Add typed IDM relationship contracts

docs/MODULE_ARCHITECTURE.md

@@ -207,13 +207,20 @@ Other stable runtime capabilities currently include:
 
 - `identity.directory` and `identity.search`
 - `organizations.directory`
-- `idm.directory`
+- `idm.directory`, `idm.function_assignments`, `idm.relationships`, and
+  `idm.assignment_lifecycle`
 - `calendar.outbox`, `calendar.scheduling`, `calendar.invitations`, and
   `calendar.externalProfiles`
 - `poll.scheduling`
 - `notifications.dispatch`
 - `workflow.definitionContributions` and `workflow.runtimeWorker`
 
+The provider-neutral `idm.relationships` contract carries tenant-scoped typed
+groups, effective-dated identity relationships, and explicit membership
+decisions. It deliberately does not expose IDM persistence models or imply an
+Access permission. Consumers can retain source revisions and inclusion or
+exclusion provenance while remaining optional-module safe.
+
 Modules contribute reusable process baselines through
 `ModuleManifest.workflow_definitions`. Each contribution pins its origin module
 and version, stable key, schema and content hash, native graph/BPMN content,