fix(provenance): preserve execution files across durable surfaces

[icecrasher321]

Summary

• Preserve provenance from Function exports through file reads, parsing, copies, archive extraction, and KB ingestion. Bind sidecars to canonical content revisions and retain legacy compatibility.
• Carry rendered image and document contributors through file conversions and Function inputs; prevent archived metadata or concurrent reads from dropping lineage.
• Recognize owned Azure execution URLs using the configured storage client endpoint. Keep model and Function admission at their consuming boundaries.
• Keep existing feature flags and use the current file sidecar schema.

Type of Change

• Bug fix

Testing

• Real PostgreSQL/Redis integration covers execution ZIP → workspace extraction → table rows → immutable KB copy → delayed indexing/search, plus unknown, secret-bearing, legacy, archived, and wrong-run cases. External embeddings are mocked.
• Focused provenance, Function, file, table, memory, and KB suites; 350 regression tests for the review follow-up; 11 real database integration scenarios; type checks; lint and all 46 audits, including API boundary validation. Bun 1.4.1.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 11, 2026 7:03pm UTC

[greptile-apps]

Confidence Score: 5/5

The reviewed provenance changes appear safe to merge, with no outstanding blocking finding.

Summary

• Binds sidecars to canonical file identities and content revisions.
• Carries source and rendered contributor identities through Function reads and mounts.
• Classifies harvested execution files and preserves provenance through durable file surfaces.
• Recognizes Azure execution URLs from the configured Blob client endpoint.
• Adds focused unit and integration coverage for legacy, unknown, archived, concurrent, and cross-scope cases.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Function or file operation] --> B[Authorize canonical stored file]
  B --> C[Read bytes and contributor identities]
  C --> D{Rendered content?}
  D -->|Yes| E[Apply opaque egress admission]
  D -->|No| F[Import runtime provenance]
  E --> F
  F --> G[Execute or transform]
  G --> H[Classify output provenance]
  H --> I[Persist bytes and revision-bound sidecar]
  I --> J[Copy, extract, or ingest into durable surface]

Loading

_{Reviews (2) · Last reviewed commit: "fix(provenance): preserve storage identi..."}

[icecrasher321]

@greptile

[icecrasher321]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@icecrasher321 I have started the AI code review. It will take a few minutes to complete.