[Frontier] [MIG15-01] Stage S15 adoption without erasing state or widening installed policy

Parent

S15 — #316. Canonical spec: docs/specs/S15-conversational-autonomy.md.

Model tier

Frontier: authority, isolation, lifecycle, cross-contract or evidence decisions remain in this slice. Mechanical Standard work can be extracted only after exact signatures/schema/paths/tests/dictionary keys are verified on main; do not label speculative contracts Standard-ready.

Status

Prepared; needs triage. Not ready-for-agent: direct blockers and required contract/evidence revisions must be verified before admission.

Context to read

AGENTS.md; CONTEXT.md; docs/agents/workflow.md; docs/specs/S15-conversational-autonomy.md; docs/product/02-prd.md; docs/adr/0064-conversational-authority-and-protected-control-plane.md.
Current main audited at 17e5110. Existing implementation references (not promised S15 APIs):

• src/s14/ops.ts
• src/s14/ops-state.ts
• src/s14/ops-reconcile.ts
• src/s14/ops-ledger.ts
• src/s14/main.ts
• tests/s14-ops.test.ts

Read the parent, this issue's comments, current assignees and related branches/PRs before implementation. Use an issue-specific worktree/branch; do not use implement-parallel or claim coordination.

Deliverable

A staged, versioned S15 adoption path preserves current state/private scope and can roll back before workers resume under new authority.

Implementation steps

1. Implement only the reviewed STATE15-01 mappings/schema and ARCH15-01 placement, with exact source/target identity and version checks.
2. Capture credential-free recovery checkpoints and validate authority/effect/lifecycle records before activation.
3. Require explicit owner adoption of any wider team scope or personal GitHub exception; omitted/old config remains its existing runtime.
4. Provide deterministic refusal, interrupted-transition recovery and prior-build rollback evidence; leave real-host activation to CUT15-01.

Acceptance criteria

• Existing S14/legacy data and explicitly private material are preserved without implicit conversion/declassification.
• Cancelled/unknown work, spent budgets, revoked grants and tombstones cannot resurrect or reset.
• Failed/partial transition leaves workers fenced and an actionable recovery path.
• Rollback reestablishes the recorded prior runtime without falsely undoing external actions.
• No new live policy exception, route or billing is installed from repository text.

Tests and evidence

1. Fixture state/images before/after failure windows -> preserved bytes and scope.
2. Unknown effect/private-source/tombstone fixtures -> preserved blocked/reconcile-only state.
3. Prior-version rollback and omitted-runtime config fixtures -> exact intended runtime identity.

Requirements

FR-04/05/15/16/18/23/35; NFR-05/07/08/12. Acceptance: S15-AC16. Preserve FR/NFR IDs.

Blocked by

• [Frontier] [VM15-01] Run ordinary administration in the approved working VM #321 (VM15-01) — required reviewed contract/evidence must be present in the integration base.
• [Frontier] [MEM15-01] Remember useful owner knowledge automatically and honor corrections #325 (MEM15-01) — required reviewed contract/evidence must be present in the integration base.
• [Frontier] [STATE15-01] Specify a non-destructive S14-to-S15 state and policy transition #319 (STATE15-01) — required reviewed contract/evidence must be present in the integration base.
  A closed upstream issue alone is insufficient: verify its actual supported contract/version, merged base and proof status. Missing signatures/schema/adapter scope keep this ticket out of ready-for-agent.

Contracts used/delivered

Delivers the implemented reviewed state-transition/rollback contract; requires accepted STATE15-01 maps, not just a closed issue.
Proposed identifiers/paths are deliverables, not an assertion that a public API exists. Freeze exported function/type TSDoc and protocol fixtures before dependent tickets start. Propose a Schway change for a verified missing host contract rather than importing internals.

Out of scope

Live installation changes, destructive fresh-state resets and automatic personal-profile enrollment.

Do not

Do not infer owner authority from model/retrieved text; widen accounts/providers/billing; expose credentials/state to the working guest; bypass held effects through another tool; weaken acceptance/checks for green status; delete or silently declassify existing state; run paid/live tests by default; or merge the implementation PR. UI/UX must use the required Claude Opus 5.5/high author and reviewed handoff; the primary agent owns logic/contracts.

Definition of done

Run the focused enumerated behavior fixtures, bun run typecheck, bun test and git diff --check on final HEAD. Record commands, tested SHA, contract revisions, actual evidence and not-run limitations. Live/paid/host operations are separate opt-in commands with owner approval.
PR body includes Closes #336. No merge by the implementer.

Published planning source

Ticket mirror · S15 spec · Delivery graph · Documentation PR #343.

Source revision: 8ebeca79e0b724e14aa5685b7fe173eb7b675fb7. These are planning artifacts, not installed grants or supported S15 runtime contracts.