[Frontier] [FILE16-01] Attach a file in conversation and deliver a real file-derived result #396

Parent

S16 #392 — #392

Model tier

Frontier: integration changes cross authority, data custody, replay/recovery and client/service contracts.

Context to read

AGENTS.md, CONTEXT.md, docs/agents/workflow.md, docs/specs/S16-rakazo-experience.md, ADRs 0064/0074, the relevant implemented S15 contracts, #392/#393/#394, and pinned Rakazo abf3c08145a05cba92a912d6c24fdfb5f569d0e0.

Deliverable

The first end-to-end file workflow on Jit: a supported text/document/image enters a protected attachment boundary, becomes bounded untrusted context or an authorized working-computer input, and produces an evidenced downloadable artifact. Integrate the required UI handoff; do not route S15 through the legacy project/topic authority.

Verified starting paths

src/attachments/{sanitizer,storage,multipart,types,limits,model-images,box-copies}.ts are reuse candidates; inspect their legacy DB/topic coupling before use. src/s15/conversation/{types,validation,application,schway}.ts; src/s15/disclosure/; src/s15/vm/; src/s15/web/; tests/s15-composition*.test.ts. New file/artifact modules need explicit owning contracts.

Implementation steps

1. Freeze an S15/S16-owned attachment/artifact ingress contract: immutable IDs/hashes, permitted types/byte/count bounds, custody/lifecycle and authenticated receipt binding.
2. Adapt reviewed existing sanitizer/storage logic or pinned upstream helpers where useful, retaining exact licenses/notices and avoiding legacy store/permission reuse.
3. Add bounded authenticated upload/cancel/status/download routes with streamed size checks, atomic custody and idempotent references; do not expose arbitrary host paths.
4. Bind selected attachments as untrusted work inputs with protected lineage/recipient checks. Use supported Schway image/text or VM file seams; interpreter authority never comes from file content.
5. Collect one real generated output into an immutable artifact and implement the authored client upload/progress/error/download workflow.
6. Test the whole flow plus cancellation, restart, malicious files, quota and withdrawal. Document unsupported types honestly.

Acceptance criteria

• An owner attaches a valid supported file, requests work and receives a file-derived answer plus a real downloadable artifact with matching hash/lineage.
• Spoofed types, malformed/oversized files, excessive counts and sanitizer failures are refused before model/tool access; partial uploads are cleaned up without losing dedupe facts.
• Prompt injection in an attachment cannot create another purpose, approve an action or grant a new data recipient.
• Retries/reconnect and duplicate references do not create duplicate work/artifacts; cancelled/withdrawn inputs cannot be used or downloaded later.
• Thai/English authored states and keyboard/mobile attachment interactions use actual server limits/capabilities.
• S14/legacy files/databases and existing private content are untouched.

Tests and evidence

1. Actual composed upload → sanitizer → scripted-model/VM input → artifact → authorized byte download and SHA-256 verification.
2. Invalid type/magic, malformed PDF/image, size/count boundary and cancellation mid-stream; no protected credential bytes.
3. Duplicate submit/restart, cross-conversation references, forget/revoke during processing/download and new-recipient hold.

Requirements

FR-04/07/15/16/17/18/22/31/35/38/42; NFR-02/05/06/07/08/10/11/12/14; S16-AC03/04.

Blocked by

#393 baseline; API16-01 shared client/ingress seam; #394 authored file workflow. Audit current sanitizer and supported Schway image/artifact/input seams before dispatch. No live provider prerequisite for deterministic implementation.

Contracts used/delivered

Use implemented S15 owning-service contracts and supported Schway public exports. Freeze the exact new versioned seam in the implementation issue/PR before treating it as supported. Existing schemas/defaults/private data are not silently reinterpreted.

Out of scope

Live owner credentials, production/host activation, hosted SaaS/billing, unrelated native clients, replacing Schway, migration of S14/legacy data.

Do not

Do not treat old stack choices as fixed, copy a second upstream authority/runtime, weaken protected gates, log credentials, add model attribution, use implement-parallel, or merge the implementation PR yourself. Imported code must retain license, provenance, applicable notices and modified-file notices.

Definition of done

bun install --frozen-lockfile, bun run typecheck, relevant deterministic/composed tests and git diff --check pass. Run browser tests for rendered behavior. PR body Closes the exact implementation issue; record SHA/contracts/evidence and honest live pending items. Parent #392 remains open.

Delivery split (2026-11-05)

The complete acceptance above is retained. Native sub-issues separate the first UTF-8 end-to-end client/work/artifact slice (#400) from the required isolated PDF/image processing (#401). #402 tracks precise file ancestry through sourced memory and later conversations before enabling file memory/history. Text-only acceptance does not close this issue or S16-AC03/04. #400 is stacked over draft PRs #398/#399; no live host, default runtime or installed owner policy has changed.

Complete backlog publication — 2026-11-05

Retain all original acceptance. #400/#401 are implemented on draft #403/#404; #402 still owns precise file memory/history. New native child #433 owns file-to-VM processing/collection; #407 owns global library/revisions/preview. #431 owns remaining real Linux/model evidence. None of these is inferred complete from the first text/binary flow.