Tancrad

Screens

• /login — OIDC sign-in against Authentik. Redirects to an explanatory page until the TANCRAD_OIDC_* values are set and the callback is registered.
• /claims — the real caseload, against the database: the file list with its tiles and filters, and the §Daune review below it. Choose a company first. Requires a session.
• /preview/daune — the caseload LIST: stat tiles, search, stage and blocker filters, ages. From fixtures; dev only, reads no tenant data.
• /preview/claims-review — the §Daune review, rendered from fixtures. Dev only; reads no tenant data.

API

• GET /api/health — no auth
• GET /api/claims/review — 401 without a Syn bearer token, 403 without the x-tancrad-organization header naming an org you belong to
• GET /api/company/readiness — same two gates

Not built yet

• Sign-in is built but not configured: /login, /auth/callback and /logout exist over the shared OIDC client, and the session cookie feeds the same Syn check the API routes use. It needs the TANCRAD_OIDC_* settings and a callback registered on Authentik before a browser can obtain a token.
• claim.get_detailed cannot resolve a vehicle from the insurance module yet: the intent plane serves visibility:dev, so no caller credential is forwarded and it degrades to unavailable rather than a wrong answer.
• No SCREEN files a claim. tancrad.claim.file is served and works — it allocates the file number itself (DAU-<year>-<seq>, per organization, migration 0005) — but it is reachable only as an intent, not from the browser. The form is the next screen, not a missing rule.

Backend