verify: close phase zero gate

TASKS.md

@@ -157,4 +157,5 @@ Progress:
   - Phase 0 / task `0.13`: введены `RegistryExtension`, `ExtensionMigration` и `apply_extension_migrations(...)` в `crank-registry` как отдельный public seam для additive private migrations
   - Phase 0 / task `0.14`: добавлены `AdminServiceBuilder`, seam slots (`identity_provider`, `policy_engine`, `audit_sink`, `token_issuer`, `capability_profile`) и community defaults для них; `apps/admin-api/src/main.rs` переведен на builder
   - Phase 0 / task `0.15`: route delegation переведен на public seams — `capabilities` route идет через `capability_profile`, write handlers в `routes/access.rs` проверяют `policy_engine` и пишут generic audit events через `audit_sink`, а `machine_auth` route использует `token_issuer` seam и сохраняет текущий Community `403` contract
+  - Phase 0 / task `0.16`: phase verification gate пройден — `just fmt`, `just check`, `just test`, таргетные Community machine-auth tests и MCP initialize smoke (`requires_initialized_notification_before_tool_methods`) зеленые; runtime regression test обновлен под новый `RuntimeError::ProtocolAdapter` contract
   - backward-compatible alias `CommunityMachineCredentialVerifier` сохранен, поведение Community не изменено

apps/admin-api/src/routes/machine_auth.rs

@@ -18,15 +18,17 @@ pub async fn issue_agent_token(
         .token_issuer()
         .issue_short_lived(payload, &community_token_issuer_actor())
         .await
-        .map_err(|error| map_token_issuer_error(
+        .map_err(|error| {
-            error,
+            map_token_issuer_error(
-            edition,
+                error,
-            MachineAccessMode::ShortLivedToken,
+                edition,
-            json!({
+                MachineAccessMode::ShortLivedToken,
-                "grant_type": grant_type,
+                json!({
-                "upgrade_required": true,
+                    "grant_type": grant_type,
-            }),
+                    "upgrade_required": true,
-        ))?;
+                }),
+            )
+        })?;
     Ok(Json(serde_json::json!(response)))
 }
 
@@ -41,15 +43,17 @@ pub async fn issue_one_time_agent_token(
         .token_issuer()
         .issue_one_time(payload, &community_token_issuer_actor())
         .await
-        .map_err(|error| map_token_issuer_error(
+        .map_err(|error| {
-            error,
+            map_token_issuer_error(
-            edition,
+                error,
-            MachineAccessMode::OneTimeToken,
+                edition,
-            json!({
+                MachineAccessMode::OneTimeToken,
-                "operation_id": operation_id,
+                json!({
-                "upgrade_required": true,
+                    "operation_id": operation_id,
-            }),
+                    "upgrade_required": true,
-        ))?;
+                }),
+            )
+        })?;
     Ok(Json(serde_json::json!(response)))
 }
 
@@ -80,22 +84,14 @@ fn map_token_issuer_error(
                     "static agent key machine access is not available for token issue"
                 }
             },
-            merge_machine_auth_context(
+            merge_machine_auth_context(edition, machine_access_mode, extra_context),
-                edition,
-                machine_access_mode,
-                extra_context,
-            ),
         ),
         TokenIssuerError::InvalidGrant(reason) => ApiError::validation_with_context(
             "invalid machine token grant",
             json!({ "reason": reason }),
         ),
-        TokenIssuerError::AgentKeyUnknown => {
+        TokenIssuerError::AgentKeyUnknown => ApiError::validation("agent key is unknown"),
-            ApiError::validation("agent key is unknown")
+        TokenIssuerError::OperationNotStrict => ApiError::validation("operation is not strict"),
-        }
-        TokenIssuerError::OperationNotStrict => {
-            ApiError::validation("operation is not strict")
-        }
         TokenIssuerError::OperationNotPublishedForAgent => {
             ApiError::validation("operation is not published for agent")
         }

crates/crank-runtime/src/executor.rs

@@ -1450,7 +1450,7 @@ mod tests {
             .await
             .unwrap_err();
 
-        assert!(matches!(error, RuntimeError::RestAdapter(_)));
+        assert!(matches!(error, RuntimeError::ProtocolAdapter(_)));
     }
 
     #[tokio::test]