Define proto contracts for Tier 2 service interactions

[haasonsaas]

Context

The proto auto-bump workflow was rolled out today across all repos. Now we need to define the inter-service contracts that Tier 2 services will use to communicate. This unblocks parallel development — teams can code against proto interfaces before implementations exist.

Requirements

New proto packages needed

• evalops.identity.v1 — Role, Permission, ApiKey, CheckPermissionRequest/Response
• evalops.audit.v1 — QueryEventsRequest/Response, ComplianceReport, GenerateReportRequest
• evalops.meter.v1 — Budget, SetBudgetRequest, CheckBudgetRequest/Response, ExportUsageRequest
• evalops.governance.v1 — SafetyPolicy, PiiDetection, RetentionPolicy, EvaluatePolicy, CheckRetention
• evalops.memory.v1 — Memory, StoreRequest, RecallRequest/Response (with similarity scores)
• evalops.approvals.v1 — ApprovalRequest, ApprovalDecision, EscalationConfig, HabitRule
• evalops.notifications.v1 — NotificationTemplate, SendRequest, DeliveryStatus, Preferences
• evalops.pipeline.v1 — Deal, DealStage, Signal, PipelineMetrics

Cross-cutting proto additions

• Define evalops.common.v1.PageRequest/PageResponse for consistent cursor-based pagination
• Add permission annotation proto option for service method declarations
• Define standard NATS event envelope extending CloudEvents for inter-service events

Guidelines

• All RPCs should use google.protobuf.FieldMask for partial updates
• Include google.protobuf.Timestamp for all temporal fields
• Use oneof for polymorphic fields (e.g., budget scope: org vs team vs agent)
• Add proto comments documenting expected behavior — these are the API contract

Why proto-first

The auto-bump workflow means once these are merged, every service gets the generated Go code automatically. This lets services develop against interfaces immediately, even before the implementing service is ready.

[haasonsaas]

Current Progress: ~75%

Existing packages (6 of 8)

Package	Status	Notes
identity.v1	Partial	Has token RPCs but no RBAC (Role, Permission, CheckPermission missing)
audit.v1	Partial	Has event RPCs but no ComplianceReport/GenerateReport
meter.v1	Partial	Full usage RPCs but no Budget/SetBudget/CheckBudget/ExportUsage
governance.v1	Complete	All RPCs defined
memory.v1	Complete	Store, Recall, Consolidate with similarity scores
approvals.v1	Complete	Full approval flow + habits + escalation
notifications.v1	Complete	Send, preferences, delivery status

Missing

• pipeline.v1 — 0% (no Deal, DealStage, Signal, PipelineMetrics)
• common.v1 — 0% (no PageRequest/PageResponse, no permission annotations)
• Identity RBAC — CheckPermissionRequest/Response, Role, Permission messages

Priority order

1. Identity RBAC protos — unblocks evalops/identity#104, Add ConnectRPC interceptor for cross-service permission checks service-runtime#109
2. common.v1 PageRequest/PageResponse — standardizes pagination
3. Meter budget protos — unblocks evalops/meter#70
4. Audit compliance protos — unblocks evalops/audit#54
5. pipeline.v1 — lowest urgency