ADR-001: Signup Orchestration
Date: 2026-09-15
Status: Draft - In Progress
Deciders: Pete Carroll
Context
Real finding, caught before building anything wrong: ProvisionTenantJob is a Hangfire background job — structurally incompatible with the "no half-provisioned state" requirement, since Command Center can't guarantee it's actually finished by the time a request returns. This was reasoned through from the framing docs' own description before any RoundTrip code was seen directly, then confirmed by asking RoundTrip's own team directly rather than guessing.
RoundTrip's real, substantive response (command-center-tenant-admin-provisioning.md): the tenant-provisioning logic was extracted from the Hangfire job into a shared service, with a new synchronous POST /v1/tenant-admin/provision endpoint calling the same logic directly. Genuinely proven idempotent, not just assumed — RoundTrip's own account: a real mutation-testing pass caught that their first idempotency test didn't actually prove the claim (it passed even with the safety guard disabled, since a normal second call never exercised that code path), and a second, more targeted test was built specifically to force the real risk path. Two real open questions raised in their document, both resolved this session:
- Entra identity resolution: RoundTrip assumed no pre-existing Entra identity exists for a new signup. Confirmed correct for our actual flow — email/password registration into Keystone directly, no Entra federation involved.
- Authentication mechanism: resolved by reusing the existing
X-CommandCenter-ApiKeyconvention in reverse (a new equivalent header, Command Center authenticating to RoundTrip rather than the reverse).
Decision
Alternates Considered
Implementation
Consequences
A real, significant consequence surfaced and explicitly not glossed over: accepting RoundTrip's design as-is means a new signup whose first product is RoundTrip ends up with two separate credentials — a real, working Keystone password, and a separate Entra identity (with its own temp password and invitation email) that's what actually grants RoundTrip access, since RoundTrip hasn't migrated to Keystone-based auth yet. Reasoned through as consistent with keystone-framing.md §8's own already-decided sequencing (RoundTrip migrates last, deliberately) rather than a flaw in this session's design — but named as a real, explicit tradeoff requiring sign-off, not silently accepted.
Related
Document History
| Version | Date | Author | Changes |
|---|---|---|---|
| 1.0 | September 2026 | Pete Carroll | Initial ADR Created |