Traxs Platform — Cross-Project Action Items
Purpose: design work for the identity/signup/billing platform spans four real codebases (Keystone, Command Center, RoundTrip, Waypoint), some of which are worked on in entirely separate conversations. This document exists so nothing gets lost in that gap — a single, current list of what each project actually owes the others, kept up to date as design continues rather than assembled once at the end.
How to use this: whoever picks up work in any one project's own context should check this document first for what that project owes, and update it (or flag it for update) whenever a conversation elsewhere produces a new real action item touching this project. Each item links back to the document holding its full reasoning — this list is deliberately just the "what," not a restatement of the "why."
Status key: 🔴 not started · 🟡 designed, not built · 🟢 done
Cross-Product Data Sharing (Waypoint Dashboard / Relay)
Status: Specified in command-center-prd.md §3.5–3.10, command-center-brd.md §5.4/§5.5, and ticketed in command-center-impl-plan.md (CC-006–CC-015) — written before the Keystone/signup/Stripe-centralization work this document has otherwise tracked. Worth a real design/requirements review before building, not just executing the old spec as-is — confirm nothing from the intervening work (entitlements, Stripe centralization, Tenant.OwnerId) changes these shapes.
| Item | Status | Source |
|---|---|---|
GET /v1/suite/subscriptionsGetSuiteSubscriptionsQuery/Endpoint); command-center-sad.md §7.2 and the impl plan's CC-013 status are stale and should be corrected | 🟢 Done | This conversation, 2026-09-20 |
Outbound IRoundTripClient (X-Internal-ApiKey/RoundTripApi:InternalApiKey) for the five RoundTrip data endpoints below — a third, still-unreconciled RoundTrip auth scheme alongside the two already flagged in documentation-inconsistencies.md | 🔴 | command-center-sad.md §5–6 |
GET /v1/roundtrip/revenue-summary, /tickets/open, /invoices/recent, /team, /ar/aging — Command Center's own wrapper endpoints | 🔴 | command-center-prd.md §3.5–3.9; command-center-impl-plan.md CC-008–CC-012 |
RoundTrip's own internal endpoints (GET /v1/internal/revenue-summary, etc.) — RoundTrip's codebase, not Command Center's | 🔴 | command-center-sad.md §6; ticketed as TRA-NNN in the impl plan |
POST /v1/clients/sync — cross-product client record sync, RoundTrip → Waypoint | 🔴 | command-center-brd.md §5.4; command-center-impl-plan.md CC-015 |
Relay integration (POST /v1/relay/lead, POST /v1/roundtrip/client, campaign trigger events) — correctly deferred, waits on Relay's own build starting | 🔴 (deferred, not forgotten) | command-center-brd.md §5.5; command-center-impl-plan.md CC-014 |
| Long-term platform evolution (unified billing hub, webhook management, AI inference gateway, platform analytics) — Phase 5, 2028+, correctly left undesigned | 🔴 (deferred, not forgotten) | command-center-brd.md §5.6; command-center-impl-plan.md Phase 5 |
Keystone
| Item | Status | Source |
|---|---|---|
keystone-prd.md §3.11 | 🟢 Done | keystone-build-log.md Entry 4; re-verified and corrected to v1.2 this session after catching a real regression from a stale merge |
| 🟢 Done | POST /v1/accounts/provision, built and proven — keystone-build-log.md Entry 4 | |
Update keystone-prd.md to v1.2 in both the shared GitHub repo (the canonical copy all Claude projects read from) and the Ops Manual repo (separate, DevOps-hosted, kept for broad human reference — not connected to any Claude project's knowledge, so it never syncs automatically). Delete the outdated hard-drive copy now that it has no remaining purpose. | 🟡 | shared repo pushed and live; Ops Manual update still pending, planned for later tonight. Source: this conversation, 2026-09-21. |
app-traxs-keystone-production, build→test→deploy pipeline green | 🟢 Done | This conversation, 2026-09-28 |
ConnectionStrings:DefaultConnection resolving correctly via Key Vault reference | 🟢 Done | This conversation, 2026-09-28 |
External login (Microsoft Entra) made opt-in/fail-soft and deliberately left unconfigured in production after a same-evening startup-crash incident and a credential-exposure incident — Keystone runs on local email/password only right now. Don't assume Entra SSO federation is live when integrating against Keystone. Full incident + rationale in keystone-production-secrets.md. | 🟢 Done (deliberate) | This conversation, 2026-09-28; see keystone-production-secrets.md |
