie l'édition à l'IA via Jido, recompile, et met à jour le PDF en direct. Le panneau IA à droite affiche la conversation (l'historique des révisions) et un champ de prompt libre avec sélection de section.

Côté fiabilité : les échecs LLM ou compile diffusent maintenant un statut :error à l'éditeur au lieu de laisser l'indicateur figé sur « Compilation… ». Foundation prête pour B-3 (validations, commentaires, approbation).

• Broadcast only fires on {:ok, _} in create/update/delete/transition/update_directive
• Add approve_article/reject_article fallback clauses returning {:error, :invalid_transition} for non-pending articles
• Eliminate Repo.get!(Organization, ...) in update/delete/transition using admin_for_org_id? helper
• Add 20 new tests: cross-org auth, update/delete happy paths, get_article! isolation, invalid-transition guards

Wires up the admin approve/reject buttons in the pending AI suggestions section of /settings/knowledge. Approve transitions an ai_pending article to ai_approved (moving it into the approved list); reject transitions it to rejected (removing it from view). Both flows handle :unauthorized and :invalid_transition results, and ids are validated via Integer.parse to mirror the hardening in Task 9.

Adds EN/FR gettext strings for the new flash and confirmation copy.

Adds the org Knowledge Base settings page (Task 9):

• Route: /settings/knowledge under live_session :authenticated.
• Three sections: AI directive editor, approved articles list (CRUD via modal, admin-only), pending AI suggestions (read-only — approve/reject is Task 10).
• Subscribes to Knowledge.topic(org_id) and reloads on :knowledge_changed / :directive_changed broadcasts.
• Adds a "Connaissances" entry to the settings sidebar.

Edit gating uses a per-LiveView can_edit? helper (super-admin OR member with at least one role in the org) because is_org_admin and user_permissions in this codebase are both org-membership signals, not per-user role assignments.

• Extend settings_nav_item with optional :badge attr (renders pill when truthy/non-zero)
• Load :knowledge_pending_count in AuthLiveSession on mount; subscribe to Knowledge.topic(org)
• Update count live on {:knowledge_changed, _} broadcasts via attach_hook
• Pass @knowledge_pending_count through all settings_nav callers
• Fill EN/FR gettext translations for knowledge feature strings (16 entries)

PromptBuilder.build_instructions/3 now emits a [Org Directives] block between identity and authority when organizations.ai_directive is non-empty. The migration enforces NOT NULL (default "") so the nil case cannot occur in practice; pattern matches on nil are kept as safety belts for callers that build Organization structs directly.

Wire validations panel, comments panel, and approve & send modal into EditorLive. Adds mount assigns, all event handlers (run_validations, resolve_validation, create_comment, resolve_comment, open/close/confirm approve), handle_info for :validations_updated, auto-debounced :elixir_only validation on :compiled, and recipient_email/1 helper. Approve path calls CRM.send_proposal + ProposalMailer.render + EmailDispatch.send_prepared.

Adds a Knowledge section in the aside panel of the client detail view following the existing drawer pattern (alongside meetings, propositions, documents, etc.). Lists company-scoped articles only (org-wide articles remain in /settings/knowledge) and lets admins create new ones inline with scope auto-set to the active company.

Adds the org admin settings LiveView at /settings/proposals that lets an organization choose its default_proposal_flow (flow_1 / flow_2 / per_template). Drives the FlowPickerComponent's "Recommended" highlight.

Includes EN/FR gettext entries for the new strings.

Add null: false to the ai_directive column in the organizations migration to match auto_extract_knowledge and prevent a DB-level nullable column that the schema treats as a non-null string with default "".

Adds Meridian.Actions.ReadKnowledgeBase, a read-only Jido action that wraps Knowledge.fetch_for_scope/2 and serializes approved articles to plain maps for LLM consumption. Wires the action into every skill actions list that already includes ReadContext (18 sites across services, software, and pharma_consulting templates).

Returns ProposalRevision rows newest-first for the editor's conversation panel, with a configurable :limit (default 50).

Adds Meridian.Proposals.broadcast_failure/3 and wires it into all terminal-failure branches of GenerateProposal, ProposeProposalEdit, and RecompileProposalTypst so the editor's compile_status no longer gets stuck on :compiling when an LLM call, compile, template-mismatch, or section-not-found error occurs.

Adds Meridian.Knowledge.Article (schema + changeset) with required-field validation, source/scope_type enums, title/body length caps, and a DB-backed scope consistency guard that prevents cross-tenant company references.

Thin context helper wrapping Task.Supervisor.start_child around Meridian.Actions.ProposeProposalEdit.run/2, with :missing_keys validation and run: false dry-run mode for tests.

Les opérateurs peuvent maintenant choisir entre Flow 1 (DOCX, édition manuelle) et Flow 2 (Typst, piloté par l'IA) à chaque génération de proposition depuis une opportunité. La nouvelle page Paramètres → Flux de proposition permet aux administrateurs de l'organisation de définir le flow recommandé par défaut. Des badges visuels sur chaque proposition rendent évident quel flow est utilisé.

Les org-admins peuvent maintenant créer un template de proposition Typst (Flow 2) en 7 étapes assistées par IA : upload d'une inspiration DOCX/PDF (ou un des 3 modèles vierges fournis), analyse automatique de la structure, de la palette, de la typographie et des variables candidates, puis raffinage interactif avec aperçu PDF en direct. Le résultat est un template flow_2_native réutilisable depuis l'éditeur Flow 2.

L'éditeur Flow 2 (Typst) est maintenant accessible depuis le détail d'une opportunité. Le bouton « Générer une proposition Flux 2 » crée un brouillon contre le modèle Flow 2 par défaut de l'organisation et redirige vers le nouvel éditeur split-pane pendant que l'IA génère les sections initiales en arrière-plan.

Cette première livraison embarque la surface de l'éditeur : aperçu PDF live multi-pages, ancres de sections persistées depuis le compilateur Typst (pour les chips à venir), verrou d'édition basé sur Phoenix.Presence pour empêcher deux opérateurs d'écrire en même temps, et un bouton de bascule vers le Flux 1. Les chips d'édition IA, le panneau de validations, les commentaires et le flot d'approbation arrivent dans les itérations suivantes.

Adds placeholder WizardLive at /crm/proposal-templates/wizard (+ /:template_id variant), registers both routes in the :authenticated live_session, and inserts a "New Flow 2 template" secondary action button alongside the existing "New Template" button on the templates list page. EN+FR gettext strings added.

Copy the Phoenix-managed temp file to a controlled path inside the consume_uploaded_entries callback before spawning the async task, so the file still exists when AnalyzeInspirationDocument reads it. The Task cleans up the copy in a try/after regardless of success or crash.

Add a defensive {:error, _kind, detail} catch-all to RefineTemplate's with/else so an unknown future NIF kind never falls through to a 2-tuple clause and raises WithClauseError. Contract test pins the NIF kind to a String, detecting any future atom regression.

