crank/TASKS.md

TASKS

Current

feat/open-core-repo-boundary

Status: in_progress

Goal:

• закрепить техническую границу между crank-community, crank-enterprise и crank-cloud.

Main code areas:

• docs/commercial-boundaries.md
• docs/module-decomposition.md
• docs/development-rules.md
• docs/implementation-plan.md
• release scripts / Docker manifests / future packaging files

Implementation slices:

1. Определить extension seams в public code.
2. Подготовить отдельные delivery manifests для Community.
3. Убрать из Community repo assumptions о размещении private code рядом с Community logic.
4. Подготовить naming и packaging strategy для private repositories.
5. После завершения seams и capability split остановиться на управленческом gate и создать:
   • public repository crank-community
   • private repository crank-enterprise
   • private repository crank-cloud Только после этого начинать физическое вынесение commercial code из текущего monorepo.

DoD:

• можно объяснить, что именно публикуется как OSS, а что уходит в private delivery;
• Community release path отделен от commercial release path;
• документация не ссылается на удаленные review files.
• момент создания 3 целевых repositories зафиксирован в плане как отдельный обязательный шаг, а не подразумевается неявно.

Verification:

• docs consistency pass;
• release checklist review.

Progress:

• done:
  • public target repository crank-community now exists and can receive bootstrap templates once the remaining private repositories are created
  • gate for creating 3 target repositories is already documented before any physical commercial split
  • canonical Community deployment manifest and env template now live under deploy/community/*, and public deploy uses that manifest instead of the root compose file
  • CI, README, runtime/deploy smoke docs now point to deploy/community/* as the Community delivery source of truth
  • separate Community release checklist now exists and explicitly forbids treating future Enterprise/Cloud delivery as just another env on the same public manifest
  • explicit repository split map now defines what goes to crank-community, crank-enterprise, and crank-cloud
  • Community is now fixed as REST-only in product docs, capability model, backend validation, demo seed, and UI protocol expectations
  • bootstrap templates now exist for crank-community, crank-enterprise, and crank-cloud, including initial README and workflow skeletons
  • crank-runtime now has protocol feature seams, and the runtime crate compiles with --no-default-features as a REST-only base
• pending:
  • next management gate is to create the remaining private target repositories:
    • crank-enterprise
    • crank-cloud
  • after all 3 repositories exist, move the prepared bootstrap templates into their roots before physical split starts

Planned

feat/commercial-machine-token-flow

Status: ready

Goal:

• реализовать короткоживущие и одноразовые машинные токены как коммерческий auth contour, а не как Community stub.

Main code areas:

• private enterprise/cloud token services
• public contracts already fixed in:
  • crates/crank-core
  • apps/admin-api
  • apps/mcp-server
  • docs/agent-auth-model.md

Implementation slices:

1. short-lived token issuance
2. one-time token issuance
3. replay guard / nonce coordination on top of cache layer
4. runtime verification and policy enforcement by security_level
5. capability-gated UI/admin flows for commercial editions

DoD:

• replay guard is no longer a stub abstraction and is wired into a real token flow;
• elevated/strict machine access works end-to-end in commercial contours;
• Community remains on static agent keys only.

feat/enterprise-access-governance

Status: ready

Goal:

• реализовать enterprise access layer вне Community scope.

Main code areas:

• private enterprise services and crates
• public contracts in:
  • docs/admin-api.md
  • docs/agent-auth-model.md
  • docs/product-editions.md

Implementation slices:

1. SSO
2. 2FA
3. extended RBAC
4. audit log
5. enterprise admin flows in UI through capability gating

DoD:

• governance features не живут как полумеры в Community;
• enterprise access model согласован с public contracts.

feat/cloud-metering-control-plane

Status: ready

Goal:

• подготовить hosted-редакцию как отдельный продуктовый контур.

Main code areas:

• private cloud services
• usage/metering integration points
• docs/product-editions.md
• docs/commercial-boundaries.md

Implementation slices:

1. usage metering by workspace / agent / token;
2. billing integration;
3. hosted tenant controls;
4. cloud operational tooling.

DoD:

• Cloud edition не зависит от ручного учета usage;
• hosted product surface согласован с feature matrix.

feat/release-protection-distribution

Status: ready

Goal:

• подготовить безопасную поставку Community и коммерческих редакций.

Main code areas:

• CI workflows
• Dockerfiles
• deployment manifests
• release docs

Implementation slices:

1. public GitHub release flow for Community;
2. private registry flow for Enterprise;
3. signed artifacts and provenance;
4. release checklist for edition-specific packaging.

DoD:

• Community публикуется из crank-community;
• Enterprise и Cloud используют private delivery path;
• коммерческий код не требуется публиковать в open source ради поставки.

feat/live-authenticated-staging-entry

Status: ready

Goal:

• держать реальный staging/demo контур в состоянии, пригодном для демонстрации и регрессии.

Main code areas:

• docs/demo-runbook.md
• docs/deploy-and-staging-smoke.md
• docs/authenticated-staging-pass.md
• deployment workflows

Implementation slices:

1. актуализировать demo user flow;
2. прогнать authenticated staging pass;
3. зафиксировать regressions и manual checks;
4. синхронизировать deploy docs с реальным окружением.

DoD:

• staging validation не зависит от локальных фикстур;
• documentation matches deployed behavior;
• demo flow reproducible on real environment.