Validate portable workspace identifiers

docs/internal/manifest.md

@@ -17,6 +17,11 @@ Explain the session-progress and invocation-audit models implemented by
 - durable `artifacts` records
 - per-stage `stages` map
 
+Session, campaign, and run identities in local and downloaded manifests must be
+portable opaque segments. Unsafe legacy identities are rejected with migration
+guidance rather than being normalized into a different workspace or remote
+namespace.
+
 The model admits these stage states:
 
 - `pending`