Implements step 2 of the Proposal v2 template wizard: reads a DOCX/PDF/TXT via TextExtractor, sends content to Router (use_case: "template_analysis"), and normalizes the response into a wizard_state envelope (sections, palette, typography, logo_placement, cover_layout, language, variables).

Replace the placeholder dotted-namespace paths (e.g. opportunity.contact.name) with the flat keys that Variables.build/1 and Computed.compute/2 actually produce in the snapshot. Tighten the count assertion to exact (== 10) and remove the dotted-notation check in favour of a non-empty-string check.

Implements Voice (step 5), Preview & Refine (step 6), and Save (step 7) in the proposal template wizard LiveView, plus the async Typst compile pipeline (generate_typst → Task.async → handle_info cond → Task.start compile → {:compile_done} → Storage.put → preview_pdf_url). Fixes fuzzy gettext translations that were rendering wrong button labels in EN/FR.

Appends canonical_paths/0 to Meridian.Proposals.Variables, returning a typed catalog of 17 dotted CRM paths the wizard's variable mapper will dropdown into. Adds two unit tests covering shape and dotted-notation invariants.

Add list_flow_2_templates/1, create_flow_2_template/2, update_flow_2_template/3, delete_flow_2_template/2 to Meridian.Proposals. Each write op persists a proposal_template_versions row atomically via Ecto.Multi; create broadcasts {:template_created, id} on PubSub; cross-org deletes return {:error, :forbidden}.

Adds Proposals.compile_template_preview/2 and the supporting synth_inputs/1 + synth_value/1 helpers. Compiles a Typst template against synthetic dummy data derived from the variable manifest, returning PDF bytes + hash without any persistence. Includes 6-test suite covering success path, error handling, tmp cleanup, and all synth_value type branches.

Add purely presentational function components for the proposal templates wizard: wizard_stepper, color_palette_picker, font_pair_card, section_checklist, variable_mapping_table, typst_preview, ai_prompt_input, and layout_card.

Add WizardPreviewController to serve transient wizard preview PDFs at /preview/wizard/:org_id/:hash, cross-org 403 and unknown hash 404.

Adds the TypstPreview LiveView hook that fetches a PDF URL from data-pdf-url and renders the first page into a canvas via PDF.js. The pdf.worker.mjs is built as a separate esbuild entry point and served as a static asset at /assets/js/pdf.worker.mjs.

Add Meridian.Proposals.TemplatePresets with list/0, fetch!/1, and slugs/0. Variable sources are validated against Variables.canonical_paths/0 at test time; retainer.start_date intentionally uses source: nil to force operator mapping in the wizard picker.

Adds Step 6 of the proposal v2 wizard: synthesizes Typst source from a wizard_state map, validates via Compiler.validate_fragment/2, and retries once with the prior failure detail injected into the prompt.

Replace the stub WizardLive with a full state machine covering Upload (step 1), AI Analyse (step 2), Identité visuelle (step 3), and Sections & variables (step 4). Steps 5-7 render a placeholder pending Task 13. Async LLM work (AnalyzeInspirationDocument, MapVariablesToCRM) runs via Task.async with proper demonitor + DOWN handling. Adds 4 LiveViewTest cases and extracts 14 new gettext strings.

Foundation for the upcoming Proposal v2 flow. No user-facing UI yet — Wizard (Option A) and Editor (Option B) build on this in subsequent plans.

What landed:

• Typst compile pile. Rust NIF (native/typst_compiler) wraps the typst crate directly: dirty-CPU scheduled compile/3 returns the PDF, a layout map (page + bbox per #section marker), and a SHA-256 of the PDF bytes. parse_section/2 and patch_section/3 are AST-based and tolerate both #section(id: "x")[...] and #section("x")[...] forms. validate_fragment/2 enforces an AST whitelist on IA-generated edits. SandboxWorld rejects parent-directory escapes and package-bound file ids.
• Data model. New proposal_revisions, proposal_comments, proposal_validations, proposal_templates (Flow 2 native, distinct from the legacy DOCX templates). New columns on crm_proposals (flow, typst_source, variables_snapshot, pdf_artifact_path, pdf_compiled_hash, language, downgraded_*). archived status added to the proposal enum. organizations.tax_config jsonb (default TPS+TVQ).
• Storage. Meridian.Proposals.Storage is a thin wrapper over File.* with org-scoped paths. PDFs live at org_<id>/proposals/<id>/pdf/<hash>.pdf. Auth-gated route GET /crm/proposals/:id/pdf streams them.
• Variables pipeline. Variables.compute/1 builds the snapshot from the opportunity + line items + per-org tax config. The opportunity listener auto-refreshes Flow 2 snapshots through RefreshProposalSnapshotWorker and broadcasts a toast on diff.
• Jido actions. GenerateProposal, ProposeProposalEdit (with AST
  • compile retry), RecompileProposalTypst, ExportProposalPdf, ValidateProposalConsistency (3 Elixir-pure + 3 Router-driven validators, :elixir_only / :router_only / :all scopes).
• Concurrency safety. SectionLock (Phoenix.Presence-backed) serializes simultaneous editors at the section grain.
• Operability. Dedicated :proposals Oban queue. Telemetry events [:meridian, :proposals, :compile, :*] span every compile call with proposal_id metadata. Daily EmitProposalDiskUsageWorker cron emits a per-org disk_used gauge (no quotas — telemetry only).

Add MeridianWeb.Presence tracker (wired into the supervision tree) and Meridian.Proposals.SectionLock, a thin first-arriver-wins lock keyed by proposal id. Auto-releases when the holding LiveView terminates via Presence's built-in untrack-on-down behaviour.

Three pure-Elixir validators for Flow 2 proposals — no LLM, no DB. Each exposes run/1 over a preloaded proposal-shaped map and returns a list of issue maps %{kind, severity, message, source_refs}.

• RequiredSections — uses Typst.Parser.list_section_ids/1 and extract_section/2 to flag missing-or-empty sections declared in the template's variables_manifest["sections"].
• DateConsistency — flags past delivery_date and mismatches between variables_snapshot["expected_close_date"] and the CRM opportunity.expected_close_on column.
• Completeness — flags empty values for every key in variables_manifest["required"].

• Add :proposal_compile Oban queue (concurrency 4) alongside the existing :proposals queue.
• Introduce Meridian.Proposals.Telemetry with attach/0 + handlers for [:meridian, :proposals, :compile, :start | :stop | :exception] and a disk_used gauge under [:meridian, :proposals, :storage].
• Wrap Compiler.compile/3 calls in the three actions (GenerateProposal, ProposeProposalEdit, RecompileProposalTypst) with :telemetry.span/3 so each compile carries proposal_id + action metadata.
• Attach telemetry handlers from Meridian.Application.start/2.
• Add Meridian.Workers.EmitProposalDiskUsageWorker (daily cron at 04:30 UTC) that calls Telemetry.emit_disk_usage/0 to publish one disk_used event per org root.

No quotas or enforcement — telemetry only (per Q4 / Q10).

