[joshrotenberg]

Independent clients can now upload one image and send it through the same durable message operation as the UI. attachment_upload returns an operator/routine-bound reference; attachment_read retrieves owned bytes; prompt_agent accepts the reference with text or an empty image-only prompt. The existing 10 MB PNG/JPEG/GIF/WebP limit applies to both surfaces.

The shared storage boundary checks size, image headers, ownership, workspace, regular files and content digests. Upload retries deduplicate live identical content. Missing or changed bytes can be reuploaded under a fresh reference. Message admission and cleanup serialize through the database: active messages protect their image, settled work receives normal retention, and expired references retain metadata. Exact prompt retries return the original receipt even after image expiry or a workspace move. Delivery occurs after durable attachment admission; acceptance does not assert image consumption or provider completion.

Both composers use the same validation and refuse the entire message on invalid upload. MCP tools require verified human identity and never accept caller-selected server paths. Legacy text-only retries, optional null idempotency keys and existing upload links remain supported. The main HTTP body bound is 14 MB for the base64 envelope; the memory endpoint remains at 2 MB. Validation recognizes image headers; it is not full codec decoding or sanitization.

Validation

• All five repository gates: formatting, warning-free compilation, strict Credo, full tests (2,710 passed, 3 excluded) and Dialyzer (zero findings).
• 266 focused checks passed under seeds 1, 12345 and 777.
• Actual HTTP discovery/upload/read/prompt/auth checks on protocols 2025-11-25 and 2026-07-28, including requests larger than the former 2 MB body limit.
• Deterministic Claude/Codex offline, paused and busy delivery with image-only and text-plus-image messages; concurrent admission/cleanup and duplicate submission; ownership, expiry, missing/modified files and symlink refusal; UI validation and draft preservation.
• Independent review and regenerated MCP reference. No paid native calls or running-fleet changes.

Operating note

Adds the operator attachment metadata table and nullable message reference. Adoption requires pull, migrate and restart. No existing image paths or text receipts are rewritten. The new facilities remain human-only; caretaker and delegated-agent authority is unchanged. Cleanup retains queued, executing and waiting images, then tombstones expired references before attempting file removal; failed removal is retried later.

Implements attachment acceptance slice A of #846. The parent remains open for its remaining shared operator-action inventory and related client proofs.