feat(stage3): scaffold task-001 baseline

- WHY: establish Stage 3 task-001 execution baseline per repo intent
- WHAT: add minimal solution/project skeleton and boundary docs
- RULE: apply stage3 execution runtime and repository workflow directives

Thalos.Service.slnx

@@ -0,0 +1,10 @@
+<Solution>
+  <Folder Name="/src/">
+    <Project Path="src/Thalos.Service.Identity.Abstractions/Thalos.Service.Identity.Abstractions.csproj" />
+    <Project Path="src/Thalos.Service.Application/Thalos.Service.Application.csproj" />
+    <Project Path="src/Thalos.Service.Grpc/Thalos.Service.Grpc.csproj" />
+  </Folder>
+  <Folder Name="/tests/">
+    <Project Path="tests/Thalos.Service.Application.UnitTests/Thalos.Service.Application.UnitTests.csproj" />
+  </Folder>
+</Solution>

docs/architecture/thalos-service-modules.puml

@@ -0,0 +1,29 @@
+@startuml
+skinparam packageStyle rectangle
+
+package "thalos-service" {
+  package "Thalos.Service.Identity.Abstractions" {
+    class IssueIdentityTokenRequest
+    class IssueIdentityTokenResponse
+    interface IdentityAbstractionBoundary
+  }
+
+  package "Thalos.Service.Application" {
+    interface IIssueIdentityTokenUseCase
+    class IssueIdentityTokenUseCase
+    interface IIdentityTokenReadPort
+  }
+
+  package "Thalos.Service.Grpc" {
+    class Program
+  }
+
+  IssueIdentityTokenUseCase ..|> IIssueIdentityTokenUseCase
+  IssueIdentityTokenUseCase --> IIdentityTokenReadPort
+  IIssueIdentityTokenUseCase --> IssueIdentityTokenRequest
+  IIssueIdentityTokenUseCase --> IssueIdentityTokenResponse
+}
+
+package "thalos-dal" as ThalosDal
+IIdentityTokenReadPort ..> ThalosDal
+@enduml

docs/identity/abstraction-ownership.md

@@ -0,0 +1,12 @@
+# Identity Abstraction Ownership
+
+## Ownership Rule
+
+- Identity-specific abstractions are owned by `thalos-service`.
+- `Thalos.Service.Identity.Abstractions` is the canonical abstraction package.
+- Blueprint and non-Thalos repositories must not own identity abstractions.
+
+## Guardrails
+
+- Identity token and authorization contracts remain in Thalos scope.
+- Cross-repo consumers reference abstractions, not Thalos internals.

docs/identity/token-policy-and-use-cases.md

@@ -0,0 +1,12 @@
+# Token Policy and Use Cases
+
+## Use-Case Boundaries
+
+- `IIssueIdentityTokenUseCase`: orchestrates token issuance behavior.
+- `IIdentityTokenReadPort`: DAL-facing identity token boundary.
+
+## Policy Baseline
+
+- Token issuance policy is orchestrated in service use cases.
+- Data retrieval and persistence details remain in thalos-dal.
+- Protocol adaptation remains outside use-case logic.

src/Thalos.Service.Application/Ports/IIdentityTokenReadPort.cs

@@ -0,0 +1,16 @@
+using Thalos.Service.Identity.Abstractions.Contracts;
+
+namespace Thalos.Service.Application.Ports;
+
+/// <summary>
+/// Defines DAL-facing boundary for issuing identity tokens.
+/// </summary>
+public interface IIdentityTokenReadPort
+{
+    /// <summary>
+    /// Issues an identity token from persistence-backed policy data.
+    /// </summary>
+    /// <param name="request">Token request contract.</param>
+    /// <returns>Token response contract.</returns>
+    Task<IssueIdentityTokenResponse> IssueTokenAsync(IssueIdentityTokenRequest request);
+}

src/Thalos.Service.Application/Thalos.Service.Application.csproj

@@ -0,0 +1,10 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+  </PropertyGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\Thalos.Service.Identity.Abstractions\Thalos.Service.Identity.Abstractions.csproj" />
+  </ItemGroup>
+</Project>

src/Thalos.Service.Application/UseCases/IIssueIdentityTokenUseCase.cs

@@ -0,0 +1,16 @@
+using Thalos.Service.Identity.Abstractions.Contracts;
+
+namespace Thalos.Service.Application.UseCases;
+
+/// <summary>
+/// Defines orchestration boundary for identity token issuance.
+/// </summary>
+public interface IIssueIdentityTokenUseCase
+{
+    /// <summary>
+    /// Handles identity token issuance use case.
+    /// </summary>
+    /// <param name="request">Token request contract.</param>
+    /// <returns>Token response contract.</returns>
+    Task<IssueIdentityTokenResponse> HandleAsync(IssueIdentityTokenRequest request);
+}