Foundation review flagged three gaps:

1. GenerateProposal bypassed Compiler.validate_fragment/2 — the AST whitelist that ProposeProposalEdit enforces on every IA-emitted fragment. Bodies returned by the LLM were rendered straight into Typst source without the gate. Add validate_sections/3 (single- pass, no retry — mirrors the editor's first attempt; the @max_ast_attempts 2 retry can be ported later) wired into the with chain right after call_llm_for_sections/3. On the first violation: persist a ProposalRevision with accepted: false, error_kind: "ast", section_id, and metadata: %{"error", "fragment"}, broadcast {:edit_failed, "ast", msg}, and short-circuit with {:error, %{reason: :ast_invalid, section_id, detail}}. The function is exposed (not defp) so tests can drive it directly — the natural path is gated by ai_enabled: false on the org default.

2. Three controller error strings were extracted into both default.po files but left with empty msgstr: "Proposal or PDF not found" / "PDF not yet compiled" / "PDF file missing on disk". Filled in EN copies and FR translations. mix gettext.extract --merge is now stable (no diff).

3. The :proposal_compile Oban queue was declared in config/config.exs but no worker uses it (compile happens synchronously inside the action; EmitProposalDiskUsageWorker uses :maintenance, the snapshot worker uses :proposals). Drop the dead queue line; update the foundation changelog entry to drop the stale reference.

Test plan: test/meridian/actions/generate_proposal_test.exs gains a describe "validate_sections/3 (AST whitelist)" block with three cases: (a) clean bodies return :ok and persist nothing; (b) a body with #read("/etc/passwd") returns {:error, %{reason: :ast_invalid, section_id: "intro"}} and lands a rejected revision with the fragment

• error in metadata; (c) the reducer halts on the first violation (only one revision row, not two).

Adds MeridianWeb.ProposalPdfDownloadController, mounted under the authenticated [:browser, :load_user, :require_auth] pipeline next to the existing /crm/proposals/:id/docx download. The route streams the on-disk PDF artifact for a Flow 2 proposal, scoped to the caller's current organization via Meridian.Proposals.fetch_for_org/2 — cross- org access returns 404, as does a proposal that has not yet been compiled.

Naming note: file is proposal_pdf_download_controller.ex to avoid a filename collision with the pre-existing public-token-based ProposalPDFController at /proposal/:token/pdf.

Walks the PagedDocument frame tree to find #metadata((kind: "section", id: ...)) markers and emits JSON with their page + position. Layout JSON is consumed by the Flow 2 editor to overlay HTML chips on top of the PDF preview for hover-to-edit interactions.

Adds Meridian.Actions.GenerateProposal, a Jido action that generates the initial Flow 2 (Typst) proposal draft from an opportunity + a Meridian.Proposals.ProposalTemplate. Pipeline: freeze the variables snapshot, ask Router (use_case proposal_edit, with proposal_id metadata) for JSON-shaped section bodies via chat_completion_json/3, render #section(id: ...)[body] markers, prepend the preamble, compile via the Typst NIF, persist the PDF, and write a ProposalRevision row tagged applied_by: "ai" / accepted: true. Broadcasts {:compiled, hash} on "proposal:<id>".

The action takes both a proposal_id and a template_id since the existing crm_proposals table does not yet carry a template_id FK to the new proposal_templates table — when that FK lands the call collapses to one arg.

Registers the action's UI slot in Meridian.Agents.ActionMapping under the proposal: entity (label, icon — module resolution happens via the existing autonomy-rule lookup, not in this catalog).

Tests cover schema validation (org mismatch, incompatible flow_compat, missing rows) and the :ai_disabled Router gate; this project does not use Mox, matching the convention of proposal_assistant_test.exs.

Extends crm_proposals with Flow 2 columns (flow, typst_source, variables_snapshot, pdf_artifact_path, pdf_compiled_hash, language, downgraded_from_flow, downgraded_at) and creates 6 new tables:

• proposal_revisions — append-only edit ledger for typst_source
• proposal_comments — pin-anchored comments tied to section_id + char_range
• proposal_validations — cross-source validation results
• proposal_templates — Flow 2 (Typst) templates, distinct from legacy crm_proposal_templates (Flow 1 / DOCX)
• proposal_template_versions
• proposal_template_assets

Per-tenant scoping enforced via NOT NULL organization_id FKs on every new table. The plan's status CHECK constraint is omitted: existing rows already use values outside its narrow set (pending_approval, viewed, changes_requested, accepted, rejected, expired) and Ecto.Enum on the schema enforces validation at the application layer instead.

First step of the Proposal v2 architecture foundation. Creates the typst_compiler Rust crate with three NIF entry points (compile, parse_section, patch_section) returning stubs. Body of each is filled in by subsequent tasks. Pins typst* deps to a single version and registers the crate via rustler_crates in mix.exs.

Wires the compile NIF to actually run typst::compile through SandboxWorld, render to PDF via typst-pdf, SHA-256 hash the PDF, and return all three (plus a stub layout JSON for Task 5) to Elixir. Adds the Meridian.Proposals.Typst.Compiler wrapper module that loads the NIF and exposes compile/3 with proper return shape, plus stubs for parse_section/patch_section that Task 6 implements.

Pure-function pipeline that turns a Flow 2 proposal (with its opportunity, primary contact, company and line items preloaded) into the raw variables map, then enriches it with subtotal_cad, per-rate taxes and total_cad driven by organization.tax_config. The combined map is the canonical input for Typst compile and the value persisted as the proposal's variables_snapshot.

Adapted from the v2 plan to the real schemas: line items live on the proposal (not the opportunity), the contact uses full_name / preferred_locale, and the client company name comes from opportunity.company.name.

Single Jido action that fans out to all six Flow 2 proposal validators (3 Elixir-pure + 3 Router-driven), persists results to proposal_validations, and broadcasts {:validations_updated, list} on the per-proposal PubSub topic.

• Schema: proposal_id, template_id (passed explicitly because crm_proposals has no template_id FK yet — same convention as Tasks 17+18), scope in [:elixir_only, :router_only, :all].
• Fan-out via Task.async_stream/3 with a per-validator rescue so one bad validator can't poison the run.
• Persistence deletes prior unresolved rows before inserting, so re-running doesn't double-stack (resolved/dismissed rows are kept for audit).
• Preload chain opportunity: [:primary_contact, meetings: :transcripts] feeds all six validators with the data they need.

Also picks up a mix format whitespace fix on the Router-validations test file.

Lightweight Jido actions for the auto-refresh worker (Task 15) and the final-export pipeline.

RecompileProposalTypst is a pure recompile: it loads the proposal + template, refreshes the template root's inputs.json from the proposal's variables_snapshot, drives Typst.Compiler.compile/3 against the existing typst_source, persists the PDF, updates pdf_artifact_path/pdf_compiled_hash, and broadcasts {:compiled, hash} on the per-proposal PubSub topic. It does NOT change typst_source and does NOT insert a ProposalRevision — recompile is not an edit. Mirrors the schema (proposal_id + template_id) and error-handling shape of Tasks 17 and 18.

