Dogfood Public Repository Standard v1 in Flow and Bootstrap

[jmcte]

Problem statement

Bootstrap and Flow do not yet conform to the standard they are meant to operate.

Desired outcome

Bootstrap plans and applies both repositories as the first dogfood migration, with pinned versions and all strict gates passing.

Scope

• Ownership inventory and migration fixtures.
• Plan-first application to Flow, then Bootstrap.
• Record exceptions and migration outcomes.

Non-goals

• Fleet-wide rollout.

Acceptance criteria

• No reusable production workflow or policy pin targets main.
• Generated artifacts have ownership metadata and no direct edits.
• Both READMEs, diagrams, security, DCO, provenance, and conformance checks pass.
• Live GitHub settings match the resolved contract.

Test expectations

Run migration golden tests, local full checks, dry-run diffs, applied conformance, and live CI/security verification.

Security implications

Use short-lived credentials; keep private provenance outside both public repositories.

Documentation implications

Publish migration outcomes and remaining fleet risks.

Dependencies

All prior v1 capability issues and immutable Flow/Bootstrap releases.

Human decision points

Any hard stop, class deviation, license/ownership change, or permanent exception.