ExternalLogin domain entity and User's linking methods, ExternalLoginConfig (including its call site in ServiceConfigs.cs), the EF migration dropping the table (RemoveExternalLogin), the now-unused Microsoft.AspNetCore.Authentication.OpenIdConnect/Microsoft.IdentityModel.Validators package references (csproj and Directory.Packages.props), and the test-layer leftovers (unused constants in UserTests.cs, the stale Authentication:MicrosoftEntra block in appsettings.Testing.json, stale env-var calls in CustomWebApplicationFactory.cs). keystone-api-reference.md regenerated clean from source, as expected. documentation-inconsistencies.md's entry on this is marked resolved. | 🟢 Done | This conversation, 2026-10-01 |
Command Center
| Item | Status | Source |
|---|---|---|
POST /v1/signup orchestration endpoint | 🟢 Done | command-center-stripe-migration.md, Implementation Status |
SignupAttempt table and retry-until-complete logic | 🟢 Done | command-center-stripe-migration.md, Implementation Status |
| 🟢 Done | command-center-stripe-migration.md, Implementation Status | |
IStripeCheckoutService, webhook + orchestration + all six subscription-sync events, all tested. RoundTrip's decommissioning is tracked separately below, not this project's work. | 🟢 Done (Command Center side) | command-center-stripe-migration.md, Implementation Status |
POST /v1/tenant-admin/provision (mirroring X-CommandCenter-ApiKey in reverse) | 🟢 Done | keystone-build-log.md Entry 1 |
Tenant?Tenant.OwnerId, nullable, holds a KeystoneUserId value, no physical FK, no uniqueness constraint, set once at signup from SignupAttempt | 🟢 Done | command-center-database.md, "Tenant ownership" |
GET /v1/tenants/{id}/owner) for RoundTrip/Waypoint to call at the rare moment of a demote/remove/reassign-admin action — a live call is fine here, unlike entitlements. | 🟢 Done | This conversation, 2026-09-15 |
POST /v1/accounts/provision — attach Keystone:ApiKey as the X-Keystone-ApiKey header; endpoint is live and proven | 🟢 Done | keystone-build-log.md Entry 4 |
Build GET /v1/signup/status?idempotencyKey={key} — polling endpoint for the success page; pending collapses "row doesn't exist yet" and "exists but incomplete" into one non-error state, since the frontend can't usefully distinguish them | 🔴 | This conversation, 2026-09-19; GetTenantProvisioningStatusHandlerTests.cs (RoundTrip) as prior art |
| 🟢 Done | This conversation, 2026-09-21 | |
keystone-framing.md flagged for Keystone specifically. Reversible later — splitting onto separate servers is a well-supported, low-friction Azure operation once real revenue justifies it. | 🟢 Done | This conversation, 2026-09-21 |
Keep command-center-swagger.json regenerated and current after each build session. A stale copy from early in this project sat undetected in the shared repo's Command-Center/ folder, missing /v1/tenants/{id}/owner entirely — a second copy in WayPoint/ drifted separately, catching the same discrepancy independently (waypoint-keystone-migration-design.md §2.7) before this conversation caught it again. One canonical, freshly-regenerated copy belongs in the repo, not two silently diverging ones. | 🟡 Fresh copy generated locally, 2026-09-21 — needs pushing to replace the stale Command-Center/ copy; decide whether to keep a second copy in WayPoint/ at all, or consolidate to one location | This conversation, 2026-09-21 |
Generalize product provisioning beyond RoundTrip. Confirmed directly from source (command-center-api-reference.md): ProvisionProductAdminHandler hardcodes attempt.ProductSlug != "roundtrip" as an outright rejection for every other product — not a stale doc claim, a real if with no dispatch mechanism behind it. Only IRoundTripProvisioningClient exists under CommandCenter.API.Core/Interfaces; no IWaypointProvisioningClient/IRelayProvisioningClient exists yet. Needed: (1) a real IWaypointProvisioningClient once Waypoint builds its own receiving endpoint (blocked on Waypoint §2.5 below, which is the other half of this same gap), (2) replace the hardcoded if with a slug-keyed dispatch so a third/fourth product doesn't require touching this handler again. Also confirmed: there is no seed data or admin path for Products/ProductTiers for any product, including RoundTrip's own rows — whatever exists today was inserted by hand. Does not block Waypoint's Step 4 bootstrap (that path never goes through /v1/signup/the webhook orchestration), only a future self-serve Waypoint signup through Command Center. | 🔴 | This conversation, 2026-09-30; see command-center-api-reference.md |