ExportProposalPdf is a thin composition over RecompileProposalTypst. For MVP it propagates the result unchanged; future iterations will also flip status to :sent and trigger the recipient email.

Both actions registered in Meridian.Agents.ActionMapping under the :proposal slot.

Implements typst::World on SandboxWorld struct: sources/files resolved through the configured root path, escapes rejected with FileError::AccessDenied. Fonts loaded once from typst-assets at first access (OnceLock-cached). Used by compile/3 NIF in Task 4.

Adds whitelist validator that walks the parsed Typst AST and rejects any node whose SyntaxKind isn't in the allowed set, plus rejects FuncCall to non-whitelisted callees. Core helpers (section, format_cad, format_date) are always allowed; per-template helpers come from variables_manifest.exposed_helpers. Used by the edit pipeline (Task 18) to validate LLM-emitted fragments before patching them into a proposal source.

Three Router-driven validators for Flow 2 proposals, each calling Router.chat_completion_json/3 with use_case: "proposal_validation" and proposal_id: id for ledger metadata, and parsing the structured {found_issue, severity, message, source_refs} JSON contract.

• RouterCheck — shared helper that wraps the Router call and Sanitizer-wraps the user prompt.
• PricingConsistency — extracts numeric tokens from opportunity → meetings → transcripts.content (transcripts join via meeting_id, not directly to opportunity) and asks the LLM whether the snapshot pricing matches.
• ScopeConsistency — synthesizes a qualification scope from opportunity need, description, transcript_summary, and transcript_requirements (no single qualification_scope column exists) and compares against variables_snapshot["scope"].
• LanguageConsistency — picks opportunity.locale_override ahead of primary_contact.preferred_locale (the contact column is preferred_locale, not language_preference) and checks against the rendered Typst sample.

All three return [] on Router failure so a transient outage cannot surface false-positive validation rows.

• Tag ledger metadata with :proposal_id when callers pass it through Router.chat_completion opts (Task 16, Proposal v2 plan).
• Append three proposal-related use cases to the AI settings catalog: proposal_edit, proposal_validation, template_analysis. Includes matching icon/description helpers + EN/FR gettext entries.
• Migration seed_proposal_use_cases inserts the three new rows for every existing organization with on_conflict: :nothing.

Adds Flow 2 fields to the existing Meridian.CRM.Proposal schema and introduces six new schemas under Meridian.Proposals.* for the new Flow 2 tables.

Meridian.CRM.Proposal (extended in place):

• new fields: flow, typst_source, variables_snapshot, pdf_artifact_path, pdf_compiled_hash, language, downgraded_from_flow, downgraded_at
• validate_inclusion(:flow, [1, 2])
• validate_flow_2_required_fields/1 — when flow == 2, typst_source and variables_snapshot are required (no-op for Flow 1, preserving existing changeset behavior)
• :archived added to the @statuses Ecto.Enum

Section-scoped Jido action for editing one #section(id: ...) of a Flow 2 (Typst) proposal. Pipeline:

1. Extract section body (Parser.extract_section/2).
2. Ask Router (use_case proposal_edit) for a new fragment.
3. AST-validate against the template's whitelist (variables_manifest["exposed_helpers"]). Retry once with the prior error appended to the prompt; persist a failure ProposalRevision (error_kind: "ast") and return {:error, %{reason: :ast_invalid}} if both attempts fail.
4. Patch + compile, retrying once on transient compile_failed; persist a failure revision (error_kind: "compile") and return {:error, %{reason: :compile_failed}} if both attempts fail.
5. On success, persist the PDF, update the proposal row, insert an accepted ProposalRevision, and broadcast {:compiled, hash}.

Hard cap: max 2 LLM calls per AST stage, max 2 compile attempts.

Also adds Meridian.Proposals.Typst.Compiler.validate_fragment/2 — NIF wrapper exposing crate::whitelist::validate_fragment so the action can run the same allowlist gate the compile path enforces, but on a raw fragment instead of a full source. Returns :ok or {:error, kind, detail} with kind one of "forbidden_kind", "forbidden_func", "parse_error".

Tests follow the project's no-Mox convention (cf. generate_proposal_test.exs): the LLM call is exercised through the :ai_disabled early-exit path, and the AST whitelist is tested directly against the new NIF (clean fragment, core helper, forbidden function, let binding, per-template helper allow/deny). Two-call retry semantics are covered by the unit tests on validate_fragment plus the action's pipeline shape; full two-call sequence belongs in an integration suite gated on a network-bearing tag.

Replace the parse_section/2 and patch_section/3 NIF stubs with a real AST-based span finder under native/typst_compiler/src/sections.rs and expose them via lib/meridian/proposals/typst/parser.ex with extract_section/2, patch_section/3, and a regex-based list_section_ids/1 for UI dropdowns. Pure-syntax operations -- no compile -- so they're cheap to call from edit-pipeline LiveViews and Jido actions.

Implementation note: walks the parsed tree with typst_syntax::LinkedNode to get absolute byte offsets via range() instead of the manual offset += child.len() accumulation hinted at in the design plan. The trailing #section(id: "x")[body] content block is parsed as a child of the FuncCall's Args wrap (per typst-syntax 0.13.1 parser::args), so the finder descends one level into Args to locate it.

Wire the Flow 2 snapshot pipeline end-to-end so any change to a CRM opportunity propagates to its in-flight proposals:

• Meridian.Proposals.freeze_snapshot/1 and refresh_snapshot/1 (re)compute the proposal's variables_snapshot from the current opportunity state and broadcast :variables_refreshed on proposal:<id>.
• Meridian.Proposals.SnapshotListener GenServer subscribes to the new "opportunities:updated" PubSub topic and enqueues a Meridian.Workers.RefreshProposalSnapshotWorker for every Flow 2 proposal still in :draft or :pending_approval on the touched opportunity (approved/sent/etc. proposals are deliberately left alone — their snapshot is locked).
• Meridian.CRM.Sales.update_opportunity/2 now broadcasts {:opportunity_updated, id} on success.
• New :proposals Oban queue (concurrency 4) hosts the worker.
• SnapshotListener wired into the supervision tree after the agent layer (Phoenix.PubSub + Oban already up by then).

Introduces Meridian.Proposals.Storage, a thin wrapper over File.* that gives proposal templates and compiled PDFs a stable, org-scoped on-disk layout. Single Docker volume host-mount, no S3 abstraction. Test config points the root at a unique tmp dir per run.

Adds tax_config (jsonb) to organizations with a Quebec-default of TPS (5%) + TVQ (9.975%). Flow 2 proposals read tax rates from this per-org config when computing line-item totals.

The default is set via execute rather than add :col, :map, default: because Ecto's add macro does not reliably serialize a nested Elixir map literal to a Postgres JSONB default; using a SQL JSON literal is explicit and adapter-agnostic. Existing rows are backfilled.

