docs: declare institutional architecture boundary

AGENTS.md

@@ -1,5 +1,11 @@
 # GovOPlaN Identity Codex Guide
 
+## Documentation Contract
+
+- Treat documentation as part of every behavior change. Update this module's manifest-driven `DocumentationTopic` contributions for affected user and administrator behavior.
+- Keep feature content here; `govoplan-docs` projects it without importing Identity internals.
+- Maintain a static user/admin baseline and run `/mnt/DATA/git/govoplan/tools/checks/check-manifest-shapes.py` after behavior or manifest changes.
+
 ## Scope
 
 This repository owns the canonical GovOPlaN identity directory: internal

src/govoplan_identity/backend/manifest.py

@@ -6,6 +6,7 @@ from govoplan_core.core.access import CAPABILITY_AUTH_PERMISSION_EVALUATOR, CAPA
 from govoplan_core.core.identity import CAPABILITY_IDENTITY_DIRECTORY, CAPABILITY_IDENTITY_SEARCH
 from govoplan_core.core.module_guards import persistent_table_uninstall_guard
 from govoplan_core.core.modules import DocumentationTopic, MigrationSpec, ModuleContext, ModuleManifest, PermissionDefinition, RoleTemplate
+from govoplan_core.core.provider_governance import declared_module_architecture
 from govoplan_core.db.base import Base
 from govoplan_identity.backend.db import models as identity_models  # noqa: F401 - populate metadata
 
@@ -92,6 +93,17 @@ manifest = ModuleManifest(
             order=24,
         ),
     ),
+    architecture=declared_module_architecture(
+        layer="institutional_foundation",
+        kind="foundation",
+        maturity="vertical_slice",
+        documentation_ref="docs/IDENTITY_MODEL.md",
+        test_ref="tests/test_directory.py",
+        known_limits=("Identity proofing and external-directory reconciliation are outside the current vertical slice.",),
+        owned_concepts=("identity", "identity-account link"),
+        non_owned_concepts=("account authentication", "function assignment", "contact point", "organization"),
+        security_docs=("docs/IDENTITY_MODEL.md",),
+    ),
 )