chore: depend on the published harness crates, not a git revision (#25)

.github/workflows/ci.yml

@@ -86,7 +86,12 @@ jobs:
   conformance:
     name: conformance (module kit)
     needs: detect-modules
-    uses: Cratefield/harness/.github/workflows/conformance.yml@main
+    # Pinned to a commit, not `@main`: a reusable workflow resolved at
+    # `@main` means an unrelated push to the harness can change what this
+    # repository's CI runs, with no diff here. The harness has no release
+    # tags yet (release-plz has never produced one), and a SHA is
+    # immutable where a tag can be moved. Bump deliberately.
+    uses: Cratefield/harness/.github/workflows/conformance.yml@b0858003713c5bc449ef617154ca375842ec1a4b
     with:
       module-glob: ${{ needs.detect-modules.outputs.modules }}
 

Cargo.toml

@@ -12,15 +12,18 @@ repository = "https://github.com/Factory-Zero/auth"
 [workspace.dependencies]
 askama = "0.14.0"
 # Harness crates, pinned to a harness main commit (45c34a4, 2026-09-07).
-# They are NOT on crates.io yet; when they publish, these git pins become
-# version pins (issue #25).
+# Published on crates.io as of 2026-09-07, so these are ordinary version
+# requirements rather than git revisions (issue #25). The crates were
+# renamed from `factory0-*` to `cratefield-*` before that first release
+# (harness ADR 0011); this service keeps its own `factory0-auth-*` names,
+# which are Factory Zero's and are never published.
 #
-# The repository moved to the Cratefield organisation. git follows the
-# rename, but the address is written out here so a reader is not misled
-# about where the code lives.
-factory0-core = { git = "https://github.com/Cratefield/harness", rev = "45c34a4cc1ad8e2ed0c0077093590a424623f0bd" }
-factory0-testing = { git = "https://github.com/Cratefield/harness", rev = "45c34a4cc1ad8e2ed0c0077093590a424623f0bd" }
-factory0-adapter-sqlite = { git = "https://github.com/Cratefield/harness", rev = "45c34a4cc1ad8e2ed0c0077093590a424623f0bd" }
+# The ranges follow the harness's own policy in its docs/COMPATIBILITY.md:
+# a caret on the current minor while pre-1.0, so `"0.3"` accepts 0.3.x and
+# a core minor bump can never be picked up silently.
+cratefield-core = "0.3"
+cratefield-testing = "0.1"
+cratefield-adapter-sqlite = "0.1"
 
 # Versions mirror the harness workspace so the git harness crates and our
 # direct dependencies unify into one dependency tree.
@@ -125,11 +128,11 @@ p256 = { version = "0.14.0", default-features = false, features = [
 # Meta's data deletion callback (#18) verifies an HMAC-SHA256 over a
 # `signed_request`. hmac 0.13 pairs with sha2 0.11; both are pure Rust.
 hmac = { version = "0.13.0", default-features = false }
-# sha2 matches the harness pin (factory0-core depends on 0.11).
+# sha2 matches the harness pin (cratefield-core depends on 0.11).
 sha2 = { version = "0.11.0", default-features = false }
 
 # Enabled by wasm leaf crates (same as the harness venture example):
-# getrandom (via ulid/rand through factory0-core) needs the opt-in
+# getrandom (via ulid/rand through cratefield-core) needs the opt-in
 # wasm_js backend on wasm32-unknown-unknown.
 getrandom = { version = "0.4.3", default-features = false, features = [
     "wasm_js",

README.md

@@ -30,8 +30,11 @@ on its own.
 > six on one account.
 
