fix(provenance): bind durable reads to their source snapshots

[icecrasher321]

Summary

• Capture table values and provenance in the same bounded read snapshot across API reads, enrichment, and workflow-column inputs; capture mutation results before releasing write locks. Return the actual persisted row after partial updates.
• Treat ordinary external downloads as having no tracked Sim-secret contribution, while preserving canonical authorization and lineage for owned storage URLs.
• Keep upload reads valid across a same-revision save to workspace, and refresh explicitly resolved secrets from the current authorized environment snapshot.
• Add specific table-read failure reasons and remove unused route-local provenance logic. Keep feature flags and legacy compatibility unchanged.

Type of Change

• Bug fix

Testing

• Bun 1.4.1: 1,185 unit tests, 33 PostgreSQL tests, and 8 file end-to-end tests passed.
• End-to-end parser/upload/storage/sidecar/model-admission tests, including enforcement-enabled external downloads, secret redaction, and unsafe lineage rejection.
• App typecheck, lint, block-registry audit, API boundary validation, all 46 repository audits, and docs-manifest check.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 14, 2026 7:46pm UTC

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; no new actionable correctness, security, migration, or repository-rule issue remains.

Summary

• Captures table values and provenance together under bounded database snapshots.
• Returns persisted mutation results captured before write locks are released.
• Tracks upload content revisions and preserves owned-storage authorization and lineage.
• Adds an embedding_search projection maintained synchronously by a database trigger and initialized before application rollout.
• Restricts Better Auth’s organization schema surface to live columns without altering migration metadata.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Authorized durable read] --> B[Bounded database snapshot]
  B --> C[Value or row data]
  B --> D[Provenance reader]
  C --> E[Workflow, enrichment, API, or Copilot input]
  D --> F[Provenance envelope]
  E --> G[Resolved-secret trace registry]
  F --> G
  G --> H[Governed downstream execution]

  I[Embedding write] --> J[Database synchronization trigger]
  J --> K[Stored binary candidate projection]
  K --> L[Authorized ANN candidate search]
  L --> M[Exact rerank and hydration]

Loading

_{Reviews (2) · Last reviewed commit: "test(provenance): align Copilot query mo..."}

[icecrasher321]

@greptile

[icecrasher321]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@icecrasher321 I have started the AI code review. It will take a few minutes to complete.