Router now supports per-tenant configuration for the settings that enterprise customers need to control themselves:

• Bring-your-own OpenRouter key (BYOK). Organizations can pin their own OpenRouter API key from Router → Settings → AI & Models → Configuration. When set, Router calls bill against that account instead of the platform default. Stored encrypted at rest; the UI shows "Configured" / "Not configured" without revealing the key.
• Custom rate limits. Super admins can override the per-org requests-per-minute ceiling from Admin → Organizations. Leaving the field blank uses the tier default (30 rpm free, 120 prepaid, 600 postpaid/enterprise) — the form now shows the active default in the placeholder.
• Per-org model overrides. From Router → Admin → LLM Models, super admins can open the new "Per-org overrides" drawer to whitelist a globally-disabled model for one organization, blacklist a globally- enabled one, or reclassify the billing tier for that customer. A filter input narrows the model list as the catalog grows.

• Detect skills whose required_actions reference unimplemented modules and surface them as "Coming soon" in the UI; SkillExecutor short-circuits execution with {:error, {:coming_soon, missing}} instead of crashing
• Notify ai_access admins (in-app, deduped 24h) and render a "Setup pending" card on /agents when background workers find no agent owning an action they need
• Tag credit_ledger_entries metadata and Stripe meter events with api_key_id and user_id to enable per-key cost audit
• Strip stale fuzzy flags from 76 AI-perimeter gettext entries and queue the rest as tech debt in TODO.md

Cluster A (production bug): Meridian.Actions.QueryMessages and QueryTraces were ordering by m.inserted_at, but the AgentMessage and AgentTrace schemas expose a custom :created_at field and do not call timestamps(). Both queries crashed at runtime with ERROR 42703 (undefined_column). Switched the order_by clauses to :created_at. Also pinned the trace ordering test setup to use explicit, separated created_at values, since :created_at is naive_datetime (second resolution) and rapid back-to-back inserts shared a timestamp, making ordering non-deterministic.

Cluster B (mailer refactor): Meridian.CRM.Billing.InvoiceMailer and Meridian.CRM.Emails were refactored to expose only render_*/1 functions; sending now goes through Meridian.Organizations.EmailDispatch. Rewrote the two affected test files to call render_invoice_email/1 and render_confirmation/1 and assert on %{subject, body_html, text_body, ...} instead of using assert_email_sent/Swoosh test assertions. The "email is sent to the correct recipient" test was reframed as "rendered output references the recipient company" since recipient resolution moved to EmailDispatch.

Cluster C (LiveView permission gates): a new MeridianWeb.PermissionLiveSession on_mount hook enforces an @permission module attribute on each protected LiveView. Updated the test conn_case.ex register_and_log_in_user/1 helper to also create a per-test role containing every seeded permission and assign it to the test user. This unblocks every authenticated LiveView test that previously redirected to / with "You don't have permission...". Verified one test from each affected LiveView module renders.

Cluster D edge cases:

• Meridian.Backups.Encryptor.decrypt/2 length guard relaxed from > to >= iv+tag size so that empty-plaintext roundtrips work (a legitimate case; AES-256-GCM with no payload is still a valid 28-byte ciphertext).
• Meridian.GuardTest custom_patterns assertion now matches by prefix instead of equality, since the regex error message gained a ": missing terminating ]..." suffix.
• BookingLive test for the pre-selected slot now asserts the design token border-[var(--color-primary)] instead of the legacy border-blue-500 class.
• Meridian.Actions.ResearchCompany not-found test now uses a guaranteed- missing positive id and passes agent: nil in context so we reach the CRM.get_company! call (which is the path under test) instead of crashing earlier on context.agent.

• C1: fall back to token-based cost estimate when OpenRouter omits usage.cost in the final SSE event; warn if both cost and usage are missing.
• C10: error responses uniformly include OpenAI-compat shape {error: {message, type, code, param}} with param always present (nil when N/A).
• C11: emit SSE keep-alive comment every 30s during streaming to keep intermediate proxies from closing slow streams.
• C12: bound SSE parser buffer to prevent unbounded growth on malformed upstream events; abort with :sse_buffer_overflow on overflow.
• C13: move streaming state out of the process dictionary into an explicit accumulator for reentrancy safety.

mix precommit green.

Replaces direct Router calls from CRM LiveViews and workers with Jido action dispatch. CRM AI features now run through the agent runtime, producing agent_traces rows and respecting autonomy rules.

Two improvements to make the agent surface honest about what it can actually do for your organization:

• 'Coming soon' skills. Template-seeded skills that depend on actions not yet implemented are now shown with a "Coming soon" badge in the skills library and on the skill detail page (with the missing actions listed). The Run-now button is disabled for these skills, and triggers that fire them are short-circuited with an informative log instead of silently erroring.
• Setup-pending alerts. When a background event fires (qualification scoring, transcript extraction/summary, opportunity insights, company research) and no active agent in your organization owns the matching action, admins now get an in-app notification (deduplicated to one per action per 24h) and a "Setup pending" card on the Agents dashboard listing every unassigned platform action.

• C7: /router/settings/api-keys LiveView for org users to create, revoke, and audit usage of their Router API keys. Plaintext shown once on creation; rest of the time only prefix is visible. Permission: router_api_keys_manage. Sidebar entry added.
• C9: /router/pricing public LiveView with per-model pricing table (CAD primary, USD secondary, includes platform fee) and an interactive cost estimator using CostEstimator.estimate/3. Mounted in the public marketing live_session.

mix precommit green.

• C2: confirmed pre-existing — guard_policies table + Pipeline already per-org (created in earlier P5 work). Settings_guard_live UI already exposes strict_mode toggle, detector controls, custom patterns and allowlist editor; no schema or pipeline changes needed.
• C4: organizations.openrouter_api_key_override (encrypted via Meridian.Encrypted.Binary); Router.get_api_key/1 prefers per-org BYOK over Platform.openrouter_api_key over Application env. Added test seam Router.test_resolve_api_key/1. settings_ai_live shows Configured / Not configured status without revealing the key; "clear" sentinel removes the override.
• C5: organizations.rate_limit_rpm (nullable); RateLimiter.resolve_limit/1 returns explicit override → tier default by billing_mode (free 30, prepaid 120, postpaid/enterprise 600) → 60 fallback. Admin organization edit form gets a number input with placeholder showing the current tier default.
• C6: org_model_overrides table + OrgModelOverride schema; LlmModel gains list_active_for_org/1 + list_all_for_org/1 that LEFT JOIN overrides. Billing.resolve_model now consults the org-aware list so per-org blacklists/whitelists take effect across explicit model_id, agent.llm_model_id, use_case, and org default paths. Router admin LLM Models page gains a "Per-org overrides" drawer with org picker, filter input, per-model effective enabled toggle, tier override select, and reset button.

EN+FR gettext translations added for all new strings.

mix precommit green: 2228 tests, 0 failures (was 2199 baseline).

Mix is not available at runtime in an Elixir release, so calling Mix.Project.config()[:version] inside a migration crashes the boot on production deploys (UndefinedFunctionError) and aborts every subsequent pending migration. Read the version via Application.spec/2, which works in both dev and release.

