feat(core): scaffold agentd-core service

[geoffjay]

Adds the crates/core workspace member implementing the central auth/API gateway scaffold described in issue #212.

• Binary agentd-core listening on port 17007 (configurable via AGENTD_PORT)
• GET /health endpoint returning {"status":"ok","service":"core"}
• GET /metrics Prometheus endpoint with service_info gauge
• Graceful Ctrl+C shutdown
• Shared middleware: structured tracing, CORS, Prometheus metrics layer
• Two integration tests covering health status and JSON body

Closes #212

[geoffjay]

This change is part of the following stack:

• feat(core): scaffold agentd-core service #1058 ◀
  • feat(core): add entity module stubs, migration runner, and Storage wrapper #1059
    • feat(core): implement initial sea-orm migration for core service schema #1060
      • feat(core): define SeaORM User entity with has_many relations #1061
        • feat(core): define SeaORM Session entity with belongs_to User #1062
          • feat(core): define Organization and Membership entities with many-to-many relations #1063
            • feat(core): add SeaORM integration tests for entity relations #1064
              • feat(core): add OrganizationStorage and MembershipStorage #1066
                • feat(core): add UserStorage with argon2 password hashing and username migration #1067
                  • feat(core): add authentication endpoints with SQLite-backed sessions #1068
                  • feat(core): add TenantContext middleware and active organization endpoint #1069
                  • feat(core): add user and organization management API endpoints #1070
                  • feat(cli): add auth and org commands for core service #1071
                  • feat(core): add API gateway proxy for downstream service routing #1072

_{Change managed by git-spice.}

[geoffjay]

Review: feat(core): scaffold agentd-core service

Clean scaffold that correctly follows the established service patterns across the workspace. No issues found.

---

Stack context

issue-212 branches directly off main with no needs restack marker — the branch is current. No parent PR. This is the v0.3.3 critical path entry point; landing it unblocks #240 → #241 → #237 → {#238, #239} → #242 and ultimately resolves the architectural placement question on PR #1057.

---

Correctness checks

Bind address (127.0.0.1): Consistent with the majority of services in the workspace — orchestrator, communicate, memory, notify, wrap, and index all bind to 127.0.0.1. The pattern is correct. ✅

uuid pinned version: uuid is not in the workspace [dependencies] table, so uuid = { version = "1.11", features = ["v4", "serde"] } is the correct form. Matches orchestrator, notify, memory, and every other crate that uses uuid. ✅

tower-http: Uses workspace = true correctly since it is a workspace dependency. ✅

Port 17007: The doc comment correctly explains the divergence from the issue spec (17010 was already taken by communicate). Good transparency. ✅

---

Structure

lib.rs + main.rs split: Correct Rust binary+library crate pattern. api.rs is compiled as part of the library (for tests) and independently in the binary. The #[cfg(test)] tests in api.rs run under the library compilation unit, which is the right setup. ✅

init_metrics(): The .expect("failed to install metrics recorder") is acceptable — metrics recorder installation is a fatal startup error in every other service that uses the same pattern. ✅

Metrics in main.rs rather than api::create_router(): Correct separation — the metrics endpoint requires PrometheusHandle state that's initialized at the binary level, not something create_router() should own. Tests correctly cover /health without needing a metrics recorder. ✅

Middleware order (metrics_layer → trace_layer → cors_layer): Consistent with orchestrator and other services. ✅

Graceful shutdown: axum::serve(...).with_graceful_shutdown(shutdown_signal()).into_future().await? is the correct axum 0.7 pattern. ✅

---

Tests

Both tests use tower::ServiceExt::oneshot — the idiomatic axum handler test approach:

• health_returns_200: verifies status code ✅
• health_returns_json_body: verifies both status and service fields ✅

Coverage is appropriate for a scaffold PR. ✅

---

Summary

This PR delivers exactly what #212 specified: health endpoint, Prometheus metrics, graceful shutdown, shared middleware, two integration tests. The implementation is consistent with the rest of the workspace. Approving.