crank/TASKS.md

TASKS

Current

feat/community-finalization

Status: done

Goal:

• довести crank-community до окончательного самостоятельного состояния как открытой REST-only редакции;
• убрать transitional split-логику, legacy premium ballast и скрытые assumptions из эпохи общего репозитория.

Main code areas:

• TASKS.md
• docs/community-source-whitelist.md
• docs/implementation-plan.md
• docs/repository-split-map.md
• docs/community-release-checklist.md
• docs/commercial-boundaries.md
• workspace manifests
• Community backend/UI tests and fixtures
• Community UI copy and localization

Implementation slices:

1. привести документацию и backlog к реальному состоянию crank-community;
2. убрать premium зависимости из Community workspace manifests;
3. очистить Community test boundary и убрать зависимость от test = false как способа скрывать legacy tests;
4. удалить premium backend ballast, который больше не относится к Community;
5. дочистить UI, локализацию и e2e fixtures до честного Community surface;
6. пройти финальную верификацию Community release path.

DoD:

• crank-community описывает себя как самостоятельный public repository, а не как промежуточный этап split;
• Community manifests и workspace dependencies соответствуют REST-only product boundary;
• Community tests и fixtures проверяют только Community functionality;
• UI и docs не содержат рабочих premium flows и misleading copy;
• Community release path воспроизводим и проверяем без ссылок на transitional import procedure.

Verification:

• docs consistency pass;
• cargo metadata --no-deps;
• just fmt
• just check
• just test
• UI build and Community-targeted smoke/e2e pass.

Progress:

• done:
• deploy/community/* already acts as the canonical Community delivery contour
• Community capability model is already constrained to:
  • REST
  • static agent key
  • security_level = standard
• public wizard HTML surface is already reduced to the Community REST flow
• transitional docs and backlog now describe crank-community as the current source of truth instead of a future split artifact
• premium protocol toolchain dependencies have been removed from the Community workspace manifest while keeping the REST-only workspace green under cargo check
• Community backend crates no longer rely on test = false; just test now runs against a real Community-only test surface on the isolated local test database
• premium protocol and streaming ballast has been removed from Community backend test/dev paths, and Community demo expectations now match the actual REST-only demo seed
• dormant premium UI modules, fixtures, and translation strings have been removed, while the remaining Community wizard and admin pages stay green under local Playwright smoke
• final Community verification pass completed:
  • cargo metadata --no-deps
  • just fmt
  • just check
  • just test
  • apps/ui build
  • Community-targeted Playwright smoke

Next

feat/community-release-hardening

Status: done

Goal:

• закрепить воспроизводимый Community release path и release checklist без скрытых переходных допущений.

Main code areas:

• .github/workflows/ci.yml
• .github/workflows/deploy.yml
• deploy/community/*
• docs/community-release-checklist.md
• docs/deploy-and-staging-smoke.md
• docs/authenticated-staging-pass.md
• docs/public-smoke-targets.md
• docs/staging-regression-notes.md
• scripts/staging-smoke.sh
• scripts/authenticated-staging-smoke.sh
• scripts/staging-note-block.sh

Implementation slices:

1. проверить соответствие CI Community manifests;
2. зафиксировать Community-only smoke baseline;
3. обновить release checklist после финальной cleanup-фазы.

DoD:

• Community release path не зависит от private repositories;
• checklist соответствует реальному Community deploy surface;
• пост-деплойная проверка повторяема.

Verification:

• python3 YAML parse for .github/workflows/ci.yml
• docker compose -f deploy/community/docker-compose.yml --env-file deploy/community/.env.example config -q
• docker compose -f deploy/community/docker-compose.yml --env-file deploy/community/.env.example --profile cache config -q
• just check
• apps/ui build
• Community-targeted Playwright smoke including staging-authenticated.spec.js

Progress:

• done:
  • UI Checks in CI now run real npm ci and npm run build before the container image build
  • Community release docs and helper scripts now describe only the real REST-only deploy smoke baseline
  • staging templates and regression notes no longer require GraphQL, gRPC, WebSocket, SOAP, or streaming scenarios in Community
  • Community public smoke targets are reduced to the canonical REST -> Open-Meteo path
  • obsolete split-helper artifact scripts/export-community.sh and stale premium smoke payloads have been removed from the public repo

feat/common-public-improvements

Status: in_progress

Goal:

• вносить общие улучшения в публичную базу, которые потом синхронно переносятся в enterprise и cloud.
• начать Wave 1 modularization из modular_decomposition.xml без изменения поведения Community runtime.

