Provisioning & deployment
Durable stage history from control-plane registration through runtime bootstrap.
Stages
Eight durable stages; domain and container work are optional gates.
SaaSAppId, SaasAppIdInt, domain, routing, storage and usage meters registered.
Core cloned from the golden CustomerCopy; logging and AI databases created.
SaasAppIdentityMap stamped and sp_AssertDatabaseIdentity passed.
AppAccount, tenant owner, full data role, log bridge and AI bridge created.
Control-plane status moved Provisioning → Active after tenant verification.
Builder settings, theme, top bar, menus and blank Home page created.
core.text draft published as Home page version 2; edit lock released.
sp_Runtime_GetPageBootstrap returned metadata, shell, components and page.
Recent log
| Time | Stage | Message |
|---|---|---|
| 07:25:36 | Runtime contract | Four-result-set runtime bootstrap verified. |
| 07:20:14 | Publish first page | Home page version 2 published with core.text. |
| 06:58:00 | Create app shell | Blank shell and Home page created. |
| 06:37:51 | Activate app | Tenant root and database bridges verified; app activated. |
| 06:29:38 | Physical databases | Core, logging and AI databases online; identity stamped. |
Shows the durable worker lifecycle rather than a browser-run wizard. Each successful stage writes an idempotent provisioning record. Activation follows tenant-root and bridge verification; custom domains and containers remain independent optional work for BuilderOnly products.
If a stage fails you’ll see a plain-language message, never a raw system error — and a retry when retrying can help.
Behind this page/apps/:saasAppId/provisioning · CanDeploy
Retrieve
sp_Builder_GetAppAdminDetail returns app/routing state; provisioning history must use stable keyset pagination over SaaSAppProvisioningLogId. Show the durable stage code, safe message, timestamp, and retry eligibility.
Save
Retry queues only the failed retryable worker stage with an idempotency key. The browser never creates databases, restores backups, stamps identity, creates tenant roles, or reruns tripwire procedures directly.
Success
- Active is allowed with primary domain
Pending. - BuilderOnly is allowed with container
NotStarted. - Partial database creation blocks automation and requires operator-safe recovery.
- Worker logs expose safe messages and correlation IDs, not provider secrets.
CLI handoff
Implement this scaffold from the structured contract, then remove hard-coded preview rows. The source of truth is CLI Handoff and admin-cli-manifest.json.
Server-inject identity and scope values; never trust browser-supplied account, app, tenant, user, entitlement, price, or permission identifiers. Preserve the loading, empty, forbidden, failed, retrying, and completed states shown by the preview.