[Frontier] [ART16-01] Find and revise delivered artifacts with isolated previews #407

Parent

#392 — #392; complete S16 target #392.

Model tier

Frontier: this slice requires judgment about protected authority, lifecycle/recovery or a new cross-client/service contract; exact new APIs and migrations are not yet settled.

Context to read

AGENTS.md; CONTEXT.md; docs/agents/workflow.md; docs/specs/S16-rakazo-experience.md; docs/specs/S15-conversational-autonomy.md; ADR 0064 and ADRs 0074–0077; docs/design/S16-rakazo-experience.md; docs/design/S16-mobbin-research.md. Reuse the completed design research; do not repeat broad Mobbin discovery.

Starting implementation/contract surfaces: src/s16/files/; src/s16/http.ts; src/s15/web/library.ts; src/s16/web/. Read their current definitions and relevant tests before selecting changes. Paths with braces denote existing module families, not settled new signatures.

Deliverable

Search a durable artifact library, inspect provenance, preview supported text/HTML/documents safely and request a new immutable revision from an existing artifact.

Baseline and readiness

Audited stack head 17b814220371cd1e2126be2ec9bd9753537f69e6; main remains the pre-S16 baseline. #398/#399/#403/#404 are open drafts, not merged/live acceptance. Existing S15 services are reusable baseline, and #400/#401 supply draft text/binary custody. No new behavior is claimed here. Branches/PRs and issue ownership were inspected on 2026-11-05; this new ticket has no implementation claim. Recheck at dispatch. Preserve the primary-owned jit/402-s16-file-memory branch.

Needs triage: contract/engineering choices remain; no ready-for-agent label. Resolve named contract decisions and verify prerequisite revisions before unattended implementation. Independent audit/design work may proceed now; final acceptance needs these deliveries.

Implementation steps

1. Recheck ownership, branches/PRs, prerequisites and exact source baseline. Compare existing implementation, pinned Rakazo reuse and a simpler alternative; record the chosen tradeoff and versioned contract before coding.
2. Define stable artifact/revision ancestry and current guarded pagination independent of the recent CHAT window.
3. Collect real working outputs through bounded custody, commit and integrity checks; compare reuse of existing staged-object protocol.
4. Add authorized artifact-as-input and revision commands with exact parent hash, idempotency and current lineage.
5. Build library, source/revision navigation, isolated active-document preview and fresh verified download from the authored design.
6. Integrate the authored experience using real service facts, English/Thai dictionary keys in their designated files, accessible loading/error/empty/reconnect states and current capabilities. For non-UI evidence work, verify those states instead of inventing new UI. Record migrations, compatibility and exact build evidence.

Acceptance criteria

• Revise a delivered file after restart; old and new bytes/hashes remain distinct.
• Withdraw parent during search/preview/download/revision blocks descendants.
• Active HTML cannot access cookies/network/parent commands.
• Uncommitted output and stale pagination cannot expose revoked/private objects.
• Deliverable works end to end through its actual owning service/client; source presence, transport success and model prose alone are insufficient.
• No S14 default, S15 opt-in, installed policy, historical private scope or owner-host configuration changes without its separate explicit transition.
• New contracts, unresolved limits and exact revision/evidence are recorded; applicable upstream licenses, immutable provenance and modified-file notices ship.

Tests and evidence

1. Revise a delivered file after restart; old and new bytes/hashes remain distinct. Use scripted models, protocol fixtures, fake clocks and barriers for deterministic cases; assert actual resulting state/bytes/effects.
2. Withdraw parent during search/preview/download/revision blocks descendants. Use scripted models, protocol fixtures, fake clocks and barriers for deterministic cases; assert actual resulting state/bytes/effects.
3. Active HTML cannot access cookies/network/parent commands. Use scripted models, protocol fixtures, fake clocks and barriers for deterministic cases; assert actual resulting state/bytes/effects.
4. Uncommitted output and stale pagination cannot expose revoked/private objects. Use scripted models, protocol fixtures, fake clocks and barriers for deterministic cases; assert actual resulting state/bytes/effects.
5. Run relevant existing module/composed regressions plus the new scenario suite; for rendered behavior, exercise the real bundle in English/Thai, keyboard and mobile widths. Record exact test paths/commands in the PR after implementation selects them.
6. Keep real host/account/device checks opt-in and evidence-labelled; no absent credential blocks independent deterministic work. Public evidence contains hashes/outcomes only; installation-specific details belong in ignored .local records.

Requirements

S16-AC04, S16-AC20; FR-01, FR-04, FR-05, FR-07, FR-10, FR-16, FR-18, FR-22, FR-24, FR-35, FR-42, NFR-05, NFR-06, NFR-07, NFR-08, NFR-11, NFR-12. Retain S15 authority decisions and FR/NFR identifiers.

Blocked by

• [Frontier] [FILE16-01A] Deliver a real text-file brief through the shared React client #400: prerequisite owning contract/delivery; currently open, not merged acceptance.
• [Frontier] [MEM16-01A] Carry precise file ancestry through memory and later conversations #402: prerequisite owning contract/delivery; currently open, not merged acceptance.

Contracts used/delivered

Use current owning POLICY, DATA15, TEAM, MEM, WORK, CHAT and S16 client/file contracts where relevant, plus Schway's supported public host surface. Specific inputs and proposed delivery: src/s16/files/; src/s16/http.ts; src/s15/web/library.ts; src/s16/web/. The Deliverable and ordered steps define the missing contract outcome; freeze version, schemas, migration/recovery and conformance fixtures in the implementation ADR/PR. Proposed operations are not already supported APIs. A demonstrated missing engine seam requires a bounded public-only reproduction and a linked Schway contract ticket, never an internal import or duplicate runtime.

Out of scope

Other tickets' outcomes, hosted multi-user SaaS, marketplace operation, upstream branding, silent billing, replacing Schway, general historical data conversion, and unapproved live deployment. Live credentials, real-device acceptance and owner-host cutover are separately owned by LIVE16-01/CUT16-01; deterministic implementation remains in scope.

Do not

Do not use source/model/tool output as authority; expose credentials/sensitive sessions/protected state to working execution; remove guards before proof; auto-retry unknown effects; weaken product-default GitHub approval or broaden an opt-in personal exception; treat current stack limitations as scope cuts; add model attribution; use implement-parallel; alter #402 ownership; self-merge or deploy. No placeholder controls or fabricated success.

Definition of done

Run bun install --frozen-lockfile, bun run typecheck, bun test --timeout 30000 for affected deterministic suites, and git diff --check; record exact selected suite commands and results. Add real-browser tests for rendered paths and package checks for shipped artifacts. Pure feasibility documentation runs link/coverage checks and git diff --check; a prototype must run its conformance cases. PR body includes Closes #407 and Refs #392, contract versions, tested head and honest pending evidence. No self-merge; parent #392 remains open until full accepted outcomes.