crank/TASKS.md

# TASKS

## Current

### `feat/community-finalization`

Status: done

Goal:
- довести `crank-community` до окончательного самостоятельного состояния как открытой `REST-only` редакции;
- убрать transitional split-логику, legacy premium ballast и скрытые assumptions из эпохи общего репозитория.

Main code areas:
- `TASKS.md`
- `docs/community-source-whitelist.md`
- `docs/implementation-plan.md`
- `docs/repository-split-map.md`
- `docs/community-release-checklist.md`
- `docs/commercial-boundaries.md`
- workspace manifests
- Community backend/UI tests and fixtures
- Community UI copy and localization

Implementation slices:
1. привести документацию и backlog к реальному состоянию `crank-community`;
2. убрать premium зависимости из Community workspace manifests;
3. очистить Community test boundary и убрать зависимость от `test = false` как способа скрывать legacy tests;
4. удалить premium backend ballast, который больше не относится к Community;
5. дочистить UI, локализацию и e2e fixtures до честного Community surface;
6. пройти финальную верификацию Community release path.

DoD:
- `crank-community` описывает себя как самостоятельный public repository, а не как промежуточный этап split;
- Community manifests и workspace dependencies соответствуют `REST-only` product boundary;
- Community tests и fixtures проверяют только Community functionality;
- UI и docs не содержат рабочих premium flows и misleading copy;
- Community release path воспроизводим и проверяем без ссылок на transitional import procedure.

Verification:
- docs consistency pass;
- `cargo metadata --no-deps`;
- `just fmt`
- `just check`
- `just test`
- UI build and Community-targeted smoke/e2e pass.

Progress:
  - done:
  - `deploy/community/*` already acts as the canonical Community delivery contour
  - Community capability model is already constrained to:
    - `REST`
    - static agent key
    - `security_level = standard`
  - public wizard HTML surface is already reduced to the Community `REST` flow
  - transitional docs and backlog now describe `crank-community` as the current source of truth instead of a future split artifact
  - premium protocol toolchain dependencies have been removed from the Community workspace manifest while keeping the `REST-only` workspace green under `cargo check`
  - Community backend crates no longer rely on `test = false`; `just test` now runs against a real Community-only test surface on the isolated local test database
  - premium protocol and streaming ballast has been removed from Community backend test/dev paths, and Community demo expectations now match the actual `REST-only` demo seed
  - dormant premium UI modules, fixtures, and translation strings have been removed, while the remaining Community wizard and admin pages stay green under local Playwright smoke
  - final Community verification pass completed:
    - `cargo metadata --no-deps`
    - `just fmt`
    - `just check`
    - `just test`
    - `apps/ui` build
    - Community-targeted Playwright smoke

## Next

### `feat/community-release-hardening`

Status: done

Goal:
- закрепить воспроизводимый Community release path и release checklist без скрытых переходных допущений.

Main code areas:
- `.github/workflows/ci.yml`
- `.github/workflows/deploy.yml`
- `deploy/community/*`
- `docs/community-release-checklist.md`
- `docs/deploy-and-staging-smoke.md`
- `docs/authenticated-staging-pass.md`
- `docs/public-smoke-targets.md`
- `docs/staging-regression-notes.md`
- `scripts/staging-smoke.sh`
- `scripts/authenticated-staging-smoke.sh`
- `scripts/staging-note-block.sh`

Implementation slices:
1. проверить соответствие CI Community manifests;
2. зафиксировать Community-only smoke baseline;
3. обновить release checklist после финальной cleanup-фазы.

DoD:
- Community release path не зависит от private repositories;
- checklist соответствует реальному Community deploy surface;
- пост-деплойная проверка повторяема.

Verification:
- `python3` YAML parse for `.github/workflows/ci.yml`
- `docker compose -f deploy/community/docker-compose.yml --env-file deploy/community/.env.example config -q`
- `docker compose -f deploy/community/docker-compose.yml --env-file deploy/community/.env.example --profile cache config -q`
- `just check`
- `apps/ui` build
- Community-targeted Playwright smoke including `staging-authenticated.spec.js`

Progress:
- done:
  - `UI Checks` in `CI` now run real `npm ci` and `npm run build` before the container image build
  - Community release docs and helper scripts now describe only the real `REST-only` deploy smoke baseline
  - staging templates and regression notes no longer require `GraphQL`, `gRPC`, `WebSocket`, `SOAP`, or streaming scenarios in Community
  - Community public smoke targets are reduced to the canonical `REST -> Open-Meteo` path
  - obsolete split-helper artifact `scripts/export-community.sh` and stale premium smoke payloads have been removed from the public repo

### `feat/common-public-improvements`

Status: in_progress

Goal:
- вносить общие улучшения в публичную базу, которые потом синхронно переносятся в `enterprise` и `cloud`.
- начать Wave 1 modularization из `modular_decomposition.xml` без изменения поведения Community runtime.

