Coverage — Tenant Admin — Tenant Admin Console

What's covered, what's fixture-only, what's deferred. For live status query routes.csv.

At a glance#

Bucket	Count	Walkthrough status
Total `page.tsx` files in `apps/oshun/tenant-admin/src/app/`	15	—
Documented (per-view files)	15	14 drafted · 1 walked

Coverage is exact: 15 app routes = 15 CSV rows = 15 per-view files, zero gaps.

Group	Routes	Pages
identity-access	3	identity, members, roles
governance	4	audit, content, data, policy
operations	3	agents, notifications, status
integrations	1	integrations
configuration	1	help
meta	3	home (`/`), handoff, unauthorized

Surfaced while authoring; these are code-state findings, not walkthrough quality issues.

Three gated workspaces now read tenant-scoped BFF data. /identity, /members, and /audit use tenantBffGet against /v1/tenant-console/{sso,members,audit}. The other ten gated workspace pages remain read-only projections over in-process @oshun/tenant-console data; they have no realtime or client mutation path. Each per-view file records its current backing and any missing write path under "Open questions / known gaps."
Uniform auth gate. Every workspace calls getTenantServerSession() and redirects to /unauthorized?reason=missing-session&returnTo=<route> on null; middleware.ts gates all non-public paths and deletes the oshun-tenant-session cookie on an invalid token. canEnterTenantWorkspace currently delegates to the shell scope check, so the sidebar "Locked" per-workspace state is effectively unreachable in V1 (noted per file).
No error.tsx / loading.tsx / not-found.tsx under src/app. Because most projected datasets are fixed-length seeds, loading / empty / long / offline states are commonly N/A and are marked - [x] N/A because … so the omissions are auditable. BFF-backed pages document their degraded-read state separately.
Public surfaces: /handoff (the IdP bridge explaining a tenant:admin:{tenantId} session must be issued) and /unauthorized (the deny page) render without the shell and without a session.