feat: Add domain architecture and extract core services from Prism Console

## Domain Architecture
- Complete domain-to-service mapping for 16 verified domains
- Subdomain architecture for blackroad.systems and blackroad.io
- GitHub organization mapping (BlackRoad-OS repos)
- Railway service-to-domain configuration
- DNS configuration templates for Cloudflare

## Extracted Services

### AIops Service (services/aiops/)
- Canary analysis for deployment validation
- Config drift detection
- Event correlation engine
- Auto-remediation with runbook mapping
- SLO budget management

### Analytics Service (services/analytics/)
- Rule-based anomaly detection with safe expression evaluation
- Cohort analysis with multi-metric aggregation
- Decision engine with credit budget constraints
- Narrative report generation

### Codex Governance (services/codex/)
- 82+ governance principles (entries)
- Codex Pantheon with 48+ agent archetypes
- Manifesto defining ethical framework

## Integration Points
- AIops → infra.blackroad.systems (blackroad-os-infra)
- Analytics → core.blackroad.systems (blackroad-os-core)
- Codex → operator.blackroad.systems (blackroad-os-operator)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

services/codex/entries/008-identity-guard.md

@@ -0,0 +1,28 @@
+# Codex 8 — The Identity Guard
+
+**Fingerprint:** `23064887b1469b19fa562e8afdee5e9046bedf99aa9cd7142c35e38f91e6fef2`
+
+## Principle
+Identity is the front gate. If it falls, the house is lost. Guard it with layers, respect, and minimal exposure.
+
+## Non-Negotiables
+1. **Multi-Factor Default** — No account without MFA. Hardware keys (FIDO2/U2F) preferred; app-based codes or biometrics as fallback.
+2. **Passwordless Path** — Favor device+biometric login over traditional passwords; passwords, if used, must be long, unique, and hashed with Argon2.
+3. **Least Privilege** — Accounts only see what they must. Admin powers are time-limited and require dual approval.
+4. **Continuous Checks** — Behavior monitored; anomalous sessions re-verified instantly.
+5. **No Ghosts** — Accounts de-provisioned automatically when roles end. Stale identities = purged.
+6. **Audit Trail** — Every login attempt logged with device, IP, and outcome. Owners can see their own history.
+
+## Implementation Hooks (v0)
+- Identity provider integration (OIDC with MFA enforced).
+- Table: `session_logs {user_id, ip, device, timestamp, result}`.
+- Endpoint: `/my-sessions` for owner view.
+- Cron job: detect inactive accounts >90 days → flag/purge.
+- Just-in-time role elevation with dual approval workflow.
+
+## Policy Stub (`IDENTITY.md`)
+- Lucidia never reuses or shares credentials.
+- Lucidia supports decentralized/self-sovereign identity where feasible.
+- Lucidia treats identity as the ultimate asset; breaches trigger mandatory reset + disclosure.
+
+**Tagline:** Guard the gate, guard the whole.