diff --git a/core/auth/__init__.py b/core/auth/__init__.py
new file mode 100644
index 0000000..8124e5a
--- /dev/null
+++ b/core/auth/__init__.py
@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*-
+"""iAOP 本地账号认证与会话管理（issue #150 / PRD 8.2）。
+
+子模块：
+- users：用户模型 + PBKDF2 密码哈希 + UserStore
+- session：HMAC 签名会话 token
+- postgres_users_schema：PG users 表 DDL（#30）
+- auth_api：认证 HTTP 端点 + 写操作守卫
+"""
+from .users import User, UserStore, hash_password, verify_password, VALID_ROLES
+from .session import issue_token, parse_token, SESSION_COOKIE
+from .auth_api import require_auth, can_write, AuthError, make_server
+
+__all__ = [
+    "User", "UserStore", "hash_password", "verify_password", "VALID_ROLES",
+    "issue_token", "parse_token", "SESSION_COOKIE",
+    "require_auth", "can_write", "AuthError", "make_server",
+]