 Built as a consumer of the
-[Factory Zero harness](https://github.com/Factory-Zero/harness): one Worker,
-one D1 database, modules that see only ports. Read
+[Cratefield harness](https://github.com/Cratefield/harness): one Worker,
+one D1 database, modules that see only ports. It depends on the published
+crates (`cratefield-core` and friends on crates.io), not on a git revision.
+Its own crates stay `factory0-auth-*` and are never published: they are
+Factory Zero's service, not part of the harness (harness ADR 0011). Read
 [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) for how it fits, what was
 validated before the issues were written, and what is deferred.
 

crates/auth-client/Cargo.toml

@@ -12,7 +12,7 @@ repository.workspace = true
 workspace = true
 
 [dependencies]
-factory0-core = { workspace = true }
+cratefield-core = { workspace = true }
 axum = { workspace = true }
 http = { workspace = true }
 serde = { workspace = true }
@@ -26,7 +26,7 @@ bytes = { workspace = true }
 
 [dev-dependencies]
 async-trait = { workspace = true }
-factory0-testing = { workspace = true }
+cratefield-testing = { workspace = true }
 pollster = { workspace = true }
 tower = { workspace = true }
 time = { workspace = true }

crates/auth-client/src/extractor.rs

@@ -9,7 +9,7 @@ use std::sync::Arc;
 
 use axum::extract::FromRequestParts;
 use axum::http::request::Parts;
-use factory0_core::Problem;
+use cratefield_core::Problem;
 
 use crate::jwks::AuthClient;
 use crate::verify::{Claims, token_fingerprint};
@@ -76,7 +76,7 @@ fn bearer(parts: &Parts) -> Option<&str> {
 /// expired: all the same. A caller learns that it is not authenticated
 /// and nothing else, because each distinguishable answer is a hint
 /// about how to get closer.
-pub const UNAUTHENTICATED: factory0_core::ProblemDef = factory0_core::ProblemDef {
+pub const UNAUTHENTICATED: cratefield_core::ProblemDef = cratefield_core::ProblemDef {
     slug: "unauthenticated",
     status: axum::http::StatusCode::UNAUTHORIZED,
     title: "Not authenticated",

crates/auth-client/src/jwks.rs

@@ -10,7 +10,7 @@ use std::sync::{Arc, RwLock};
 
 use base64ct::{Base64UrlUnpadded, Encoding};
 use bytes::Bytes;
-use factory0_core::{Clock, HttpClient};
+use cratefield_core::{Clock, HttpClient};
 use p256::ecdsa::VerifyingKey;
 use serde::Deserialize;
 

crates/auth-client/tests/verify.rs

@@ -10,8 +10,8 @@ use std::sync::{Arc, RwLock};
 use async_trait::async_trait;
 use base64ct::{Base64UrlUnpadded, Encoding};
 use bytes::Bytes;
+use cratefield_core::{Clock, HttpClient, HttpError};
 use factory0_auth_client::{AuthClient, VerifyError};
-use factory0_core::{Clock, HttpClient, HttpError};
 use p256::ecdsa::signature::Signer;
 use p256::ecdsa::{self, Signature};
 use serde_json::{Value, json};

crates/auth-core/Cargo.toml

@@ -13,7 +13,7 @@ workspace = true
 
 [dependencies]
 askama = { workspace = true }
-factory0-core = { workspace = true }
+cratefield-core = { workspace = true }
 axum = { workspace = true }
 http = { workspace = true }
 sea-query = { workspace = true }
@@ -29,7 +29,7 @@ sha2 = { workspace = true }
 thiserror = { workspace = true }
 
 [dev-dependencies]
-factory0-testing = { workspace = true }
-factory0-adapter-sqlite = { workspace = true }
+cratefield-testing = { workspace = true }
+cratefield-adapter-sqlite = { workspace = true }
 pollster = { workspace = true }
 tower = { workspace = true }

crates/auth-core/src/authorize.rs

@@ -33,7 +33,7 @@ use axum::http::{HeaderMap, StatusCode, header};
 use axum::response::{IntoResponse, Response};
 use axum::routing::get;
 use base64ct::{Base64UrlUnpadded, Encoding};
-use factory0_core::{Config, Database, ModuleConfig, Problem, Scope, subject_hash};
+use cratefield_core::{Config, Database, ModuleConfig, Problem, Scope, subject_hash};
 use serde::Deserialize;
 use serde_json::json;
 use sha2::{Digest, Sha256};