D — Agents:

• D5: trigger outcome detail (last_fire_outcome + last_fire_reason) surfaced in triggers UI; structured outcomes (executed, agent_inactive, skill_archived, filter_mismatch, no_owning_agent, error) with hover tooltip showing the human-readable reason
• D6: human inbox :retry resolution mode — re-dispatches the original action via JidoAgent.submit_action; UI button next to Approve/Reject
• D7: org-level autonomy_learning_mode flag (opt-in). When enabled, AutonomyServer auto-promotes escalate to propose_first after N consecutive successful runs (default 5, configurable per org via autonomy_learning_threshold). Hooked into SkillExecutor success path. Toggle exposed in admin organizations settings.
• D8: implement triggers-using-this-skill list (was Task 23 placeholder)
• D9/D10: gettext + design tokens in agent_chat_live (replaced bg-gray-, text-gray- with var(--surface-), var(--text-); added Send message aria-label)
• D11: surface model save errors in agent_constitution_live with changeset.errors translation and inline

  below the model select

• D12: explain "Skill library coming soon" with helper text + lock icon for clearer deferred-feature signal
• D13: agents sub-nav exposing Overview/Skills/Triggers/Inbox/Traces; removed redundant Inbox/Traces buttons from page header
• D14: weekly digest skeleton card shown while LiveView is not yet connected

E — CRM:

• E2: cancel button for AI rewrite during generation; cancel_ai_rewrite event uses cancel_async on both :ai_rewrite and :ai_slash_command tasks
• E3: stop button for docx composer; ProposalDocxComposer.cancel/1 sets a :persistent_term flag the forwarder loop checks; PubSub :cancelled event lets the LiveView reset its UI immediately
• E4: cost display in docx progress UI (estimated CAD spent based on cumulative token count)
• E6: design tokens in opportunities/modals (no more bg-blue-100 / bg-gray-100 / dark:bg-* duplication)
• E7: gettext on opportunities/modals raw English strings [E10: streaming for chat/rewrite — skipped per plan]

Big-bang reorg + safety pass.

REORG (Option 2):

• Move Meridian.AI.Router → Meridian.Router (lib/meridian/router.ex)
• Move Meridian.AI.LLMClient → Meridian.Router.LLMClient
• Move Meridian.Billing.* → Meridian.Router.Billing.*
• Move Meridian.Guard.* → Meridian.Router.Guard.*
• Move Router web modules to lib/meridian_web/live/router/ + lib/meridian_web/live/router_admin/ + lib/meridian_web/router/
• Move tests to test/meridian/router/{billing,guard}/ and test/meridian/router_test.exs etc.
• Add @moduledoc to llm/embeddings/models controllers identifying them as Router product API.

URL renames + sidebar Router group:

• /settings/ai → /router/settings/ai
• /settings/guard → /router/settings/guard
• /admin/llm-models → /router/admin/llm-models
• 301 redirects from old URLs via MeridianWeb.RedirectController (remove after one release of grace).
• Settings sidebar gains a "Router" group containing AI Settings, Guard, and Models Catalog (super-admin only). active_page values renamed accordingly: ai_settings → router_ai_settings, guard_settings → router_guard_settings, admin_llm_models → router_llm_models.
• /settings/billing-credits not currently routed → no rename needed.

Safety fixes:

• B1: CostEstimator returns {:error, :unpriced_model} for unknown models (no synthetic 0.001/0.002 fallback). Router gateway gains ensure_priced/1 step before reservation; chat_completion, chat_completion_stream, and embed all surface the error. llm_controller + embeddings_controller return 422 with OpenAI-compat shape (code: "unpriced_model", param: "model").
• B2: embeddings_controller returns 422 (was 412) for guard halts with OpenAI-compat shape exposing only the high-level category names — never regex source or matched substring.
• B3: Confirmed input halt skips reservation/debit (the with-chain short-circuits before run_with_reservation) and writes a halted: true audit row via record_halt_audit. Fixed a latent String.Chars crash in record_halt_audit when called from chat_completion (messages list now serialized via serialize_messages/1 before audit insert).

Tests added:

• Meridian.Router.Billing.CostEstimatorTest now asserts {:error, :unpriced_model} for unknown models.
• Meridian.RouterTest covers chat_completion unpriced rejection and guard halt no-debit / audit-row invariant.
• Meridian.RouterEstimateTest renamed and updated for :unpriced_model.
• LlmControllerTest gains 422 unpriced model integration test.
• New EmbeddingsControllerTest covers guard halt 422, unpriced 422, missing input 400, and 401 without auth.

CLAUDE.md updated: AI architecture table now reflects new paths; new forbidden rule blocks direct Router.Billing imports outside Router product code.

mix precommit green: 2194 tests, 0 failures (baseline 2187 + 7 new).

Surgical drift fixes across 17 test files plus one production fix.

• context_resolver: replace map[:key] access with Map.get(map, :key) so Ecto schema structs (which don't support [] access) work correctly. Real bug surfaced by agents_jido_test.
• crm_clients (11): selector drift after action_button migration.
• crm_proposals_live + crm/proposals: align with require_proposal_approval default; set false in test fixtures where pre-approval flow is intended.
• crm_opportunities (8): assertions updated for drawer-based Intelligence panel and design-token buttons.
• dashboard (5): follow redirect to /dashboard, update section names.
• organizations: use new ApiKey API, update constraint name and log_api_key_usage return shape.
• crm_projects: assert on phx-click selector instead of localized button label (gettext drift).
• misc: targeted fixes across time_live, user_dropdown, backup_download_controller, tax_service, agents_jido, send_agent_message, opportunity_product_types, invoices_live, page_controller.

mix precommit green (2208 tests, 0 failures).

Big-bang removal of dead/deprecated AI code paths after the move to a Router-only LLM gateway.

• Delete Meridian.AI.OpenAIClient (no production callers; only ModelCache used it)
• Delete Meridian.AI.ModelCache (zombie supervised child, no callers)
• Drop openai_api_key, openai_workspace_id, ai_system_prompt columns from organizations table; remove BYOK form fields from admin/settings UIs. Migration: priv/repo/migrations/20260426034202_drop_byok_columns_from_organizations.exs
• Delete Meridian.Agents.AgentProcess (replaced by JidoAgent; no callers)
• Standardize JidoAgent.submit_task signature on {org_id, slug}; add submit_task_by_id/2 helper for callers that only have an agent UUID; fix chat_server.ex which was passing a bare agent_id.

mix precommit green.

Replace the placeholder-token flow with a single AI pass that sees the whole template plus the full proposal/opportunity context (company, contact, discovery, transcripts, line items, instructions) and decides per paragraph whether to keep, rewrite, or delete. Operations are applied via python-docx so layout, tables, headings and styles are preserved. Streaming progress is broadcast on Phoenix.PubSub so the proposal detail view shows live phases and a token counter while generation runs.

Also fixes the per-chunk "No x-openrouter-cost header" warning by asking OpenRouter to include usage in the SSE stream and demoting the missing-header log to debug — cost is now reported accurately for streamed completions.

