refactor(phase-3): the bundle contract becomes a profile object

Phase 3 step 1. What Phases 1 and 2 hard-coded about a valid bundle now
lives on one frozen `BundleProfile`, and `DEFAULT` states exactly the
ingest-spec v1 + Phase 2 contract. Nothing observable changes: the 425
existing tests are unmodified and green, and `git diff --stat examples/`
is empty, which is assumption C1's whole proof. Both oracles are real
rather than nominal — the golden suite compares `read_bytes()`, and Door
B pins its frontmatter block as an exact string.

Moved onto the profile, each one previously a constant with a reader:
the index name and its managed-link shape (template plus pattern, kept
honest by a round-trip test), the three filename namespaces
(`ingest-`/`inbox-`/`import-` and `.md`), the reserved `verdict` layer
(duplicated in `manifest` and `inbox` before this), the frontmatter key
order, and the `source_query` whitespace collapse.

Two details are worth naming. The DEFAULT key order spans both doors:
Door A's seven keys and Door B's six are subsequences of one nine-key
order, so a single canonical order reproduces both doors byte-for-byte.
And emission follows commons decision D1 — ordered prefix, then any
remaining keys sorted — which is the mechanism the proving consumer's
hash registry needs; under DEFAULT the tail is always empty.

`TypePolicy` refuses the reserved layer at CONSTRUCTION (assumption C3),
so a profile admitting `verdict` cannot be built, let alone passed to a
door. It reports refusals rather than raising them, because Door A
refuses with `ManifestError` and Door B with `MaterializationError` for
the same type — the wording and the stable code come from the policy,
the exception class stays each door's own.

Deliberately NOT moved, each for a stated reason: the required and
allowlisted key sets the proving consumer needs (no code reads them
until the STRICT_V1 validator exists, and a field nothing reads is a
claim nothing tests), the id grammar (a pattern the slugger derives a
separator class from, not a flat name), `NAME_MAX_BYTES` (a filesystem
fact, not a contract choice), and every disposition/origin/channel
vocabulary (guard territory, always). The profile is also not exported
from the package root yet — the optional `profile` argument on the
flows is step 3's plumbing change.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2aKJxLejT9S8jYwoZ9fut

src/llm_ingestion_okf/importer.py

@@ -34,20 +34,18 @@ from typing import Protocol
 from .errors import IngestError, MaterializationError, SourceError
 from .extract import decode_text
 from .materialize import (
-    INDEX_NAME,
     check_filename_length,
     link_in_index,
     reduce_to_id_grammar,
     validate_ingested_at,
     write_bytes,
 )
+from .profiles import DEFAULT
 
 # An OKF concept is a `.md` document by definition — the guard's path gate
 # rejects anything else outright — so nothing else in the source tree is a
-# concept, and nothing else is this door's to merge.
-_CONCEPT_SUFFIX = ".md"
-
-_FILENAME_PREFIX = "import-"
+# concept, and nothing else is this door's to merge. The suffix and the
+# `import-` namespace are the profile's (`DEFAULT.paths`).
 
 # The guard's non-blocking floor and its review queue, by VALUE (`Disposition`
 # is a `str, Enum`, so the value is the stable thing to compare against across
@@ -176,7 +174,7 @@ def import_slug(concept_path: str) -> str:
     collapse them onto one filename. A path that reduces to nothing fails fast
     rather than being given an invented name.
     """
-    concept_id = concept_path[: -len(_CONCEPT_SUFFIX)]
+    concept_id = concept_path[: -len(DEFAULT.paths.concept_suffix)]
     slug = reduce_to_id_grammar(concept_id)
     if not slug:
         raise MaterializationError(
@@ -195,7 +193,8 @@ def import_filename(slug: str) -> str:
     grammar admits.
     """
     return check_filename_length(
-        f"{_FILENAME_PREFIX}{slug}{_CONCEPT_SUFFIX}", code="import_path_too_long"
+        f"{DEFAULT.paths.import_prefix}{slug}{DEFAULT.paths.concept_suffix}",
+        code="import_path_too_long",
     )
 
 
@@ -206,7 +205,7 @@ def _index_label(concept_path: str) -> str:
     does not. Fail-fast, never repair — the same rule Door A applies to a
     manifest title and Door B to a dropped filename.
     """
-    label = concept_path[: -len(_CONCEPT_SUFFIX)]
+    label = concept_path[: -len(DEFAULT.paths.concept_suffix)]
     if any(char in label for char in "\n\r[]"):
         raise MaterializationError(
             f"concept path {concept_path!r} contains '[' or ']', which would break "
@@ -229,7 +228,7 @@ def _read_bundle(source: Path) -> tuple[dict[str, str], list[FailedConcept]]:
         # glob: glob case-sensitivity follows the FILESYSTEM, so `NOTE.MD`
         # would be a concept on APFS and not one on ext4 — the same bundle
         # importing differently per platform. The guard folds case here too.
-        if not path.is_file() or path.suffix.lower() != _CONCEPT_SUFFIX:
+        if not path.is_file() or path.suffix.lower() != DEFAULT.paths.concept_suffix:
             continue
         concept_path = path.relative_to(source).as_posix()
         try:
@@ -409,9 +408,9 @@ def import_bundle(
 
         # §6 index — the last disk mutation, and only when something merged.
         if merged:
-            index_path = bundle / INDEX_NAME
+            index_path = bundle / DEFAULT.index.name
             if not index_path.is_file():
-                write_bytes(bundle, INDEX_NAME, "")
+                write_bytes(bundle, DEFAULT.index.name, "")
             for entry in merged:
                 link_in_index(bundle, entry.path.name, _index_label(entry.concept_path))