Returns the resolved manifest of the latest non-archived version by default. Pass ?version= with a policy set version public ID to read a specific version's manifest (e.g. for rollback: GET an old manifest, PUT it back — which mints a new version at the tip with the old content; history is never re-pointed).

There is deliberately no ?version=active keyword: a binding slot is (zone, target_type, target_id, mode) and a set may have zero or several active bindings, so "the active version" is not a function of the set alone. Resolve the version ID first — from the enriched policy set representation (active_version_id) or GET /policy-bindings — then pass it here.

The default (latest) read anchors the apply flow: the ETag response header is the JCS SHA-256 digest of the latest manifest and is the value to send as If-Match on PUT. ETag is emitted only on the default latest read — versioned reads return manifest_sha in the body but no ETag, so a stale token cannot be round-tripped as a precondition.

A policy set with no versions yet returns 200 with empty entries, null policy_set_version_id/version/schema_version/manifest_sha, and the digest of the empty manifest as ETag, so even the first apply can be conditional.