docs: declare institutional architecture boundary

AGENTS.md

@@ -0,0 +1,16 @@
+# GovOPlaN IDM Codex Guide
+
+## Scope
+
+This repository owns identity-to-organization function assignments, governed request/grant workflows, effective dates, and external directory reconciliation.
+
+## Documentation Contract
+
+- Treat documentation as part of every behavior change. Update this module's manifest-driven `DocumentationTopic` contributions for affected user and administrator behavior.
+- Keep feature content here; `govoplan-docs` projects it without importing IDM internals.
+- Maintain a static user/admin baseline and run `/mnt/DATA/git/govoplan/tools/checks/check-manifest-shapes.py` after behavior or manifest changes.
+
+## Boundaries
+
+- Identity owns people; Organizations owns structures and functions; Access maps resulting facts to authority.
+- Preserve effective dates, provenance, approval evidence, and reconciliation state.

src/govoplan_idm/backend/manifest.py

@@ -39,6 +39,7 @@ from govoplan_core.core.modules import (
     PermissionDefinition,
     RoleTemplate,
 )
+from govoplan_core.core.provider_governance import declared_module_architecture
 from govoplan_core.db.base import Base
 from govoplan_idm.backend.db import models as idm_models  # noqa: F401 - populate metadata
 from govoplan_idm.backend.workflow_definitions import (
@@ -314,6 +315,19 @@ manifest = ModuleManifest(
             order=28,
         ),
     ),
+    architecture=declared_module_architecture(
+        layer="institutional_foundation",
+        kind="foundation",
+        maturity="vertical_slice",
+        documentation_ref="docs/FUNCTION_ASSIGNMENT_WORKFLOWS.md",
+        test_ref="tests/test_assignment_workflow.py",
+        known_limits=("External directory provisioning and all authority-specific grant workflows are not reference-ready.",),
+        owned_concepts=("function assignment", "assignment delegation", "acting-for assignment", "assignment request"),
+        non_owned_concepts=("identity", "organization function", "application role", "workflow runtime"),
+        recovery_docs=("docs/FUNCTION_ASSIGNMENT_WORKFLOWS.md",),
+        security_docs=("docs/FUNCTION_ASSIGNMENT_WORKFLOWS.md",),
+        operations_docs=("README.md",),
+    ),
 )