Main code areas:
- общий Community runtime/UI/API surface
- `crates/crank-core`
- `apps/mcp-server`
- `docs/modular_decomposition.xml`

Implementation slices:
1. выполнять общие изменения сначала в `crank-community`;
2. брать архитектурные slices из `modular_decomposition.xml`, а не из legacy cleanup backlog;
3. после стабилизации базовой границы подтягивать ее в private repos по зафиксированной sync model.

DoD:
- общий функционал не расходится между тремя редакциями без необходимости;
- Community остается source base для общей open-core логики.

Verification:
- `cargo check --workspace`
- таргетные compile/test checks для затронутого бинаря или crate

Progress:
- done:
  - Phase 0 / task `0.1`: создан `crank-core::ext` module skeleton
  - Phase 0 / task `0.2`: `MachineCredentialVerifier` и связанные типы вынесены из `apps/mcp-server` в public seam `crank_core::ext::auth`
  - Phase 0 / task `0.3`: введены `MachineTokenIssuer`, `NoMachineTokenIssuer`, `TokenIssuerActor` и `TokenIssuerError` в public seam `crank_core::ext::auth`
  - Phase 0 / task `0.4`: введены `IdentityProvider`, `IdentityProviderKind`, `IdentityError`, `LoginPayload`, `LoginOutcome` и public forwarder type `AuthenticatedIdentity` в `crank_core::ext::auth`
  - Phase 0 / task `0.5`: введены `PolicyEngine`, `SessionActor`, `PolicyAction`, `PolicyScope`, `PolicyDecision` и default `OwnerOnlyPolicyEngine` в public seam `crank_core::ext::access`
  - Phase 0 / task `0.6`: введены `AuditSink`, `NoopAuditSink`, `AuditEventId` и базовые audit-типы в public seam `crank_core::ext::audit`
  - Phase 0 / task `0.7`: введены `CapabilityProfile` и `CommunityCapabilityProfile`, а `admin-api` capability payload теперь собирается через public seam вместо локального literal
  - Phase 0 / task `0.8`: введены `ProtocolAdapter`, `ProtocolAdapterError`, `AdapterRegistry` и базовые transport-типы (`PreparedRequest`, `AdapterResponse`, `WindowExecutionResult`, `RuntimeRequestContext`) в `crank_core::ext::protocol`
  - Phase 0 / task `0.9`: `crank-adapter-rest::RestAdapter` реализует новый `ProtocolAdapter` contract, а seam дополнен явным `Target` и window parameters для реального adapter wiring
  - Phase 0 / task `0.10`: `RuntimeExecutor` переведен с hardcoded adapter fields на `AdapterRegistry`, `crank-runtime` больше не держит protocol feature flags, а общий `PreparedRequest` seam дополнен `timeout_ms` для корректного runtime dispatch
  - Phase 0 / task `0.11`: добавлены `RuntimeExecutorBuilder` и `community_default()`, а default community runtime wiring вынесен из `RuntimeExecutor` в отдельный builder layer
  - Phase 0 / task `0.12`: `apps/admin-api` и `apps/mcp-server` переведены на `community_default().with_limits(...).with_response_cache(...).build()` вместо прямой сборки runtime через `RuntimeExecutor::with_limits(...)`
  - Phase 0 / task `0.13`: введены `RegistryExtension`, `ExtensionMigration` и `apply_extension_migrations(...)` в `crank-registry` как отдельный public seam для additive private migrations
  - Phase 0 / task `0.14`: добавлены `AdminServiceBuilder`, seam slots (`identity_provider`, `policy_engine`, `audit_sink`, `token_issuer`, `capability_profile`) и community defaults для них; `apps/admin-api/src/main.rs` переведен на builder
  - Phase 0 / task `0.15`: route delegation переведен на public seams — `capabilities` route идет через `capability_profile`, write handlers в `routes/access.rs` проверяют `policy_engine` и пишут generic audit events через `audit_sink`, а `machine_auth` route использует `token_issuer` seam и сохраняет текущий Community `403` contract
  - Phase 0 / task `0.16`: phase verification gate пройден — `just fmt`, `just check`, `just test`, таргетные Community machine-auth tests и MCP initialize smoke (`requires_initialized_notification_before_tool_methods`) зеленые; runtime regression test обновлен под новый `RuntimeError::ProtocolAdapter` contract
