Status and maintenance

Purpose#

Read-only tenant-visible status surface: aggregates component health, active incidents, scheduled maintenance, SLA-breach signal, escalation plan, active banners, and postmortem visibility into one panel. Backs the status workspace (governance group) in libs/oshun/navigation/src/tenant-ia.ts.

Entry points#

• Shell sidebar (TenantSidebar) — "Status" (shortLabel) under the Governance group, link to /status (data-workspace-id="status")
• Workspace grid on / (home) — list item data-workspace-id="status"
• Direct URL /status (bookmarkable; middleware-gated)

Layout regions#

Inside TenantShell:

• Header: TenantHeader shows tenant · <tenantId> › "Status and maintenance"
• Main: <section data-testid="tenant-status-panel" data-tenant-id={tenantId}>
  • <h1>Status and maintenance</h1> + subtitle paragraph
  • .summaryGrid — four tiles: Overall (view.overall), Active incidents (view.activeIncidents.length), SLA breach ("Yes"/"No"), Escalations (escalation?.steps.length ?? 0)
  • .table — two evidence rows: Banner (message + active count, badgeWarn) and Postmortem (visibility badge: badgeGood "visible" / badgeBad "hidden")

States#

• Loading — N/A; server component computes the status view in one pass
• Empty — N/A; the fixture always includes one incident, one banner, one postmortem
• Populated (short) — both evidence rows render; summary tiles reflect buildStatusPageView, evaluateSlo, planEscalation
• Populated (long) — N/A; fixture is fixed-size
• Error (recoverable) — N/A; no runtime query
• Error (unrecoverable) — no session → redirect('/unauthorized?reason=missing-session&returnTo=/status')
• Offline — N/A for data (SSR-rendered)
• Gated — getTenantServerSession() null → redirect to /unauthorized; sidebar Locked when canEnterTenantWorkspace is false
• Standalone PWA — verify; no manifest/SW confirmed in source

Interactions#

The <main> content is a static report — no buttons, inputs, banner-dismiss control, or incident drill-in. All interactivity is shell chrome:

• Skip to main content (link, TenantShell) → anchors #tenant-main
• Sidebar workspace links (links, TenantSidebar) → navigate; current aria-current="page"; Locked when gated
• Evidence rows — non-interactive; banner message / postmortem visibility shown as text + badges. Note: the banner fixture is dismissible: true but no dismiss control is rendered on this page

Data & contracts#

• Reads: no BFF/network read. The page composes pure functions from @oshun/tenant-console on in-page fixtures:
  • buildStatusPageView({ components: ComponentHealth[], incidents, maintenance, nowUnixSeconds }) → view.overall, view.activeIncidents
  • evaluateSlo({ target, availabilitySamples, latencySamples, minSamplesForVerdict, nowUnixSeconds }) → slo.breached
  • planEscalation({ breachId, tenantId, evaluation: slo, contacts, tierDelaysSeconds, nowUnixSeconds }) → escalation.steps
  • activeBannersFor({ banners, viewerTenantId, viewerRole, viewerLocale, fallbackLocale, nowUnixSeconds, dismissedBannerIds }) → banners
  • postmortemVisibleTo({ postmortem, viewer }) → boolean
  • viewerRole hardcoded 'tenant-admin'; NOW = Date.UTC(2026, 4, 11, 15) (seconds)
• Writes: None.
• Realtime: None.
• Caching: SSR (server component); deterministic per tenantId
• Auth/role check: getTenantServerSession() in page; middleware gate

Contract: ComponentHealth from @oshun/tenant-console (libs/oshun/tenant-console); incidents/maintenance/SLO/banner/postmortem shapes are inferred from the function signatures.

Cross-references#

• Workspace definition: libs/oshun/navigation/src/tenant-ia.ts (status — group governance, requiredScopes: ['tenant:admin:*'], iconToken: 'activity')
• Shell: TenantShell.tsx, TenantSidebar.tsx, TenantHeader.tsx
• Sibling routes: policy.md, roles.md, integrations.md, members.md, notifications.md
• Conventions: ../WALKTHROUGH/00-conventions.md

Open questions / known gaps#

• No live status BFF route is wired — page renders a static component/incident/banner/postmortem fixture.
• Banner fixture is dismissible: true but no dismiss UI is rendered; dismissedBannerIds is always an empty Set. Verify whether dismissal is planned client-side.
• viewerRole is hardcoded 'tenant-admin' rather than derived from the session scopes; confirm intended role-aware banner/postmortem audience.