core: add community capability profile seam

TASKS.md

@@ -144,4 +144,5 @@ Progress:
 - done:
   - Phase 0 / task `0.1`: создан `crank-core::ext` module skeleton
   - Phase 0 / task `0.2`: `MachineCredentialVerifier` и связанные типы вынесены из `apps/mcp-server` в public seam `crank_core::ext::auth`
+  - Phase 0 / task `0.7`: введены `CapabilityProfile` и `CommunityCapabilityProfile`, а `admin-api` capability payload теперь собирается через public seam вместо локального literal
   - backward-compatible alias `CommunityMachineCredentialVerifier` сохранен, поведение Community не изменено

apps/admin-api/src/service.rs

@@ -4,8 +4,8 @@ use std::path::PathBuf;
 use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
 use crank_core::{
     Agent, AgentId, AgentOperationBinding, AgentStatus, AgentVersion, AggregationMode,
-    AsyncJobHandle, AuthConfig, AuthKind, AuthProfile, AuthProfileId, ConfigExport,
+    AsyncJobHandle, AuthConfig, AuthKind, AuthProfile, AuthProfileId, CapabilityProfile,
-    EditionCapabilities, EditionLimits, ExecutionMode, ExportMode, GeneratedDraft,
+    ConfigExport, EditionCapabilities, ExecutionMode, ExportMode, GeneratedDraft,
     GeneratedDraftStatus, InvitationId, InvitationStatus, InvitationToken, InvocationLevel,
     InvocationLog, InvocationLogId, InvocationSource, InvocationStatus, IssueAgentTokenRequest,
     IssueOneTimeAgentTokenRequest, IssuedAgentTokenResponse, JobStatus, MachineAccessMode,
@@ -1496,17 +1496,7 @@ impl AdminService {
     }
 
     pub async fn get_capabilities(&self) -> EditionCapabilities {
-        EditionCapabilities {
+        crank_core::CommunityCapabilityProfile.capabilities()
-            edition: ProductEdition::Community,
-            supported_protocols: vec![Protocol::Rest],
-            supported_security_levels: vec![OperationSecurityLevel::Standard],
-            machine_access_modes: vec![MachineAccessMode::StaticAgentKey],
-            limits: EditionLimits {
-                max_workspaces: Some(1),
-                max_users_per_workspace: Some(1),
-                max_agents_per_workspace: Some(1),
-            },
-        }
     }
 
     pub async fn issue_agent_token(

crates/crank-core/src/ext/capability.rs

@@ -1 +1,27 @@
+use crate::{
+    EditionCapabilities, EditionLimits, MachineAccessMode, OperationSecurityLevel, ProductEdition,
+    Protocol,
+};
 
+pub trait CapabilityProfile: Send + Sync {
+    fn capabilities(&self) -> EditionCapabilities;
+}
+
+#[derive(Clone, Copy, Debug, Default)]
+pub struct CommunityCapabilityProfile;
+
+impl CapabilityProfile for CommunityCapabilityProfile {
+    fn capabilities(&self) -> EditionCapabilities {
+        EditionCapabilities {
+            edition: ProductEdition::Community,
+            supported_protocols: vec![Protocol::Rest],
+            supported_security_levels: vec![OperationSecurityLevel::Standard],
+            machine_access_modes: vec![MachineAccessMode::StaticAgentKey],
+            limits: EditionLimits {
+                max_workspaces: Some(1),
+                max_users_per_workspace: Some(1),
+                max_agents_per_workspace: Some(1),
+            },
+        }
+    }
+}

crates/crank-core/src/lib.rs

@@ -36,6 +36,7 @@ pub use ext::auth::{
     MachineCredentialVerifier, MachineCredentialVerifierError, SharedMachineCredentialVerifier,
     VerifiedMachineCredential,
 };
+pub use ext::capability::{CapabilityProfile, CommunityCapabilityProfile};
 pub use ids::{
     AgentId, AsyncJobId, AuthProfileId, DescriptorId, InvitationId, InvocationLogId, OperationId,
     PlatformApiKeyId, SampleId, SecretId, StreamSessionId, ToolId, UserId, UserSessionId,