  - Phase 1 / tasks `1.1`–`1.3`: strict-REST Community cleanup уже был закрыт ранее — non-REST adapters и `crank-proto` удалены из workspace, descriptor/premium UI surface убран из Community build, wizard и i18n приведены к REST-only baseline
  - Phase 1 / task `1.4`: создан crate `crank-community-auth`; в него вынесены password hashing/session cookie primitives и `PasswordIdentityProvider`, `admin-api` переключен на этот crate, а `login()` теперь реально делегирует credential check через `IdentityProvider` seam
  - Phase 1 / task `1.5`: создан crate `crank-community-mcp`; в него вынесены `build_app`, `catalog`, `jsonrpc`, `session` и `auth` из `apps/mcp-server`, а `apps/mcp-server/src/main.rs` стал thin launcher с env parsing и DI wiring
  - Phase 1 / task `1.6`: Community test surface уже приведен к честному baseline — `test = false` удален ранее, premium-only tests вычищены, `just verify` проходит на текущем составе workspace
  - Phase 1 / task `1.7`: workspace version bumped to `0.2.0`; release gate пройден (`just verify`, `npm run build`, `npm run e2e`), release commit и tag `v0.2.0` подготовлены в `crank-community`
  - Phase 2 dependency slice: `IdentityProvider` seam widened to cover `SSO/TOTP` with default `NotSupportedForProvider` methods and shared public DTOs for authorize/callback/two-factor flows; workspace version bumped to `0.3.0` for downstream enterprise consumption
  - Phase 2 dependency slice: `apps/admin-api` now exposes a reusable lib target (`src/lib.rs`), so downstream private repos can depend on `build_app`, `AppState`, `AdminServiceBuilder`, and auth/state modules without copying the Community admin app
  - Phase 3 dependency slice: added public tenancy seam in `crank-core` — `TenantId`, `TenantResolutionContext`, `TenantController`, `TenancyError`, and `SingleTenantController` — so `cloud` can build hosted tenant routing without bypassing the shared extension model
  - Phase 3 dependency slice: added public metering seam in `crank-core` — `MeteringEvent`, `MeteringSink`, `SharedMeteringSink`, and `NoopMeteringSink` — so `cloud` can add hosted usage capture without introducing private-only contracts
  - Phase 3 dependency slice: added public billing seam in `crank-core` — `BillingHook`, `BillingGate`, `BillingError`, `SharedBillingHook`, and `NoopBillingHook` — so `cloud` can layer billing policy without private-only contracts in the base repo
  - Phase 3 runtime slice: `RuntimeRequestContext` now carries optional metering context (`workspace_id`, `agent_id`, `source`), `RuntimeExecutorBuilder` accepts a `MeteringSink`, and `RuntimeExecutor` emits `MeteringEvent` on invocation completion while Community apps keep using the default `NoopMeteringSink`
  - Phase 3 dependency slice: added `CacheBackendFactory` in `crank-runtime` with `BuiltinCacheBackendFactory`; unlike the original draft, the seam lives in runtime rather than core to avoid a `crank-core -> crank-runtime` dependency cycle around `RuntimeCacheStores`
  - Phase 5 / task `5.1`: added Community UI overlay foundation — `slot-registry.js`, `overlay-loader.js`, optional `CRANK_UI_OVERLAY_DIR` copy path in the UI build, settings slot mounts, and wizard protocol-card slot mounts; Community build stays noop without any private overlay package
  - backward-compatible alias `CommunityMachineCredentialVerifier` сохранен, поведение Community не изменено

### `feat/community-release-pipeline`

Status: in_progress

Goal:
- закрыть `Phase 6.1` и сделать reproducible tag-release flow для `crank-community`.

Main code areas:
- `.github/workflows/release.yml`
- `apps/admin-api/Dockerfile`
- `apps/mcp-server/Dockerfile`
- `apps/ui/Dockerfile`

Implementation slices:
1. build release binaries and UI dist on `push tag v*`;
2. publish Community images to `GHCR`;
3. attach checksums and SBOM to GitHub Release.

DoD:
- `crank-community` выпускается из собственного repo без private inputs;
- tag push `v*` produces GitHub Release artifacts and container images.

Verification:
- `python3` YAML parse for `.github/workflows/release.yml`