Main code areas:

• общий Community runtime/UI/API surface
• crates/crank-core
• apps/mcp-server
• docs/modular_decomposition.xml

Implementation slices:

1. выполнять общие изменения сначала в crank-community;
2. брать архитектурные slices из modular_decomposition.xml, а не из legacy cleanup backlog;
3. после стабилизации базовой границы подтягивать ее в private repos по зафиксированной sync model.

DoD:

• общий функционал не расходится между тремя редакциями без необходимости;
• Community остается source base для общей open-core логики.

Verification:

• cargo check --workspace
• таргетные compile/test checks для затронутого бинаря или crate

Progress:

• done:
  • Phase 0 / task 0.1: создан crank-core::ext module skeleton
  • Phase 0 / task 0.2: MachineCredentialVerifier и связанные типы вынесены из apps/mcp-server в public seam crank_core::ext::auth
  • Phase 0 / task 0.3: введены MachineTokenIssuer, NoMachineTokenIssuer, TokenIssuerActor и TokenIssuerError в public seam crank_core::ext::auth
  • Phase 0 / task 0.4: введены IdentityProvider, IdentityProviderKind, IdentityError, LoginPayload, LoginOutcome и public forwarder type AuthenticatedIdentity в crank_core::ext::auth
  • Phase 0 / task 0.5: введены PolicyEngine, SessionActor, PolicyAction, PolicyScope, PolicyDecision и default OwnerOnlyPolicyEngine в public seam crank_core::ext::access
  • Phase 0 / task 0.6: введены AuditSink, NoopAuditSink, AuditEventId и базовые audit-типы в public seam crank_core::ext::audit
  • Phase 0 / task 0.7: введены CapabilityProfile и CommunityCapabilityProfile, а admin-api capability payload теперь собирается через public seam вместо локального literal
  • Phase 0 / task 0.8: введены ProtocolAdapter, ProtocolAdapterError, AdapterRegistry и базовые transport-типы (PreparedRequest, AdapterResponse, WindowExecutionResult, RuntimeRequestContext) в crank_core::ext::protocol
  • Phase 0 / task 0.9: crank-adapter-rest::RestAdapter реализует новый ProtocolAdapter contract, а seam дополнен явным Target и window parameters для реального adapter wiring
  • Phase 0 / task 0.10: RuntimeExecutor переведен с hardcoded adapter fields на AdapterRegistry, crank-runtime больше не держит protocol feature flags, а общий PreparedRequest seam дополнен timeout_ms для корректного runtime dispatch
  • Phase 0 / task 0.11: добавлены RuntimeExecutorBuilder и community_default(), а default community runtime wiring вынесен из RuntimeExecutor в отдельный builder layer
  • Phase 0 / task 0.12: apps/admin-api и apps/mcp-server переведены на community_default().with_limits(...).with_response_cache(...).build() вместо прямой сборки runtime через RuntimeExecutor::with_limits(...)
  • Phase 0 / task 0.13: введены RegistryExtension, ExtensionMigration и apply_extension_migrations(...) в crank-registry как отдельный public seam для additive private migrations
  • Phase 0 / task 0.14: добавлены AdminServiceBuilder, seam slots (identity_provider, policy_engine, audit_sink, token_issuer, capability_profile) и community defaults для них; apps/admin-api/src/main.rs переведен на builder
  • Phase 0 / task 0.15: route delegation переведен на public seams — capabilities route идет через capability_profile, write handlers в routes/access.rs проверяют policy_engine и пишут generic audit events через audit_sink, а machine_auth route использует token_issuer seam и сохраняет текущий Community 403 contract
  • Phase 0 / task 0.16: phase verification gate пройден — just fmt, just check, just test, таргетные Community machine-auth tests и MCP initialize smoke (requires_initialized_notification_before_tool_methods) зеленые; runtime regression test обновлен под новый RuntimeError::ProtocolAdapter contract
