feat: implement institutional mandate resolver

docs/MANDATES_DOMAIN.md

@@ -0,0 +1,34 @@
+# Mandates Domain
+
+## Ownership
+
+Mandates owns stable mandate identities and immutable revisions. A revision
+states effective time, task and authority types, constrained organization
+units/functions, jurisdiction, subject scope, authority ceiling, legal bases,
+evidence, lifecycle state, and explicit conflicts.
+
+It does not own organization structures, function incumbency, accounts,
+application permissions, policy rules, cases, or formal decisions.
+
+## Resolution
+
+Resolution is tenant-bound and deterministic. It evaluates the requested time,
+task, authority, unit, function, jurisdiction, and subject against the latest
+effective revision of each mandate. Conflicting effective mandates fail closed
+and return their conflict/evidence references.
+
+Consumers must freeze the exact mandate reference and evidence used for a
+consequential action. A later mandate correction does not rewrite historical
+decisions or effects.
+
+## Revision And Recovery
+
+Creation and revision use optimistic concurrency. Every new revision has a new
+revision identifier, `recorded_at`, and change reason. Lifecycle transitions
+follow the shared Core contract. Rows are append-only apart from marking the
+previous row superseded; destructive retirement requires the platform database
+snapshot and module-retirement preflight.
+
+Database restore is the recovery unit. Replaying a request with the same
+tenant, mandate identity, and revision is idempotent; a different payload under
+an existing revision is rejected.