LTI 2.0 Variable Flow Confusion

I am busily implementing LTI 2.0 for Sakai and running into some problems where I cannot follow data flowing back and forth. So here is an outline of what I am doing an where I am stuck.

(1) I make a "in-progress" tool proxy in my database (lets call it id=8). I choose a reg_key and reg_password and launch the TP url with the following data:

reg_key=987654
reg_password=supersecret
tc_profile_url=http://localhost:8080/imsblis/lti2/tc_profile/8

You will note that I put the consumer id into the url for the profile because I am going to give a slightly different profile (i.e. which services are offered) to different TPs.

(2) When I generate the Tool Consumer Profile I put my id of the tool proxy into the URL because I have no other way of getting this information as to which of my tool proxies a particular registration request applies to:

"service_offered" : [ {
"@type" : "RestService",
"@id" : "ltitcp:ToolProxy.collection",
"endpoint" : "http://localhost:8080/imsblis/lti2/tc_registration/8",
"format" : "application/vnd.ims.lti.v2.ToolProxy+json",
"action" : [ "POST" ]
},

This feels wrong - but I have no other way to keep track of the id of my nascent tool proxy in Sakai.

Also what is the purpose of the product_instance guid - is this just a random number the TC generates - or is it used for some lookup later?

"product_instance" : {
"guid" : "ctools-001",

(3) Then when my TP is making its registration request, I know to use the reg_key and reg_password to sign the request but I wonder where I might expect that tool proxy id (i.e. 8 in my examples) other than putting it on that registration url. I also have no idea what the following fields mean in the registration request or who generates them:

{
"@type": "ToolProxy",
"@id": "__ID__",
"tool_proxy_guid": "__GUID__",
"tool_profile": {
"guid": "__TPGUID__",
"service_provider": {
"guid": "__SPGUID__",

"security_contract": {
"shared_secret": "__SECRET__",
}

So which of these is the consumer key - or is the reg_key the consumer key? Also who creates which GUID in the above JSON? Are any of the GUIDs expected to be set by the Tool Consumer (i.e. 8 in my little example)?

Thanks in advance.