  • Phase 1 / tasks 1.1–1.3: strict-REST Community cleanup уже был закрыт ранее — non-REST adapters и crank-proto удалены из workspace, descriptor/premium UI surface убран из Community build, wizard и i18n приведены к REST-only baseline
  • Phase 1 / task 1.4: создан crate crank-community-auth; в него вынесены password hashing/session cookie primitives и PasswordIdentityProvider, admin-api переключен на этот crate, а login() теперь реально делегирует credential check через IdentityProvider seam
  • Phase 1 / task 1.5: создан crate crank-community-mcp; в него вынесены build_app, catalog, jsonrpc, session и auth из apps/mcp-server, а apps/mcp-server/src/main.rs стал thin launcher с env parsing и DI wiring
  • Phase 1 / task 1.6: Community test surface уже приведен к честному baseline — test = false удален ранее, premium-only tests вычищены, just verify проходит на текущем составе workspace
  • Phase 1 / task 1.7: workspace version bumped to 0.2.0; release gate пройден (just verify, npm run build, npm run e2e), release commit и tag v0.2.0 подготовлены в crank-community
  • Phase 2 dependency slice: IdentityProvider seam widened to cover SSO/TOTP with default NotSupportedForProvider methods and shared public DTOs for authorize/callback/two-factor flows; workspace version bumped to 0.3.0 for downstream enterprise consumption
  • Phase 2 dependency slice: apps/admin-api now exposes a reusable lib target (src/lib.rs), so downstream private repos can depend on build_app, AppState, AdminServiceBuilder, and auth/state modules without copying the Community admin app
  • Phase 3 dependency slice: added public tenancy seam in crank-core — TenantId, TenantResolutionContext, TenantController, TenancyError, and SingleTenantController — so cloud can build hosted tenant routing without bypassing the shared extension model
  • Phase 3 dependency slice: added public metering seam in crank-core — MeteringEvent, MeteringSink, SharedMeteringSink, and NoopMeteringSink — so cloud can add hosted usage capture without introducing private-only contracts
  • Phase 3 dependency slice: added public billing seam in crank-core — BillingHook, BillingGate, BillingError, SharedBillingHook, and NoopBillingHook — so cloud can layer billing policy without private-only contracts in the base repo
  • Phase 3 runtime slice: RuntimeRequestContext now carries optional metering context (workspace_id, agent_id, source), RuntimeExecutorBuilder accepts a MeteringSink, and RuntimeExecutor emits MeteringEvent on invocation completion while Community apps keep using the default NoopMeteringSink
  • Phase 3 dependency slice: added CacheBackendFactory in crank-runtime with BuiltinCacheBackendFactory; unlike the original draft, the seam lives in runtime rather than core to avoid a crank-core -> crank-runtime dependency cycle around RuntimeCacheStores
  • Phase 5 / task 5.1: added Community UI overlay foundation — slot-registry.js, overlay-loader.js, optional CRANK_UI_OVERLAY_DIR copy path in the UI build, settings slot mounts, and wizard protocol-card slot mounts; Community build stays noop without any private overlay package
  • backward-compatible alias CommunityMachineCredentialVerifier сохранен, поведение Community не изменено

feat/community-release-pipeline

Status: in_progress

Goal:

• закрыть Phase 6.1 и сделать reproducible tag-release flow для crank-community.

Main code areas:

• .github/workflows/release.yml
• apps/admin-api/Dockerfile
• apps/mcp-server/Dockerfile
• apps/ui/Dockerfile

Implementation slices:

1. build release binaries and UI dist on push tag v*;
2. publish Community images to GHCR;
3. attach checksums and SBOM to GitHub Release.

DoD:

• crank-community выпускается из собственного repo без private inputs;
• tag push v* produces GitHub Release artifacts and container images.

Verification:

• python3 YAML parse for .github/workflows/release.yml