# Coverage — Tenant Admin

What's covered, what's fixture-only, what's deferred. For live status query
[`routes.csv`](./routes.csv).

## At a glance

| Bucket                                                       | Count | Walkthrough status        |
| ------------------------------------------------------------ | ----- | ------------------------- |
| Total `page.tsx` files in `apps/oshun/tenant-admin/src/app/` | 15    | —                         |
| Documented (per-view files)                                  | 15    | **14 drafted · 1 walked** |

Coverage is exact: 15 app routes = 15 CSV rows = 15 per-view files, zero gaps.

## Group breakdown

| Group           | Routes | Pages                             |
| --------------- | ------ | --------------------------------- |
| identity-access | 3      | identity, members, roles          |
| governance      | 4      | audit, content, data, policy      |
| operations      | 3      | agents, notifications, status     |
| integrations    | 1      | integrations                      |
| configuration   | 1      | help                              |
| meta            | 3      | home (`/`), handoff, unauthorized |

## Cross-cutting findings

Surfaced while authoring; these are **code-state** findings, not walkthrough
quality issues.

1. **Three gated workspaces now read tenant-scoped BFF data.** `/identity`,
   `/members`, and `/audit` use `tenantBffGet` against
   `/v1/tenant-console/{sso,members,audit}`. The other ten gated workspace pages
   remain read-only projections over in-process `@oshun/tenant-console` data;
   they have no realtime or client mutation path. Each per-view file records its
   current backing and any missing write path under "Open questions / known
   gaps."
2. **Uniform auth gate.** Every workspace calls `getTenantServerSession()` and
   redirects to `/unauthorized?reason=missing-session&returnTo=<route>` on null;
   `middleware.ts` gates all non-public paths and deletes the
   `oshun-tenant-session` cookie on an invalid token. `canEnterTenantWorkspace`
   currently delegates to the shell scope check, so the sidebar "Locked"
   per-workspace state is effectively unreachable in V1 (noted per file).
3. **No `error.tsx` / `loading.tsx` / `not-found.tsx`** under `src/app`. Because
   most projected datasets are fixed-length seeds, loading / empty / long /
   offline states are commonly N/A and are marked `- [x] N/A because …` so the
   omissions are auditable. BFF-backed pages document their degraded-read state
   separately.
4. **Public surfaces:** `/handoff` (the IdP bridge explaining a
   `tenant:admin:{tenantId}` session must be issued) and `/unauthorized` (the
   deny page) render without the shell and without a session.

## Status legend

- `stub` — no walkthrough file yet
- `drafted` — written from code reading; not verified live
- `walked` — verified live against a running build
- `stale` — code under `source:` changed since `last_walked`