[Frontier] [FILE16-01B] Process real PDF and image inputs through isolated validated paths #401

Parent

FILE16-01 #396, S16 #392. This is the document/image remainder, not optional scope.

Model tier

Frontier: isolated decoding, private derivative lineage, real model-image sends, resource/recipient protection and process-loss cleanup need contract design.

Context to read

AGENTS.md, CONTEXT.md, docs/agents/workflow.md, S16 spec and authored experience, ADRs 0064/0074/0075/0076, docs/contracts/s16-files-v1.md, #393/#394/#395/#400. Audit src/attachments/{types,sanitizer-runtime,sanitizer-output,model-images}.ts, ops/box sanitizer image/scripts, src/s16/files/, src/s15/model/{types,service}.ts and the pinned public schway/host image contracts. Existing legacy attachment storage is not this authority root.

Deliverable

The /s16 client attaches one supported PDF and one supported PNG/JPEG, processes their actual bounded content through protected isolation/public Schway seams or an authorized working-computer path, and delivers evidenced answers plus immutable artifacts. Maintain text compatibility.

Implementation steps

1. Freeze the versioned original/derivative receipt, MIME, page/pixel/expanded-output/time/memory limits, validation version, parser generation and active validation/cancel/restart states.
2. Reuse or adapt the existing networkless disposable sanitizer runtime independently from legacy DB/project/topic ownership. Mount only generated input snapshots; no vault/Jit state, service environment, credentials, host paths or network. Fail closed on missing runtime, parser crash and uncertain cleanup; retain safe tombstones.
3. Validate bounded named outputs outside the parser. Preserve original and derivative hashes, dimensions/page counts, truncation/coverage and private source ancestry; never accept parser-authored authority.
4. Extend MODEL15 through supported Schway public image construction/probes/resolvers and final guarded sends, or prove a scoped VM image path. No provider protocol reimplementation or filename-only image claim.
5. Bind PDF actual extracted text and image actual content to observed evidence. Every model/VM release and artifact descendant rechecks all original/derivative source and recipient ceilings.
6. Implement the already-authored PDF/image chip/progress/error/result/preview interactions with actual advertised capabilities. Keep active content isolated. Add explicit original/derived details where transformed.
7. Test real fixtures and separately record opt-in Linux parser isolation and supported live image-route evidence; do independent implementation before requesting a human login.

Acceptance criteria

• A supported PDF and PNG/JPEG each change the result through actual processing and yield a matching downloadable immutable output after refresh/restart.
• Invalid signatures, corrupt/encrypted PDFs, decompression/pixel/page/output/time limits and active/unsupported types refuse before model/VM access.
• Cancellation, restart and cleanup uncertainty leave no runnable parser/late derivative; a successor cannot adopt or destroy another job.
• Cross-conversation/owner/resource substitution, source withdrawal and new-recipient holds propagate through originals, derivatives, evidence, model sends and artifact downloads.
• Server capability pairs/limits and Thai/English authored desktop/mobile UI describe actual supported paths, transformations, truncation and unavailable reasons.
• S14/legacy data/defaults and installed owner policies remain unchanged.

Tests and evidence

1. Deterministic isolated-runtime protocol tests: bounded inputs/outputs, exact no-network/mount/env/limit profile, cancellation/cleanup/process-loss fencing.
2. Composed PDF/image upload → real parser or isolated controlled parser fixture → actual Schway image/text/VM input → evidenced artifact → byte/hash download.
3. Auth/CSRF/type/pixel/page/capacity/source/recipient/restart tests and real-browser authored-state tests.
4. Opt-in real Linux isolation and supported model-image wire/send proof, labelled independently from deterministic fixture evidence.

Requirements

FR-07/15/17/18/22/31/35/38/42; NFR-02/06/07/08/10/11/12/14; remaining S16-AC03 and relevant AC04.

Blocked by

#400 text custody/publication/client contract; #394 authored handoff. Precise image input/send/probe contract and sanitizer isolation audit must be resolved before ready-for-agent. No live credential is a prerequisite for deterministic code work.

Contracts used/delivered

Existing protected POLICY/DATA15/TEAM and supported schway/host; new versioned original/derivative file and MODEL15 image seam, reviewed before advertisement. No silent extension of deployed text meanings.

Out of scope

Native clients, global library/revisions, unrelated browser work, production/owner-host activation, S14/legacy migration and replacing Schway.

Do not

Do not parse complex binary formats in the protected service, use filename-only context as image evidence, fake parser availability, grant authority from parser/file content, silently widen recipients/policy, add model attribution, use implement-parallel or merge the PR.

Definition of done

bun install --frozen-lockfile, bun run typecheck, relevant deterministic/composed/parser/browser tests and git diff --check pass. PR Closes this exact issue, Refs #396/#392, records exact contracts/heads and honest live pending proof. #396 closes only after its full acceptance is demonstrated.

Verified integration seams (2026-11-05)

The pinned Schway package already exposes createImageContent, HostOptions.images with current probe records/resolver, and HostInput.images. node_modules/schway/docs/host.md documents re-resolution/hash/dimension checks on every model attempt/tool round, byte-free native references, typed unavailable outcomes and caller-owned deletion race fencing. No Schway fork or provider-protocol rewrite is currently indicated. Jit's ModelStepInput/openModelService are text-only, so Jit must add the scoped image port and final-send/source guards explicitly. Fixture passing probe records must never be installed as live-account evidence.

The existing PodmanAttachmentSanitizer in src/attachments/sanitizer-runtime.ts and ops/box/sanitize provide a reusable digest-pinned networkless parser boundary and bounded named-output stream. The legacy AttachmentSanitizer/storage/MODEL image adapters remain project/topic-coupled and must not become the S16 authority root. Audit/reuse the runtime and pure validators; add a separate S16 job/custody adapter with exact original/derivative receipts. The current container name is installation-scoped, so concurrent file validation needs an explicit serialized queue or immutable per-job isolation/cleanup ownership; four independent UI uploads cannot safely call reset/run concurrently.

The parser currently reports PDF truncation at its 50-page/text caps. S16 must expose real extraction coverage, reject or label incomplete source coverage, and independently bound derived UTF-8/image metadata/bytes. Current text-only FileStore.read and completion byte-range coverage cannot silently stand in for original PDF/image coverage. This audit is implementation planning, not proof that PDF/images are already supported.

Complete backlog publication — 2026-11-05

Draft #404 remains at audited baseline 17b8142. Focused 29, package/service/installer 262 and real-browser 5 passed as previously recorded; the earlier full-tree 4461 pass/26 skip/1 installer failure was corrected by that head and covered by package regressions. No new test was run by backlog publication. Linux generation-3 parser isolation and real-account image proof remain pending under #431; #396 remains open.