# Start here: UI registry

Use https://mortar.tony.codes to assemble React 19 + Tailwind 4 applications from centrally managed components. Give the agent this URL and your application brief. No team, invitation or owner credential is needed.

## The brief describes the product

For example: “Build a one-page trading dashboard with portfolio value, daily change, holdings, recent trades and order entry. Use realistic mock data.” You do not need to repeat registry setup, component reuse, contribution, testing or deployment rules.

Read the [service agent skill](https://mortar.tony.codes/agent-skill.md). Its versioned [workflow contract](https://mortar.tony.codes/agent-policy.json) is included in every build packet. Registration, graph discovery, approved npm reuse, project-agnostic contributions, responsive accessible light/dark UI, build/typecheck/audit and browser verification are service defaults. Fix failures before reporting completion. Provide a local preview by default; deployment requires user authorisation already given or subsequently requested.

`init` saves the defaults in `.tony-ui/agent-instructions.md`, includes required checks in its output, and creates `AGENTS.md` if absent. It preserves existing human `AGENTS.md` instructions; read both those instructions and the saved service defaults. The generated starter uses the same contract.

The code audit enforces supported import, approval, integrity, collection and styling rules. It does not prove that build/typecheck or visual, responsive and accessibility verification occurred. Its report lists the outstanding categories of completion evidence; supply actual results separately. Protected CI independently verifies its checkout. A product brief cannot grant approval or deployment authority.

## Individual agent onboarding

Read the [machine manifest](https://mortar.tony.codes/.well-known/ui-agent.json), inspect the specific client through your normal permissions, then run from the application checkout:

```sh
curl --fail https://mortar.tony.codes/agent-cli.mjs -o /tmp/tony-ui-agent.mjs
node /tmp/tony-ui-agent.mjs init --agent 'my-agent' --brief 'Application dashboard'
```

The client registers an individual identity, creates a private project record when needed, configures npm, installs the exact approved release and saves `.tony-ui/build-packet.json`. Add `--scaffold` for an empty generic application. Existing source, scripts and human instructions are preserved. Use `register --agent my-agent` to obtain an identity without creating a project or installing anything. Approved discovery is public: `GET /api/agent/discover?brief=Application%20dashboard`.

Credentials are saved at mode 0600 outside the application. Named profiles are keyed by checkout and stable agent name. Reuse the same name/path for later runs; `UI_IDENTITY_FILE` can explicitly select an external profile. Names and repository URLs are attribution, never access credentials. Each agent owns its new project records. Registering another agent does not expose existing projects, unpublished submissions or audit history. Existing credentials retain their existing private access during migration; archived team/membership records are retained for that purpose, but team and invitation HTTP operations are removed. Existing shared project configurations require an already authorised identity, not a new invitation.

The client needs Node 22+. `.npmrc` routes `@tony-ui` to the public registry at git.tony.codes. Installing the MIT kit needs no service account or UI token; the agent credential is used only for hosted services. Unset obsolete `UI_INVITE`; onboarding ignores unrelated `UI_TOKEN`. Use `rotate --agent my-agent` to replace the saved credential. Update an externally supplied `UI_TOKEN` separately. Registration retries use a persistent random client key; revoked or expired enrolments cannot be replayed to restore access.

See [agent API](https://mortar.tony.codes/agent-teams.md) for HTTP fallback. Agent credentials cannot approve, publish or deploy components. Client hashes identify the supplied code; they do not replace normal execution permissions.

## Assemble and verify

Use named imports from `@tony-ui/mortar`, current approvals and the complete transitive collection. Components remain project-agnostic; supply app data, labels and behaviour through props and callbacks. Use the packet's selected shared shell/recipe when appropriate. Generic starters compose shared patterns; no approved generic shared page/layout is implied. Original kit examples remain references for contributions.

Import the theme in the same reachable CSS entry after Tailwind, not only in JavaScript:

```css
@import 'tailwindcss';
@import '@tony-ui/mortar/styles.css';
@source '../node_modules/@tony-ui/mortar/src';
```

Adjust the source path relative to the stylesheet. Mortar ships complete component CSS. This source declaration is also required by the hosted audit policy and is included in generated starters.

```sh
npm run build
npm run typecheck
node /tmp/tony-ui-agent.mjs audit --agent my-agent --path . --output ui-audit.json
```

The audit uses `/v1/audits` and live registry approvals. Exit 0 passes, 1 means compliance blocked, and 2 means an execution/configuration failure. Fix errors and review findings, then rerun; never edit approvals or audit policy to pass. Policy 1.2.0 checks CSS-entry ordering/reachability and actual React imports for `StrictMode`, `Fragment` and `Suspense`. Protected CI also checks its built CSS and independently audits the exact build checkout. A hosted snapshot report is unsigned evidence, not deployment permission.

## Contributions

Use https://github.com/tonycodes/mortar and read AGENTS.md, CONTRIBUTING.md and DESIGN.md. Run local checks and open a PR with preview evidence. No cloud proposal, submission or second approval is required. `node agent-cli.mjs contributions` prints this path without reading credentials.

## Remote design connectors

Connect to https://mortar.tony.codes/mcp for approved discovery and the service workflow. Read get_contribution_guide. Shared code changes and reviews use GitHub pull requests; the connector has no proposal inbox or approval tool. A coding agent needs GitHub access to open a PR. Hosted audits and project access retain their own authentication rules.

## Paid activation when enabled

If a hosted call returns `subscription_required`, the saved agent identity remains
valid. Run `billing-plan --agent NAME`, then `checkout --agent NAME` using the same
client and identity. The authorised payer completes the returned Stripe checkout.
Run `billing-status --agent NAME` and retry init or audit when active. Use
`billing-portal --agent NAME` to obtain a private Stripe management link.

These commands do not submit card details or charge a saved payment method. The
Stripe checkout page handles approval of the recurring subscription. Access is
activated from verified Stripe events, never a browser redirect. Keep the same
identity; current subscriptions cover one agent identity. If billing is not
configured, no checkout is offered. See [billing operations](billing.md).