Resolve pinned Flow policy into a compatible repository contract

[jmcte]

Problem statement

Bootstrap's existing manifest v2 is incompatible with the target v2 contract and policy defaults are compiled locally or reference main.

Desired outcome

A backward-compatible resolver combines repository input, pinned Flow policy, and publisher defaults into a deterministic read-only contract.

Scope

• Characterize current v1/v2 fixtures.
• Add immutable policy loading and integrity checks.
• Add explicit migration/version negotiation and resolved types.

Non-goals

• Changing rendered files.

Acceptance criteria

• Existing fixtures retain behavior unless migrated explicitly.
• Unpinned or incompatible strict policy fails with remediation.
• Unknown settings are preserved or reported, never silently dropped.
• Resolution works deterministically offline from a verified bundle.

Test expectations

Begin with failing legacy, target, precedence, pin, digest, and round-trip fixtures.

Security implications

Policy supply-chain integrity is verified; no runtime credentials enter the resolved public contract.

Documentation implications

Document schema collision and migration procedure.

Dependencies

Flow v1 policy bundle and Bootstrap ADR-0001.

Human decision points

Class deviations and destructive migration choices.

[jmcte]

Acceptance verification

The resolved-policy contract is complete on main:

• PR feat: resolve verified Flow policy bundles #67 added deterministic offline resolution, immutable exact-tag/SHA requirements, digest verification, compatibility checks, and remediation for strict failures.
• PR feat: load Flow policy bundles from manifests #68 connected manifest configuration to verified local bundle loading without network access.
• PR feat: report unknown manifest policy settings #69 preserved and reported unknown settings instead of silently discarding them.
• The explicit legacy migration path landed with PR feat: require explicit repository class migrations #70, so existing fixtures do not change class semantics without an operator choice.

Current verification on commit 415b35947f5aca2c2407eef07f11102a8a94bc2e:

• npm test -- --run tests/policy.test.ts tests/manifest.test.ts tests/language-profiles.test.ts — 24 tests passed.
• npm run typecheck — passed as part of the full baseline run.

All #54 acceptance criteria are satisfied. The unrelated conformance fixture regression discovered during the full baseline is isolated in PR #89 under #58.