[Frontier] [API16-01] Run a real tool-backed conversation through a reusable Jit client contract #395

Parent

S16 #392 — #392

Model tier

Frontier: integration changes cross authority, data custody, replay/recovery and client/service contracts.

Context to read

AGENTS.md, CONTEXT.md, docs/agents/workflow.md, docs/specs/S16-rakazo-experience.md, ADRs 0064/0074, the relevant implemented S15 contracts, #392/#393/#394, and pinned Rakazo abf3c08145a05cba92a912d6c24fdfb5f569d0e0.

Deliverable

A headless TypeScript client talks to the actual composed protected Jit service, submits a conversation, reads safe progress/result/evidence, stops work and reconnects without duplication. This is the first shared contract for subsequent Web/desktop/mobile UI; do not build a second engine or approval service.

Verified starting paths

src/s15/conversation/{http,types,application,owner-view,validation}.ts; src/s15/composition.ts; tests/s15-conversation*.test.ts; tests/fixtures/s15-composition.ts. Proposed client package path and transport are selected in the implementation, not assumed to be an existing API.

Implementation steps

1. Inventory existing authenticated conversation, current owner projections, event cursors, stop and exact decision routes; select the smallest shared client contract that avoids duplicating protected service logic.
2. Implement reusable Bun/TypeScript request/result validation and client operations over actual service endpoints; add missing safe bootstrap projections only when needed.
3. Exercise a scripted-model real tool invocation through composed Jit, with progress, committed evidence/result and current authorization.
4. Prove retries/reconnect/stop and held approvals cannot duplicate a task/effect, broaden scope or publish withdrawn/stopped output.
5. Expose capability/error states that clients can render honestly and document the exact versioned public client seam.

Acceptance criteria

• A scripted-model client request performs an actual registered tool call through the composed Jit service and returns committed evidence.
• Duplicate request identity creates one intent; conflicting payload is refused; cursor reconnect never submits new work.
• Stop, permission loss and private-lineage withdrawal fence later content; unknown tool/effect outcomes stay reconcile-only.
• Unauthenticated/cross-origin/CSRF-invalid requests cannot invoke commands; exact approvals retain revision/hash binding.
• Client code imports no Schway internals, protected credentials or server database implementation.

Tests and evidence

1. Actual composed HTTP fixture: request → tool invocation → result/evidence; no provider network.
2. Retry same/changed request; disconnect/reconnect/cursor reset; stop before/after tool dispatch; duplicate approval.
3. Auth/Host/Origin/CSRF, expiry/revocation and withdrawn memory/source cases; observe zero unauthorized tool calls.

Requirements

FR-04/06/10/14/15/17/19/24/31/32/35/37/38; NFR-02/05/06/07/10/11/12; S16-AC02/14/21.

Blocked by

#393 baseline; #394 for rendered UI acceptance only. Headless deterministic contract work can proceed against the exact baseline without waiting on live credentials.

Contracts used/delivered

Use implemented S15 owning-service contracts and supported Schway public exports. Freeze the exact new versioned seam in the implementation issue/PR before treating it as supported. Existing schemas/defaults/private data are not silently reinterpreted.

Out of scope

Live owner credentials, production/host activation, hosted SaaS/billing, unrelated native clients, replacing Schway, migration of S14/legacy data.

Do not

Do not treat old stack choices as fixed, copy a second upstream authority/runtime, weaken protected gates, log credentials, add model attribution, use implement-parallel, or merge the implementation PR yourself. Imported code must retain license, provenance, applicable notices and modified-file notices.

Definition of done

bun install --frozen-lockfile, bun run typecheck, relevant deterministic/composed tests and git diff --check pass. Run browser tests for rendered behavior. PR body Closes the exact implementation issue; record SHA/contracts/evidence and honest live pending items. Parent #392 remains open.

Complete backlog publication — 2026-11-05

The shared client is implemented on draft #399. Targeted steering and independent-work acceptance remain owned by #406; liveSteering=false stays truthful until that contract is implemented. #395 may close only its original headless seam, not full AC02/14/21.