Initialize identity module

AGENTS.md

@@ -0,0 +1,27 @@
+# GovOPlaN Identity Codex Guide
+
+## Scope
+
+This repository owns the canonical GovOPlaN identity directory: internal
+identity records and links between identities and platform accounts.
+
+The module does not own authentication sessions, passwords, API keys, roles,
+permissions, or external IDM connector behavior.
+
+## Boundaries
+
+- Depend on kernel contracts from `govoplan-core`.
+- Do not import access, IDM, organizations, postbox, workflow, or portal
+  internals.
+- Expose integration through manifests, capabilities, API routes, events, and
+  typed DTOs.
+- Keep external-provider synchronization in `govoplan-idm`; this module stores
+  accepted normalized identity facts.
+
+## Local Workflow
+
+Use Gitea issues as the canonical backlog and state log. The shared workflow is
+installed under `.gitea/`, with labels in `docs/gitea-labels.json`.
+
+Focused verification is still driven from `/mnt/DATA/git/govoplan-core` for
+cross-repository behavior.