Keystone — Spike Status
Genuinely good moment to take stock — a lot has accumulated across many sessions. Let me lay it out against the spike's own actual scope, keystone-spike-scope.md §2's six numbered items, rather than a vague sense of progress.
The six spike items
| # | What it proves | Status |
|---|---|---|
| 1 | OpenIddict issuing real tokens end to end | ✅ Proven — client_credentials, real signed/encrypted tokens |
| 2 | Email/password registration and login | ✅ Proven and exceeded — full interactive authorization-code flow built too, beyond original scope |
| 3 | Optional federation against a real Entra app registration | ✅ Proven against real Microsoft infrastructure — not a local test tool |
| 4 | Linking-not-coupling ExternalLogins guardrails | ✅ Proven — verified-email-required, no auto-merge, all three linking cases built and tested |
| 5 | Stable person ID FK-compatible with RoundTrip's TenantUsers | ✅ Just confirmed this session — real, current schema reviewed, zero structural changes needed |
| 6 | Same FK pattern against Waypoint's WaypointUsers | ⬜ Not started — lower-stakes per the spike doc itself (zero live Waypoint users), but still technically open |
Five of six numbered items genuinely done — and every one of them proven against real evidence, not assumption: real tokens, a real Microsoft tenant, a real schema review just now, not a stale mental model.
The bigger bar — keystone-framing.md §8's "ready to use" tier
This is broader than the spike's own six items, and worth being honest about two real gaps here:
- Entitlement delegation to Command Center — not even stubbed.
spike-scope.md§3 explicitly says this should be trivial ("stub it — a hardcoded 'yes' is enough"), but no code anywhere calls out to anything resembling this yet. - Password reset — not built at all.
POST /account/forgot-password/reset-passwordfromapi-design.md's endpoint table, named in the framing doc as the literal minimum bar so "nobody gets permanently locked out."
What's genuinely left, roughly by size
- Item 6 — the Waypoint FK check (small, mechanical, per the doc's own framing)
- The Command Center entitlement stub (explicitly meant to be trivial)
- Password reset flow (real, but bounded — two endpoints, no new architectural ground)
- The Program.cs → admin-app CORS policy,
xunit.runner.json— small housekeeping items
Honest overall picture: this spike has substantially succeeded. The two hardest, riskiest, most novel pieces — the interactive OpenIddict flow and real Entra federation — are both done and thoroughly tested (69 automated tests). What's left is smaller and lower-risk than what's already behind you, not a second mountain to climb.