Add production-shaped demo fixtures and screenshots

README.md

@@ -10,13 +10,13 @@ same database. Your scripts and admin tools can still write it. cfgit sits besid
 the store, records what changed, and refuses to clobber changes it did not record.
 
 <p align="center">
-  <img src="docs/screenshots/01-diff.png" alt="Side-by-side line diff of a live agent config, with a sticky field header and collapsed context" width="32%" />
-  <img src="docs/screenshots/02-impact.png" alt="System-impact panel: deterministic facts plus opt-in LLM narration of what the change does downstream" width="32%" />
-  <img src="docs/screenshots/03-scoped-impact.png" alt="Scoped impact: select records on the left and reason the change against only those" width="32%" />
+  <img src="docs/screenshots/01-diff.png" alt="Production-shaped support agent drift with collection stats, branch workflow controls, history, and line-aligned diff" width="32%" />
+  <img src="docs/screenshots/02-impact.png" alt="High-risk system-impact panel for a refund-resolution agent change with provider-backed LLM narration" width="32%" />
+  <img src="docs/screenshots/03-scoped-impact.png" alt="Scoped impact analysis with selected policy, eval, and rollout records plus provider-backed narration" width="32%" />
 </p>
 
 <p align="center">
-  <sub>Line-aligned diff of a live record &nbsp;·&nbsp; system-impact panel &nbsp;·&nbsp; impact scoped to the records you select &nbsp;(demo data)</sub>
+  <sub>Production-shaped drift review &nbsp;·&nbsp; narrated whole-system impact &nbsp;·&nbsp; narrated impact scoped to selected policy, eval, and rollout records</sub>
 </p>
 
 ## Why cfgit exists
@@ -357,34 +357,38 @@ If you omit `--port`, cfgit will try the next free local ports. If you pass
 `--port` explicitly, cfgit treats that port as intentional and fails if it is
 already in use.
 
-## Synthetic UI demo
+## Production-shaped UI demo
 
-The repo includes a fake support-control-plane fixture for screenshots, demos,
-and UI testing. It creates only synthetic records in the database you pass; use a
-throwaway database name when you want to keep the run contained.
+The repo includes a safe support-control-plane fixture for screenshots, demos,
+and UI testing. It creates synthetic records only in the database you pass; use a
+throwaway database name when you want the run contained.
 
 ```bash
 python examples/seed_support_demo.py \
   --uri 'mongodb://localhost:27017/?replicaSet=rs0' \
   --db cfgit_ui_demo \
   --reset
 
-cfg --config-file examples/cfgit-support-demo.toml init
-cfg --config-file examples/cfgit-support-demo.toml import --all -m "initial synthetic demo import"
+cfg --config-file examples/cfgit-support-demo.toml --env dev init
+cfg --config-file examples/cfgit-support-demo.toml --env dev import --all -m "initial production-shaped demo import"
 
 python examples/seed_support_demo.py \
   --uri 'mongodb://localhost:27017/?replicaSet=rs0' \
   --db cfgit_ui_demo \
   --drift
 
-cfg --config-file examples/cfgit-support-demo.toml ui
+cfg --config-file examples/cfgit-support-demo.toml --env dev status
+cfg --config-file examples/cfgit-support-demo.toml --env dev ui
 ```
 
-The first seed creates clean planner, critic, router, model, and policy records.
-The `--drift` pass then simulates an admin-console edit: planner routing changes,
-the refund policy changes, and a new entitlements resolver appears. That gives
-the UI useful drift, impact, adopt, branch, PR, merge, and restore-history paths
-without using proprietary data.
+The base seed creates a realistic support-agent runtime surface: orchestrator
+and specialist agent configs, model routing, policy rules, tool registry records,
+routing policies, escalation policies, eval suites, rollout controls, and
+knowledge-source allowlists. The `--drift` pass simulates admin-console edits to
+refund automation, refund policy, routing confidence, eval gates, rollout
+traffic, and a new loyalty-credit tool. That gives the UI useful drift, impact,
+scoped impact, adopt, branch, PR, merge, and restore-history paths without using
+proprietary data.
 
 ## MCP and agent usage
 

examples/cfgit-support-demo.toml

@@ -31,6 +31,48 @@ live_when = { active = true }
 ignore_fields = ["_id", "active", "updated_at", "updated_by"]
 secret_fields = []
 
+[[collection]]
+name = "tool_registry"
+id_field = "tool_id"
+live_when = { enabled = true }
+ignore_fields = ["_id", "enabled", "updated_at", "updated_by"]
+secret_fields = ["credentials.api_key_ref", "oauth.client_secret_ref"]
+
+[[collection]]
+name = "routing_policies"
+id_field = "policy_id"
+live_when = { active = true }
+ignore_fields = ["_id", "active", "updated_at", "updated_by"]
+secret_fields = []
+
+[[collection]]
+name = "escalation_policies"
+id_field = "escalation_id"
+live_when = { active = true }
+ignore_fields = ["_id", "active", "updated_at", "updated_by"]
+secret_fields = []
+
+[[collection]]
+name = "eval_suites"
+id_field = "suite_id"
+live_when = { enabled = true }
+ignore_fields = ["_id", "enabled", "updated_at", "updated_by"]
+secret_fields = []
+
+[[collection]]
+name = "rollout_controls"
+id_field = "rollout_id"
+live_when = { enabled = true }
+ignore_fields = ["_id", "enabled", "updated_at", "updated_by"]
+secret_fields = []
+
+[[collection]]
+name = "knowledge_sources"
+id_field = "source_id"
+live_when = { enabled = true }
+ignore_fields = ["_id", "enabled", "updated_at", "updated_by"]
+secret_fields = []
+
 [secrets]
 block_fields = ["*_key", "*_secret", "*_token", "*api_key*", "*password*"]
 block_values = ["sk-[A-Za-z0-9]{20,}", "AKIA[0-9A-Z]{16}"]
@@ -45,10 +87,24 @@ share_with_ai = []
 ai_provider = "openai"
 warn_level = "none"
 links = [
-  { field = "phase_contract", means = "contract other records may rely on" },
-  { field = "tools", means = "shared tool list" },
-  { field = "fallback_models", means = "fallback model routing" },
+  { field = "agent", means = "agent identifier" },
+  { field = "agents", means = "agent identifiers" },
   { field = "applies_to", means = "policy-to-agent linkage" },
+  { field = "approval_policy", means = "human approval requirement" },
+  { field = "audience", means = "customer or segment targeting" },
+  { field = "escalation_policy", means = "human handoff policy" },
+  { field = "eval_suite", means = "quality gate for a config" },
+  { field = "fallback_models", means = "fallback model routing" },
+  { field = "guarded_by", means = "policy or guardrail dependency" },
+  { field = "handoffs", means = "agent handoff graph" },
+  { field = "knowledge_sources", means = "retrieval source allowlist" },
+  { field = "model", means = "model routing" },
+  { field = "model_path", means = "model identifier" },
+  { field = "policy_refs", means = "referenced policy rules" },
+  { field = "routing_policy", means = "orchestration routing policy" },
+  { field = "rollout_id", means = "rollout gate" },
+  { field = "tool_id", means = "tool identifier" },
+  { field = "tools", means = "shared tool list" },
 ]
 
 [env.dev]