fix(files): align workbench reads with provenance policy

[icecrasher321]

Summary

• Keep files without producer provenance usable and record the coverage gap through the existing audit path. Preserve known secret contributions and explicit verification failures across reads, mounts, archives, and ingestion.
• Classify generated workbench files from settled machine history and carry captured version provenance through historical downloads, text reads, and transformation errors. Preserve recorded byte receipts when another delivery has no producer evidence. Keep the existing redaction cutoff, placeholders, and resource budgets.
• Audit accepted files under canonical ownership, avoid duplicate import events, and emit document admission events only after commit. Record workbench transfer acceptance after receipt persistence.
• Remove redundant classification of intentional chat uploads; reuse existing file delivery, history, and provenance utilities.

Type of Change

• Bug fix

Testing

45 live workbench checks, 110 PostgreSQL/Redis integration checks, and 413 focused tests passed. Regressions failed before their fixes; removing individual safety guards made their checks fail. Application type-checking, lint, all 55 audits, generators, staging-aware block registry, and docs manifest checks passed. Repeatable JSON reports retained locally.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 2, 2026 1:27am UTC

[icecrasher321]

@greptile

[icecrasher321]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@icecrasher321 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 34 files

<sub>Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 34 files

<sub>Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 5/5

[High risk] Reclassifies unrecorded file provenance from blocked to allowed.

The PR appears safe to merge; no outstanding finding or new blocking issue was established.

Summary

The PR aligns file reads and knowledge admission with the unrecorded-provenance policy while retaining known-secret and explicit-failure protections. Since the previous review, it also moves workbench transfer auditing until after receipt persistence and adds acceptance and failure-path tests.

_{Reviews (3) · Last reviewed commit: "fix(files): audit completed workbench tr..."}

[icecrasher321]

@greptile

[icecrasher321]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@icecrasher321 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 35 files

<sub>Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Fix all with cubic | Re-trigger cubic</sub>

[icecrasher321]

@greptile

[icecrasher321]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@icecrasher321 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 36 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Re-trigger cubic</sub>