RoundTrip
| Item | Status | Source |
|---|---|---|
| 🟢 Done | Confirmed by Pete | |
| 🟢 Done | Confirmed by Pete | |
| Publish the "A Short Pause, On Purpose" blog post explaining both changes | 🟡 In progress | Drafted this session; Pete publishing |
Drop the Provisioning/ProvisioningFailed tenant-status check from POST /v1/tenant-admin/provision — superseded once real API-key auth exists | 🔴 | keystone-build-log.md Entry 1 |
| Accept the new inbound API-key header from Command Center | 🔴 | keystone-build-log.md Entry 1 |
| Real, explicit sign-off needed: accept the two-credential signup experience (Keystone password + separate Entra identity) for any customer whose first product is RoundTrip, for as long as RoundTrip hasn't migrated to Keystone auth | 🔴 | keystone-signup-orchestration.md §5 |
| Eventually: RoundTrip's own real Keystone auth migration — explicitly sequenced after Waypoint's | 🔴 | keystone-framing.md §8; reaffirmed waypoint-auth-review.md §7 |
| Remove/retire the existing Stripe webhook handler once Command Center's replacement is live | 🔴 | keystone-signup-orchestration.md §3 |
Persist keystoneUserId (already received on /v1/tenant-admin/provision) as a new, nullable correlation column on TenantUser — not the auth-resolution key, just enough for RoundTrip to check Tenant.OwnerId locally without waiting on the full Keystone-auth migration | 🔴 | Command Center conversation, 2026-09-15 |
Waypoint
| Item | Status | Source |
|---|---|---|
| 🟢 Done | appsettings.development.json is gitignored verified by Pete | |
The real Keystone migration itself — explicitly scoped to include real authorization checks and a real WaypointUser lookup (not automatic side effects of an identity-provider swap) | 🟡 In progress | waypoint-auth-review.md §7 Migration design document created 9-22-2026 |
| 🟢 Done | This conversation waypoint conversation and design document address as being a patch unless domain objects are affected | |
TRA-223 already found unreliable) | 🟢 Done | waypoint-keystone-migration-design.md |
Persist keystoneUserId as a new, nullable correlation column on WaypointUser — same reasoning as RoundTrip's equivalent item, needed for local ownership checks ahead of Waypoint's own Keystone migration | 🟡 In progress | Command Center conversation, 2026-09-15 |
Schema migration — add the new WaypointUser/Workspace columns (Section 2.8). Zero real data to migrate or preserve beyond Pete's own single row. | 🟡 In progress | waypoint-keystone-migration-design.md |
Local identity resolution + tenant resolution (Sections 2.2–2.3) — build the new CurrentUserService, delete the Entra-claim-reading middleware/services, wire Keystone JWT bearer validation in place of Microsoft.Identity.Web. | 🔴 | waypoint-keystone-migration-design.md |
| 🟢 Done | waypoint-keystone-migration-design.md - audit has been completed and all endpoints now are gated with the proper Roles | |
Bootstrap Pete's own account — a one-time, explicit step, not a generalized backfill process: Pete registers a real Keystone account, a real Tenant row is created for Waypoint's existing customer (via Command Center, following the same shape new signups will use), and Pete's existing WaypointUser/Workspace rows get their TenantId corrected from the shared Entra-claim value to this new, real, unique TenantId, with KeystoneUserId set directly (skipping the invite-redemption flow, since there's no inviting admin — Pete provisions himself as the first and only WaypointAdmin). Worth a short script or a manual one-off, not new product code, given it runs exactly once. | 🔴 | waypoint-keystone-migration-design.md |
| New-tenant provisioning endpoint (Section 2.5) — needed before Waypoint can be offered through Command Center's signup flow at all, but not needed for step 4, since Pete's account isn't a "new signup" in that flow's sense. | 🔴 | waypoint-keystone-migration-design.md |
| Invite rebuild (Section 2.6) — can genuinely land after steps 1–4 are live, since Pete is the only user and there's no active team to invite yet; sequenced last deliberately, not because it's unimportant, but because nothing blocks on it. | 🔴 | waypoint-keystone-migration-design.md |
| Frontend: swap MSAL for Keystone's OIDC flow. | 🔴 | waypoint-keystone-migration-design.md |