src/Thalos.Service.Application/UseCases/IssueIdentityTokenUseCase.cs

@@ -0,0 +1,17 @@
+using Thalos.Service.Application.Ports;
+using Thalos.Service.Identity.Abstractions.Contracts;
+
+namespace Thalos.Service.Application.UseCases;
+
+/// <summary>
+/// Default orchestration implementation for identity token issuance.
+/// </summary>
+public sealed class IssueIdentityTokenUseCase(IIdentityTokenReadPort readPort)
+    : IIssueIdentityTokenUseCase
+{
+    /// <inheritdoc />
+    public Task<IssueIdentityTokenResponse> HandleAsync(IssueIdentityTokenRequest request)
+    {
+        return readPort.IssueTokenAsync(request);
+    }
+}

src/Thalos.Service.Grpc/Program.cs

@@ -0,0 +1,6 @@
+var builder = WebApplication.CreateBuilder(args);
+
+// Stage 3 skeleton: single active internal protocol policy is gRPC-first.
+var app = builder.Build();
+
+app.Run();

src/Thalos.Service.Grpc/Thalos.Service.Grpc.csproj

@@ -0,0 +1,11 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+  </PropertyGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\Thalos.Service.Application\Thalos.Service.Application.csproj" />
+    <ProjectReference Include="..\Thalos.Service.Identity.Abstractions\Thalos.Service.Identity.Abstractions.csproj" />
+  </ItemGroup>
+</Project>

src/Thalos.Service.Identity.Abstractions/Contracts/IssueIdentityTokenRequest.cs

@@ -0,0 +1,8 @@
+namespace Thalos.Service.Identity.Abstractions.Contracts;
+
+/// <summary>
+/// Request contract for issuing an identity token.
+/// </summary>
+/// <param name="SubjectId">Identity subject identifier.</param>
+/// <param name="TenantId">Tenant scope identifier.</param>
+public sealed record IssueIdentityTokenRequest(string SubjectId, string TenantId);

src/Thalos.Service.Identity.Abstractions/Contracts/IssueIdentityTokenResponse.cs

@@ -0,0 +1,8 @@
+namespace Thalos.Service.Identity.Abstractions.Contracts;
+
+/// <summary>
+/// Response contract for identity token issuance.
+/// </summary>
+/// <param name="Token">Issued access token value.</param>
+/// <param name="ExpiresInSeconds">Token expiration in seconds.</param>
+public sealed record IssueIdentityTokenResponse(string Token, int ExpiresInSeconds);

src/Thalos.Service.Identity.Abstractions/Ownership/IdentityAbstractionBoundary.cs

@@ -0,0 +1,8 @@
+namespace Thalos.Service.Identity.Abstractions.Ownership;
+
+/// <summary>
+/// Marker boundary for abstractions owned by thalos-service.
+/// </summary>
+public interface IdentityAbstractionBoundary
+{
+}

src/Thalos.Service.Identity.Abstractions/Thalos.Service.Identity.Abstractions.csproj

@@ -0,0 +1,7 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+  </PropertyGroup>
+</Project>

tests/Thalos.Service.Application.UnitTests/IssueIdentityTokenUseCaseTests.cs

@@ -0,0 +1,28 @@
+using Thalos.Service.Application.Ports;
+using Thalos.Service.Application.UseCases;
+using Thalos.Service.Identity.Abstractions.Contracts;
+
+namespace Thalos.Service.Application.UnitTests;
+
+public class IssueIdentityTokenUseCaseTests
+{
+    [Fact]
+    public async Task HandleAsync_WhenCalled_DelegatesToReadPort()
+    {
+        var port = new FakeIdentityTokenReadPort();
+        var useCase = new IssueIdentityTokenUseCase(port);
+
+        var response = await useCase.HandleAsync(new IssueIdentityTokenRequest("user-1", "tenant-1"));
+
+        Assert.Equal("token-123", response.Token);
+        Assert.Equal(3600, response.ExpiresInSeconds);
+    }
+
+    private sealed class FakeIdentityTokenReadPort : IIdentityTokenReadPort
+    {
+        public Task<IssueIdentityTokenResponse> IssueTokenAsync(IssueIdentityTokenRequest request)
+        {
+            return Task.FromResult(new IssueIdentityTokenResponse("token-123", 3600));
+        }
+    }
+}

tests/Thalos.Service.Application.UnitTests/Thalos.Service.Application.UnitTests.csproj

@@ -0,0 +1,21 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <IsPackable>false</IsPackable>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="coverlet.collector" Version="6.0.4" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="xunit" Version="2.9.3" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+  </ItemGroup>
+  <ItemGroup>
+    <Using Include="Xunit" />
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\..\src\Thalos.Service.Application\Thalos.Service.Application.csproj" />
+    <ProjectReference Include="..\..\src\Thalos.Service.Identity.Abstractions\Thalos.Service.Identity.Abstractions.csproj" />
+  </ItemGroup>
+</Project>