Implement identity canon alignment

docs/contracts.md

@@ -10,9 +10,32 @@ HTTP or RPC adapters should preserve these operation names:
 - `resolve_tenant_context`, `set_tenant_account_status`, `add_membership`,
   `tenant_diagnostics`
 - `register_application`, `publish_catalog`
-- `set_profile_value`, `effective_profile`, `projection`
+- `set_profile_value`, `effective_profile`, `projection`, `identity_context`
 - `audit_records`, `outbox_events`
 
+## Identity Context Contract
+
+`identity_context` is the first canon-facing read model for NetKingdom
+identity-domain consumers. It resolves a verified actor into the local user,
+account, external identity links, tenant scope, memberships, optional
+application scope, optional effective profile, canon entity references,
+relationship references, grant-like membership facts, and evidence references.
+
+The method keeps these concepts distinct:
+
+- user-engine `User` record;
+- operational `Account`;
+- external `Identity Record` and scoped issuer/subject identifier;
+- `Actor` from verified claims;
+- `Authenticated Subject` projected from issuer and subject;
+- `Authorization Principal` projected for policy evaluation;
+- `Tenant`, `Team`, `Scope`, `Membership Relationship`, and `Role` references.
+
+Evidence references are currently derived from local audit records. External
+policy, control, access-review, exception, and lifecycle task references belong
+to adapter contracts and remain non-owned unless a later workplan assigns
+source-of-truth responsibility to user-engine.
+
 ## Error Taxonomy
 
 - `ValidationError`: caller supplied an invalid shape, state transition, or
@@ -42,6 +65,9 @@ Every mutating service operation appends an audit record and outbox event with
 the same correlation id and resolved tenant. Authorization denials are audited
 without emitting outbox events.
 
+Local audit records may be exported as identity-canon `Evidence Source`
+references. Durable platform audit custody remains outside user-engine.
+
 ## Migration Contract
 
 The isolated store exposes `SCHEMA_VERSION = 0001_initial` and a `migrate`