Removes the two-step tokenize-then-fill approach (TemplateTokenizer, Docx.tokenize/3, original_file_path column, modal "Upload PDF" / "Import as Draft" tabs) which produced inconsistent results.

Generating a Word proposal now uses a single AI pass over the entire template with full opportunity context — company, contact, discovery, transcripts, internal notes, line items, and any extra instructions. The model decides per paragraph whether to keep, rewrite, or delete, so finished-proposal templates work as inspiration: layout, tables, headings and styles are preserved while mandate-specific paragraphs are personalized for the client.

The proposal detail panel now shows live progress while generation runs — preparing, writing, applying — with a token counter so you can see the AI working in real time.

Surfaces the latest WeeklyDigest (reclaimed hours, run count, override rate, WoW delta, narrative highlights, needs-attention) at the top of the Agents Dashboard, falling back to a friendly placeholder when no digest exists yet.

Introduces AgentsSkillsLive at /agents/skills with filter chips (All / Template / Custom / per-agent), search, and a SkillCardComponent-based grid. Whole cards link to /agents/skills/:slug (Task 14 target).

Bridges named Skills to JidoAgent: renders {{param}} templates in instructions, submits the task to the agent GenServer (starting it via AgentSupervisor if needed), and persists the result as a skill_runs row with outcome, duration, tokens, and trace_ref. Wraps the GenServer call in try/rescue/catch so a missing or misbehaving agent process still produces a skill_run with outcome="error" instead of crashing the caller. Broadcasts {:skill_run_completed, run} on the org topic and enqueues the (stub) SkillRunJudgeWorker for Task 9.

Also adds the Noop test action and a stub judge worker using the :default queue until the :agents queue is introduced in Task 9.

Adds Meridian.Agents.Emails.DigestEmail builder (Swoosh) and wires it into DigestComposerWorker so the weekly digest is delivered to all org users after the narrative skill runs. Marks the digest email_sent_at stamp once after a successful pass.

Task 32 (Agents v1.0): hooks up the Phase 4 @-mention infrastructure (AgentMention JS hook + AgentMentionComponent picker) to rich-text surfaces across the CRM.

Wired with hook attributes (phx-hook + data-entity-type/id + .agent-ready wrapper):

• Opportunities discovery Q&A textareas (inline + drawer versions)
• Client company note body
• Proposal note body
• Meeting internal notes
• Meeting qualification-override notes (opportunity surface)

Fully wired (picker + 4 event handlers) on the opportunity detail LV (CRMOpportunitiesLive):

• agent_mention_picker_open/close → toggles @mention_picker assign
• agent_mention_insert → push_event mention-inserted
• agent_mention_run_skill → SkillExecutor.execute/3 with mention_context

The picker is conditionally mounted next to the opportunity detail view.

No-op catch-alls added to CRMClientsLive and MeetingDetailLive so users typing @ in those notes fields don't crash the LV while their full picker wiring is deferred to a future task. CRMProposalsLive already has a broader catch-all that absorbs the events.

Skipped surfaces:

• projects/detail_components.ex — no rich-text notes field to wire
• public/discovery_live.ex — public-facing, no authenticated context

Adds Meridian.Agents.EventBus, a GenServer that subscribes to the "crm:events" PubSub channel and fires matching crm_event triggers via SkillExecutor. CRM contexts broadcast events on successful mutations:

• opportunity_created (CRM.Sales.create_opportunity/1)
• proposal_sent (CRM.Proposals.send_proposal/2)
• proposal_signed (CRM.Proposals.accept_proposal/1)
• meeting_scheduled (CRM.Meetings.book_meeting/3)
• invoice_paid (CRM.Billing.Payments.record_payment/1, only when the status transitions to :paid)

• Gate TriggerCronWorker + EventBus on agents_v1_enabled via Triggers query joins
• Gate DigestComposerWorker on agents_v1_enabled
• Zero reclaimed_minutes on error-outcome skill_runs
• Parse digest narrative from AgentTrace.decision, not SkillRun.decision
• Add from: :binary_id to skill_runs.trigger_id modify for rollback safety
• Tenant-scope list_skills_for_agent and EventBus/TriggerCronWorker skill loads
• Replace silent no-op with info flash on non-opportunity mention surfaces

Adds the primitives for @-mention agent/skill picker in rich-text surfaces:

• JS hook detects @ + partial slug in textareas / contentEditable and pushes agent_mention_picker_open / _close to the host LiveView.
• LiveComponent renders a popover listing active agents and their skills filtered by query, with events targeted at the host LV.

Host wiring will follow in Task 32 (rich-text surfaces).

Implements Task 14 of Agents v1.0: MeridianWeb.Agents.AgentSkillLive editor for individual skills, supporting both create (slug == "new") and edit flows. Includes a Run-now modal that lists the skill's parameters_schema and dispatches SkillExecutor.execute/3 with the collected params. Also supports attach/detach to agents, archiving, and shows recent skill_runs.

Fixes a latent bug in Skills.update_skill/2 where the template→custom source flip produced a mixed atom/string-key map (rejected by Ecto.Changeset.cast) when invoked from LiveView forms.

Your agents just got four new powers:

• Skills — reusable multi-step workflows. Each template ships with ~6 pre-built skills; add your own or tune the defaults.
• Triggers — run skills on a cron schedule, on CRM events (new opportunity, proposal signed, invoice paid), or anticipatorily (30 min before a meeting, 7 days before an invoice is due). The CRM is the event source — no connectors needed.
• Weekly Digest — every Monday, see how much time your agents saved you, written by an agent itself.
• @-mentions — type @Scout in any opportunity, client, proposal, or meeting note. The agent picker opens inline; pick a quick-run skill to fire it with the surrounding entity as context.

Turn it on from Org settings → Agents v1.0.

Your skills now run on their own.

• Cron triggers — schedule skills with natural-language or raw cron (Monday 9am, every weekday at 8am, etc.).
• CRM event triggers — fire when a new opportunity lands, a proposal is signed, an invoice is paid, or a meeting is booked. Optional event filter DSL (e.g. "unless source is referral", "when score ≥ 80") narrows the fire condition.
• Anticipatory triggers — pre-computed time-relative events like meeting_30m_before and invoice_due_in_7d fire on their own.

Each industry template ships with 5 seeded triggers wired to the default skills. Turn them off or tune them in /agents/triggers.

Agents now run Skills: named, reusable workflows that chain tool calls and LLM reasoning. Each industry template ships with a pre-built skill library — attach them to agents, tune them, or author your own.

Next up in this release: Triggers to fire them automatically, a weekly digest of reclaimed hours, and @-mentions to invoke them from any page.

Type @ in any note, comment, or proposal draft to invoke an agent right where you're working.

• Mention an agent — @Scout opens a picker with quick-run skills scoped to the current entity.
• Run a skill with context — one click fires the skill with the surrounding opportunity/client/meeting as auto-context.
• Stays in flow — no page jump, no tab switch. The agent replies inline.

Wired surfaces in v1: opportunity discovery notes, client notes, proposal notes, meeting notes. More surfaces land in v1.1.

