---
path: /agents
surface: tenant-admin
domain: operations
auth: signed-in (tenant) + scope:tenant:admin:{tenantId} (or tenant:admin:*)
source: apps/oshun/tenant-admin/src/app/agents/page.tsx
status: drafted
last_walked: '—'
---

# Agentic pipelines

## Purpose

Shows the tenant's effective agentic-pipeline configuration — budget units,
approval gates, and enabled/disabled status — after layering operator defaults,
per-family budget caps, and tenant-scoped tighten-only overrides. It is the
`agents` workspace (`group: configuration`) in `@oshun/navigation`.

## Entry points

- Shell sidebar **Configuration › Agents** item (`TenantSidebar`,
  `shortLabel: 'Agents'`, path `/agents`).
- Direct URL `/agents` (bookmarkable; scope-gated).

## Layout regions

Wrapped in `<TenantShell session currentWorkspaceId="agents">`:

- **Sidebar / Header**: standard `TenantShell` chrome (header crumb reads
  "Agentic pipelines").
- **Main** (`<section data-testid="tenant-agents-panel" data-tenant-id={...}>`):
  - `<h1>Agentic pipelines</h1>` + subtitle explaining the layering of operator
    defaults, family caps, and tenant tighten-only config.
  - `styles.summaryGrid` of three tiles: **Catalog** (`v1`), **Configured**
    (`pipelines.length` = 2), **Disabled** (count of `p.disabled`).
  - `styles.table` with columns **Pipeline / Budget units / Approval gates /
    Status**, one row per pipeline. Status renders a `badgeGood`/`badgeBad`
    badge reading `enabled`/`disabled`.

## States

- [ ] **Loading** — N/A; synchronous server render from `effectiveConfigFor()`
      over hard-coded `tenantConfig`/`pipelineDefaults` (no fetch).
- [ ] **Empty** — N/A; two pipelines (`metis-study-plan`, `open-web-enrichment`)
      are always computed from in-file seed data.
- [ ] **Populated (short)** — always exactly 2 rows. `metis-study-plan` enabled
      with tightened budget 1800 + gates `operator.safety-review`,
      `tenant.curriculum-review`; `open-web-enrichment` disabled (budget 0) with
      gates `operator.source-review`, `tenant.security-review`.
- [ ] **Populated (long)** — N/A; fixed 2-row dataset.
- [ ] **Error (recoverable)** — N/A; no query.
- [ ] **Error (unrecoverable)** — no custom handler; render throw → Next default
      error boundary.
- [ ] **Offline** — N/A (server-rendered, no client data).
- [ ] **Gated** — no session →
      `redirect('/unauthorized?reason=missing-session&returnTo=/agents')`;
      middleware also blocks unauthenticated requests upstream.
- [ ] **Standalone PWA** — N/A; no manifest shipped. (verify.)

## Interactions

- [ ] **Summary tiles** (`styles.summaryItem` × 3) — display-only counts
      (Catalog / Configured / Disabled); not focusable, no telemetry.
- [ ] **Pipeline table rows** (`<tr>` per `pipeline.pipelineId`)
  - Function: render-only; shows `pipelineId` (mono `<code>`), `budgetUnits`,
    joined `approvalGateIds`, and a status badge. No edit/toggle controls exist
    in code — this page is read-only.
  - Keyboard: table is not interactive.
  - Screen reader: standard table semantics (`thead` headers).
  - Touch target: N/A.
  - Mobile (≤ 640 px): inherits `workspace.module.css` table styling.
  - Disabled when: N/A.
  - Offline behavior: N/A.
  - Telemetry: _None._

## Data & contracts

- **Reads**: `getTenantServerSession()`;
  `effectiveConfigFor({ tenantConfig, pipelineDefaults })` from
  `@oshun/tenant-console` — returns effective config (`pipelineId`,
  `budgetUnits`, `approvalGateIds`, `disabled`, `family`). `tenantConfig`
  (catalog id, per-pipeline tighten configs, per-family budget caps) and
  `pipelineDefaults` are hard-coded in the page. **No BFF call.**
- **Writes**: _None._ (No mutation surface in code.)
- **Realtime**: _None._
- **Caching**: SSR (dynamic; reads cookies). Pure-function output is
  deterministic per tenant id.
- **Auth/role check**: `middleware.ts` + page `getTenantServerSession()` →
  `canEnterTenantShell` (`tenant:admin:*` / `tenant:admin:{tenantId}`).

## Cross-references

- Domain logic: `libs/oshun/tenant-console/src` (`effectiveConfigFor`,
  `EffectiveAgentConfig`). Index: `libs/oshun/tenant-console/src/index.ts`.
- Workspace model: `libs/oshun/navigation/src/tenant-ia.ts` (`agents`,
  `group: configuration`).
- Sibling routes: [home.md](./home.md), [content.md](./content.md),
  [help.md](./help.md). `/integrations` and `/notifications` lack files yet.

## Open questions / known gaps

- [ ] All pipeline/tenant config is hard-coded seed data (`metis-study-plan`,
      `open-web-enrichment`); a real tenant config source / BFF read is not yet
      wired. Document the eventual backing store + write path for tighten-only
      overrides.
- [ ] Page is read-only; there is no UI to add/disable pipelines or adjust
      budgets. Confirm whether editing is in scope for a later phase.