Introduce identity model and reconcile upstream imports

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a070b5-4994-7271-bd8b-7c3dbcedec4b

tests/test_identity_boundary.py

@@ -0,0 +1,26 @@
+from info_tech_canon.generation import concept_ownership
+from info_tech_canon.service import load_context
+
+
+def test_identity_does_not_own_its_upstream_imports():
+    context = load_context()
+    rows = concept_ownership(context)["concepts"]
+    owned = {r["concept"] for r in rows if r["owner"] == "model/identity" and r["source"] == "frontmatter.owned_concepts"}
+    assert len(owned) == 23
+    assert owned.isdisjoint({"Actor", "Person", "Agent", "Organization", "Group", "Role", "Membership", "Subject", "Principal", "Relationship Tuple", "Evidence", "Evidence Source", "Authority", "Responsibility", "Ownership"})
+    for concept in owned:
+        assert {r["owner"] for r in rows if r["concept"] == concept} == {"model/identity"}
+
+
+def test_incumbent_definition_anchors_are_imports():
+    root = load_context().infospace_root
+    for path, concept, anchor in [
+        ("models/organization/InfoTechCanonOrganizationModel.md", "Delegation", "## 10.18 Delegation"),
+        ("models/information-space/InfoTechCanonInformationSpaceModel.md", "Identifier", "## 11.37 Identifier"),
+    ]:
+        text = (root / path).read_text()
+        assert anchor in text
+        assert f"**{concept}** is" not in text
+        assert "../identity/InfoTechCanonIdentityModel.md" in text
+    access = (root / "models/access-control/InfoTechCanonAccessControlModel.md").read_text()
+    assert "ITC-IDENT" in access.split("## 3.5 Boundary with Identity and Authentication", 1)[1].split("## ", 1)[0]