Every Monday morning, the Weekly Digest lands in your inbox — and on your Agents dashboard.

• Reclaimed hours: how many minutes of human work your agents saved this week, LLM-judged per run.
• Three wins: a short narrative of the biggest impact, written by an agent.
• Needs attention: errors, escalations, and override spikes that deserve a look.
• Per-agent rollup: who did what, in one table.

Tune the schedule or turn the digest off in Agents → Skills → compose-weekly-digest.

• changelog: stop auto-marking the popup seen on mount (previous fix flashed the modal then dismissed it). Instead, an in-memory ShownCache records {user_id, version} the first time the popup renders, and subsequent LV mounts in the same BEAM run skip recomputing entries. The DB flag (last_seen_app_version) is still only written when the user explicitly dismisses, so a restart or re-login without dismiss will surface the popup again.
• invoices: add optional "Amount" field to the New Invoice modal. When set, a single "Services" line item is created alongside the invoice so users don't have to create the invoice first and then add a line item. Field only shows on new invoices (not edit).

Meridian.Changelog.all/0 sorted entries by date only, so on /changelog a day with 20+ entries spanning multiple releases (like today's v0.64.4 through v0.65.0 burst) rendered in whatever order NimblePublisher handed them back — versions appeared interleaved (v0.64.5 next to v0.65.0 next to v0.64.2) which read as broken.

Use a (date desc, version desc) comparator. Within a day, unreleased entries (nil :version) bubble above released ones so in-progress work stays visible when a shipped version lands the same day.

Expose Changelog.sort/1 so the two filtered sort sites in Unseen (filter_trigger/2 and all_unread/2) share the canonical ordering instead of re-sorting by date alone and re-introducing the bug for the login popup and avatar unread modal.

• changelog: mark last_seen_app_version as soon as the popup shows so it doesn't re-appear on every page navigation. Dismiss button is now strictly for closing the on-screen modal. Also short-circuit trigger_entries when user is already caught up.
• invoice modal: tax rate was exponentially growing on each phx-change because validate_invoice cast the raw "13" percent value as a fraction, then the re-render multiplied by 100 for display. Route validate_invoice params through maybe_convert_tax_rate to match save_invoice.
• line-item modal: unit_price wasn't a schema field (schema uses unit_price_cents) so the changeset silently dropped it on validate, making it impossible to type an amount. Route validate_line_item through convert_line_item_params.
• harden maybe_convert_to_cents / maybe_convert_tax_rate to use Float.parse / Decimal.parse so partial/integer input doesn't crash.

These survived the accounts -> organizations table rename. Postgres identifies them by OID so they kept working, but they produced misleading errors (account_users_user_id_fkey on FK violations) and broke code that looked up names statically (e.g. pg_get_serial_sequence still returned accounts_id_seq).

• Adds an INSERT path when the target organization row is absent (bare-DB disaster recovery). Looks up the sequence name via pg_get_serial_sequence so it survives the legacy accounts_id_seq name.
• Replaces the four-field hand-picked update with a full-attribute update so slug and other fields are correctly restored onto an existing org.

Wraps every per-org DEK with the master key at rest in backup_storage_configs and exposes Backups.fetch_dek/1 for callers that need the raw DEK.

Scans a directory of .enc files, groups by organization, applies the configured strategy (latest-per-org or all-in-order), and restores each through the importer. v1 files without the MRDN magic are logged and skipped since they cannot be DR-recovered without the DB DEK.

Previously every agent reply rendered with the same neutral sunken bubble, even when the underlying task outcome was "error", "rejected", "escalated", or "proposed". An insufficient_credits failure landed as %{decision: %{"error" => "insufficient_credits"}, outcome: "error"} inspected into the chat, blending in with a normal response.

ChatServer.spawn_agent_response now runs each JidoAgent result through format_agent_result/1:

• outcome: "error" → human-readable text + warning glyph, stamps metadata.error = true, metadata.error_reason. Known reasons (insufficient_credits, ai_disabled, budget_exceeded) get friendly copy; others fall through.
• outcome: "rejected" → same, carries the guardrail reason.
• outcome: "escalated" / "proposed" → inbox hand-off message, metadata.escalated = true.

The drawer's message_classes/2 now reads that metadata: error/rejected render in the danger soft surface, escalated/proposed in warning soft, everything else keeps the neutral sunken look. Helpers tolerate both atom and string keys because we serialize the map through the DB and back.

estimate_reservation_cents used a max(cost_cad, 500) floor — $5 CAD reserved on every LLM call regardless of model or prompt size. Nano models actually cost 1-2¢ per call, so the reservation was 500× the settlement. With parallel agents (suggest_actions runs async_stream with concurrency 4) this effectively locked $20 of credit during a burst for calls that settled to pennies, starving anything else on the same org balance.

Keep the worst-case estimate (prompt + max_tokens × pricing) and apply a 1.5× safety buffer for tokenizer drift, then clamp to a sensible $0.10–$100 range. Per-call overhead like ledger writes and markup rounding still has headroom, but we stop over-reserving by three orders of magnitude.

• chat_server: match raw map returned by JidoAgent.submit_task so successful responses run through format_agent_result instead of inspect-dumping the decision map into the drawer
• ai-drawer: humanize legacy raw inspect dumps already persisted in conversations and apply error/escalated colors to content-sniffed matches
• ai-router: drop reservation estimate from 1.5× to 1.25×, floor 10¢ → 2¢, and assume 300 completion tokens by default (was 1000) so short chats reserve a few cents instead of ~$0.50

Two wire-format mistakes caused the streamed chat completion to crash with "Jason.Encoder not implemented for type Function":

1. build_tools/1 passed Jido.Action.Tool.to_tool/1's raw map through to the router. That map embeds function: &execute_action/3 — a captured handler used for local dispatch, not for serialization. Jason choked on the function reference when encoding the request body. Project the Jido shape into OpenAI's {"type": "function", "function": {name, description, parameters}} envelope and drop the handler.

2. HandoffManager.handoff_tools/1 built a flat map with name/ description/parameters at the top level. OpenAI/OpenRouter require those under a nested "function" key alongside "type" — without the wrapper the API would reject the call even if Jason had succeeded.

Tool execution on our side still happens via the module lookup (build_tools knows the Elixir module behind each tool). The LLM only needs the schema, so exposing just the schema is correct and safe.

AgentSupervisor.start_agent/1 starts the JidoAgent via the same DynamicSupervisor that owns the ChatServer. Calling it from inside ChatServer.init/1 means the supervisor is already busy servicing the ChatServer's own start_child request and can't accept the nested JidoAgent start — GenServer.call times out after 5s (the supervisor start is blocked waiting for init to return, which is blocked waiting for the supervisor). The first AI drawer open hit this and killed the LiveView before the panel could render.

Move the start_agent call to ensure_started/1, which runs in the caller's process BEFORE we ask the supervisor to start the ChatServer. Idempotent for already-running JidoAgents. Removes the temporary toggle diagnostic.