WASI Preview 1 imports on Preview 2 component runtime permission boundary

A configuration is needed for loading WebAssembly modules compiled against WASI Preview 1 into runtimes that target the WASI Preview 2 component model. Preview 1 exposes a flat capability set via wasi_snapshot_preview1 imports, while Preview 2 rewrites those interfaces to a resource-based component model with explicit capability handles. The Component Model canonical ABI does not define an explicit host import version negotiation constraint for this case.

Runtime behavior is currently inconsistent. Some implementations provide a compatibility shim for mixed preview loads, others reject the module outright. The unresolved decision is whether a host should silently upgrade Preview 1 imports to Preview 2 resources or require an explicit adapter, and how that choice affects permission boundaries for file system and network access. Implementation support varies across runtimes and toolchains, and permission boundaries are not identical between previews.

What version negotiation, if any, should a host enforce when a Preview 1 module is presented to a Preview 2 component runtime? Should silent import upgrade be allowed, and how would capability handles be mapped to preserve the intended permission boundary? Is an explicit adapter required to maintain isolation between Preview 1 flat capabilities and Preview 2 resource capabilities?