core: introduce public auth extension seam

TASKS.md

@@ -115,19 +115,33 @@ Progress:
 
 ### `feat/common-public-improvements`
 
-Status: ready
+Status: in_progress
 
 Goal:
 - вносить общие улучшения в публичную базу, которые потом синхронно переносятся в `enterprise` и `cloud`.
+- начать Wave 1 modularization из `modular_decomposition.xml` без изменения поведения Community runtime.
 
 Main code areas:
 - общий Community runtime/UI/API surface
+- `crates/crank-core`
+- `apps/mcp-server`
+- `/home/github-ops/crank/docs/modular_decomposition.xml`
 
 Implementation slices:
-1. делать изменение в `crank-community`;
-2. переносить тот же change set в `crank-enterprise`;
-3. переносить тот же change set в `crank-cloud`.
+1. выполнять общие изменения сначала в `crank-community`;
+2. брать архитектурные slices из `modular_decomposition.xml`, а не из legacy cleanup backlog;
+3. после стабилизации базовой границы подтягивать ее в private repos по зафиксированной sync model.
 
 DoD:
 - общий функционал не расходится между тремя редакциями без необходимости;
 - Community остается source base для общей open-core логики.
+
+Verification:
+- `cargo check --workspace`
+- таргетные compile/test checks для затронутого бинаря или crate
+
+Progress:
+- done:
+  - Phase 0 / task `0.1`: создан `crank-core::ext` module skeleton
+  - Phase 0 / task `0.2`: `MachineCredentialVerifier` и связанные типы вынесены из `apps/mcp-server` в public seam `crank_core::ext::auth`
+  - backward-compatible alias `CommunityMachineCredentialVerifier` сохранен, поведение Community не изменено

apps/mcp-server/src/auth.rs

@@ -1,36 +1,14 @@
-use std::sync::Arc;
-
 use async_trait::async_trait;
-use crank_core::{MachineAccessMode, OperationSecurityLevel, PlatformApiKeyScope};
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct VerifiedMachineCredential {
-    pub machine_access_mode: MachineAccessMode,
-    pub max_security_level: OperationSecurityLevel,
-    pub scopes: Vec<PlatformApiKeyScope>,
-}
-
-#[async_trait]
-pub trait MachineCredentialVerifier: Send + Sync {
-    async fn verify_bearer_token(
-        &self,
-        workspace_slug: &str,
-        agent_slug: &str,
-        token: &str,
-    ) -> Result<Option<VerifiedMachineCredential>, MachineCredentialVerifierError>;
-}
-
-pub type SharedMachineCredentialVerifier = Arc<dyn MachineCredentialVerifier>;
+pub use crank_core::{
+    MachineCredentialVerifier, MachineCredentialVerifierError, SharedMachineCredentialVerifier,
+    VerifiedMachineCredential,
+};
 
 #[derive(Clone, Default)]
-pub struct CommunityMachineCredentialVerifier;
-
-#[derive(Debug, thiserror::Error)]
-#[error("machine credential verifier failed")]
-pub struct MachineCredentialVerifierError;
+pub struct StaticAgentKeyVerifier;
 
 #[async_trait]
-impl MachineCredentialVerifier for CommunityMachineCredentialVerifier {
+impl MachineCredentialVerifier for StaticAgentKeyVerifier {
     async fn verify_bearer_token(
         &self,
         _workspace_slug: &str,
@@ -40,3 +18,5 @@ impl MachineCredentialVerifier for CommunityMachineCredentialVerifier {
         Ok(None)
     }
 }
+
+pub use StaticAgentKeyVerifier as CommunityMachineCredentialVerifier;

crates/crank-core/src/ext/access.rs

@@ -0,0 +1 @@
+

crates/crank-core/src/ext/audit.rs

@@ -0,0 +1 @@
+

crates/crank-core/src/ext/auth.rs

@@ -0,0 +1,28 @@
+use std::sync::Arc;
+
+use async_trait::async_trait;
+
+use crate::{MachineAccessMode, OperationSecurityLevel, PlatformApiKeyScope};
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct VerifiedMachineCredential {
+    pub machine_access_mode: MachineAccessMode,
+    pub max_security_level: OperationSecurityLevel,
+    pub scopes: Vec<PlatformApiKeyScope>,
+}
+
+#[derive(Debug, thiserror::Error)]
+#[error("machine credential verifier failed")]
+pub struct MachineCredentialVerifierError;
+
+#[async_trait]
+pub trait MachineCredentialVerifier: Send + Sync {
+    async fn verify_bearer_token(
+        &self,
+        workspace_slug: &str,
+        agent_slug: &str,
+        token: &str,
+    ) -> Result<Option<VerifiedMachineCredential>, MachineCredentialVerifierError>;
+}
+
+pub type SharedMachineCredentialVerifier = Arc<dyn MachineCredentialVerifier>;

crates/crank-core/src/ext/capability.rs

@@ -0,0 +1 @@
+

crates/crank-core/src/ext/mod.rs

@@ -0,0 +1,5 @@
+pub mod access;
+pub mod audit;
+pub mod auth;
+pub mod capability;
+pub mod protocol;

crates/crank-core/src/ext/protocol.rs

@@ -0,0 +1 @@
+

crates/crank-core/src/lib.rs

@@ -3,6 +3,7 @@ pub mod agent;
 pub mod auth;
 pub mod cache;
 pub mod edition;
+pub mod ext;
 pub mod ids;
 pub mod observability;
 pub mod operation;
@@ -31,6 +32,10 @@ pub use cache::{
 pub use edition::{
     EditionCapabilities, EditionLimits, MachineAccessMode, OperationSecurityLevel, ProductEdition,
 };
+pub use ext::auth::{
+    MachineCredentialVerifier, MachineCredentialVerifierError, SharedMachineCredentialVerifier,
+    VerifiedMachineCredential,
+};
 pub use ids::{
     AgentId, AsyncJobId, AuthProfileId, DescriptorId, InvitationId, InvocationLogId, OperationId,
     PlatformApiKeyId, SampleId, SecretId, StreamSessionId, ToolId, UserId, UserSessionId,