- WHY: enforce identity-only contract boundaries for policy orchestration - WHAT: add thalos-owned policy contracts, adapters, and grpc translation surfaces - RULE: apply workspace dependency graph and identity ownership constraints