| Frontend Rewrite: This is a decision/design task. I am not sure I like the UI that has been built. It is a little generic and some of it reminds me of libreOffice and other open source applications in the early 2000's. I would like a sleek, modern interface that is on the cutting edge or offers a new way of visualizing what Waypoint is providing | 🔴 | Pete's Comments |
Ownership-check wiring (Section 2.7) — meaningful only once a second WaypointUser could plausibly exist, so naturally follows step 6. | 🔴 | waypoint-keystone-migration-design.md |
| *Review PRD for accuracy and rewrite as needed | 🔴 | Per Pete - document has not been touched since initial draft. I also want to add some more requirements as the endpoint audit has given me some ideas |
| *Review BRD for accuracy and rewrite as needed | 🔴 | Per Pete - document has not been touched since initial draft. I also want to add some more requirements as the endpoint audit has given me some ideas |
| *Review SAD for accuracy and rewrite as needed | 🔴 | Per Pete - document has not been touched since initial draft. The architecture will be changed with the migration to Keystone |
| *Write Create Requirements addendum | 🔴 | For Pete - write an addendum document to capture new requirements and direction for waypoint |
| **Move API projects to a src folder - the current setup has the projects at the solution level | 🔴 | Pete review on 2026-09-29 |
| **Create tests folder and create the appropriate tests suites. - currently waypoint has no tests at all | 🔴 | Pete review on 2026-09-29 - Company standard requirements |
NOTE: I know I added steps to add more requirements. I feel that since we stopped the ability to register in RoundTrip that we have a little time to get Waypoint to where it needs to be and not just the security aspect. During the endpoint audit there were a lot of questions about departments and user groups and that discussion led to me thinking that we need to really think about what Waypoint does. I also had stated that I was open to totally redoing Waypoint and I think I was wrong in that statement or at least partially. The API is in pretty good shape, minus the issues we found, but the architecture is there and the keystone migration should help the issues. Where I wouldn't mind restarting is the React App. While it looks good I am not sure I like how it works and it definately needs some color and a look at the icons. I know that is out of scope to what this document is covering but I thought I should capture it.
Marketing / Websites
| Item | Status | Source |
|---|---|---|
traxsgroup.com | 🟢 Done | Confirmed by Pete |
Real design pass needed first — the actual UI for signup.traxsgroup.com (form fields, product/tier picker, how the Stripe Checkout redirect and return are handled) has no design document of its own yet. This is the one missing piece standing between everything already built and a real, live signup working end to end: Command Center's POST /v1/signup orchestration is real and tested (command-center-stripe-migration.md), Keystone's provisioning endpoint is real and tested — the frontend that actually calls them doesn't exist. Same discipline as keystone-signup-orchestration.md/waypoint-keystone-migration-design.md: design document before code. | 🔴 | This conversation, 2026-09-22 |
Build the new signup.traxsgroup.com route itself, once the design pass above settles the actual shape | 🔴 | keystone-signup-orchestration.md §1; blocked on the design-pass item above |
Platform Administration Application
Doesn't exist as a real codebase yet, and doesn't need to yet — genuinely low-urgency, not a current blocker on anything else in this tracker.
| Item | Status | Source |
|---|---|---|
Real BRD-style scoping pass needed before this becomes its own project — who actually uses it (Pete and Robin only, today — not a customer-facing surface), what it needs to do on day one versus later, and which of keystone-prd.md §3.14's already-proposed admin endpoints (account search, force-reset, audit log) it should actually consume. Currently just a name in that section with no real requirements behind it. Wanted mostly out of genuine interest in having it, not driven by a current operational need — worth keeping that context so whoever scopes it doesn't over-build for urgency that isn't really there. | 🔴 | This conversation, 2026-09-22 |
Not yet relevant
Relay doesn't exist as a real codebase yet — nothing here applies to it until it does.