deps: the alkcall substrate pin + the batch-1 module skeleton

- Cargo.toml: alkcall = "0.8.0" (convention 11 — pinned, first
  consumption of the 0.8.0 surface), serde/serde_json, bytes, and
  the std-only futures subset (BoxFuture seam shape). tokio's
  wasm-clean subset and the empty local/composed features unchanged.
- lib.rs: the six skeleton modules per overview.md §Module Map
  (params, wire, producer, consumer, egress, error) — stub files
  with module docs naming their filling tasks; no re-exports yet
  (each implementation task adds its own).

Verified: cargo test (76 tests), clippy --all-targets -D warnings,
fmt --check, cargo doc --no-deps, both wasm checks
(check + clippy on wasm32-unknown-unknown), and the dep-graph
spot-checks (no mio/socket2/tokio::net in the default normal graph;
normal tokio features = bytes/io-util/macros/rt/sync/time only).
alkcall 0.8.0 from crates.io confirmed wasm-clean via probe build
before wiring.

Task: tasks/implementation/core-crate-deps.md (completed)

Cargo.toml

@@ -22,6 +22,9 @@ local = []
 composed = []
 
 [dependencies]
+# The substrate (convention 11): pinned, bump deliberately, never
+# transitively. First consumption of the 0.8.0 surface.
+alkcall = "0.8.0"
 tokio = { version = "1", default-features = false, features = ["rt", "sync", "io-util", "macros", "time"] }
 # The fork's declared logging seam (rfc1928.md: upstream `log` calls
 # were dropped or re-pointed here); no source file references it yet —
@@ -29,6 +32,10 @@ tokio = { version = "1", default-features = false, features = ["rt", "sync", "io
 # diagnostics (review 001 N-2).
 tracing = "0.1"
 thiserror = "2"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+bytes = "1"
+futures = { version = "0.3", default-features = false, features = ["std"] }
 
 [dev-dependencies]
 tokio = { version = "1", features = ["full", "test-util", "macros"] }

src/consumer.rs

@@ -0,0 +1,5 @@
+//! The consumer half: the channels-native session types (CONNECT /
+//! ASSOCIATE / the BIND reply#2 reader) and teardown ownership.
+//!
+//! Stub: filled by the `implementation/core-consumer-*` tasks
+//! (CONNECT first).

src/egress.rs

@@ -0,0 +1,6 @@
+//! The egress/accept seam types: the `DialFn` / `EgressFactory` /
+//! `BindAcceptFactory` contracts (function-not-trait, ownership rides
+//! the handle — ADR-004); the inversion point where no substrate type
+//! is ever named.
+//!
+//! Stub: filled by the `implementation/core-seam-types` task.

src/error.rs

@@ -0,0 +1,3 @@
+//! `SocksError` + the typed open-error surface (alkcall ADR-049 §4).
+//!
+//! Stub: filled by the `implementation/core-params-errors` task.

src/lib.rs

@@ -21,3 +21,10 @@
 #![forbid(unsafe_code)]
 
 pub mod rfc1928;
+
+pub mod consumer;
+pub mod egress;
+pub mod error;
+pub mod params;
+pub mod producer;
+pub mod wire;

src/params.rs

@@ -0,0 +1,4 @@
+//! The trivial open-op params schema + the scope constants
+//! (`SOCKS5_OPEN_SCOPE`, `SOCKS5_BIND_SCOPE`) — ADR-001/ADR-006.
+//!
+//! Stub: filled by the `implementation/core-params-errors` task.

src/producer.rs

@@ -0,0 +1,6 @@
+//! The producer half: the open op spec (scope-gated), the
+//! session-gate establisher, the command-dispatch pump handler
+//! (typestate driving + the three seams), teardown.
+//!
+//! Stub: filled by the `implementation/core-producer-*` tasks
+//! (CONNECT first).

src/wire.rs

@@ -0,0 +1,5 @@
+//! The ASSOCIATE datagram frame codec: the first-party
+//! `[len: u16 BE][addr + data]` framing (ADR-003), applied exactly
+//! once, by this layer.
+//!
+//! Stub: filled by the `implementation/core-wire-codec` task.

tasks/implementation/core-crate-deps.md

@@ -1,7 +1,7 @@
 ---
 id: implementation/core-crate-deps
 name: Core — crate dependencies + module skeleton (alkcall wiring)
-status: pending
+status: completed
 depends_on: []
 scope: narrow
 risk: low
@@ -47,19 +47,19 @@ Deliverables:
 
 ## Acceptance Criteria
 
-- [ ] `cargo test` passes
-- [ ] `cargo clippy --all-targets -- -D warnings` clean
-- [ ] `cargo fmt --check` clean
-- [ ] `cargo check --target wasm32-unknown-unknown` clean — the wasm
+- [x] `cargo test` passes
+- [x] `cargo clippy --all-targets -- -D warnings` clean
+- [x] `cargo fmt --check` clean
+- [x] `cargo check --target wasm32-unknown-unknown` clean — the wasm
       gate stays green with alkcall + serde + bytes + futures in the
       graph (alkcall 0.8.0's default crate is wasm-clean; verify, do
       not assume)
-- [ ] `cargo clippy --target wasm32-unknown-unknown -- -D warnings`
+- [x] `cargo clippy --target wasm32-unknown-unknown -- -D warnings`
       clean
-- [ ] No `tokio/net`, `socket2`, `mio` in the default dependency
+- [x] No `tokio/net`, `socket2`, `mio` in the default dependency
       graph (`cargo tree` spot-check)
-- [ ] `alkcall` pinned at `"0.8.0"` (not a range)
-- [ ] Module skeleton matches overview.md §Module Map (module names
+- [x] `alkcall` pinned at `"0.8.0"` (not a range)
+- [x] Module skeleton matches overview.md §Module Map (module names
       and file layout)
 
 ## References
@@ -74,8 +74,59 @@ Deliverables:
 
 ## Notes
 
-> To be filled by implementation agent
+- Verified before implementing that alkcall 0.8.0 (the crates.io
+  artifact, same resolution alktunnels uses) is wasm-clean with no
+  `[patch]`/RUSTFLAGS need: its `getrandom 0.4 + wasm_js` is
+  self-contained on `wasm32-unknown-unknown`. The `futures = {
+  default-features = false, features = ["std"] }` subset compiles in
+  the same graph (probe build in `/tmp/opencode/wasm-probe`).
+- **Cargo.toml** — added `alkcall = "0.8.0"` (pinned, not a range —
+  convention 11), `serde = { version = "1", features = ["derive"] }`,
+  `serde_json = "1"`, `bytes = "1"`, and
+  `futures = { version = "0.3", default-features = false, features =
+  ["std"] }` (the BoxFuture seam shape; the std-only subset, not
+  default features — the latter is the same set in practice, but the
+  explicit subset is the documented posture). tokio unchanged (the
+  wasm-clean subset, `default-features = false` — never `full`); the
+  full-tokio dev-dep stays native-only. `[features]` untouched
+  (`default = []`, `local = []`, `composed = []` — ADR-009, populated
+  by batch-2).
+- **lib.rs** — kept `#![forbid(unsafe_code)]` + crate docs; declared
+  the six skeleton modules per overview.md §Module Map: `params`,
+  `wire`, `producer`, `consumer`, `egress`, `error` (alphabetical
+  declaration order after `rfc1928`; rustfmt-sorted). No re-exports
+  yet (convention 15 posture: each implementation task adds its own).
+- **Stub files** — one-line module docs (2–5 lines) each naming its
+  filling task: `params`/`error` → core-params-errors, `wire` →
+  core-wire-codec, `egress` → core-seam-types, `producer` →
+  core-producer-connect (+ associates/bind), `consumer` →
+  core-consumer-connect (+ associates/bind). `door.rs`, `local/`,
+  `composed/` are deliberately absent — feature-gated batch-2 modules
+  born with their features, per the overview module map's local/
+  composed posture.
+- Dep-graph spot checks: `cargo tree --target
+  wasm32-unknown-unknown -e normal -i mio` and `-i socket2` print
+  nothing (not in the wasm normal graph); the normal-only tokio
+  feature set on both native and wasm targets is exactly
+  `bytes/default io-util macros rt sync time` (the `net`/`full`
+  features appear only via the dev-dependency tokio — the test-only
+  surface, by design).
 
 ## Summary
 
-> To be filled on completion
+Added the batch-1 dependency surface and the module skeleton:
+`Cargo.toml` gains `alkcall = "0.8.0"` (the substrate pin,
+convention 11), `serde`/`serde_json`, `bytes`, and the std-only
+`futures` subset — tokio's wasm-clean subset and the empty
+`local`/`composed` features unchanged; `src/lib.rs` declares the six
+skeleton modules (`params`, `wire`, `producer`, `consumer`, `egress`,
+`error`) per overview.md §Module Map, each a stub with a module doc
+naming its filling task (the vendor-scaffolding precedent); no
+re-exports yet. Wasm-cleanliness verified before and after: alkcall
+0.8.0's crates.io artifact compiles clean on
+`wasm32-unknown-unknown` with no patching (probe build), and the
+crate's checks all pass — `cargo test` (39+37 tests, 2 doc-ignored),
+`cargo clippy --all-targets -- -D warnings`, `cargo fmt --check`,
+`cargo doc --no-deps`, both wasm checks, and the `mio`/`socket2`/
+`tokio::net` absence spot-checks on the default (normal) dependency
+graph.